------------------------------------------------------------------
--- Changelog.all ----------- Tue May  5 14:30:09 UTC 2026 ------
------------------------------------------------------------------
------------------------------------------------------------------
------------------  2026-4-30  -  Apr 30 2026  -------------------
------------------------------------------------------------------

++++ containerd:

  - Add patch for CVE-2026-33186 (bsc#1260296):
    * 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch

------------------------------------------------------------------
------------------  2026-4-28  -  Apr 28 2026  -------------------
------------------------------------------------------------------

++++ firewalld:

  - FIX  CVE-2026-4948: local unprivileged users can modify firewall
    state due to D-Bus setter mis-authorizations
    [+ 0001-Fix-CVE-2026-4948-local-unprivileged-users-can-modif.patch]

------------------------------------------------------------------
------------------  2026-4-27  -  Apr 27 2026  -------------------
------------------------------------------------------------------

++++ avahi:

  - Add avahi-CVE-2026-34933.patch: refuse to accept publish flags
    where both wide_area and multicast are set.
    (CVE-2026-34933, bsc#1261546)

------------------------------------------------------------------
------------------  2026-4-26  -  Apr 26 2026  -------------------
------------------------------------------------------------------

++++ vim:

  - Fix bsc#1261833 / CVE-2026-39881.
  - Update to 9.2.0398.
  - Changes:
    * 9.2.0398: MS-Windows: missing strptime() support
    * 9.2.0397: tabpanel: double-click opens a new tab
    * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS
    * 9.2.0395: tests: Test_backupskip() may read from $HOME
    * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative
    * 9.2.0393: MS-Windows: link error with XPM support on UCRT64
    * 9.2.0392: tests: Some tests are flaky
    * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting
    * 9.2.0390: filetype: some Beancount files are not recognized
    * 9.2.0389: DECRQM still leaves stray "pp" on Apple Terminal.app
    * 9.2.0388: strange indent in update_topline()
    * 9.2.0387: DECRQM request may leave stray chars in terminal
    * 9.2.0386: No scroll/scrollbar support in the tabpanel
    * 9.2.0385: Integer overflow with "ze" and large 'sidescrolloff'
    * 9.2.0384: stale Insstart after <Cmd> cursor move breaks undo
    * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs
    * 9.2.0382: Wayland: focus-stealing is non-working
    * 9.2.0381: Vim9: Missing check_secure() in exec_instructions()
    * 9.2.0380: completion: a few issues in completion code
    * 9.2.0379: gui.color_approx is never used
    * 9.2.0378: Using int as bool type in win_T struct
    * 9.2.0377: Using int as bool type in gui_T struct
    * 9.2.0376: Vim9: elseif condition compiled in dead branch
    * 9.2.0375: prop_find() does not find a virt text in starting line
    * 9.2.0374: c_CTRL-{G,T} does not handle offset
    * 9.2.0373: Ctrl-R mapping not triggered during completion
    * 9.2.0372: pum: rendering issues with multibyte text and opacity
    * 9.2.0371: filetype: ghostty config files are not recognized
    * 9.2.0370: duplicate code with literal string_T assignment
    * 9.2.0369: multiple definitions of STRING_INIT macro
    * 9.2.0368: too many strlen() calls when adding strings to dicts
    * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows
    * 9.2.0366: pum: flicker when updating pum in place
    * 9.2.0365: using int as bool
    * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails
    * 9.2.0363: Vim9: variable shadowed by script-local function
    * 9.2.0362: division by zero with smoothscroll and small windows
    * 9.2.0361: tests: no tests for ch_listen() with IPs
    * 9.2.0360: Cannot handle mouse-clicks in the tabpanel
    * 9.2.0359: wrong VertSplitNC highlighting on winbar
    * 9.2.0358: runtime(vimball): still path traversal attacks possible
    * 9.2.0357: [security]: command injection via backticks in tag files
    * 9.2.0356: Cannot apply 'scrolloff' context lines at end of file
    * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()
    * 9.2.0354: filetype: not all Bitbake include files are recognized
    * 9.2.0353: Missing out-of-memory check in register.c
    * 9.2.0352: 'winhighlight' of left window blends into right window
    * 9.2.0351: repeat_string() can be improved
    * 9.2.0350: Enabling modelines poses a risk
    * 9.2.0349: cannot style non-current window separator
    * 9.2.0348: potential buffer underrun when setting statusline like option
    * 9.2.0347: Vim9: script-local variable not found
    * 9.2.0346: Wrong cursor position when entering command line window
    * 9.2.0345: Wrong autoformatting with 'autocomplete'
    * 9.2.0344: channel: ch_listen() can bind to network interface
    * 9.2.0343: tests: test_clientserver may fail on slower systems
    * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind
    * 9.2.0341: some functions can be run from the sandbox
    * 9.2.0340: pum_redraw() may cause flicker
    * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often
    * 9.2.0338: Cannot handle mouseclicks in the tabline
    * 9.2.0337: list indexing broken on big-endian 32-bit platforms
    * 9.2.0336: libvterm: no terminal reflow support
    * 9.2.0335: json_encode() uses recursive algorithm
    * 9.2.0334: GTK: window geometry shrinks with with client-side decorations
    * 9.2.0333: filetype: PklProject files are not recognized
    * 9.2.0332: popup: still opacity rendering issues
    * 9.2.0331: spellfile: stack buffer overflows in spell file generation
    * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough
    * 9.2.0329: tests: test_indent.vim leaves swapfiles behind
    * 9.2.0328: Cannot handle mouseclicks in the statusline
    * 9.2.0327: filetype: uv scripts are not detected
    * 9.2.0326: runtime(tar): but with dotted path
    * 9.2.0325: runtime(tar): bug in zstd handling
    * 9.2.0324: 0x9b byte not unescaped in <Cmd> mapping
    * 9.2.0323: filetype: buf.lock files are not recognized
    * 9.2.0322: tests: test_popupwin fails
    * 9.2.0321: MS-Windows: No OpenType font support
    * 9.2.0320: several bugs with text properties
    * 9.2.0319: popup: rendering issues with partially transparent popups
    * 9.2.0318: cannot configure opacity for popup menu
    * 9.2.0317: listener functions do not check secure flag
    * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType
    * 9.2.0315: missing bound-checks
    * 9.2.0314: channel: can bind to all network interfaces
    * 9.2.0313: Callback channel not registered in GUI
    * 9.2.0312: C-type names are marked as translatable
    * 9.2.0311: redrawing logic with text properties can be improved
    * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys()
    * 9.2.0309: Missing out-of-memory check to may_get_cmd_block()
    * 9.2.0308: Error message E1547 is wrong
    * 9.2.0307: more mismatches between return types and documentation
    * 9.2.0306: runtime(tar): some issues with lz4 support
    * 9.2.0305: mismatch between return types and documentation
    * 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix
    * 9.2.0303: tests: zip plugin tests don't check for warning message properly
    * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces
    * 9.2.0301: Vim9: void function return value inconsistent
    * 9.2.0300: The vimball plugin needs some love
    * 9.2.0299: runtime(zip): may write using absolute paths
    * 9.2.0298: Some internal variables are not modified
    * 9.2.0297: libvterm: can improve CSI overflow code
    * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c
    * 9.2.0295: 'showcmd' shows wrong Visual block size with 'linebreak'
    * 9.2.0294: if_lua: lua interface does not work with lua 5.5
    * 9.2.0293: :packadd may lead to heap-buffer-overflow
    * 9.2.0292: E340 internal error when using method call on void value
    * 9.2.0291: too many strlen() calls
    * 9.2.0290: Amiga: no support for AmigaOS 3.x
    * 9.2.0289: 'linebreak' may lead to wrong Visual block highlighting
    * 9.2.0288: libvterm: signed integer overflow parsing long CSI args
    * 9.2.0287: filetype: not all ObjectScript routines are recognized
    * 9.2.0286: still some unnecessary (int) casts in alloc()
    * 9.2.0285: :syn sync grouphere may go beyond end of line
    * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count
    * 9.2.0283: unnecessary (int) casts before alloc() calls
    * 9.2.0282: tests: Test_viminfo_len_overflow() fails
    * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows

------------------------------------------------------------------
------------------  2026-4-24  -  Apr 24 2026  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fixes:
    * CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631)
    * CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632)
    * CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635)
    * CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636)
    * CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638)
    * sws: prevent "connection monitor" to say disconnect twice (bsc#1259362)
    * Add patches:
  - curl-CVE-2026-4873.patch
  - curl-CVE-2026-5545.patch
  - curl-CVE-2026-6253.patch
  - curl-CVE-2026-6276.patch
  - curl-CVE-2026-6429.patch
  - curl-CVE-2026-1965-disable-ntlm-fix.patch

++++ mozilla-nss:

  - update to NSS 3.112.5
    * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max.
    * bmo#2034185 - update to version 2.84 of builtins module.

------------------------------------------------------------------
------------------  2026-4-23  -  Apr 23 2026  -------------------
------------------------------------------------------------------

++++ Mesa:

  - bsc1261998-CVE-2026-40393-nir-Use-STACK_ARRAY-instead-of-NIR_VLA.patch
    bsc1261998-CVE-2026-40393-spirv-Use-STACK_ARRAY-instead-of-NIR_VLA.patch
    * Mesa: out-of-bounds memory access can occur in WebGPU because
    the amount of to-be-allocated data depends on an untrusted
    party (bsc#1261998, CVE-2026-40393)

++++ Mesa-drivers:

  - bsc1261998-CVE-2026-40393-nir-Use-STACK_ARRAY-instead-of-NIR_VLA.patch
    bsc1261998-CVE-2026-40393-spirv-Use-STACK_ARRAY-instead-of-NIR_VLA.patch
    * Mesa: out-of-bounds memory access can occur in WebGPU because
    the amount of to-be-allocated data depends on an untrusted
    party (bsc#1261998, CVE-2026-40393)

------------------------------------------------------------------
------------------  2026-4-20  -  Apr 20 2026  -------------------
------------------------------------------------------------------

++++ haproxy:

  - VUL-0: CVE-2026-33555: haproxy: Request smuggling via HTTP/3 parser desynchronization
    (bsc#1262103) Add upstream patch
    0001-BUG-MAJOR-h3-check-body-size-with-content-length-on-.patch

------------------------------------------------------------------
------------------  2026-4-17  -  Apr 17 2026  -------------------
------------------------------------------------------------------

++++ opensc:

  - Security fix:
    * CVE-2025-66037: crafted input can cause an out-of-bounds read (bsc#1261218)
    * CVE-2025-66038: improper compact-TLV length validation can lead to crash or unexpected behavior  (bsc#1261219)
    * CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses (bsc#1261214)
    * CVE-2025-66215: crafted smart card or USB device can cause a stack-buffer-overflow write (bsc#1261220)
    * Added opensc-CVE-2025-49010.patch
    * Added opensc-CVE-2025-66037.patch
    * Added opensc-CVE-2025-66038.patch
    * Added opensc-CVE-2025-66215.patch

------------------------------------------------------------------
------------------  2026-4-16  -  Apr 16 2026  -------------------
------------------------------------------------------------------

++++ ncurses:

  - Add patch fix-bsc1259924.patch (bsc#1259924, CVE-2025-69720)
    * Backport from ncurses-6.5-20251213.patch

++++ libpng16:

  - added patches
    CVE-2026-34757: Information disclosure and data corruption via use-after-free vulnerability [bsc#1261957]
    * libpng16-CVE-2026-34757.patch

------------------------------------------------------------------
------------------  2026-4-15  -  Apr 15 2026  -------------------
------------------------------------------------------------------

++++ mozilla-nss:

  - Added "Suggests: p11-kit-nss-trust" to favor over mozilla-nss-certs
    (Jira: PED-15633)

++++ python311-core:

  - Add CVE-2026-3446-base64-padding.patch preventing ignoring
    excess Base64 data after the first padded quad (bsc#1261970,
    CVE-2026-3446, gh#python/cpython#145264).

++++ python311:

  - Add CVE-2026-3446-base64-padding.patch preventing ignoring
    excess Base64 data after the first padded quad (bsc#1261970,
    CVE-2026-3446, gh#python/cpython#145264).

++++ sed:

  - Add CVE-2026-5958.patch
    * Fix CVE-2026-5958 (bsc#1262144):
    A TOCTOU race can allow to read attacker-controlled content and write
    it to an unintended file

------------------------------------------------------------------
------------------  2026-4-14  -  Apr 14 2026  -------------------
------------------------------------------------------------------

++++ mozilla-nss:

  - update to NSS 3.112.4
    * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
    * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
    * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
    * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
    * bmo#2029323 - Improve size calculations in CMS content buffering.
    * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
    * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
    * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
    * bmo#2027345 - Improve input validation in DSAU signature decoding.
    * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
    * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
    * bmo#2026156 - Add a maximum cert uncompressed len and tests.
    * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
    * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
    * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
    * bmo#2019224 - Remove invalid PORT_Free().
    * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
    * bmo#1935995 - make ss->ssl3.hs.cookie an owned-copy of the cookie.

------------------------------------------------------------------
------------------  2026-4-13  -  Apr 13 2026  -------------------
------------------------------------------------------------------

++++ openvswitch:

  - Fix CVE-2026-34956 [bsc#1261273] -- Invalid memory access in conntrack FTP alg
    * Add CVE-2026-34956.patch

------------------------------------------------------------------
------------------  2026-4-10  -  Apr 10 2026  -------------------
------------------------------------------------------------------

++++ libcap:

  - CVE-2026-4878: Fixed a a potential TOCTOU race condition in cap_set_file() (bsc#1261809)
    0001-Address-a-potential-TOCTOU-race-condition-in-cap_set.patch:

------------------------------------------------------------------
------------------  2026-4-9  -  Apr 9 2026  -------------------
------------------------------------------------------------------

++++ cockpit-podman:

  - Update dependencies to fix bsc#1257836/CVE-2026-25547 bsc#1258641/CVE-2026-26996

++++ cockpit-tukit:

  - Update dependencies to fix bsc#1257836/CVE-2026-25547 bsc#1258641/CVE-2026-26996

++++ gdk-pixbuf:

  - Add gdk-pixbuf-CVE-2026-5201.patch: jpeg: Reject unsupported
    number of components (bsc#1261210 CVE-2026-5201
    glgo#GNOME/gdk-pixbuf#266).

------------------------------------------------------------------
------------------  2026-4-8  -  Apr 8 2026  -------------------
------------------------------------------------------------------

++++ cockpit-machines:

  - Update dependencies to fix bsc#1257836/CVE-2026-25547 bsc#1258641/CVE-2026-26996

++++ openssl-3:

  - Security fix:
    * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
    * Add openssl-CVE-2026-28390.patch

------------------------------------------------------------------
------------------  2026-4-7  -  Apr 7 2026  -------------------
------------------------------------------------------------------

++++ sudo:

  - CVE-2026-35535: potential privilege escalation when running
    the mailer (bsc#1261420)
    * fix-CVE-2026-35535.patch

------------------------------------------------------------------
------------------  2026-4-2  -  Apr 2 2026  -------------------
------------------------------------------------------------------

++++ avahi:

  - Add avahi-CVE-2026-24401.patch: Fix unsolicited mDNS response
    containing a recursive CNAME record (bsc#1257235).

++++ avahi:

  - Add avahi-CVE-2026-24401.patch: Fix unsolicited mDNS response
    containing a recursive CNAME record (bsc#1257235).

++++ python311-core:

  - Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has
    the same security model as open(). The documented limitations
    ensure compatibility with non-filesystem loaders; Python
    doesn't check that. (bsc#1259989, CVE-2026-3479,
    gh#python/cpython#146121).

++++ python311:

  - Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has
    the same security model as open(). The documented limitations
    ensure compatibility with non-filesystem loaders; Python
    doesn't check that. (bsc#1259989, CVE-2026-3479,
    gh#python/cpython#146121).

++++ vim:

  - Fix bsc#1261191 / CVE-2026-34714.
  - Fix bsc#1261271 / CVE-2026-34982.
  - Fix bsc#1259985 / CVE-2026-33412.
  - Update to 9.2.0280:
    * patch 9.2.0280: [security]: path traversal issue in zip.vim
    * patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list
    * patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file
    * patch 9.2.0277: tests: test_modeline.vim fails
    * patch 9.2.0276: [security]: modeline security bypass
    * patch 9.2.0275: tests: test_options.vim fails
    * patch 9.2.0274: BSU/ESU are output directly to the terminal
    * patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns
    * patch 9.2.0272: [security]: 'tabpanel' can be set in a modeline
    * patch 9.2.0271: buffer underflow in vim_fgets()
    * patch 9.2.0270: test: trailing spaces used in tests
    * patch 9.2.0269: configure: Link error on Solaris
    * patch 9.2.0268: memory leak in call_oc_method()
    * patch 9.2.0267: 'autowrite' not triggered for :term
    * patch 9.2.0266: typeahead buffer overflow during mouse drag event
    * patch 9.2.0265: unnecessary restrictions for defining dictionary function names
    * patch 9.2.0264: Cannot disable kitty keyboard protocol in vim :terminal
    * patch 9.2.0263: hlset() cannot handle attributes with spaces
    * patch 9.2.0262: invalid lnum when pasting text copied blockwise
    * patch 9.2.0261: terminal: redraws are slow
    * patch 9.2.0260: statusline not redrawn after closing a popup window
    * patch 9.2.0259: tabpanel: corrupted display during scrolling causing flicker
    * patch 9.2.0258: memory leak in add_mark()
    * patch 9.2.0257: unnecessary memory allocation in set_callback()
    * patch 9.2.0256: visual selection size not shown in showcmd during test
    * patch 9.2.0255: tests: Test_popup_opacity_vsplit() fails in a wide terminal
    * patch 9.2.0254: w_locked can be bypassed when setting recursively
    * patch 9.2.0253: various issues with wrong b_nwindows after closing buffers
    * patch 9.2.0252: Crash when ending Visual mode after curbuf was unloaded
    * patch 9.2.0251: Link error when building without channel feature
    * patch 9.2.0250: system() does not support bypassing the shell
    * patch 9.2.0249: clipboard: provider reacts to autoselect feature
    * patch 9.2.0248: json_decode() is not strict enough
    * patch 9.2.0247: popup: popups may not wrap as expected
    * patch 9.2.0246: memory leak in globpath()
    * patch 9.2.0245: xxd: color output detection is broken
    * patch 9.2.0244: memory leak in eval8()
    * patch 9.2.0243: memory leak in change_indent()
    * patch 9.2.0242: memory leak in check_for_cryptkey()
    * patch 9.2.0241: tests: Test_visual_block_hl_with_autosel() is flaky
    * patch 9.2.0240: syn_name2id() is slow due to linear search
    * patch 9.2.0239: signcolumn may cause flicker
    * patch 9.2.0238: showmode message may not be displayed
    * patch 9.2.0237: filetype: ObjectScript routines are not recognized
    * patch 9.2.0236: stack-overflow with deeply nested data in json_encode/decode()
    * patch 9.2.0235: filetype: wks files are not recognized.
    * patch 9.2.0234: test: Test_close_handle() is flaky
    * patch 9.2.0233: Compiler warning in strings.c
    * patch 9.2.0232: fileinfo not shown after :bd of last listed buffer
    * patch 9.2.0231: Amiga: Link error for missing HAVE_LOCALE_H
    * patch 9.2.0230: popup: opacity not working accross vert splits
    * patch 9.2.0229: keypad keys may overwrite keycode for another key
    * patch 9.2.0228: still possible flicker
    * patch 9.2.0227: MS-Windows: CSI sequences may be written to screen
    * patch 9.2.0226: No 'incsearch' highlighting support for :uniq
    * patch 9.2.0225: runtime(compiler): No compiler plugin for just
    * patch 9.2.0224: channel: 2 issues with out/err callbacks
    * patch 9.2.0223: Option handling for key:value suboptions is limited
    * patch 9.2.0222: "zb" scrolls incorrectly with cursor on fold
    * patch 9.2.0221: Visual selection drawn incorrectly with "autoselect"
    * patch 9.2.0220: MS-Windows: some defined cannot be set on Cygwin/Mingw
    * patch 9.2.0219: call stack can be corrupted
    * patch 9.2.0218: visual selection highlighting in X11 GUI is wrong.
    * patch 9.2.0217: filetype: cto files are not recognized
    * patch 9.2.0216: MS-Windows: Rendering artifacts with DirectX
    * patch 9.2.0215: MS-Windows: several tests fail in the Windows CUI.
    * patch 9.2.0214: tests: Test_gui_system_term_scroll() is flaky
    * patch 9.2.0213: Crash when using a partial or lambda as a clipboard provider
    * patch 9.2.0212: MS-Windows: version packing may overflow
    * patch 9.2.0211: possible crash when setting 'winhighlight'
    * patch 9.2.0210: tests: Test_xxd tests are failing
    * patch 9.2.0209: freeze during wildmenu completion
    * patch 9.2.0208: MS-Windows: excessive scroll-behaviour with go+=!
    * patch 9.2.0207: MS-Windows: freeze on second :hardcopy
    * patch 9.2.0206: MS-Window: stripping all CSI sequences
    * patch 9.2.0205: xxd: Cannot NUL terminate the C include file style
    * patch 9.2.0204: filetype: cps files are not recognized
    * patch 9.2.0203: Patch v9.2.0185 was wrong
    * patch 9.2.0202: [security]: command injection via newline in glob()
    * patch 9.2.0201: filetype: Wireguard config files not recognized
    * patch 9.2.0200: term: DECRQM codes are sent too early
    * patch 9.2.0199: tests: test_startup.vim fails
    * patch 9.2.0198: cscope: can escape from restricted mode
    * patch 9.2.0197: tabpanel: frame width not updated for existing tab pages
    * patch 9.2.0196: textprop: negative IDs and can cause a crash
    * patch 9.2.0195: CI: test-suite gets killed for taking too long
    * patch 9.2.0194: tests: test_startup.vim leaves temp.txt around
    * patch 9.2.0193: using copy_option_part() can be improved
    * patch 9.2.0192: not correctly recognizing raw key codes
    * patch 9.2.0191: Not possible to know if Vim was compiled with Android support
    * patch 9.2.0190: Status line height mismatch in vertical splits
    * patch 9.2.0189: MS-Windows: opacity popups flicker during redraw in the console
    * patch 9.2.0188: Can set environment variables in restricted mode
    * patch 9.2.0187: MS-Windows: rendering artifacts with DirectX renderer
    * patch 9.2.0186: heap buffer overflow with long generic function name
    * patch 9.2.0185: buffer overflow when redrawing custom tabline
    * patch 9.2.0184: MS-Windows: screen flicker with termguicolors and visualbell
    * patch 9.2.0183: channel: using deprecated networking APIs
    * patch 9.2.0182: autocmds may leave windows with w_locked set
    * patch 9.2.0181: line('w0') moves cursor in terminal-normal mode
    * patch 9.2.0180: possible crash with winminheight=0
    * patch 9.2.0179: MS-Windows: Compiler warning for converting from size_t to int
    * patch 9.2.0178: DEC mode requests are sent even when not in raw mode
    * patch 9.2.0177: Vim9: Can set environment variables in restricted mode
    * patch 9.2.0176: external diff is allowed in restricted mode
    * patch 9.2.0175: No tests for what v9.2.0141 and v9.2.0156 fixes
    * patch 9.2.0174: diff: inline word-diffs can be fragmented
    * patch 9.2.0173: tests: Test_balloon_eval_term_visual is flaky
    * patch 9.2.0172: Missing semicolon in os_mac_conv.c
    * patch 9.2.0171: MS-Windows: version detection is deprecated
    * patch 9.2.0170: channel: some issues in ch_listen()
    * patch 9.2.0169: assertion failure in syn_id2attr()
    * patch 9.2.0168: invalid pointer casting in string_convert() arguments
    * patch 9.2.0167: terminal: setting buftype=terminal may cause a crash
    * patch 9.2.0166: Coverity warning for potential NULL dereference
    * patch 9.2.0165: tests: perleval fails in the sandbox
    * patch 9.2.0164: build error when XCLIPBOARD is not defined
    * patch 9.2.0163: MS-Windows: Compile warning for unused variable
    * patch 9.2.0162: tests: unnecessary CheckRunVimInTerminal in test_quickfix
    * patch 9.2.0161: intro message disappears on startup in some terminals
    * patch 9.2.0160: terminal DEC mode handling is overly complex
    * patch 9.2.0159: Crash when reading quickfix line
    * patch 9.2.0158: Visual highlighting might be incorrect
    * patch 9.2.0157: Vim9: concatenation can be improved
    * patch 9.2.0156: perleval() and rubyeval() ignore security settings
    * patch 9.2.0155: filetype: ObjectScript are not recognized
    * patch 9.2.0154: if_lua: runtime error with lua 5.5
    * patch 9.2.0153: No support to act as a channel server
    * patch 9.2.0152: concatenating strings is slow
    * patch 9.2.0151: blob_from_string() is slow for long strings
    * patch 9.2.0150: synchronized terminal update may cause display artifacts
    * patch 9.2.0149: Vim9: segfault when unletting an imported variable
    * patch 9.2.0148: Compile error when FEAT_DIFF is not defined
    * patch 9.2.0147: blob: concatenation can be improved
    * patch 9.2.0146: dictionary lookups can be improved
    * patch 9.2.0145: UTF-8 decoding and length calculation can be improved
    * patch 9.2.0144: 'statuslineopt' is a global only option
    * patch 9.2.0143: termdebug: no support for thread and condition in :Break
    * patch 9.2.0142: Coverity: Dead code warning
    * patch 9.2.0141: :perl ex commands allowed in restricted mode
    * patch 9.2.0140: file reading performance can be improved
    * patch 9.2.0139: Cannot configure terminal resize event
    * patch 9.2.0138: winhighlight option handling can be improved
    * patch 9.2.0137: [security]: crash with composing char in collection range
    * patch 9.2.0136: memory leak in add_interface_from_super_class()
    * patch 9.2.0135: memory leak in eval_tuple()
    * patch 9.2.0134: memory leak in socket_server_send_reply()
    * patch 9.2.0133: memory leak in netbeans_file_activated()
    * patch 9.2.0132: tests: Test_recover_corrupted_swap_file1 fails on be systems
    * patch 9.2.0131: potential buffer overflow in regdump()
    * patch 9.2.0130: missing range flags for the :tab command
    * patch 9.2.0129: popup: wrong handling of wide-chars and opacity:0
    * patch 9.2.0128: Wayland: using _Boolean instead of bool type
    * patch 9.2.0127: line('w0') and line('w$') return wrong values in a terminal
    * patch 9.2.0126: String handling can be improved
    * patch 9.2.0125: tests: test_textformat.vim leaves swapfiles behind
    * patch 9.2.0124: auto-format may swallow white space
    * patch 9.2.0123: GTK: using deprecated gdk_pixbuf_new_from_xpm_data()
    * patch 9.2.0122: Vim still supports compiling on NeXTSTEP
    * patch 9.2.0120: tests: test_normal fails
    * patch 9.2.0119: incorrect highlight initialization in win_init()
    * patch 9.2.0118: memory leak in w_hl when reusing a popup window
    * patch 9.2.0117: tests: test_wayland.vim fails
    * patch 9.2.0116: terminal: synchronized output sequences are buffered
    * patch 9.2.0115: popup: screen flickering possible during async callbacks
    * patch 9.2.0114: MS-Windows: terminal output may go to wrong terminal
    * patch 9.2.0113: winhighlight pointer may be used uninitialized
    * patch 9.2.0112: popup: windows flicker when updating text
    * patch 9.2.0111: 'winhighlight' option not always applied

++++ vim:

  - Fix bsc#1261191 / CVE-2026-34714.
  - Fix bsc#1261271 / CVE-2026-34982.
  - Fix bsc#1259985 / CVE-2026-33412.
  - Update to 9.2.0280:
    * patch 9.2.0280: [security]: path traversal issue in zip.vim
    * patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list
    * patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file
    * patch 9.2.0277: tests: test_modeline.vim fails
    * patch 9.2.0276: [security]: modeline security bypass
    * patch 9.2.0275: tests: test_options.vim fails
    * patch 9.2.0274: BSU/ESU are output directly to the terminal
    * patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns
    * patch 9.2.0272: [security]: 'tabpanel' can be set in a modeline
    * patch 9.2.0271: buffer underflow in vim_fgets()
    * patch 9.2.0270: test: trailing spaces used in tests
    * patch 9.2.0269: configure: Link error on Solaris
    * patch 9.2.0268: memory leak in call_oc_method()
    * patch 9.2.0267: 'autowrite' not triggered for :term
    * patch 9.2.0266: typeahead buffer overflow during mouse drag event
    * patch 9.2.0265: unnecessary restrictions for defining dictionary function names
    * patch 9.2.0264: Cannot disable kitty keyboard protocol in vim :terminal
    * patch 9.2.0263: hlset() cannot handle attributes with spaces
    * patch 9.2.0262: invalid lnum when pasting text copied blockwise
    * patch 9.2.0261: terminal: redraws are slow
    * patch 9.2.0260: statusline not redrawn after closing a popup window
    * patch 9.2.0259: tabpanel: corrupted display during scrolling causing flicker
    * patch 9.2.0258: memory leak in add_mark()
    * patch 9.2.0257: unnecessary memory allocation in set_callback()
    * patch 9.2.0256: visual selection size not shown in showcmd during test
    * patch 9.2.0255: tests: Test_popup_opacity_vsplit() fails in a wide terminal
    * patch 9.2.0254: w_locked can be bypassed when setting recursively
    * patch 9.2.0253: various issues with wrong b_nwindows after closing buffers
    * patch 9.2.0252: Crash when ending Visual mode after curbuf was unloaded
    * patch 9.2.0251: Link error when building without channel feature
    * patch 9.2.0250: system() does not support bypassing the shell
    * patch 9.2.0249: clipboard: provider reacts to autoselect feature
    * patch 9.2.0248: json_decode() is not strict enough
    * patch 9.2.0247: popup: popups may not wrap as expected
    * patch 9.2.0246: memory leak in globpath()
    * patch 9.2.0245: xxd: color output detection is broken
    * patch 9.2.0244: memory leak in eval8()
    * patch 9.2.0243: memory leak in change_indent()
    * patch 9.2.0242: memory leak in check_for_cryptkey()
    * patch 9.2.0241: tests: Test_visual_block_hl_with_autosel() is flaky
    * patch 9.2.0240: syn_name2id() is slow due to linear search
    * patch 9.2.0239: signcolumn may cause flicker
    * patch 9.2.0238: showmode message may not be displayed
    * patch 9.2.0237: filetype: ObjectScript routines are not recognized
    * patch 9.2.0236: stack-overflow with deeply nested data in json_encode/decode()
    * patch 9.2.0235: filetype: wks files are not recognized.
    * patch 9.2.0234: test: Test_close_handle() is flaky
    * patch 9.2.0233: Compiler warning in strings.c
    * patch 9.2.0232: fileinfo not shown after :bd of last listed buffer
    * patch 9.2.0231: Amiga: Link error for missing HAVE_LOCALE_H
    * patch 9.2.0230: popup: opacity not working accross vert splits
    * patch 9.2.0229: keypad keys may overwrite keycode for another key
    * patch 9.2.0228: still possible flicker
    * patch 9.2.0227: MS-Windows: CSI sequences may be written to screen
    * patch 9.2.0226: No 'incsearch' highlighting support for :uniq
    * patch 9.2.0225: runtime(compiler): No compiler plugin for just
    * patch 9.2.0224: channel: 2 issues with out/err callbacks
    * patch 9.2.0223: Option handling for key:value suboptions is limited
    * patch 9.2.0222: "zb" scrolls incorrectly with cursor on fold
    * patch 9.2.0221: Visual selection drawn incorrectly with "autoselect"
    * patch 9.2.0220: MS-Windows: some defined cannot be set on Cygwin/Mingw
    * patch 9.2.0219: call stack can be corrupted
    * patch 9.2.0218: visual selection highlighting in X11 GUI is wrong.
    * patch 9.2.0217: filetype: cto files are not recognized
    * patch 9.2.0216: MS-Windows: Rendering artifacts with DirectX
    * patch 9.2.0215: MS-Windows: several tests fail in the Windows CUI.
    * patch 9.2.0214: tests: Test_gui_system_term_scroll() is flaky
    * patch 9.2.0213: Crash when using a partial or lambda as a clipboard provider
    * patch 9.2.0212: MS-Windows: version packing may overflow
    * patch 9.2.0211: possible crash when setting 'winhighlight'
    * patch 9.2.0210: tests: Test_xxd tests are failing
    * patch 9.2.0209: freeze during wildmenu completion
    * patch 9.2.0208: MS-Windows: excessive scroll-behaviour with go+=!
    * patch 9.2.0207: MS-Windows: freeze on second :hardcopy
    * patch 9.2.0206: MS-Window: stripping all CSI sequences
    * patch 9.2.0205: xxd: Cannot NUL terminate the C include file style
    * patch 9.2.0204: filetype: cps files are not recognized
    * patch 9.2.0203: Patch v9.2.0185 was wrong
    * patch 9.2.0202: [security]: command injection via newline in glob()
    * patch 9.2.0201: filetype: Wireguard config files not recognized
    * patch 9.2.0200: term: DECRQM codes are sent too early
    * patch 9.2.0199: tests: test_startup.vim fails
    * patch 9.2.0198: cscope: can escape from restricted mode
    * patch 9.2.0197: tabpanel: frame width not updated for existing tab pages
    * patch 9.2.0196: textprop: negative IDs and can cause a crash
    * patch 9.2.0195: CI: test-suite gets killed for taking too long
    * patch 9.2.0194: tests: test_startup.vim leaves temp.txt around
    * patch 9.2.0193: using copy_option_part() can be improved
    * patch 9.2.0192: not correctly recognizing raw key codes
    * patch 9.2.0191: Not possible to know if Vim was compiled with Android support
    * patch 9.2.0190: Status line height mismatch in vertical splits
    * patch 9.2.0189: MS-Windows: opacity popups flicker during redraw in the console
    * patch 9.2.0188: Can set environment variables in restricted mode
    * patch 9.2.0187: MS-Windows: rendering artifacts with DirectX renderer
    * patch 9.2.0186: heap buffer overflow with long generic function name
    * patch 9.2.0185: buffer overflow when redrawing custom tabline
    * patch 9.2.0184: MS-Windows: screen flicker with termguicolors and visualbell
    * patch 9.2.0183: channel: using deprecated networking APIs
    * patch 9.2.0182: autocmds may leave windows with w_locked set
    * patch 9.2.0181: line('w0') moves cursor in terminal-normal mode
    * patch 9.2.0180: possible crash with winminheight=0
    * patch 9.2.0179: MS-Windows: Compiler warning for converting from size_t to int
    * patch 9.2.0178: DEC mode requests are sent even when not in raw mode
    * patch 9.2.0177: Vim9: Can set environment variables in restricted mode
    * patch 9.2.0176: external diff is allowed in restricted mode
    * patch 9.2.0175: No tests for what v9.2.0141 and v9.2.0156 fixes
    * patch 9.2.0174: diff: inline word-diffs can be fragmented
    * patch 9.2.0173: tests: Test_balloon_eval_term_visual is flaky
    * patch 9.2.0172: Missing semicolon in os_mac_conv.c
    * patch 9.2.0171: MS-Windows: version detection is deprecated
    * patch 9.2.0170: channel: some issues in ch_listen()
    * patch 9.2.0169: assertion failure in syn_id2attr()
    * patch 9.2.0168: invalid pointer casting in string_convert() arguments
    * patch 9.2.0167: terminal: setting buftype=terminal may cause a crash
    * patch 9.2.0166: Coverity warning for potential NULL dereference
    * patch 9.2.0165: tests: perleval fails in the sandbox
    * patch 9.2.0164: build error when XCLIPBOARD is not defined
    * patch 9.2.0163: MS-Windows: Compile warning for unused variable
    * patch 9.2.0162: tests: unnecessary CheckRunVimInTerminal in test_quickfix
    * patch 9.2.0161: intro message disappears on startup in some terminals
    * patch 9.2.0160: terminal DEC mode handling is overly complex
    * patch 9.2.0159: Crash when reading quickfix line
    * patch 9.2.0158: Visual highlighting might be incorrect
    * patch 9.2.0157: Vim9: concatenation can be improved
    * patch 9.2.0156: perleval() and rubyeval() ignore security settings
    * patch 9.2.0155: filetype: ObjectScript are not recognized
    * patch 9.2.0154: if_lua: runtime error with lua 5.5
    * patch 9.2.0153: No support to act as a channel server
    * patch 9.2.0152: concatenating strings is slow
    * patch 9.2.0151: blob_from_string() is slow for long strings
    * patch 9.2.0150: synchronized terminal update may cause display artifacts
    * patch 9.2.0149: Vim9: segfault when unletting an imported variable
    * patch 9.2.0148: Compile error when FEAT_DIFF is not defined
    * patch 9.2.0147: blob: concatenation can be improved
    * patch 9.2.0146: dictionary lookups can be improved
    * patch 9.2.0145: UTF-8 decoding and length calculation can be improved
    * patch 9.2.0144: 'statuslineopt' is a global only option
    * patch 9.2.0143: termdebug: no support for thread and condition in :Break
    * patch 9.2.0142: Coverity: Dead code warning
    * patch 9.2.0141: :perl ex commands allowed in restricted mode
    * patch 9.2.0140: file reading performance can be improved
    * patch 9.2.0139: Cannot configure terminal resize event
    * patch 9.2.0138: winhighlight option handling can be improved
    * patch 9.2.0137: [security]: crash with composing char in collection range
    * patch 9.2.0136: memory leak in add_interface_from_super_class()
    * patch 9.2.0135: memory leak in eval_tuple()
    * patch 9.2.0134: memory leak in socket_server_send_reply()
    * patch 9.2.0133: memory leak in netbeans_file_activated()
    * patch 9.2.0132: tests: Test_recover_corrupted_swap_file1 fails on be systems
    * patch 9.2.0131: potential buffer overflow in regdump()
    * patch 9.2.0130: missing range flags for the :tab command
    * patch 9.2.0129: popup: wrong handling of wide-chars and opacity:0
    * patch 9.2.0128: Wayland: using _Boolean instead of bool type
    * patch 9.2.0127: line('w0') and line('w$') return wrong values in a terminal
    * patch 9.2.0126: String handling can be improved
    * patch 9.2.0125: tests: test_textformat.vim leaves swapfiles behind
    * patch 9.2.0124: auto-format may swallow white space
    * patch 9.2.0123: GTK: using deprecated gdk_pixbuf_new_from_xpm_data()
    * patch 9.2.0122: Vim still supports compiling on NeXTSTEP
    * patch 9.2.0120: tests: test_normal fails
    * patch 9.2.0119: incorrect highlight initialization in win_init()
    * patch 9.2.0118: memory leak in w_hl when reusing a popup window
    * patch 9.2.0117: tests: test_wayland.vim fails
    * patch 9.2.0116: terminal: synchronized output sequences are buffered
    * patch 9.2.0115: popup: screen flickering possible during async callbacks
    * patch 9.2.0114: MS-Windows: terminal output may go to wrong terminal
    * patch 9.2.0113: winhighlight pointer may be used uninitialized
    * patch 9.2.0112: popup: windows flicker when updating text
    * patch 9.2.0111: 'winhighlight' option not always applied

------------------------------------------------------------------
------------------  2026-4-1  -  Apr 1 2026  -------------------
------------------------------------------------------------------

++++ python-cryptography:

  - CVE-2026-34073: X.509 bypass of name constraints on wildcard SANs with matching peer names (bsc#1260876)
    Add patch CVE-2026-34073.patch

++++ suseconnect-ng:

  - Update version to 1.21.1:
  - Fix nil token handling (bsc#1261155)
  - Switch to using go1.24-openssl as the default Go version to
    install to support building the package (jsc#SCC-585).

------------------------------------------------------------------
------------------  2026-3-31  -  Mar 31 2026  -------------------
------------------------------------------------------------------

++++ ignition:

  - Add CVE-2026-33186.patch
    * Fixes [bsc#1260251]

++++ libpng16:

  - added patches
    CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code execution (bsc#1260754)
    * libpng16-CVE-2026-33416-1.patch
    * libpng16-CVE-2026-33416-2.patch
    * libpng16-CVE-2026-33416-3.patch
    * libpng16-CVE-2026-33416-4.patch
    CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and crashes (bsc#1260755)
    * libpng16-CVE-2026-33636.patch

++++ libpng16:

  - added patches
    CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code execution (bsc#1260754)
    * libpng16-CVE-2026-33416-1.patch
    * libpng16-CVE-2026-33416-2.patch
    * libpng16-CVE-2026-33416-3.patch
    * libpng16-CVE-2026-33416-4.patch
    CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and crashes (bsc#1260755)
    * libpng16-CVE-2026-33636.patch

------------------------------------------------------------------
------------------  2026-3-30  -  Mar 30 2026  -------------------
------------------------------------------------------------------

++++ glibc:

  - resolv-count-resource-records.patch: resolv: Count records correctly
    (CVE-2026-4437, bsc#1260078, BZ #34014)
  - resolv-check-hostname.patch: resolv: Check hostname for validity
    (CVE-2026-4438, bsc#1260082, BZ #34015)

++++ libtpms:

  - CVE-2025-49133: Fixed potential out of bounds (OOB) read vulnerability (bsc#1244528)
    0001-tpm2-Fix-potential-out-of-bound-access-abort-due-to-.patch

++++ python-requests:

  - CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589)
    Add patch CVE-2026-25645.patch

------------------------------------------------------------------
------------------  2026-3-27  -  Mar 27 2026  -------------------
------------------------------------------------------------------

++++ dpdk:

  - Update to version 22.11.11
  - upstream bugfix release
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id29
  - Summary:
    * app/testpmd: fix conntrack action query, fix DCB Rx queues,
    fix DCB Tx port, fix flex item link parsing
    * common/cnxk: fix async event handling
    * common/mlx5: release unused mempool entries
    * crypto/ipsec_mb: fix QP release in secondary
    * dmadev: fix debug build with tracepoints
    * dma/hisilicon: fix stop with pending transfers
    * doc: improve documentation for conntrack state inspect
    command, device argument in txgbe and ionic
    * eal: fix DMA mask validation with IOVA mode option
    * efd: fix AVX2 support
    * event/cnxk: fix Rx offload flags
    * eventdev: fix listing timer adapters with telemetry
    * fib6: fix tbl8 allocation check logic
    * graph: fix unaligned access in stats
    * hash: fix unaligned access in predictable RSS
    * net/af_packet: fix crash in secondary process
    * net/ark: remove double mbuf free
    * net/bonding: fix MAC address propagation in 802.3ad mode
    * net/dpaa2: fix duplicate call of close
    * net/dpaa2: fix L3/L4 checksum results
    * net/dpaa2: receive packets with additional parse errors
    * net/dpaa: fix resource leak
    * net/ena/base: fix unsafe memcpy on invalid memory
    * net/ena: fix PCI BAR mapping on 64K page size
    * net/enetfec: fix checksum flag handling and error return
    * net/enetfec: fix file descriptor leak on read error
    * net/enetfec: fix memory leak in Rx buffer cleanup
    * net/enetfec: fix out-of-bounds access in UIO mapping
    * net/enetfec: fix Tx queue free
    * net: fix L2 length for GRE packets
    * net/hns3: fix VLAN resources freeing
    * net/hns3: fix VLAN tag loss for short tunnel frame
    * net/i40e: fix symmetric Toeplitz hashing for SCTP
    * net/ice/base: fix integer overflow on NVM init
    * net/ice/base: fix memory leak in HW profile handling
    * net/ice/base: fix memory leak in recipe handling
    * net/ice: fix initialization with 8 ports
    * net/ice: fix memory leak in raw pattern parse
    * net/ice: fix path selection for QinQ Tx offload
    * net/ice: fix vector Rx VLAN offload flags
    * net/mlx5: fix connection tracking state item validation
    * net/mlx5: fix control flow leakage for external SQ
    * net/mlx5: fix ESP header match after UDP for group 0
    * net/mlx5: fix flow aging race condition
    * net/mlx5: fix min and max MTU reporting
    * net/mlx5/hws: fix buddy memory allocation
    * net/ngbe: reduce memory size of ring descriptors
    * net/tap: fix interrupt callback crash after failed start
    * net/txgbe: various FDIR fixes
    * net/vmxnet3: fix mapping of mempools to queues
    * test/crypto: fix vector initialization
    * test/debug: fix crash with mlx5 devices
    * test/debug: fix IOVA mode on PPC64 without huge pages
    * vfio: fix custom containers in multiprocess
    * vhost: fix double fetch when dequeue offloading
  - Add libarchive as dependency, avoid errors like
    '/lib/firmware/... cannot be decompressed' (bsc#1260007)

++++ polkit:

  - avoid reading endless amounts of memory (CVE-2026-4897 bsc#1260859)
    0001-CVE-2026-4897-getline-string-overflow.patch

++++ python311-core:

  - Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
    leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
    gh#python/cpython#143930).

++++ python311:

  - Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
    leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
    gh#python/cpython#143930).

------------------------------------------------------------------
------------------  2026-3-26  -  Mar 26 2026  -------------------
------------------------------------------------------------------

++++ expat:

  - security update:
    * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
    * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
    * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch

++++ openssl-3:

  - Security fixes:
    * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
    * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
    * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
    * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
    * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
    * CVE-2026-31791: NULL pointer dereference when processing an
    OCSP response (bsc#1260446)
    * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-CVE-2026-31791.patch

++++ openssl-3:

  - Security fixes:
    * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
    * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
    * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
    * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
    * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
    * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
    * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch

------------------------------------------------------------------
------------------  2026-3-25  -  Mar 25 2026  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Add CVE-2025-13462-tarinfo-header-parse.patch which skips
    TarInfo DIRTYPE normalization during GNU long name handling
    (bsc#1259611, CVE-2025-13462).

++++ python311:

  - Add CVE-2025-13462-tarinfo-header-parse.patch which skips
    TarInfo DIRTYPE normalization during GNU long name handling
    (bsc#1259611, CVE-2025-13462).

------------------------------------------------------------------
------------------  2026-3-23  -  Mar 23 2026  -------------------
------------------------------------------------------------------

++++ util-linux:

  - Recognize fuse "portal" as a virtual file system (boo#1234736,
    util-linux-libmount-fuse-portal.patch).
  - fdisk: Fix possible partition overlay and data corruption if EBR
    gap is missing (boo#1222465,
    util-linux-libfdisk-ebr-missing-gap-1.patch,
    util-linux-tests-fdisk-ebr-missing-gap-1.patch,
    util-linux-tests-fdisk-ebr-missing-gap-2.patch,
    util-linux-libfdisk-ebr-missing-gap-2.patch,
    util-linux-tests-fdisk-ebr-missing-gap-3.patch).

++++ python311-core:

  - Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
    unbound C recursion in conv_content_model in pyexpat.c
    (bsc#1259735, CVE-2026-4224).
  - Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
    control characters in http.cookies.Morsel.update() and
    http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644).

++++ python311:

  - Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
    unbound C recursion in conv_content_model in pyexpat.c
    (bsc#1259735, CVE-2026-4224).
  - Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
    control characters in http.cookies.Morsel.update() and
    http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644).

++++ python-pyOpenSSL:

  - CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808)
    Add patch CVE-2026-27459.patch
  - CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804)
    Add patch CVE-2026-27448.patch

++++ tar:

  - Fix bsc#1246399 / CVE-2025-45582.
  - Add patch:
    * CVE-2025-45582.patch

++++ util-linux-systemd:

  - Recognize fuse "portal" as a virtual file system (boo#1234736,
    util-linux-libmount-fuse-portal.patch).
  - fdisk: Fix possible partition overlay and data corruption if EBR
    gap is missing (boo#1222465,
    util-linux-libfdisk-ebr-missing-gap-1.patch,
    util-linux-tests-fdisk-ebr-missing-gap-1.patch,
    util-linux-tests-fdisk-ebr-missing-gap-2.patch,
    util-linux-libfdisk-ebr-missing-gap-2.patch,
    util-linux-tests-fdisk-ebr-missing-gap-3.patch).

------------------------------------------------------------------
------------------  2026-3-20  -  Mar 20 2026  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to version 11.0.2 (bsc#1260421)
    + Add iputils as a dependency to make automatic NVIDIA repo enablement
    work
  - Update to version 11.0.1
    + Fix attempt to read a deleted file resulting in an error. Refresh
    the file list for repos and services for each pass over the
    server domains we are looking to clean up the registration.
    + Update user visible messages only showing messages for the
    application configuration file.

++++ cockpit:

  - Update dependencies to fix bsc#1258641/CVE-2026-26996

++++ cockpit:

  - Update dependencies to fix bsc#1258641/CVE-2026-26996

++++ docker-compose:

  - Add patch for CVE-2025-62725 (bsc#1252752)
    0002-CVE-2025-62725-fix-Enforce-compose-files-from-OCI-ar.patch

++++ nghttp2:

  - added patches
    CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845)
    * nghttp2-CVE-2026-27135.patch

++++ rust-keylime:

  - Suggests only the IMA policy package, and keep it as example (bsc#1259963)
  - Add Cargo_toml.patch to re-generate TSS bindings
  - Update to version 0.2.9+8:
    * build(deps): bump thiserror from 2.0.17 to 2.0.18
    * build(deps): bump docker/login-action from 3 to 4
    * build(deps): bump docker/metadata-action from 5 to 6
    * Remove generate-bindings feature from tss-esapi
    * Use port constants instead of hardcoded values in tests
    * push-attestation: Use registrar TLS port when TLS is enabled
    * build(deps): bump docker/build-push-action from 6 to 7
    * build(deps): bump actions/upload-artifact from 6 to 7
    * dist: Make the services to conflict with each other
    * Bump version to 0.2.9
    * build(deps): bump mockoon/cli-action from 2 to 3
    * cargo: Bump tracing_subscriber to version 0.3.20
    * cargo: Bump time to version 0.3.47
    * build(deps): bump http from 1.3.1 to 1.4.0
    * Update reqwest from 0.12 to 0.13
    * build(deps): bump serde from 1.0.219 to 1.0.228
    * auth: Load CA certificate in authentication client
    * packit: Add missing e2e tests
    * registrar: Rename insecure option to disable_tls
    * push-attestation: Drop self-signed mTLS certificate generation
    * config: Add missing config options to keylime-agent.conf
    * config: Add support for "default" in registrar_api_versions option
    * config: Add support for "default" in registrar_tls_ca_cert option
    * config: Drop unused config options and constants
    * push-attestation: Drop support for mTLS to registrar
    * push-attestation: Drop mTLS support and require PoP authentication
    * build(deps): bump clap from 4.5.45 to 4.5.54
    * build(deps): bump actix-web from 4.11.0 to 4.12.1
    * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
    * resilient_client: Reauthenticate if a 403 error is received

------------------------------------------------------------------
------------------  2026-3-19  -  Mar 19 2026  -------------------
------------------------------------------------------------------

++++ crypto-policies:

  - Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
    * Enable and prioritize sntrup761x25519-sha512 for OpenSSH by default
    * Add crypto-policies-OpenSSH-PQC.patch

++++ systemd:

  - Import commit a943e3ce2f655b8509038e31f03f5ded18f24683
    a943e3ce2f machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
    71593f77db udev: fix review mixup
    73a89810b4 udev-builtin-net-id: print cescaped bad attributes
    0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
    40905232e2 udev: ensure tag parsing stays within bounds
    7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
    d018ac1ea3 udev: check for invalid chars in various fields received from the kernel (bsc#1259697)

++++ python-PyJWT:

  - Add CVE-2026-32597_crit-header.patch to validate the crit
    (Critical) Header Parameter defined in RFC 7515 (bsc#1259616,
    CVE-2026-32597).

------------------------------------------------------------------
------------------  2026-3-18  -  Mar 18 2026  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ libzypp:

  - Fix preloader not caching packages from arch specific subrepos
    (bsc#1253740)
  - Deprioritize invalid mirrors (fixes openSUSE/zypper#636)
  - version 17.38.5 (35)

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

------------------------------------------------------------------
------------------  2026-3-17  -  Mar 17 2026  -------------------
------------------------------------------------------------------

++++ pcr-oracle:

  - Add fix-bsc1258119-fix-stop-event-crash.patch to fix the
    potential crash when processing the stop event (bsc#1258119)

++++ python-tornado6:

  - CVE-2026-31958: parsing large multipart bodies with many parts can cause a
    denial of service (bsc#1259553)
    * added CVE-2026-31958.patch
  - VUL-0: incomplete validation of cookie attributes allows for injection of
    user-controlled values in other cookie attributes (bsc#1259630)
    * added VUL-0-cookie-attribute-validation.patch

------------------------------------------------------------------
------------------  2026-3-13  -  Mar 13 2026  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
    ensuring that `SourcelessFileLoader` uses `io.open_code` when
    opening `.pyc` files (bsc#1259240, CVE-2026-2297).

++++ python311-core:

  - Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
    ensuring that `SourcelessFileLoader` uses `io.open_code` when
    opening `.pyc` files (bsc#1259240, CVE-2026-2297).

++++ sqlite3:

  - Update to version 3.51.3:
    * Fix the WAL-reset database corruption bug:
    https://sqlite.org/wal.html#walresetbug
    * Other minor bug fixes.

++++ python311:

  - Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
    ensuring that `SourcelessFileLoader` uses `io.open_code` when
    opening `.pyc` files (bsc#1259240, CVE-2026-2297).

++++ python311:

  - Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
    ensuring that `SourcelessFileLoader` uses `io.open_code` when
    opening `.pyc` files (bsc#1259240, CVE-2026-2297).

------------------------------------------------------------------
------------------  2026-3-12  -  Mar 12 2026  -------------------
------------------------------------------------------------------

++++ libsolv:

  - respect the "default" attribute in environment optionlist in
    the comps parser
  - support suse namespace deps in boolean dependencies [bsc#1258193]
  - support for the Elbrus2000 (e2k) architecture
  - support language() suse namespace rewriting
  - bump version to 0.7.36

++++ suseconnect-ng:

  - Update version to 1.21:
  - Add expanded metric collection for kernel modules and hardware
    detection (jsc#TEL-226).
  - Support new profile based metric collection
  - Fix ignored --root parameter hanbling when reading and
    writing configuration (bsc#1257667)
  - Add expanded metric collection for system vendor/manfacturer
    (jsc#TEL-260).
  - Removed backport patch: fix-libsuseconnect-and-pci.patch
  - Add missing product id to allow yast2-registration to not break (bsc#1257825)
  - Fix libsuseconnect APIError detection logic (bsc#1257825)

------------------------------------------------------------------
------------------  2026-3-11  -  Mar 11 2026  -------------------
------------------------------------------------------------------

++++ NetworkManager:

  - Add NetworkManager-CVE-2025-9615.patch: avoid that non-admin user
    using other users' certificates
    (bsc#1257359, CVE-2025-9615, glfd#NetworkManager/NetworkManager!2324).

++++ vim:

    * Update Vim to version 9.2.0110 (from 9.2.0045).
    * Specifically, this fixes bsc#1259051 / CVE-2026-28417.

++++ vim:

    * Update Vim to version 9.2.0110 (from 9.2.0045).
    * Specifically, this fixes bsc#1259051 / CVE-2026-28417.

++++ vim:

    * Update Vim to version 9.2.0110 (from 9.2.0045).
    * Specifically, this fixes bsc#1259051 / CVE-2026-28417.

------------------------------------------------------------------
------------------  2026-3-10  -  Mar 10 2026  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to version 11.0.0 (bsc#1254960, bsc#1254982, bsc#1253777)
    + Major version bump for main package and plugin sub-packages due to
    interpreter change in SLE 15 SP4+ from Python 3.6 to Python 3.11
    + Create cache directory in code and drop from package (jsc#PED-14732)
    + Fix race condition between license watcher timer and registration
    (bsc#1254984)
    + Fix cleanup issue in hosts (bsc#1254702)
    + Fix cache clean up
    + Fix exit condition from container registry setup
    + Lock the registration process to ensure single execution (bsc#1254984)
    + Fix traceback on FP and cert mismatch
    + Switch remaining code to updated logging implementation
    + Increase loggin information in log to help with issue debugging
    + Fix exit code on partial registration success
    + Remove obsolete switchcloudguestservices

++++ cockpit-machines:

  - add drop-virtinterfaced-usage.patch (bsc#1228187)

++++ cockpit-machines:

  - add drop-virtinterfaced-usage.patch (bsc#1228187)

++++ libzypp:

  - Fix Product::referencePackage lookup (bsc#1259311)
    Use a provided autoproduct() as hint to the package name of the
    release package. It might be that not just multiple versions of
    the same release package provide the same product version, but
    also different release packages.
  - version 17.38.4 (35)

------------------------------------------------------------------
------------------  2026-3-9  -  Mar 9 2026  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fixes:
    * CVE-2026-1965: Bad reuse of HTTP Negotiate connection (bsc#1259362)
    * CVE-2026-3783: Token leak with redirect and netrc (bsc#1259363)
    * CVE-2026-3784: Wrong proxy connection reuse with credentials (bsc#1259364)
    * CVE-2026-3805: Use after free in SMB connection reuse (bsc#1259365)
    * Add patches:
  - curl-CVE-2026-1965.patch
  - curl-CVE-2026-3783.patch
  - curl-CVE-2026-3784.patch
  - curl-CVE-2026-3805.patch

++++ curl:

  - Security fixes:
    * CVE-2026-1965: Bad reuse of HTTP Negotiate connection (bsc#1259362)
    * CVE-2026-3783: Token leak with redirect and netrc (bsc#1259363)
    * CVE-2026-3784: Wrong proxy connection reuse with credentials (bsc#1259364)
    * CVE-2026-3805: Use after free in SMB connection reuse (bsc#1259365)
    * Add patches:
  - curl-CVE-2026-1965.patch
  - curl-CVE-2026-3783.patch
  - curl-CVE-2026-3784.patch
  - curl-CVE-2026-3805.patch

------------------------------------------------------------------
------------------  2026-3-6  -  Mar 6 2026  -------------------
------------------------------------------------------------------

++++ busybox:

  - Additional fix for use-after-realloc in awk (CVE-2021-42380, bsc#1192869)
    * 0001-awk-fix-use-after-realloc-CVE-2021-42380-closes-1560.patch
  - Fix use-after-free in the awk.c copyvar (CVE-2023-42365, bsc#1217585)
    * 0002-awk-fix-precedence-of-relative-to.patch
  - Fix use-after-free vulnerability in xasprintf (CVE-2023-42363, bsc#1217580)
    * 0003-awk-fix-use-after-free-CVE-2023-42363.patch
  - Fix use-after-free in the awk.c (CVE-2023-42364, bsc#1217584)
    * 0004-awk-restore-assignment-precedence-to-be-lower-than-t.patch
  - Fix hidden files in tar listing using escape chars (CVE-2025-46394, bsc#1241661)
    * 0005-archival-libarchive-sanitize-filenames-on-output-pre.patch
  - Fix file overwrite, modification, privilege escalation, potential code execution
    in tar (CVE-2026-26157, bsc#1258163) (CVE-2026-26158, bsc#1258167)
    * 0006-tar-strip-unsafe-hardlink-components-GNU-tar-does-th.patch
    * 0007-tar-only-strip-unsafe-components-from-hardlinks-not-.patch
  - Fix wget request header injection (CVE-2025-60876, bsc#1253245)
    * wget-don-t-allow-control-characters-in-url.patch

++++ python311-core:

  - Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
    Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

++++ python311-core:

  - Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
    Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

++++ python311-core:

  - Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
    Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

++++ libzypp:

  - specfile: on fedora use %{_prefix}/share as zyppconfdir if
    %{_distconfdir} is undefined (fixes #693)
    This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake.
  - Fall back to a writable location when precaching packages
    without root (bsc#1247948)
  - version 17.38.3 (35)

++++ python311:

  - Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
    Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

++++ python311:

  - Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
    Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

++++ python311:

  - Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
    Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

++++ zypper:

  - Report download progress for command line rpms (fixes #613)
  - Hint to '-vv ref' to see the mirrors used to download the
    metadata (bsc#1257882)
  - Service: Allow "zypper ls SERVICE ..." to test whether a
    service with this alias is defined (bsc#1252744)
    The command prints an abstract of all services passed on the
    command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some
    argument does not name an existing service.
  - Keep repo data when updating the service settings (bsc#1252744)
  - info: Enhance pattern content table (bsc#1158038)
    Alternatives (multiple packages providing the same requirement)
    are now listed as a single entry in the content table. The entry
    shows either the installed package which satisfies the
    requirement or the requirement itself as type 'Provides'.
    Listing all potential alternatives was miss leading, especially
    if the alternatives were mutual exclusive. It looked like an
    installed pattern had not-installed requirements and it was not
    possible to install all requirements at the same time.
  - version 1.14.95

------------------------------------------------------------------
------------------  2026-3-4  -  Mar 4 2026  -------------------
------------------------------------------------------------------

++++ salt:

  - Make syntax in httputil_test compatible with Python 3.6
  - Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
  - Use internal deb classes instead of external aptsource lib
  - Speed up wheel key.finger call (bsc#1240532)
  - Backport security patches for Salt vendored tornado:
    * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
    * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
    * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
  - Simplify and speed up utils.find_json function (bsc#1246130)
  - Extend warn_until period to 2027
  - Added:
    * fix-tornado-s-httputil_test-syntax-for-python-3.6.patch
    * backport-add-maintain-m-privilege-to-postgres-module.patch
    * use-internal-salt.utils.pkg.deb-classes-instead-of-a.patch
    * speedup-wheel-key.finger-call-bsc-1240532-713.patch
    * fixes-for-security-issues-cve-2025-13836-cve-2025-67.patch
    * simplify-utils.json.find_json-function.patch
    * extend-fails-to-warnings-until-2027-742.patch

++++ suseconnect-ng:

  - Regressions found during QA test runs:
  - Ignore product in announce call (bsc#1257490)
  - Registration to SMT server with failed (bsc#1257625)

++++ suseconnect-ng:

  - Regressions found during QA test runs:
  - Ignore product in announce call (bsc#1257490)
  - Registration to SMT server with failed (bsc#1257625)
  - Backported by PATCH: fix-libsuseconnect-and-pci.patch

++++ tar:

  - Add tar-fix-deletion-from-archive.patch
    * Fixes tar creating invalid tarballs when used with --delete (bsc#1246607)
    * Add makeinfo build requirement, needed after the addition of the patch

++++ tar:

  - Add tar-fix-deletion-from-archive.patch
    * Fixes tar creating invalid tarballs when used with --delete (bsc#1246607)
    * Add makeinfo build requirement, needed after the addition of the patch

++++ vim:

    * Update Vim to version 9.2.0045 (from 9.1.1629).
    * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed
    upstream).
    * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed
    upstream).
    * Drop obsolete or upstreamed patches:
  - vim-7.3-filetype_spec.patch
  - vim-7.4-filetype_apparmor.patch
  - vim-8.2.2411-globalvimrc.patch
    * Refresh the following patches:
  - vim-7.3-filetype_changes.patch
  - vim-7.3-filetype_ftl.patch
  - vim-7.3-sh_is_bash.patch
  - vim-9.1.1134-revert-putty-terminal-colors.patch
    * Remove autoconf from BuildRequires and drop the autoconf call in %build.
    * Package new Swedish (sv) man pages and clean up duplicate encodings
    (sv.ISO8859-1 and sv.UTF-8) during %install.

++++ vim:

    * Update Vim to version 9.2.0045 (from 9.1.1629).
    * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed
    upstream).
    * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed
    upstream).
    * Drop obsolete or upstreamed patches:
  - vim-7.3-filetype_spec.patch
  - vim-7.4-filetype_apparmor.patch
  - vim-8.2.2411-globalvimrc.patch
    * Refresh the following patches:
  - vim-7.3-filetype_changes.patch
  - vim-7.3-filetype_ftl.patch
  - vim-7.3-sh_is_bash.patch
  - vim-9.1.1134-revert-putty-terminal-colors.patch
    * Remove autoconf from BuildRequires and drop the autoconf call in %build.
    * Package new Swedish (sv) man pages and clean up duplicate encodings
    (sv.ISO8859-1 and sv.UTF-8) during %install.

++++ vim:

    * Update Vim to version 9.2.0045 (from 9.1.1629).
    * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed
    upstream).
    * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed
    upstream).
    * Drop obsolete or upstreamed patches:
  - vim-7.3-filetype_spec.patch
  - vim-7.4-filetype_apparmor.patch
  - vim-8.2.2411-globalvimrc.patch
    * Refresh the following patches:
  - vim-7.3-filetype_changes.patch
  - vim-7.3-filetype_ftl.patch
  - vim-7.3-sh_is_bash.patch
  - vim-9.1.1134-revert-putty-terminal-colors.patch
    * Remove autoconf from BuildRequires and drop the autoconf call in %build.
    * Package new Swedish (sv) man pages and clean up duplicate encodings
    (sv.ISO8859-1 and sv.UTF-8) during %install.

++++ vim:

    * Update Vim to version 9.2.0045 (from 9.1.1629).
    * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed
    upstream).
    * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed
    upstream).
    * Drop obsolete or upstreamed patches:
  - vim-7.3-filetype_spec.patch
  - vim-7.4-filetype_apparmor.patch
  - vim-8.2.2411-globalvimrc.patch
    * Refresh the following patches:
  - vim-7.3-filetype_changes.patch
  - vim-7.3-filetype_ftl.patch
  - vim-7.3-sh_is_bash.patch
  - vim-9.1.1134-revert-putty-terminal-colors.patch
    * Remove autoconf from BuildRequires and drop the autoconf call in %build.
    * Package new Swedish (sv) man pages and clean up duplicate encodings
    (sv.ISO8859-1 and sv.UTF-8) during %install.

------------------------------------------------------------------
------------------  2026-3-3  -  Mar 3 2026  -------------------
------------------------------------------------------------------

++++ freetype2:

  - update to 2.14.2
  - Important changes
    * Several changes related to LCD filtering are implemented to
    achieve better performance and encourage sound practices.
    + Instead of blanket LCD filtering over the entire bitmap, it
    is now applied only to non-zero spans using direct rendering.
    This speeds up the ClearType-like rendering by more than 40%
    at sizes above 32 ppem.
    + Setting the filter weights with FT_Face_Properties is no
    longer supported. The default and light filters are optimized
    to work with any face.
    + The legacy libXft LCD filter algorithm is no longer provided.
  - Important bug fixes
    * A bunch of potential security problems have been found
    (bsc#1259118, CVE-2026-23865). All users should update.
    * The italic angle in `PS_FontInfo` is now stored as a fixed-point
    value in degrees for all Type 1 fonts and their derivatives,
    consistent with CFF fonts and common practices. The broken
    underline position and thickness values are fixed for CFF fonts.
  - Miscellaneous
    * The `x` field in the `FT_Span` structure is now unsigned.
    * Demo program `ftgrid` got an option `-m` to select a start
    character to display.
    * Similarly, demo program `ftmulti` got an option `-m` to select a
    text string for rendering.
    * Option `-d` in the demo program `ttdebug` is now called `-a`,
    expecting a comma-separated list of axis values.  The user
    interface is also slightly improved.
    * The `ftinspect` demo program can now be compiled with Qt6, too.

------------------------------------------------------------------
------------------  2026-3-2  -  Mar 2 2026  -------------------
------------------------------------------------------------------

++++ virtiofsd:

  - Add CVE-2026-25727.patch: Avoid denial of service when parsing
    Rfc2822(bsc#1257912 CVE-2026-25727).

------------------------------------------------------------------
------------------  2026-3-1  -  Mar 1 2026  -------------------
------------------------------------------------------------------

++++ util-linux:

  - Use full hostname for PAM to ensure correct access control for
    "login -h" (bsc#1258859, CVE-2026-3184,
    util-linux-CVE-2026-3184.patch).

++++ util-linux:

  - Use full hostname for PAM to ensure correct access control for
    "login -h" (bsc#1258859, CVE-2026-3184,
    util-linux-CVE-2026-3184.patch).

++++ util-linux-systemd:

  - Use full hostname for PAM to ensure correct access control for
    "login -h" (bsc#1258859, CVE-2026-3184,
    util-linux-CVE-2026-3184.patch).

++++ util-linux-systemd:

  - Use full hostname for PAM to ensure correct access control for
    "login -h" (bsc#1258859, CVE-2026-3184,
    util-linux-CVE-2026-3184.patch).

------------------------------------------------------------------
------------------  2026-2-27  -  Feb 27 2026  -------------------
------------------------------------------------------------------

++++ systemd:

  - Import commit aef6e11921f8c46a2b7ee8cfab024c9c641d74d8
    aef6e11921 core/cgroup: avoid one unnecessary strjoina()
    cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
    26a748f727 core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
    99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

------------------------------------------------------------------
------------------  2026-2-25  -  Feb 25 2026  -------------------
------------------------------------------------------------------

++++ libsoup:

  - Add libsoup-CVE-2026-1760.patch: server: close the connection
    after responsing a request containing...
    (bsc#1257597, CVE-2026-1760, glgo#GNOME/libsoup#475).
  - Add libsoup-CVE-2026-1467.patch: uri-utils: do host validation
    when checking if a GUri is valid
    (bsc#1257398, CVE-2026-1467, glgo#GNOME/libsoup#488).
  - Add libsoup-CVE-2026-1539.patch: Also remove Proxy-Authorization
    header on cross origin redirect
    (bsc#1257441, CVE-2026-1539, glgo#GNOME/libsoup#489).

++++ qemu:

  - Bug and CVE fixes:
    * cryptodev-builtin: Limit the maximum size (bsc#1255400, CVE-2025-14876)
    * hw/virtio/virtio-crypto: verify asym request size (bsc#1255400, CVE-2025-14876)
    * hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq() (bsc#1256484, CVE-2026-0665)

------------------------------------------------------------------
------------------  2026-2-24  -  Feb 24 2026  -------------------
------------------------------------------------------------------

++++ gnutls:

  - Add the functionality to allow to specify the hash algorithm for
    the PSK. This fixes a bug in the current implementation where the
    binder is always calculated with SHA256.
    * (bsc#1258083, jsc#PED-15752, jsc#PED-15753)
    * lib/psk: Add gnutls_psk_allocate_{client,server}_credentials2
    * tests/psk-file: Add testing for _credentials2 functions
    * lib/psk: add null check for binder algo
    * pre_shared_key: fix memleak when retrying with different binder algo
    * pre_shared_key: add null check on pskcred
    * Add patches:
  - gnutls-PSK-hash.patch
  - gnutls-PSK-hash-tests.patch
  - gnutls-PSK-hash-NULL-check.patch
  - gnutls-PSK-hash-NULL-check-pskcred.patch
  - gnutls-PSK-hash-fix-memleak.patch

------------------------------------------------------------------
------------------  2026-2-20  -  Feb 20 2026  -------------------
------------------------------------------------------------------

++++ mozilla-nss:

  - update to NSS 3.112.3
    * bmo#2009552 - avoid integer overflow in platform-independent ghash

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-12105.patch (bsc#1252555 CVE-2025-12105
    glgo#GNOME/libsoup!481)
    + libsoup-CVE-2025-32049.patch (bsc#1240751 CVE-2025-32049
    glgo#GNOME/libsoup#390)
    + libsoup-CVE-2026-2443.patch (bsc#1258170 CVE-2026-2443
    glgo#GNOME/libsoup#487)
    + libsoup-CVE-2026-2369.patch (bsc#1258120 CVE-2026-2369
    glgo#GNOME/libsoup!508)
    + libsoup-CVE-2026-2708.patch (bsc#1258508 CVE-2026-2708
    glgo#GNOME/libsoup#500)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-12105.patch (bsc#1252555 CVE-2025-12105
    glgo#GNOME/libsoup!481)
    + libsoup-CVE-2025-32049.patch (bsc#1240751 CVE-2025-32049
    glgo#GNOME/libsoup#390)
    + libsoup-CVE-2026-2443.patch (bsc#1258170 CVE-2026-2443
    glgo#GNOME/libsoup#487)
    + libsoup-CVE-2026-2369.patch (bsc#1258120 CVE-2026-2369
    glgo#GNOME/libsoup!508)
    + libsoup-CVE-2026-2708.patch (bsc#1258508 CVE-2026-2708
    glgo#GNOME/libsoup#500)

------------------------------------------------------------------
------------------  2026-2-18  -  Feb 18 2026  -------------------
------------------------------------------------------------------

++++ zlib:

  - Fix CVE-2026-27171, infinite loop via the crc32_combine64 and
    crc32_combine_gen64 functions due to missing checks for negative
    lengths (bsc#1258392)
    * CVE-2026-27171.patch

------------------------------------------------------------------
------------------  2026-2-17  -  Feb 17 2026  -------------------
------------------------------------------------------------------

++++ python-cryptography:

  - CVE-2026-26007: Subgroup Attack Due to Missing Subgroup
    Validation for SECT Curves (bsc#1258074)
    * added CVE-2026-26007.patch

++++ python-cryptography:

  - CVE-2026-26007: Subgroup Attack Due to Missing Subgroup
    Validation for SECT Curves (bsc#1258074)
    * added CVE-2026-26007.patch

------------------------------------------------------------------
------------------  2026-2-13  -  Feb 13 2026  -------------------
------------------------------------------------------------------

++++ libxml2:

  - CVE-2026-0990: call stack overflow leading to application crash
    due to infinite recursion in `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811)
    * Add patch libxml2-CVE-2026-0990.patch
  - CVE-2026-0992: excessive resource consumption when processing XML
    catalogs due to exponential behavior when handling `<nextCatalog>` elements (bsc#1256808, bsc#1256809, bsc#1256812)
    * Add patch libxml2-CVE-2026-0992.patch
  - CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850)
    * Add patch libxml2-CVE-2025-8732.patch

++++ libxml2-python:

  - CVE-2026-0990: call stack overflow leading to application crash
    due to infinite recursion in `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811)
    * Add patch libxml2-CVE-2026-0990.patch
  - CVE-2026-0992: excessive resource consumption when processing XML
    catalogs due to exponential behavior when handling `<nextCatalog>` elements (bsc#1256808, bsc#1256809, bsc#1256812)
    * Add patch libxml2-CVE-2026-0992.patch
  - CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850)
    * Add patch libxml2-CVE-2025-8732.patch

------------------------------------------------------------------
------------------  2026-2-12  -  Feb 12 2026  -------------------
------------------------------------------------------------------

++++ libpng16:

  - added patches
    CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
    * libpng16-CVE-2026-25646.patch

++++ libpng16:

  - added patches
    CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
    * libpng16-CVE-2026-25646.patch

++++ libpng16:

  - added patches
    CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
    * libpng16-CVE-2026-25646.patch

------------------------------------------------------------------
------------------  2026-2-11  -  Feb 11 2026  -------------------
------------------------------------------------------------------

++++ gpg2:

  - Fix Y2K38 FTBFS:
    * gpg2 quick-key-manipulation test FTBFS-2038 (bsc#1251214)
    * Upstream issue: dev.gnupg.org/T8096
    * Add gnupg-gpgscm-New-operator-long-time-t-to-detect-proper-tim.patch

++++ python311-core:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

++++ python311-core:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

++++ python311-core:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

++++ python311-core:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

++++ libssh:

  - Security fixes:
    * CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
    * CVE-2026-0965: Possible Denial of Service when parsing unexpected
    configuration files (bsc#1258045)
    * CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
    * CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
    * CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
    * Add patches:
  - libssh-CVE-2026-0964-scp-Reject-invalid-paths-received-thro.patch
  - libssh-CVE-2026-0965-config-Do-not-attempt-to-read-non-regu.patch
  - libssh-CVE-2026-0966-misc-Avoid-heap-buffer-underflow-in-ss.patch
  - libssh-CVE-2026-0966-tests-Test-coverage-for-ssh_get_hexa.patch
  - libssh-CVE-2026-0966-doc-Update-guided-tour-to-use-SHA256-f.patch
  - libssh-CVE-2026-0967-match-Avoid-recursive-matching-ReDoS.patch
  - libssh-CVE-2026-0968-sftp-Sanitize-input-handling-in-sftp_p.patch

++++ python311:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

++++ python311:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

++++ python311:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

++++ python311:

  - CVE-2025-11468: preserving parens when folding comments in
    email headers (bsc#1257029, gh#python/cpython#143935).
    CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2026-0672: rejects control characters in http cookies.
    (bsc#1257031, gh#python/cpython#143919)
    CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865: rejecting control characters in
    wsgiref.headers.Headers, which could be abused for injecting
    false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
    CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15366: basically the same as the previous patch for
    IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
    CVE-2025-15366-imap-ctrl-chars.patch
  - CVE-2025-15282: basically the same as the previous patch for
    urllib library. (bsc#1257046, gh#python/cpython#143925)
    CVE-2025-15282-urllib-ctrl-chars.patch
  - CVE-2025-15367: basically the same as the previous patch for
    poplib library. (bsc#1257041, gh#python/cpython#143923)
    CVE-2025-15367-poplib-ctrl-chars.patch
  - CVE-2025-12781: fix decoding with non-standard Base64 alphabet
    (bsc#1257108, gh#python/cpython#125346)
    CVE-2025-12781-b64decode-alt-chars.patch

------------------------------------------------------------------
------------------  2026-2-10  -  Feb 10 2026  -------------------
------------------------------------------------------------------

++++ avahi:

  - Add avahi-CVE-2024-52615.patch:
    Backport 4e2e1ea from upstream, Resolve fixed source ports for
    wide-area DNS queries cause DNS responses be injected.
    (CVE-2024-52615, bsc#1233421)
  - Add avahi-CVE-2025-68468.patch:
    Backport f66be13 from upstream, fix DoS bug by removing incorrect
    assertion.
    (CVE-2025-68468, bsc#1256499)
  - Add avahi-CVE-2025-68471.patch:
    Backport 9c6eb53 from upstream, fix DoS bug by changing assert to
    return.
    (CVE-2025-68471, bsc#1256500)
  - Add avahi-CVE-2025-68276.patch:
    Backport 0c013e2 from upstream, refuse to create wide-area record
    browsers when wide-area is off.
    (CVE-2025-68276, bsc#1256498)

++++ avahi:

  - Add avahi-CVE-2024-52615.patch:
    Backport 4e2e1ea from upstream, Resolve fixed source ports for
    wide-area DNS queries cause DNS responses be injected.
    (CVE-2024-52615, bsc#1233421)
  - Add avahi-CVE-2025-68468.patch:
    Backport f66be13 from upstream, fix DoS bug by removing incorrect
    assertion.
    (CVE-2025-68468, bsc#1256499)
  - Add avahi-CVE-2025-68471.patch:
    Backport 9c6eb53 from upstream, fix DoS bug by changing assert to
    return.
    (CVE-2025-68471, bsc#1256500)
  - Add avahi-CVE-2025-68276.patch:
    Backport 0c013e2 from upstream, refuse to create wide-area record
    browsers when wide-area is off.
    (CVE-2025-68276, bsc#1256498)

++++ avahi:

  - Add avahi-CVE-2024-52615.patch:
    Backport 4e2e1ea from upstream, Resolve fixed source ports for
    wide-area DNS queries cause DNS responses be injected.
    (CVE-2024-52615, bsc#1233421)
  - Add avahi-CVE-2025-68468.patch:
    Backport f66be13 from upstream, fix DoS bug by removing incorrect
    assertion.
    (CVE-2025-68468, bsc#1256499)
  - Add avahi-CVE-2025-68471.patch:
    Backport 9c6eb53 from upstream, fix DoS bug by changing assert to
    return.
    (CVE-2025-68471, bsc#1256500)
  - Add avahi-CVE-2025-68276.patch:
    Backport 0c013e2 from upstream, refuse to create wide-area record
    browsers when wide-area is off.
    (CVE-2025-68276, bsc#1256498)

++++ ca-certificates-mozilla:

  - Updated to 2.84 state (bsc#1258002)
  - Removed:
  - Baltimore CyberTrust Root
  - CommScope Public Trust ECC Root-01
  - CommScope Public Trust ECC Root-02
  - CommScope Public Trust RSA Root-01
  - CommScope Public Trust RSA Root-02
  - DigiNotar Root CA
  - Added:
  - e-Szigno TLS Root CA 2023
  - OISTE Client Root ECC G1
  - OISTE Client Root RSA G1
  - OISTE Server Root ECC G1
  - OISTE Server Root RSA G1
  - SwissSign RSA SMIME Root CA 2022 - 1
  - SwissSign RSA TLS Root CA 2022 - 1
  - TrustAsia SMIME ECC Root CA
  - TrustAsia SMIME RSA Root CA
  - TrustAsia TLS ECC Root CA
  - TrustAsia TLS RSA Root CA

++++ gnutls:

  - Security fix:
    * CVE-2025-14831: DoS via excessive resource consumption during
    certificate verification (bsc#1257960)
    * Add gnutls-CVE-2025-14831.patch

++++ libpng16:

  - added patches
    CVE-2026-22695: Heap buffer over-read in png_image_finish_read (bsc#1256525)
    * libpng16-CVE-2026-22695.patch
    CVE-2026-22801: Integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526)
    * libpng16-CVE-2026-22801.patch

++++ libpng16:

  - added patches
    CVE-2026-22695: Heap buffer over-read in png_image_finish_read (bsc#1256525)
    * libpng16-CVE-2026-22695.patch
    CVE-2026-22801: Integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526)
    * libpng16-CVE-2026-22801.patch

++++ libpng16:

  - added patches
    CVE-2026-22695: Heap buffer over-read in png_image_finish_read (bsc#1256525)
    * libpng16-CVE-2026-22695.patch
    CVE-2026-22801: Integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526)
    * libpng16-CVE-2026-22801.patch

------------------------------------------------------------------
------------------  2026-2-9  -  Feb 9 2026  -------------------
------------------------------------------------------------------

++++ rust-keylime:

  - Update vendored crates (bsc#1257908, CVE-2026-25727)
    * time 0.3.47
  - Update to version 0.2.8+116:
    * build(deps): bump bytes from 1.7.2 to 1.11.1
    * api: Modify /version endpoint output in version 2.5
    * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
    * tests: add unit test for resolve_agent_id (#1182)
    * (pull-model): enable retry logic for registration
    * rpm: Update specfiles to apply on master
    * workflows: Add test to detect unused crates
    * lib: Drop unused crates
    * push-model: Drop unused crates
    * keylime-agent: Drop unused crates
    * build(deps): bump uuid from 1.18.1 to 1.19.0
    * Update reqwest-retry to 0.8, retry-policies to 0.5
    * rpm: Fix cargo_build macro usage on CentOS Stream
    * fix(push-model): resolve hash_ek uuid to actual EK hash
    * build(deps): bump thiserror from 2.0.16 to 2.0.17
    * workflows: Separate upstream test suite from e2e coverage
    * Send UEFI measured boot logs as raw bytes (#1173)
    * auth: Add unit tests for SecretToken implementation
    * packit: Enable push-attestation tests
    * resilient_client: Prevent authentication token leakage in logs

++++ rust-keylime:

  - Update vendored crates (bsc#1257908, CVE-2026-25727)
    * time 0.3.47
  - Update to version 0.2.8+116:
    * build(deps): bump bytes from 1.7.2 to 1.11.1
    * api: Modify /version endpoint output in version 2.5
    * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
    * tests: add unit test for resolve_agent_id (#1182)
    * (pull-model): enable retry logic for registration
    * rpm: Update specfiles to apply on master
    * workflows: Add test to detect unused crates
    * lib: Drop unused crates
    * push-model: Drop unused crates
    * keylime-agent: Drop unused crates
    * build(deps): bump uuid from 1.18.1 to 1.19.0
    * Update reqwest-retry to 0.8, retry-policies to 0.5
    * rpm: Fix cargo_build macro usage on CentOS Stream
    * fix(push-model): resolve hash_ek uuid to actual EK hash
    * build(deps): bump thiserror from 2.0.16 to 2.0.17
    * workflows: Separate upstream test suite from e2e coverage
    * Send UEFI measured boot logs as raw bytes (#1173)
    * auth: Add unit tests for SecretToken implementation
    * packit: Enable push-attestation tests
    * resilient_client: Prevent authentication token leakage in logs

------------------------------------------------------------------
------------------  2026-2-5  -  Feb 5 2026  -------------------
------------------------------------------------------------------

++++ regionServiceClientConfigGCE:

  - Update to version 5.2.0
    + Drop the if condition for gcemetdata requirement

------------------------------------------------------------------
------------------  2026-2-4  -  Feb 4 2026  -------------------
------------------------------------------------------------------

++++ cockpit-machines:

  - Update dependencies for bsc#1257325/CVE-2025-13465

++++ cockpit-machines:

  - Update dependencies for bsc#1257325/CVE-2025-13465

++++ cockpit-machines:

  - Update dependencies for bsc#1257325/CVE-2025-13465

++++ docker:

  - Places a hard cap on the amount of mechanisms that can be specified and
    encoded in the payload. (bcs#1253904, CVE-2025-58181)
    * 0007-CVE-2025-58181-fix-vendor-crypto-ssh.patch

++++ libxslt:

  - CVE-2025-10911 will be fixed on libxml2 side instead [bsc#1250553]
  - deleted patches
    * libxslt-CVE-2025-10911.patch

++++ libxml2:

  - CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257593, bsc#1257594, bsc#1257595)
    * Add patch libxml2-CVE-2026-1757.patch
  - CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)
    * Add patch libxml2-CVE-2025-10911.patch

++++ libxml2-python:

  - CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257593, bsc#1257594, bsc#1257595)
    * Add patch libxml2-CVE-2026-1757.patch
  - CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)
    * Add patch libxml2-CVE-2025-10911.patch

------------------------------------------------------------------
------------------  2026-2-3  -  Feb 3 2026  -------------------
------------------------------------------------------------------

++++ cockpit:

  - Update dependencies for bsc#1257324/CVE-2025-13465

++++ cockpit:

  - Update dependencies for bsc#1257324/CVE-2025-13465

++++ cockpit:

  - Update dependencies for bsc#1257324/CVE-2025-13465

++++ crun:

  - make sure the opened .krun_config.json is below the rootfs directory
    and we don't follow any symlink. (CVE-2025-24965, bsc#1237421)
    * krun-fix-CVE-2025-24965.patch

++++ docker-compose:

  - Add patch for CVE-2025-47914 (bsc#1254041), CVE-2025-47913 (bsc#1253584):
    0001-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch

++++ docker-compose:

  - Add patch for CVE-2025-47914 (bsc#1254041), CVE-2025-47913 (bsc#1253584):
    0001-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch

++++ expat:

  - security update
  - added patches
    CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
    * expat-CVE-2026-24515.patch
    CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
    * expat-CVE-2026-25210.patch

++++ expat:

  - security update
  - added patches
    CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
    * expat-CVE-2026-24515.patch
    CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
    * expat-CVE-2026-25210.patch

++++ libsoup:

  - Add libsoup-CVE-2026-1536.patch: Always validate the headers
    value when coming from untrusted source
    (bsc#1257440, CVE-2026-1536, glgo#GNOME/libsoup/commit/5c1a2e9c).
  - Add libsoup-CVE-2026-1761.patch: multipart: check length of bytes
    read soup_filter_input_stream_read_until()
    (bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496).

++++ libsoup:

  - Add libsoup-CVE-2026-1536.patch: Always validate the headers
    value when coming from untrusted source
    (bsc#1257440, CVE-2026-1536, glgo#GNOME/libsoup/commit/5c1a2e9c).
  - Add libsoup-CVE-2026-1761.patch: multipart: check length of bytes
    read soup_filter_input_stream_read_until()
    (bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496).

++++ libsoup:

  - Add libsoup-CVE-2026-1536.patch: Always validate the headers
    value when coming from untrusted source
    (bsc#1257440, CVE-2026-1536, glgo#GNOME/libsoup/commit/5c1a2e9c).
  - Add libsoup-CVE-2026-1761.patch: multipart: check length of bytes
    read soup_filter_input_stream_read_until()
    (bsc#1257598, CVE-2026-1761, glgo#GNOME/libsoup!496).

------------------------------------------------------------------
------------------  2026-1-30  -  Jan 30 2026  -------------------
------------------------------------------------------------------

++++ cockpit-podman:

  - Update dependencies to fix building on non-x86 arches
  - Update lodash to 4.17.23 for bsc#1257324

++++ cockpit-podman:

  - Update dependencies to fix building on non-x86 arches
  - Update lodash to 4.17.23 for bsc#1257324

------------------------------------------------------------------
------------------  2026-1-29  -  Jan 29 2026  -------------------
------------------------------------------------------------------

++++ libzypp:

  - Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros.
    See the ZYPP.CONF(5) man page for details.
  - Fix runtime check for broken rpm --runposttrans (bsc#1257068)
  - version 17.38.2 (35)

++++ libzypp:

  - Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros.
    See the ZYPP.CONF(5) man page for details.
  - Fix runtime check for broken rpm --runposttrans (bsc#1257068)
  - version 17.38.2 (35)

++++ podman:

  - Add symlink to catatonit in /usr/libexec/podman (bsc#1248988)

------------------------------------------------------------------
------------------  2026-1-28  -  Jan 28 2026  -------------------
------------------------------------------------------------------

++++ glib2:

  - Add CVE fixes:
    + glib2-CVE-2026-1484.patch (bsc#1257355 CVE-2026-1484
    glgo#GNOME/glib!4979).
    + glib2-CVE-2026-1485.patch (bsc#1257354 CVE-2026-1485
    glgo#GNOME/glib!4981).
    + glib2-CVE-2026-1489.patch (bsc#1257353 CVE-2026-1489
    glgo#GNOME/glib!4984).

++++ gpg2:

  - Security fix [bsc#1257396, CVE-2026-24882]
  - gpg2: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys
  - Added gnupg-CVE-2026-24882.patch
  - Security fix [bsc#1256389] (gpg.fail/filename)
    * Added gnupg-accepts-path-separators-literal-data.patch
    * GnuPG Accepts Path Separators and Path Traversals in Literal Data

++++ gpg2:

  - Security fix [bsc#1257396, CVE-2026-24882]
    * gpg2: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys
    * Added gnupg-CVE-2026-24882.patch
  - Security fix [bsc#1256389] (gpg.fail/filename)
    * Added gnupg-accepts-path-separators-literal-data.patch
    * GnuPG Accepts Path Separators and Path Traversals in Literal Data

++++ libpng16:

  - security update
  - added patches
    CVE-2025-28162 [bsc#1257364], memory leaks when running `pngimage`
    CVE-2025-28164 [bsc#1257365], memory leaks when running `pngimage`
    * libpng16-CVE-2025-28162,28164.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-28162 [bsc#1257364], memory leaks when running `pngimage`
    CVE-2025-28164 [bsc#1257365], memory leaks when running `pngimage`
    * libpng16-CVE-2025-28162,28164.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-28162 [bsc#1257364], memory leaks when running `pngimage`
    CVE-2025-28164 [bsc#1257365], memory leaks when running `pngimage`
    * libpng16-CVE-2025-28162,28164.patch

++++ regionServiceClientConfigGCE:

  - Update to version 5.1.0 (jsc#PCT-590)
    + Add licenses info in the metdata
  - Accomodate build setup

------------------------------------------------------------------
------------------  2026-1-26  -  Jan 26 2026  -------------------
------------------------------------------------------------------

++++ python-urllib3:

  - Add security patches:
    * CVE-2025-66471 (bsc#1254867)
    * CVE-2025-66418 (bsc#1254866)

------------------------------------------------------------------
------------------  2026-1-22  -  Jan 22 2026  -------------------
------------------------------------------------------------------

++++ sqlite3:

  - Update to version 3.51.2:
    * bsc#1259619, CVE-2025-70873: zipfile extension may disclose
    uninitialized heap memory during inflation.
    * Fix an obscure deadlock in the new broken-posix-lock detection
    logic.
    * Fix multiple problems in the EXISTS-to-JOIN optimization.
    * Other minor bug fixes.

++++ libxml2:

  - Add patch libxml2-CVE-2026-0989.patch, to fix call stack exhaustion
    leading to application crash due to RelaxNG parser not limiting the
    recursion depth when resolving `<include>` directives
    CVE-2026-0989, bsc#1256805, https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374

++++ libxml2:

  - CVE-2026-0989: call stack exhaustion leading to application crash
    due to RelaxNG parser not limiting the recursion depth when
    resolving `<include>` directives (bsc#1256804, bsc#1256805, bsc#1256810)
    * Add patch libxml2-CVE-2026-0989.patch
    * https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374

++++ libxml2-python:

  - CVE-2026-0989: call stack exhaustion leading to application crash
    due to RelaxNG parser not limiting the recursion depth when
    resolving `<include>` directives (bsc#1256804, bsc#1256805, bsc#1256810)
    * Add patch libxml2-CVE-2026-0989.patch
    * https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374

++++ suseconnect-ng:

  - Update version to 1.20:
  - Update error message for Public Cloud instances with registercloudguest
    installed. SUSEConnect -d is disabled on PYAG and BYOS when the
    registercloudguest command is available. (bsc#1230861)
  - Enhanced SAP detected. Take TREX into account and remove empty values when
    only /usr/sap but no installation exists (bsc#1241002)
  - Fixed modules and extension link to point to version less documentation. (bsc#1239439)
  - Fixed SAP instance detection (bsc#1244550)
  - Remove link to extensions documentation (bsc#1239439)
  - Migrate to the public library

++++ suseconnect-ng:

  - Update version to 1.20:
  - Update error message for Public Cloud instances with registercloudguest
    installed. SUSEConnect -d is disabled on PYAG and BYOS when the
    registercloudguest command is available. (bsc#1230861)
  - Enhanced SAP detected. Take TREX into account and remove empty values when
    only /usr/sap but no installation exists (bsc#1241002)
  - Fixed modules and extension link to point to version less documentation. (bsc#1239439)
  - Fixed SAP instance detection (bsc#1244550)
  - Remove link to extensions documentation (bsc#1239439)
  - Migrate to the public library

++++ suseconnect-ng:

  - Update version to 1.20:
  - Update error message for Public Cloud instances with registercloudguest
    installed. SUSEConnect -d is disabled on PYAG and BYOS when the
    registercloudguest command is available. (bsc#1230861)
  - Enhanced SAP detected. Take TREX into account and remove empty values when
    only /usr/sap but no installation exists (bsc#1241002)
  - Fixed modules and extension link to point to version less documentation. (bsc#1239439)
  - Fixed SAP instance detection (bsc#1244550)
  - Remove link to extensions documentation (bsc#1239439)
  - Migrate to the public library

------------------------------------------------------------------
------------------  2026-1-21  -  Jan 21 2026  -------------------
------------------------------------------------------------------

++++ cups:

  - Version upgrade to 2.4.16:
    See https://github.com/openprinting/cups/releases
    The hotfix release 2.4.16 includes fix for infinite loop in GTK,
    which was caused by change of internal behavior in libcups
    on which GTK depended on, and workaround for stopping
    the scheduler if configuration includes unknown directives.
    Detailed list (from CHANGES.md):
    * 'cupsUTF8ToCharset' didn't validate 2-byte UTF-8 sequences,
    potentially reading past the end of the source string
    (Issue #1438)
    * The web interface did not support domain usernames fully
    (Issue #1441)
    * Fixed an infinite loop issue in the GTK+ print dialog
    (Issue #1439 boo#1254353)
    * Fixed stopping scheduler on unknown directive in
    configuration (Issue #1443)
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Version upgrade to 2.4.15:
    See https://github.com/openprinting/cups/releases
    The release CUPS 2.4.15 brings two CVE fixes:
    Fix various cupsd issues which cause local DoS
    (CVE-2025-61915 bsc#1253783)
    Fix unresponsive cupsd process caused by slow client
    (CVE-2025-58436 bsc#1244057)
    and several bug fixes described in CHANGES.md.
    Detailed list (from CHANGES.md):
    * Fixed potential crash in 'cups-driverd' when there are
    duplicate PPDs (Issue #1355)
    * Fixed error recovery when scanning for PPDs
    in 'cups-driverd' (Issue #1416)
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.16
  - Fixed entry below dated "Sat Sep 30 08:52:42 UTC 2017"
    which contained needless UTF-8 Unicode characters that are
    now replaced by plain ASCII text in "... line - the ..."
    to fix a rpmlint "non-break-space" warning.
  - Adapted and enhanced 'tmpfiles.d' related things in cups.spec
    to "Fix packages for Immutable Mode - cups"
    (implementation task jsc#PED-14775 from epic jsc#PED-14688)

++++ glib2:

  - Add glib2-CVE-2026-0988.patch: fix a potential integer overflow
    in g_buffered_input_stream_peek (bsc#1257049 CVE-2026-0988
    glgo#GNOME/glib#3851).

------------------------------------------------------------------
------------------  2026-1-19  -  Jan 19 2026  -------------------
------------------------------------------------------------------

++++ glibc:

  - memalign-overflow-check.patch: memalign: reinstate alignment overflow
    check (CVE-2026-0861, bsc#1256766, BZ #33796)
  - nss-dns-getnetbyaddr.patch: resolv: Fix NSS DNS backend for getnetbyaddr
    (CVE-2026-0915, bsc#1256822, BZ #33802)
  - wordexp-wrde-reuse.patch: posix: Reset wordexp_t fields with WRDE_REUSE
    (CVE-2025-15281, bsc#1257005, BZ #33814)

++++ glibc:

  - memalign-overflow-check.patch: memalign: reinstate alignment overflow
    check (CVE-2026-0861, bsc#1256766, BZ #33796)
  - nss-dns-getnetbyaddr.patch: resolv: Fix NSS DNS backend for getnetbyaddr
    (CVE-2026-0915, bsc#1256822, BZ #33802)
  - wordexp-wrde-reuse.patch: posix: Reset wordexp_t fields with WRDE_REUSE
    (CVE-2025-15281, bsc#1257005, BZ #33814)

++++ openssl-3:

  - Security fixes:
    * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
    * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
    * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
    * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
    * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
    * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
    * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
    * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch

++++ openssl-3:

  - Security fixes:
    * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
    * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
    * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
    * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
    * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
    * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
    * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
    * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch

++++ openssl-3:

  - Security fixes:
    * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
    * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
    * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
    * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
    * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
    * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
    * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
    * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch

------------------------------------------------------------------
------------------  2026-1-14  -  Jan 14 2026  -------------------
------------------------------------------------------------------

++++ libsoup:

  - Add libsoup-CVE-2026-0716.patch: Fix out-of-bounds read for
    websocket (bsc#1256418, CVE-2026-0716, glgo#GNOME/libsoup!494).
  - Add libsoup-CVE-2026-0719.patch: Fix overflow for password md4sum
    (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493).

++++ libsoup:

  - Add libsoup-CVE-2026-0716.patch: Fix out-of-bounds read for
    websocket (bsc#1256418, CVE-2026-0716, glgo#GNOME/libsoup!494).
  - Add libsoup-CVE-2026-0719.patch: Fix overflow for password md4sum
    (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493).

++++ libsoup:

  - Add libsoup-CVE-2026-0716.patch: Fix out-of-bounds read for
    websocket (bsc#1256418, CVE-2026-0716, glgo#GNOME/libsoup!494).
  - Add libsoup-CVE-2026-0719.patch: Fix overflow for password md4sum
    (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493).

++++ libsoup:

  - Add libsoup-CVE-2026-0716.patch: Fix out-of-bounds read for
    websocket (bsc#1256418, CVE-2026-0716, glgo#GNOME/libsoup!494).
  - Add libsoup-CVE-2026-0719.patch: Fix overflow for password md4sum
    (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493).

++++ libzypp:

  - Avoid libcurl-mini4 when building as it does not support ftp
    protocol.
  - Translation: updated .pot file.
  - version 17.38.1 (35)

++++ libzypp:

  - Avoid libcurl-mini4 when building as it does not support ftp
    protocol.
  - Translation: updated .pot file.
  - version 17.38.1 (35)

------------------------------------------------------------------
------------------  2026-1-13  -  Jan 13 2026  -------------------
------------------------------------------------------------------

++++ systemd:

  - Name libsystemd-{shared,core} based on the major version of systemd and the
    package release number (bsc#1228081 bsc#1256427)
    This way, both the old and new versions of the shared libraries will be
    present during the update. This should prevent issues during package updates
    when incompatible changes are introduced in the new versions of the shared
    libraries.
  - Import commit 8bbac1d508acb8aa4e7262f47c7f4076b8350f72
    8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)

++++ linuxptp:

  - Move to DevicePolicy=closed instead of -PrivateDevices=true
    to allow access to devices (bsc#1256059)

++++ python-urllib3:

  - Add CVE-2026-21441.patch to fix excessive resource consumption
    during decompression of data in HTTP redirect responses
    (bsc#1256331, CVE-2026-21441)

++++ python-urllib3:

  - Add CVE-2026-21441.patch to fix excessive resource consumption
    during decompression of data in HTTP redirect responses
    (bsc#1256331, CVE-2026-21441)

------------------------------------------------------------------
------------------  2026-1-12  -  Jan 12 2026  -------------------
------------------------------------------------------------------

++++ kernel-firmware:

  - Update AMD ucode to 20251203 (bsc#1256483)

++++ net-snmp:

  - Fix snmptrapd buffer overflow (bsc#1255491, CVE-2025-68615).
    Add net-snmp-5.9.4-fix-out-of-bounds-trapOid-access.patch

------------------------------------------------------------------
------------------  2026-1-11  -  Jan 11 2026  -------------------
------------------------------------------------------------------

++++ util-linux:

  - Fix heap buffer overread in setpwnam() when processing 256-byte
    usernames (bsc#1254666, CVE-2025-14104,
    util-linux-CVE-2025-14104-1.patch,
    util-linux-CVE-2025-14104-2.patch).

++++ util-linux:

  - Fix heap buffer overread in setpwnam() when processing 256-byte
    usernames (bsc#1254666, CVE-2025-14104,
    util-linux-CVE-2025-14104-1.patch,
    util-linux-CVE-2025-14104-2.patch).

++++ util-linux:

  - Fix heap buffer overread in setpwnam() when processing 256-byte
    usernames (bsc#1254666, CVE-2025-14104,
    util-linux-CVE-2025-14104-1.patch,
    util-linux-CVE-2025-14104-2.patch).

++++ libzypp:

  - zypp.conf: follow the UAPI configuration file specification
    (PED-14658)
    In short terms it means we will no longer ship an
    /etc/zypp/zypp.conf, but store our own defaults in
    /usr/etc/zypp/zypp.conf. The systems administrator may choose to
    keep a full copy in /etc/zypp/zypp.conf ignoring our config file
    settings completely, or - the preferred way - to overwrite
    specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files.
    See the ZYPP.CONF(5) man page for details.
  - cmake: correctly detect rpm6 (fixes #689)
  - Use 'zypp.tmp' as temp directory component to ease setting up
    SELinux policies (bsc#1249435)
  - zyppng: Update Provider to current MediaCurl2 download
    approach, drop Metalink ( fixes #682 )
  - version 17.38.0 (35)

++++ libzypp:

  - zypp.conf: follow the UAPI configuration file specification
    (PED-14658)
    In short terms it means we will no longer ship an
    /etc/zypp/zypp.conf, but store our own defaults in
    /usr/etc/zypp/zypp.conf. The systems administrator may choose to
    keep a full copy in /etc/zypp/zypp.conf ignoring our config file
    settings completely, or - the preferred way - to overwrite
    specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files.
    See the ZYPP.CONF(5) man page for details.
  - cmake: correctly detect rpm6 (fixes #689)
  - Use 'zypp.tmp' as temp directory component to ease setting up
    SELinux policies (bsc#1249435)
  - zyppng: Update Provider to current MediaCurl2 download
    approach, drop Metalink ( fixes #682 )
  - version 17.38.0 (35)

++++ util-linux-systemd:

  - Fix heap buffer overread in setpwnam() when processing 256-byte
    usernames (bsc#1254666, CVE-2025-14104,
    util-linux-CVE-2025-14104-1.patch,
    util-linux-CVE-2025-14104-2.patch).

++++ util-linux-systemd:

  - Fix heap buffer overread in setpwnam() when processing 256-byte
    usernames (bsc#1254666, CVE-2025-14104,
    util-linux-CVE-2025-14104-1.patch,
    util-linux-CVE-2025-14104-2.patch).

++++ util-linux-systemd:

  - Fix heap buffer overread in setpwnam() when processing 256-byte
    usernames (bsc#1254666, CVE-2025-14104,
    util-linux-CVE-2025-14104-1.patch,
    util-linux-CVE-2025-14104-2.patch).

------------------------------------------------------------------
------------------  2026-1-9  -  Jan 9 2026  -------------------
------------------------------------------------------------------

++++ libsoup:

  - Add libsoup-CVE-2025-14523.patch: Reject duplicated Host in
    headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).

++++ libsoup:

  - Add libsoup-CVE-2025-14523.patch: Reject duplicated Host in
    headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).

++++ libsoup:

  - Add libsoup-CVE-2025-14523.patch: Reject duplicated Host in
    headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).

++++ libsoup:

  - Add libsoup-CVE-2025-14523.patch: Reject duplicated Host in
    headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).

++++ libsoup:

  - Add libsoup-CVE-2025-14523.patch: Reject duplicated Host in
    headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).

++++ libtasn1:

  - Security fix: [bsc#1256341, CVE-2025-13151]
    * Stack-based buffer overflow. The function asn1_expend_octet_string()
    fails to validate the size of input data resulting in a buffer overflow.
    * Add libtasn1-CVE-2025-13151.patch

------------------------------------------------------------------
------------------  2026-1-8  -  Jan 8 2026  -------------------
------------------------------------------------------------------

++++ gpg2:

  - Security fix: [bsc#1255715, CVE-2025-68973] (gpg.fail/memcpy)
    * gpg: Fix possible memory corruption in the armor parser [T7906]
    * Add gnupg-CVE-2025-68973.patch
  - Security fix: [bsc#1256246] (gpg.fail/sha1)
    * gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures [T7904]
    * Add gnupg-gpg-Avoid-potential-downgrade-to-SHA1-in-3rd-party-keysig.patch
  - Security fix: [bsc#1256244] (gpg.fail/detached)
    * gpg: Error out on unverified output for non-detached signatures [T7903]
    * Add gnupg-gpg-Error-out-on-unverified-output-for-non-detached-signatures.patch
  - Security fix: [bsc#1256243]
    * gpg2 agent: Fix a memory leak
    * Add patch gnupg-agent-memleak.patch
  - Security fix: [bsc#1256390] (gpg.fail/notdash)
    * gpg2:  Cleartext Signature Forgery in the NotDashEscaped header
    implementation in GnuPG
    * Add patch gnupg-CVE-2025-68972.patch

++++ gpg2:

  - Security fix: [bsc#1255715, CVE-2025-68973] (gpg.fail/memcpy)
    * gpg: Fix possible memory corruption in the armor parser [T7906]
    * Add gnupg-CVE-2025-68973.patch
  - Security fix: [bsc#1256246] (gpg.fail/sha1)
    * gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures [T7904]
    * Add gnupg-gpg-Avoid-potential-downgrade-to-SHA1-in-3rd-party-keysig.patch
  - Security fix: [bsc#1256244] (gpg.fail/detached)
    * gpg: Error out on unverified output for non-detached signatures [T7903]
    * Add gnupg-gpg-Error-out-on-unverified-output-for-non-detached-signatures.patch
  - Security fix: [bsc#1256243]
    * gpg2 agent: Fix a memory leak
    * Add patch gnupg-agent-memleak.patch
  - Security fix: [bsc#1256390] (gpg.fail/notdash)
    * gpg2:  Cleartext Signature Forgery in the NotDashEscaped header
    implementation in GnuPG
    * Add patch gnupg-CVE-2025-68972.patch

++++ gpg2:

  - Security fix: [bsc#1255715, CVE-2025-68973] (gpg.fail/memcpy)
    * gpg: Fix possible memory corruption in the armor parser [T7906]
    * Add gnupg-CVE-2025-68973.patch
  - Security fix: [bsc#1256246] (gpg.fail/sha1)
    * gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures [T7904]
    * Add gnupg-gpg-Avoid-potential-downgrade-to-SHA1-in-3rd-party-keysig.patch
  - Security fix: [bsc#1256244] (gpg.fail/detached)
    * gpg: Error out on unverified output for non-detached signatures [T7903]
    * Add gnupg-gpg-Error-out-on-unverified-output-for-non-detached-signatures.patch
  - Security fix: [bsc#1256243]
    * gpg2 agent: Fix a memory leak
    * Add patch gnupg-agent-memleak.patch
  - Security fix: [bsc#1256390] (gpg.fail/notdash)
    * gpg2:  Cleartext Signature Forgery in the NotDashEscaped header
    implementation in GnuPG
    * Add patch gnupg-CVE-2025-68972.patch

++++ libsodium:

  - Security fix: [bsc#1256070, CVE-2025-15444]
    * check Y==Z in addition to X==0
    * Add patch libsodium-CVE-2025-15444.patch
  - Security fix: [bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277]
    * check Y==Z in addition to X==0
    * Add patch libsodium-CVE-2025-15444.patch

------------------------------------------------------------------
------------------  2026-1-7  -  Jan 7 2026  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fix: [bsc#1256105, CVE-2025-14017]
    * call ldap_init() before setting the options
    * Add patch curl-CVE-2025-14017.patch

++++ curl:

  - Security fix: [bsc#1256105, CVE-2025-14017]
    * call ldap_init() before setting the options
    * Add patch curl-CVE-2025-14017.patch

++++ curl:

  - Security fix: [bsc#1256105, CVE-2025-14017]
    * call ldap_init() before setting the options
    * Add patch curl-CVE-2025-14017.patch

++++ ovmf:

  - Add backported patches for bsc#1218680 (CVE-2022-36765)
  - ovmf-UefiPayloadPkg-Hob-Integer-Overflow-in-CreateHob.patch
    59f024c76ee5 UefiPayloadPkg/Hob: Integer Overflow in CreateHob()
  - ovmf-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch
    aeaee8944f0e EmbeddedPkg/Hob: Integer Overflow in CreateHob()
  - ovmf-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch
    9a75b030cf27 StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
    (bsc#1218680, CVE-2022-36765)

++++ rust-keylime:

  - Use tmpfiles.d for /var directories (PED-14736)
    + tmpfiles.keylime renamed to rust-keylime.conf and extended
  - Update to version 0.2.8+96:
    * build(deps): bump wiremock from 0.6.4 to 0.6.5
    * build(deps): bump actions/checkout from 5 to 6
    * build(deps): bump chrono from 0.4.41 to 0.4.42
    * packit: Get coverage from Fedora 43 runs
    * Fix issues pointed out by clippy
    * Replace mutex unwraps with proper error handling in TPM library
    * Remove unused session request methods from StructureFiller
    * Fix config panic on missing ek_handle in push model agent
    * build(deps): bump tempfile from 3.21.0 to 3.23.0
    * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
    * Fix clippy warnings project-wide
    * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
    * Thread privileged resources and use MeasurementList for IMA reading
    * Add privileged resource initialization and privilege dropping to push model agent
    * Fix privilege dropping order in run_as()
    * add documentation on FQDN hostnames
    * Remove confusing logs for push mode agent
    * Set correct default Verifier port (8891->8881) (#1159)
    * Add verifier_url to reference configuration file (#1158)
    * Add TLS support for Registrar communication (#1139)
    * Fix agent handling of 403 registration responses (#1154)
    * Add minor README.md rephrasing (#1151)
    * build(deps): bump actions/checkout from 5 to 6 (#1153)
    * ci: update spec files for packit COPR build
    * docs: improve challenge encoding and async TPM documentation
    * refactor: improve middleware and error handling
    * feat: add authentication client with middleware integration
    * docker: Include keylime_push_model_agent binary
    * Include attestation_interval configuration (#1146)
    * Persist payload keys to avoid attestation failure on restart
    * crypto: Implement the load or generate pattern for keys
    * Use simple algorithm specifiers in certification_keys object (#1140)
    * tests: Enable more tests in CI
    * Fix RSA2048 algorithm reporting in keylime agent
    * Remove disabled_signing_algorithms configuration
    * rpm: Fix metadata patches to apply to current code
    * workflows/rpm.yml: Use more strict patching
    * build(deps): bump uuid from 1.17.0 to 1.18.1
    * Fix ECC algorithm selection and reporting for keylime agent
    * Improve logging consistency and coherency
    * Implement minimal RFC compliance for Location header and URI parsing (#1125)
    * Use separate keys for payload mechanism and mTLS
    * docker: update rust to 1.81 for distroless Dockerfile
    * Ensure UEFI log capabilities are set to false
    * build(deps): bump http from 1.1.0 to 1.3.1
    * build(deps): bump log from 0.4.27 to 0.4.28
    * build(deps): bump cfg-if from 1.0.1 to 1.0.3
    * build(deps): bump actix-rt from 2.10.0 to 2.11.0
    * build(deps): bump async-trait from 0.1.88 to 0.1.89
    * build(deps): bump trybuild from 1.0.105 to 1.0.110
    * Accept evidence handling structures null entries
    * workflows: Add test to check if RPM patches still apply
    * CI: Enable test add-agent-with-malformed-ek-cert
    * config: Fix singleton tests
    * FSM: Remove needless lifetime annotations (#1105)
    * rpm: Do not remove wiremock which is now available in Fedora
    * Use latest Fedora httpdate version (1.0.3)
    * Enhance coverage with parse_retry_after test
    * Fix issues reported by CI regarding unwrap() calls
    * Reuse max retries indicated to the ResilientClient
    * Include limit of retries to 5 for Retry-After
    * Add policy to handle Retry-After response headers
    * build(deps): bump wiremock from 0.6.3 to 0.6.4
    * build(deps): bump serde_json from 1.0.140 to 1.0.143
    * build(deps): bump pest_derive from 2.8.0 to 2.8.1
    * build(deps): bump syn from 2.0.90 to 2.0.106
    * build(deps): bump tempfile from 3.20.0 to 3.21.0
    * build(deps): bump thiserror from 2.0.12 to 2.0.16
    * rpm: Fix patches to apply to current master code
    * build(deps): bump anyhow from 1.0.98 to 1.0.99
    * state_machine: Automatically clean config override during tests
    * config: Implement singleton and factory pattern
    * testing: Support overriding configuration during tests
    * feat: implement standalone challenge-response authentication module
    * structures: rename session structs for clarity and fix typos
    * tpm: refactor certify_credential_with_iak() into a more generic function
    * Add Push Model Agent Mermaid FSM chart (#1095)
    * Add state to avoid exiting on wrong attestation (#1093)
    * Add 6 alphanumeric lowercase X-Request-ID header
    * Enhance Evidence Handling response parsing
    * build(deps): bump quote from 1.0.35 to 1.0.40
    * build(deps): bump libc from 0.2.172 to 0.2.175
    * build(deps): bump glob from 0.3.2 to 0.3.3
    * build(deps): bump actix-web from 4.10.2 to 4.11.0

++++ rust-keylime:

  - Use tmpfiles.d for /var directories (PED-14736)
    + tmpfiles.keylime renamed to rust-keylime.conf and extended
  - Update to version 0.2.8+96:
    * build(deps): bump wiremock from 0.6.4 to 0.6.5
    * build(deps): bump actions/checkout from 5 to 6
    * build(deps): bump chrono from 0.4.41 to 0.4.42
    * packit: Get coverage from Fedora 43 runs
    * Fix issues pointed out by clippy
    * Replace mutex unwraps with proper error handling in TPM library
    * Remove unused session request methods from StructureFiller
    * Fix config panic on missing ek_handle in push model agent
    * build(deps): bump tempfile from 3.21.0 to 3.23.0
    * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
    * Fix clippy warnings project-wide
    * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
    * Thread privileged resources and use MeasurementList for IMA reading
    * Add privileged resource initialization and privilege dropping to push model agent
    * Fix privilege dropping order in run_as()
    * add documentation on FQDN hostnames
    * Remove confusing logs for push mode agent
    * Set correct default Verifier port (8891->8881) (#1159)
    * Add verifier_url to reference configuration file (#1158)
    * Add TLS support for Registrar communication (#1139)
    * Fix agent handling of 403 registration responses (#1154)
    * Add minor README.md rephrasing (#1151)
    * build(deps): bump actions/checkout from 5 to 6 (#1153)
    * ci: update spec files for packit COPR build
    * docs: improve challenge encoding and async TPM documentation
    * refactor: improve middleware and error handling
    * feat: add authentication client with middleware integration
    * docker: Include keylime_push_model_agent binary
    * Include attestation_interval configuration (#1146)
    * Persist payload keys to avoid attestation failure on restart
    * crypto: Implement the load or generate pattern for keys
    * Use simple algorithm specifiers in certification_keys object (#1140)
    * tests: Enable more tests in CI
    * Fix RSA2048 algorithm reporting in keylime agent
    * Remove disabled_signing_algorithms configuration
    * rpm: Fix metadata patches to apply to current code
    * workflows/rpm.yml: Use more strict patching
    * build(deps): bump uuid from 1.17.0 to 1.18.1
    * Fix ECC algorithm selection and reporting for keylime agent
    * Improve logging consistency and coherency
    * Implement minimal RFC compliance for Location header and URI parsing (#1125)
    * Use separate keys for payload mechanism and mTLS
    * docker: update rust to 1.81 for distroless Dockerfile
    * Ensure UEFI log capabilities are set to false
    * build(deps): bump http from 1.1.0 to 1.3.1
    * build(deps): bump log from 0.4.27 to 0.4.28
    * build(deps): bump cfg-if from 1.0.1 to 1.0.3
    * build(deps): bump actix-rt from 2.10.0 to 2.11.0
    * build(deps): bump async-trait from 0.1.88 to 0.1.89
    * build(deps): bump trybuild from 1.0.105 to 1.0.110
    * Accept evidence handling structures null entries
    * workflows: Add test to check if RPM patches still apply
    * CI: Enable test add-agent-with-malformed-ek-cert
    * config: Fix singleton tests
    * FSM: Remove needless lifetime annotations (#1105)
    * rpm: Do not remove wiremock which is now available in Fedora
    * Use latest Fedora httpdate version (1.0.3)
    * Enhance coverage with parse_retry_after test
    * Fix issues reported by CI regarding unwrap() calls
    * Reuse max retries indicated to the ResilientClient
    * Include limit of retries to 5 for Retry-After
    * Add policy to handle Retry-After response headers
    * build(deps): bump wiremock from 0.6.3 to 0.6.4
    * build(deps): bump serde_json from 1.0.140 to 1.0.143
    * build(deps): bump pest_derive from 2.8.0 to 2.8.1
    * build(deps): bump syn from 2.0.90 to 2.0.106
    * build(deps): bump tempfile from 3.20.0 to 3.21.0
    * build(deps): bump thiserror from 2.0.12 to 2.0.16
    * rpm: Fix patches to apply to current master code
    * build(deps): bump anyhow from 1.0.98 to 1.0.99
    * state_machine: Automatically clean config override during tests
    * config: Implement singleton and factory pattern
    * testing: Support overriding configuration during tests
    * feat: implement standalone challenge-response authentication module
    * structures: rename session structs for clarity and fix typos
    * tpm: refactor certify_credential_with_iak() into a more generic function
    * Add Push Model Agent Mermaid FSM chart (#1095)
    * Add state to avoid exiting on wrong attestation (#1093)
    * Add 6 alphanumeric lowercase X-Request-ID header
    * Enhance Evidence Handling response parsing
    * build(deps): bump quote from 1.0.35 to 1.0.40
    * build(deps): bump libc from 0.2.172 to 0.2.175
    * build(deps): bump glob from 0.3.2 to 0.3.3
    * build(deps): bump actix-web from 4.10.2 to 4.11.0

++++ selinux-policy:

  - Update to version 20230523+git34.7b0eea050:
    * rsync: add rsync_exec_commands boolean and enable it by default (bsc#1231494, bsc#1255372)

------------------------------------------------------------------
------------------  2026-1-6  -  Jan 6 2026  -------------------
------------------------------------------------------------------

++++ bluez:

  - Add input.conf-Change-default-of-ClassicBondedOnly.patch
    to change default of ClassicBondedOnly in input.conf.
    25a471a83e02 input.conf: Change default of ClassicBondedOnly
    (bsc#1217877, CVE-2023-45866)
  - Fixed the date in bluez.changes:
  - Mon Sep2y 09:36:31 CEST 2008 - seife@suse.de
    +Mon Sep 29 09:36:31 CEST 2008 - seife@suse.de

------------------------------------------------------------------
------------------  2026-1-5  -  Jan 5 2026  -------------------
------------------------------------------------------------------

++++ libpcap:

  - Security fix: [bsc#1255765, CVE-2025-11961]
    * Fix out-of-bound-write and out-of-bound-read in pcap_ether_aton()
    due to missing validation of provided MAC-48 address string
    * Add libpcap-CVE-2025-11961.patch

------------------------------------------------------------------
------------------  2026-1-2  -  Jan 2 2026  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fixes:
    * [bsc#1255731, CVE-2025-14524] if redirected, require permission to use bearer
    * [bsc#1255734, CVE-2025-15224] require private key or user-agent for public key auth
    * [bsc#1255732, CVE-2025-14819] toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache
    * [bsc#1255733, CVE-2025-15079] set both knownhosts options to the same file
    * Add patches:
  - curl-CVE-2025-14524.patch
  - curl-CVE-2025-15224.patch
  - curl-CVE-2025-14819.patch
  - curl-CVE-2025-15079.patch

++++ curl:

  - Security fixes:
    * [bsc#1255731, CVE-2025-14524] if redirected, require permission to use bearer
    * [bsc#1255734, CVE-2025-15224] require private key or user-agent for public key auth
    * [bsc#1255732, CVE-2025-14819] toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache
    * [bsc#1255733, CVE-2025-15079] set both knownhosts options to the same file
    * Add patches:
  - curl-CVE-2025-14524.patch
  - curl-CVE-2025-15224.patch
  - curl-CVE-2025-14819.patch
  - curl-CVE-2025-15079.patch

++++ curl:

  - Security fixes:
    * [bsc#1255731, CVE-2025-14524] if redirected, require permission to use bearer
    * [bsc#1255734, CVE-2025-15224] require private key or user-agent for public key auth
    * [bsc#1255732, CVE-2025-14819] toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache
    * [bsc#1255733, CVE-2025-15079] set both knownhosts options to the same file
    * Add patches:
  - curl-CVE-2025-14524.patch
  - curl-CVE-2025-15224.patch
  - curl-CVE-2025-14819.patch
  - curl-CVE-2025-15079.patch

++++ curl:

  - Security fixes:
    * [bsc#1255731, CVE-2025-14524] if redirected, require permission to use bearer
    * [bsc#1255734, CVE-2025-15224] require private key or user-agent for public key auth
    * [bsc#1255732, CVE-2025-14819] toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache
    * [bsc#1255733, CVE-2025-15079] set both knownhosts options to the same file
    * Add patches:
  - curl-CVE-2025-14524.patch
  - curl-CVE-2025-15224.patch
  - curl-CVE-2025-14819.patch
  - curl-CVE-2025-15079.patch

------------------------------------------------------------------
------------------  2025-12-24  -  Dec 24 2025  -------------------
------------------------------------------------------------------

++++ ovmf:

  - Add the following patches from edk2-stable202402 for CVE-2023-45230:
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
    f31453e8d654 NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
  - ovmf-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
    8014ac2d7bbb NetworkPkg: : Add Unit tests to CI and create Host Test DSC
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
    5f3658197bf2 NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Unit Tests
    (bsc#1218880, CVE-2023-45230)
  - Add the following patches from edk2-stable202402 for CVE-2023-45229:
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
    1dbb10cc52dc NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch
    07362769ab7a NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Unit Tests
  - ovmf-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
    1d0b95f6457d NetworkPkg: : Adds a SecurityFix.yaml file
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch
    1c440a5eceed NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Related Patch
  - ovmf-NetworkPkg-Updating-SecurityFixes.yaml.patch
    5fd3078a2e08 NetworkPkg: Updating SecurityFixes.yaml
    (bsc#1218879, CVE-2023-45229)

++++ ovmf:

  - Add the following patches from edk2-stable202402 for CVE-2023-45230:
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
    f31453e8d654 NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
  - ovmf-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
    8014ac2d7bbb NetworkPkg: : Add Unit tests to CI and create Host Test DSC
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
    5f3658197bf2 NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Unit Tests
    (bsc#1218880, CVE-2023-45230)
  - Add the following patches from edk2-stable202402 for CVE-2023-45229:
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
    1dbb10cc52dc NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch
    07362769ab7a NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Unit Tests
  - ovmf-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
    1d0b95f6457d NetworkPkg: : Adds a SecurityFix.yaml file
  - ovmf-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch
    1c440a5eceed NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Related Patch
  - ovmf-NetworkPkg-Updating-SecurityFixes.yaml.patch
    5fd3078a2e08 NetworkPkg: Updating SecurityFixes.yaml
    (bsc#1218879, CVE-2023-45229)

------------------------------------------------------------------
------------------  2025-12-23  -  Dec 23 2025  -------------------
------------------------------------------------------------------

++++ capstone:

  - fix bsc#1255309 (CVE-2025-67873)
    Patch added:
    * fix-unchecked-lenght-cbef76.patch

------------------------------------------------------------------
------------------  2025-12-22  -  Dec 22 2025  -------------------
------------------------------------------------------------------

++++ qemu:

  - More spec file cleanup:
    * [openSUSE][RPM} spec: delete old specfile constructs

++++ qemu:

  - More spec file cleanup:
    * [openSUSE][RPM} spec: delete old specfile constructs

------------------------------------------------------------------
------------------  2025-12-19  -  Dec 19 2025  -------------------
------------------------------------------------------------------

++++ capstone:

  - Fix bsc#1255310 (CVE-2025-68114)
    Patch added:
    * fix-buffer-overflow-2c7797.patch

++++ podman:

  - Add patch for CVE-2025-47914 (bsc#1253993), CVE-2025-47913 (bsc#1253542):
    * 0012-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch
    * 0010-vendor-buildah-Don-t-set-ambient-capabilities.patch
    * 0011-CVE-2025-52881-backport-subset-of-patch-from-runc.patch

++++ podman:

  - Add patch for CVE-2025-47914 (bsc#1253993), CVE-2025-47913 (bsc#1253542):
    * 0012-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch
    * 0010-vendor-buildah-Don-t-set-ambient-capabilities.patch
    * 0011-CVE-2025-52881-backport-subset-of-patch-from-runc.patch

------------------------------------------------------------------
------------------  2025-12-18  -  Dec 18 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311-core:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311-core:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311-core:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311-core:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ python311:

  - Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
    CVE-2025-13836) to prevent reading an HTTP response from
    a server, if no read amount is specified, with using
    Content-Length per default as the length.
  - Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
    behavior in node ID cache clearing (CVE-2025-12084,
    bsc#1254997).
  - Add CVE-2025-13837-plistlib-mailicious-length.patch protect
    against OOM when loading malicious content (CVE-2025-13837,
    bsc#1254401).

++++ qemu:

  - We *always* want a display driver in x86 too:
    * [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too

++++ qemu:

  - We *always* want a display driver in x86 too:
    * [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too

------------------------------------------------------------------
------------------  2025-12-17  -  Dec 17 2025  -------------------
------------------------------------------------------------------

++++ selinux-policy:

  - Fix systemd generator.early and generator.late file contexts (bsc#1255027)

++++ selinux-policy:

  - Fix systemd generator.early and generator.late file contexts (bsc#1255027)

------------------------------------------------------------------
------------------  2025-12-16  -  Dec 16 2025  -------------------
------------------------------------------------------------------

++++ libvirt:

  - CVE-2025-13193: qemu: Set umask for 'qemu-img' when creating
    external inactive snapshots
    bsc#1253703
  - CVE-2025-12748: Check ACLs before parsing the whole domain XML
    bsc#1253278

++++ qemu:

  - Bug and CVE fixes:
    * [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286)
    * net: pad packets to minimum length in qemu_receive_packet() (bsc#1253002, CVE-2025-12464)

++++ qemu:

  - Bug and CVE fixes:
    * [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286)
    * net: pad packets to minimum length in qemu_receive_packet() (bsc#1253002, CVE-2025-12464)

++++ rsync:

  - Security update (CVE-2025-10158, bsc#1254441): rsync: Out of
    bounds array access via negative index
  - Add rsync-CVE-2025-10158.patch

++++ shim:

  - shim-install: Add ca_string for SL Micro to update fallback loader
    The fallback loader, /boot/efi/EFI/BOOT/bootaa64.efi or bootx64.efi,
    cannot be upgraded by shim-install on SL Micro. The issue case is
    SL Micro 6.0. It causes that system gets regression bug because it's
    fallback to a old shim. So this patch adds ca_string to SL Micro.
    (bsc#1254336)

------------------------------------------------------------------
------------------  2025-12-15  -  Dec 15 2025  -------------------
------------------------------------------------------------------

++++ glib2:

  - Add CVE fixes:
    + glib2-CVE-2025-13601-1.patch, glib2-CVE-2025-13601-2.patch
    (bsc#1254297 CVE-2025-13601 glgo#GNOME/glib#3827).
    + glib2-CVE-2025-14087-1.patch, glib2-CVE-2025-14087-2.patch,
    glib2-CVE-2025-14087-3.patch (bsc#1254662 CVE-2025-14087
    glgo#GNOME/glib#3834).
    + glib2-CVE-2025-14512.patch (bsc#1254878 CVE-2025-14512
    glgo#GNOME/glib#3845).

++++ glib2:

  - Add CVE fixes:
    + glib2-CVE-2025-13601-1.patch, glib2-CVE-2025-13601-2.patch
    (bsc#1254297 CVE-2025-13601 glgo#GNOME/glib#3827).
    + glib2-CVE-2025-14087-1.patch, glib2-CVE-2025-14087-2.patch,
    glib2-CVE-2025-14087-3.patch (bsc#1254662 CVE-2025-14087
    glgo#GNOME/glib#3834).
    + glib2-CVE-2025-14512.patch (bsc#1254878 CVE-2025-14512
    glgo#GNOME/glib#3845).

++++ systemd:

  - Import commit 9ecd16228492f44212e2771bec11ec78245b4094
    9ecd162284 timer: rebase last_trigger timestamp if needed
    cd4a9103ef timer: rebase the next elapse timestamp only if timer didn't already run
    c3f4407e97 timer: don't run service immediately after restart of a timer (bsc#1254563)
    05bcfe3295 test: check the next elapse timer timestamp after deserialization
    fe8f656975 test: restarting elapsed timer shouldn't trigger the corresponding service
    e4dd315b6c units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
    b58e72215a units: add dep on systemd-logind.service by user@.service
    97ceca445c detect-virt: add bare-metal support for GCE (bsc#1244449
  - Sync systemd-update-helper with the version shipped in Base:System
    This includes the following changes:
  - systemd-update-helper: do not stop or disable services when they are migrated
    to other packages. This can occur during package renaming or splitting.
  - systemd-update-helper: Fix invalid use of "break" in case statement
  - systemd-update-helper: fix regression introduced when support for package
    renaming/splitting was added (bsc#1245551)
  - systemd-update-helper: backport commit 2d0af8bc354f4a1429ce
    Since user@.service has `Type=notify-reload` (making the reloading process
    synchronous) and reloading implies reexecuting with `ReloadSignal=RTMIN+25`,
    reexecuting user managers synchronously can be achieved with `systemctl reload
    user@*.service" now.

++++ systemd:

  - Import commit 9ecd16228492f44212e2771bec11ec78245b4094
    9ecd162284 timer: rebase last_trigger timestamp if needed
    cd4a9103ef timer: rebase the next elapse timestamp only if timer didn't already run
    c3f4407e97 timer: don't run service immediately after restart of a timer (bsc#1254563)
    05bcfe3295 test: check the next elapse timer timestamp after deserialization
    fe8f656975 test: restarting elapsed timer shouldn't trigger the corresponding service
    e4dd315b6c units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
    b58e72215a units: add dep on systemd-logind.service by user@.service
    97ceca445c detect-virt: add bare-metal support for GCE (bsc#1244449
  - Sync systemd-update-helper with the version shipped in Base:System
    This includes the following changes:
  - systemd-update-helper: do not stop or disable services when they are migrated
    to other packages. This can occur during package renaming or splitting.
  - systemd-update-helper: Fix invalid use of "break" in case statement
  - systemd-update-helper: fix regression introduced when support for package
    renaming/splitting was added (bsc#1245551)
  - systemd-update-helper: backport commit 2d0af8bc354f4a1429ce
    Since user@.service has `Type=notify-reload` (making the reloading process
    synchronous) and reloading implies reexecuting with `ReloadSignal=RTMIN+25`,
    reexecuting user managers synchronously can be achieved with `systemctl reload
    user@*.service" now.

++++ python-tornado6:

  - Add security patches:
    * CVE-2025-67724.patch (bsc#1254903)
    * CVE-2025-67725.patch (bsc#1254905)
    * CVE-2025-67726.patch (bsc#1254904)

++++ python-tornado6:

  - Add security patches:
    * CVE-2025-67724.patch (bsc#1254903)
    * CVE-2025-67725.patch (bsc#1254905)
    * CVE-2025-67726.patch (bsc#1254904)

++++ shim:

  - Add DER format certificate files for the pretrans script to verify
    that the necessary certificate is in the UEFI db
  - openSUSE Secure Boot CA, 2013-2035
    openSUSE_Secure_Boot_CA_2013.crt
  - SUSE Linux Enterprise Secure Boot CA, 2013-2035
    SUSE_Linux_Enterprise_Secure_Boot_CA_2013.crt
  - Microsoft Corporation UEFI CA 2011, 2011-2026
    Microsoft_Corporation_UEFI_CA_2011.crt
  - Microsoft UEFI CA 2023, 2023-2038
    Microsoft_UEFI_CA_2023.crt
  - shim.spec: Add a pretrans script to verify that the necessary certificate
    is in the UEFI db.
  - Always put SUSE Linux Enterprise Secure Boot CA to target array.
    (bsc#1254679)

------------------------------------------------------------------
------------------  2025-12-12  -  Dec 12 2025  -------------------
------------------------------------------------------------------

++++ shim:

  - Update to 16.1
  - RPMs
    shim-16.1-150300.4.31.1.x86_64.rpm
    shim-debuginfo-16.1-150300.4.31.1.x86_64.rpm
    shim-debugsource-16.1-150300.4.31.1.x86_64.rpm
    shim-16.1-150300.4.31.1.aarch64.rpm
    shim-debuginfo-16.1-150300.4.31.1.aarch64.rpm
    shim-debugsource-16.1-150300.4.31.1.aarch64.rpm
  - submitreq: https://build.suse.de/request/show/395247
  - repo: https://build.suse.de/package/show/SUSE:Maintenance:39913/shim.SUSE_SLE-15-SP3_Update
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch (bsc#1205588)
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]
  - Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n (bsc#1205588)
  - Building with the latest version of gcc in the codebase:
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    (bsc#1247432)
  - SLE shim should includes vendor-dbx-sles.esl instead of
    vendor-dbx-opensuse.esl. Fixed it in shim.spec.

++++ supportutils:

  - Changes to version 3.2.12
    + Optimized lsof usage and honors OPTION_OFILES (bsc#1232351, PR#274)
    + Run in containers without errors (bsc#1245667, PR#272)
    + Removed pmap PID from memory.txt (bsc#1246011, PR#263)
    + Added missing /proc/pagetypeinfo to memory.txt (bsc#1246025, PR#264)
    + Improved database perforce with kGraft patching (bsc#1249657, PR#273)
    + Using last boot for journalctl for optimization (bsc#1250224, PR#287)
    + Fixed extraction failures (bsc#1252318, PR#275)
    + Update supportconfig.conf path in docs (bsc#1254425, PR#281)
    + drm_sub_info: Catch error when dir doesn't exist (PR#265)
    + Replace remaining `egrep` with `grep -E` (PR#261, PR#266)
    + Add process affinity to slert logs (PR#269)
    + Reintroduce cgroup statistics (and v2) (PR#270)
    + Minor changes to basic-health-check: improve information level (PR#271)
    + Collect important machine health counters (PR#276)
    + powerpc: collect hot-pluggable PCI and PHB slots (PR#278)
    + podman: collect podman disk usage (PR#279)
    + Exclude binary files in crondir (PR#282)
    + kexec/kdump: collect everything under /sys/kernel/kexec dir (PR#284)
    + Use short-iso for journalctl (PR#288)

------------------------------------------------------------------
------------------  2025-12-5  -  Dec 5 2025  -------------------
------------------------------------------------------------------

++++ libpng16:

  - security update
  - added patches
    CVE-2025-66293 [bsc#1254480], LIBPNG out-of-bounds read in png_image_read_composite
    * libpng16-CVE-2025-66293-1.patch
    * libpng16-CVE-2025-66293-2.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-66293 [bsc#1254480], LIBPNG out-of-bounds read in png_image_read_composite
    * libpng16-CVE-2025-66293-1.patch
    * libpng16-CVE-2025-66293-2.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-66293 [bsc#1254480], LIBPNG out-of-bounds read in png_image_read_composite
    * libpng16-CVE-2025-66293-1.patch
    * libpng16-CVE-2025-66293-2.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-66293 [bsc#1254480], LIBPNG out-of-bounds read in png_image_read_composite
    * libpng16-CVE-2025-66293-1.patch
    * libpng16-CVE-2025-66293-2.patch

------------------------------------------------------------------
------------------  2025-11-28  -  Nov 28 2025  -------------------
------------------------------------------------------------------

++++ libpng16:

  - security update
  - added patches
    CVE-2025-64505 [bsc#1254157], heap buffer over-read in `png_do_quantize` via malformed palette index
    * libpng16-CVE-2025-64505.patch
    CVE-2025-64506 [bsc#1254158], heap buffer over-read in `png_write_image_8bit` with 8-bit input and `convert_to_8bit` enabled
    * libpng16-CVE-2025-64506.patch
    CVE-2025-64720 [bsc#1254159], buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
    * libpng16-CVE-2025-64720.patch
    CVE-2025-65018 [bsc#1254160], heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
    * libpng16-CVE-2025-65018.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-64505 [bsc#1254157], heap buffer over-read in `png_do_quantize` via malformed palette index
    * libpng16-CVE-2025-64505.patch
    CVE-2025-64506 [bsc#1254158], heap buffer over-read in `png_write_image_8bit` with 8-bit input and `convert_to_8bit` enabled
    * libpng16-CVE-2025-64506.patch
    CVE-2025-64720 [bsc#1254159], buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
    * libpng16-CVE-2025-64720.patch
    CVE-2025-65018 [bsc#1254160], heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
    * libpng16-CVE-2025-65018.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-64505 [bsc#1254157], heap buffer over-read in `png_do_quantize` via malformed palette index
    * libpng16-CVE-2025-64505.patch
    CVE-2025-64506 [bsc#1254158], heap buffer over-read in `png_write_image_8bit` with 8-bit input and `convert_to_8bit` enabled
    * libpng16-CVE-2025-64506.patch
    CVE-2025-64720 [bsc#1254159], buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
    * libpng16-CVE-2025-64720.patch
    CVE-2025-65018 [bsc#1254160], heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
    * libpng16-CVE-2025-65018.patch

++++ libpng16:

  - security update
  - added patches
    CVE-2025-64505 [bsc#1254157], heap buffer over-read in `png_do_quantize` via malformed palette index
    * libpng16-CVE-2025-64505.patch
    CVE-2025-64506 [bsc#1254158], heap buffer over-read in `png_write_image_8bit` with 8-bit input and `convert_to_8bit` enabled
    * libpng16-CVE-2025-64506.patch
    CVE-2025-64720 [bsc#1254159], buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
    * libpng16-CVE-2025-64720.patch
    CVE-2025-65018 [bsc#1254160], heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
    * libpng16-CVE-2025-65018.patch

++++ sqlite3:

  - Update to version 3.51.1:
    * Fix incorrect results from nested EXISTS queries caused by the
    optimization in item 6b in the 3.51.0 release.
    * Fix a latent bug in fts5vocab virtual table, exposed by new
    optimizations in the 3.51.0 release
  - Changes in version 3.51.0:
    * New macros in sqlite3.h:
  - SQLITE_SCM_BRANCH → the name of the branch from which the
    source code is taken.
  - SQLITE_SCM_TAGS → space-separated list of tags on the source
    code check-in.
  - SQLITE_SCM_DATETIME → ISO-8601 date and time of the source
    code check-in.
    * Two new JSON functions, jsonb_each() and jsonb_tree() work the
    same as the existing json_each() and json_tree() functions
    except that they return JSONB for the "value" column when the
    "type" is 'array' or 'object'.
    * The carray and percentile extensions are now built into the
    amalgamation, though they are disabled by default and must be
    activated at compile-time using the -DSQLITE_ENABLE_CARRAY
    and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.
    * Enhancements to TCL Interface:
  - Add the -asdict flag to the eval command to have it set the
    row data as a dict instead of an array.
  - User-defined functions may now break to return an SQL NULL.
    * CLI enhancements:
  - Increase the precision of ".timer" to microseconds.
  - Enhance the "box" and "column" formatting modes to deal with
    double-wide characters.
  - The ".imposter" command provides read-only imposter tables
    that work with VACUUM and do not require the --unsafe-testing
    option.
  - Add the --ifexists option to the CLI command-line option and
    to the .open command.
  - Limit columns widths set by the ".width" command to 30,000 or
    less, as there is not good reason to have wider columns, but
    supporting wider columns provides opportunity to malefactors.
    * Performance enhancements:
  - Use fewer CPU cycles to commit a read transaction.
  - Early detection of joins that return no rows due to one or
    more of the tables containing no rows.
  - Avoid evaluation of scalar subqueries if the result of the
    subquery does not change the result of the overall expression.
  - Faster window function queries when using
    "BETWEEN :x FOLLOWING AND :y FOLLOWING" with a large :y.
    * Add the PRAGMA wal_checkpoint=NOOP; command and the
    SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().
    * Add the sqlite3_set_errmsg() API for use by extensions.
    * Add the sqlite3_db_status64() API, which works just like the
    existing sqlite3_db_status() API except that it returns 64-bit
    results.
    * Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the
    sqlite3_db_status() and sqlite3_db_status64() interfaces.
    * In the session extension add the sqlite3changeset_apply_v3()
    interface.
    * For the built-in printf() and the format() SQL function, omit
    the leading '-' from negative floating point numbers if the '+'
    flag is omitted and the "#" flag is present and all displayed
    digits are '0'. Use '%#f' or similar to avoid outputs like
    '-0.00' and instead show just '0.00'.
    * Improved error messages generated by FTS5.
    * Enforce STRICT typing on computed columns.
    * Improved support for VxWorks
    * JavaScript/WASM now supports 64-bit WASM. The canonical builds
    continue to be 32-bit but creating one's own 64-bit build is
    now as simple as running "make".
    * Improved resistance to database corruption caused by an
    application breaking Posix advisory locks using close().

++++ runc:

  - Update to runc v1.3.4. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.4>. bsc#1254362

------------------------------------------------------------------
------------------  2025-11-26  -  Nov 26 2025  -------------------
------------------------------------------------------------------

++++ openvswitch:

  - OpenvSwitch upstream bugfix updates:
    * https://www.openvswitch.org/releases/NEWS-3.1.7.txt
    * v3.1.7
  - Bug fixes
  - OVS validated with DPDK 22.11.7.
    * v3.1.6
  - Bug fixes
  - OVS validated with DPDK 22.11.6.
    * v3.1.5
  - Bug fixes
  - OVS validated with DPDK 22.11.5.
    * v3.1.4
  - Bug fixes
  - Fixed vulnerabilities CVE-2023-3966 (bsc#1219465)
    and CVE-2023-5366 (bsc#1216002).
  - OVS validated with DPDK 22.11.4.
    * v3.1.3
  - Bug fixes
    * v3.1.2
  - Bug fixes
    * v3.1.1
  - Bug fixes
  - Fixed vulnerability CVE-2023-1668 (bsc#1210054)
  - Remove included patches:
    CVE-2023-1668.patch
  - OVN upstream bugfix updates:
    * https://github.com/ovn-org/ovn/blob/branch-23.03/NEWS
  - Fix CVE-2025-0650 (bsc#1236353) ovn: egress ACLs may be bypassed
    via specially crafted UDP packet (CVE-2025-0650.patch)
    * v23.03.3
  - Bug fixes
  - Add "garp-max-timeout-sec" config option to vswitchd external-ids to
    cap the time between when ovn-controller sends gARP packets.
  - Security: Fixed vulnerability CVE-2024-2182 (bsc#1255435).
  - Updated patches
    install-ovsdb-tools.patch
    * v23.03.2
  - Bug fixes
    * v23.03.1
  - Bug fixes
  - CT entries are not flushed by default anymore whenever a load balancer
    backend is removed.  A new, per-LB, option 'ct_flush' can be used to
    restore the previous behavior.  Disabled by default.
  - Always allow IPv6 Router Discovery, Neighbor Discovery, and Multicast
    Listener Discovery protocols, regardless of ACLs defined.
  - Send ICMP Fragmentation Needed packets back to offending ports when
    communicating with multichassis ports using frames that don't fit through a
    tunnel. This is done only for logical switches that are attached to a
    physical network via a localnet port, in which case multichassis ports may
    have an effective MTU different from regular ports and hence may need this
    mechanism to maintain connectivity with other peers in the network.
  - ECMP routes use L4_SYM dp-hash by default if the datapath supports it.
    Existing sessions might get re-hashed to a different ECMP path when
    OVN detects the algorithm support in the datapath during an upgrade
    or restart of ovn-controller.
  - Add CoPP for the svc_monitor_mac. This addresses CVE-2023-3153
    (bsc#1212125).
  - Remove included patches:
    CVE-2023-3152.patch

++++ openvswitch:

  - OpenvSwitch upstream bugfix updates:
    * https://www.openvswitch.org/releases/NEWS-3.1.7.txt
    * v3.1.7
  - Bug fixes
  - OVS validated with DPDK 22.11.7.
    * v3.1.6
  - Bug fixes
  - OVS validated with DPDK 22.11.6.
    * v3.1.5
  - Bug fixes
  - OVS validated with DPDK 22.11.5.
    * v3.1.4
  - Bug fixes
  - Fixed vulnerabilities CVE-2023-3966 (bsc#1219465)
    and CVE-2023-5366 (bsc#1216002).
  - OVS validated with DPDK 22.11.4.
    * v3.1.3
  - Bug fixes
    * v3.1.2
  - Bug fixes
    * v3.1.1
  - Bug fixes
  - Fixed vulnerability CVE-2023-1668 (bsc#1210054)
  - Remove included patches:
    CVE-2023-1668.patch
  - OVN upstream bugfix updates:
    * https://github.com/ovn-org/ovn/blob/branch-23.03/NEWS
  - Fix CVE-2025-0650 (bsc#1236353) ovn: egress ACLs may be bypassed
    via specially crafted UDP packet (CVE-2025-0650.patch)
    * v23.03.3
  - Bug fixes
  - Add "garp-max-timeout-sec" config option to vswitchd external-ids to
    cap the time between when ovn-controller sends gARP packets.
  - Security: Fixed vulnerability CVE-2024-2182 (bsc#1255435).
  - Updated patches
    install-ovsdb-tools.patch
    * v23.03.2
  - Bug fixes
    * v23.03.1
  - Bug fixes
  - CT entries are not flushed by default anymore whenever a load balancer
    backend is removed.  A new, per-LB, option 'ct_flush' can be used to
    restore the previous behavior.  Disabled by default.
  - Always allow IPv6 Router Discovery, Neighbor Discovery, and Multicast
    Listener Discovery protocols, regardless of ACLs defined.
  - Send ICMP Fragmentation Needed packets back to offending ports when
    communicating with multichassis ports using frames that don't fit through a
    tunnel. This is done only for logical switches that are attached to a
    physical network via a localnet port, in which case multichassis ports may
    have an effective MTU different from regular ports and hence may need this
    mechanism to maintain connectivity with other peers in the network.
  - ECMP routes use L4_SYM dp-hash by default if the datapath supports it.
    Existing sessions might get re-hashed to a different ECMP path when
    OVN detects the algorithm support in the datapath during an upgrade
    or restart of ovn-controller.
  - Add CoPP for the svc_monitor_mac. This addresses CVE-2023-3153
    (bsc#1212125).
  - Remove included patches:
    CVE-2023-3152.patch

------------------------------------------------------------------
------------------  2025-11-25  -  Nov 25 2025  -------------------
------------------------------------------------------------------

++++ salt:

  - Add minimum_auth_version to enforce security (CVE-2025-62349)
  - Backport security fixes for vendored tornado
    * BDSA-2024-3438
    * BDSA-2024-3439
    * BDSA-2024-9026
  - Junos module yaml loader fix (CVE-2025-62348)
  - Require Python dependencies only for used Python version
  - Fix TLS and x509 modules for OSes with older cryptography module
  - Require python-legacy-cgi only for Python > 3.12
  - Builds with py >=3.13 require python-legacy-cgi
  - Fix Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
  - * Use external tornado on Python > 3.11
  - * Make tls and x509 to use python-cryptography
  - * Remove usage of spwd
  - Fix payload signature verification on Tumbleweed (bsc#1251776)
  - Fix broken symlink on migration to Leap 16.0 (bsc#1250755)
  - Use versioned python interpreter for salt-ssh
  - Fix known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  - Add python3.11 as preferable for salt-ssh to avoid tests fails
  - Make test_pillar_timeout test more reliable
  - Modify README and other doc files for openSUSE
  - Set python-CherryPy as required for python-salt-testsuite (#115)
  - Revert require M2Crypto >= 0.44.0 for SUSE Family distros
  - This reverts commit aa40615dcf7a15325ef71bbc09a5423ce512491d.
  - Improve SL Micro 6.2 detection with grains
  - Fix functional.states.test_user for SLES 16 and Micro systems
  - Fix the tests failing on AlmaLinux 10 and other clones
  - Added:
    * backport-3006.17-security-fixes-739.patch
    * fix-tls-and-x509-modules-for-older-cryptography-modu.patch
    * fix-salt-for-python-3.11.patch
    * do-not-break-signature-verification-on-latest-m2cryp.patch
    * use-versioned-python-interpreter-for-salt-ssh.patch
    * allow-libgit2-to-guess-sysdir-homedir-successfully-b.patch
    * add-python3.11-as-preferable-for-salt-ssh-to-avoid-t.patch
    * even-more-reliable-pillar-timeout-test.patch
    * modify-readme-for-opensuse-728.patch
    * improve-sl-micro-6.2-detection-with-grains.patch
    * fix-functional.states.test_user-for-sles-16-and-micr.patch
    * fix-the-tests-failing-on-almalinux-10-and-other-clon.patch

++++ salt:

  - Add minimum_auth_version to enforce security (CVE-2025-62349)
  - Backport security fixes for vendored tornado
    * BDSA-2024-3438
    * BDSA-2024-3439
    * BDSA-2024-9026
  - Junos module yaml loader fix (CVE-2025-62348)
  - Require Python dependencies only for used Python version
  - Fix TLS and x509 modules for OSes with older cryptography module
  - Require python-legacy-cgi only for Python > 3.12
  - Builds with py >=3.13 require python-legacy-cgi
  - Fix Salt for Python > 3.11 (bsc#1252285) (bsc#1252244)
  - * Use external tornado on Python > 3.11
  - * Make tls and x509 to use python-cryptography
  - * Remove usage of spwd
  - Fix payload signature verification on Tumbleweed (bsc#1251776)
  - Fix broken symlink on migration to Leap 16.0 (bsc#1250755)
  - Use versioned python interpreter for salt-ssh
  - Fix known_hosts error on gitfs (bsc#1250520) (bsc#1227207)
  - Add python3.11 as preferable for salt-ssh to avoid tests fails
  - Make test_pillar_timeout test more reliable
  - Modify README and other doc files for openSUSE
  - Set python-CherryPy as required for python-salt-testsuite (#115)
  - Revert require M2Crypto >= 0.44.0 for SUSE Family distros
  - This reverts commit aa40615dcf7a15325ef71bbc09a5423ce512491d.
  - Improve SL Micro 6.2 detection with grains
  - Fix functional.states.test_user for SLES 16 and Micro systems
  - Fix the tests failing on AlmaLinux 10 and other clones
  - Added:
    * backport-3006.17-security-fixes-739.patch
    * fix-tls-and-x509-modules-for-older-cryptography-modu.patch
    * fix-salt-for-python-3.11.patch
    * do-not-break-signature-verification-on-latest-m2cryp.patch
    * use-versioned-python-interpreter-for-salt-ssh.patch
    * allow-libgit2-to-guess-sysdir-homedir-successfully-b.patch
    * add-python3.11-as-preferable-for-salt-ssh-to-avoid-t.patch
    * even-more-reliable-pillar-timeout-test.patch
    * modify-readme-for-opensuse-728.patch
    * improve-sl-micro-6.2-detection-with-grains.patch
    * fix-functional.states.test_user-for-sles-16-and-micr.patch
    * fix-the-tests-failing-on-almalinux-10-and-other-clon.patch

------------------------------------------------------------------
------------------  2025-11-24  -  Nov 24 2025  -------------------
------------------------------------------------------------------

++++ gnutls:

  - Security fix bsc#1254132 CVE-2025-9820
    * Fix buffer overflow in gnutls_pkcs11_token_init
    * Added gnutls-CVE-2025-9820.patch

++++ gnutls:

  - Security fix bsc#1254132 CVE-2025-9820
    * Fix buffer overflow in gnutls_pkcs11_token_init
    * Added gnutls-CVE-2025-9820.patch

------------------------------------------------------------------
------------------  2025-11-21  -  Nov 21 2025  -------------------
------------------------------------------------------------------

++++ libmicrohttpd:

  - Fix for the following bugs:
    * bsc#1253177 CVE-2025-59777
    * bsc#1253178 CVE-2025-62689
  - Add patch:
    * CVE-2025-59777.patch
    * this same patch fixes both CVEs
    * git commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b

------------------------------------------------------------------
------------------  2025-11-19  -  Nov 19 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fix: [bsc#1253757, CVE-2025-11563]
    * curl: wcurl path traversal with percent-encoded slashes
    * Add curl-CVE-2025-11563.patch

++++ curl:

  - Security fix: [bsc#1253757, CVE-2025-11563]
    * curl: wcurl path traversal with percent-encoded slashes
    * Add curl-CVE-2025-11563.patch

++++ curl:

  - Security fix: [bsc#1253757, CVE-2025-11563]
    * curl: wcurl path traversal with percent-encoded slashes
    * Add curl-CVE-2025-11563.patch

++++ curl:

  - Security fix: [bsc#1253757, CVE-2025-11563]
    * curl: wcurl path traversal with percent-encoded slashes
    * Add curl-CVE-2025-11563.patch

++++ curl:

  - Security fix: [bsc#1253757, CVE-2025-11563]
    * curl: wcurl path traversal with percent-encoded slashes
    * Add curl-CVE-2025-11563.patch

++++ kmod:

  - man: modprobe.d: document the config file order handling (bsc#1253741)
    * man-modprobe.d-document-the-config-file-order-handling.patch

------------------------------------------------------------------
------------------  2025-11-18  -  Nov 18 2025  -------------------
------------------------------------------------------------------

++++ sssd:

  - Install file in krb5.conf.d to include sssd krb5 config snippets;
    (bsc#1244325);
  - Disable Kerberos localauth an2ln plugin for AD; (CVE-2025-11561);
    (bsc#1251827); Add patch
    0006-krb5-disable-Kerberos-localauth-an2ln-plugin-for-AD-.patch

------------------------------------------------------------------
------------------  2025-11-17  -  Nov 17 2025  -------------------
------------------------------------------------------------------

++++ dpdk:

  - Upstream bugfix update:
  - Version 22.11.10
  - net/mlx5: fix out-of-order completions in ordinary Rx burst
    (CVE-2025-23259, bsc#1254161)
  - Version 22.11.9
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id24
  - Version 22.11.8
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id21
  - Version 22.11.7
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id18
  - Remove included fix dpdk-CVE-2024-11614.patch
  - Version 22.11.6
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id15
  - Version 22.11.5
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id12
  - Version 22.11.4
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id8
  - Version 22.11.3
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id4
    Remove included fixes:
  - 0001-kni-fix-build-with-Linux-6.3.patch
  - Version 22.11.2
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id2
  - Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
    + Add kernel support flag for rte_kni.ko

++++ dpdk:

  - Upstream bugfix update:
  - Version 22.11.10
  - net/mlx5: fix out-of-order completions in ordinary Rx burst
    (CVE-2025-23259, bsc#1254161)
  - Version 22.11.9
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id24
  - Version 22.11.8
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id21
  - Version 22.11.7
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id18
  - Remove included fix dpdk-CVE-2024-11614.patch
  - Version 22.11.6
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id15
  - Version 22.11.5
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id12
  - Version 22.11.4
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id8
  - Version 22.11.3
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id4
    Remove included fixes:
  - 0001-kni-fix-build-with-Linux-6.3.patch
  - Version 22.11.2
    https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id2
  - Fix [bsc#1214724], SUSE provided DPDK modules taint the kernel as unsupported
    + Add kernel support flag for rte_kni.ko

++++ glib2:

  - Add glib2-CVE-2025-7039.patch: fix computation of temporary file
    name (bsc#1249055 CVE-2025-7039 glgo#GNOME/glib#3716).

++++ glib2:

  - Add glib2-CVE-2025-7039.patch: fix computation of temporary file
    name (bsc#1249055 CVE-2025-7039 glgo#GNOME/glib#3716).

++++ glib2:

  - Add glib2-CVE-2025-7039.patch: fix computation of temporary file
    name (bsc#1249055 CVE-2025-7039 glgo#GNOME/glib#3716).

++++ freetype2:

  - update to 2.14.1:
    * The auto-hinter got new abilities. It can now better separate
    diacritic glyphs from base glyphs at small sizes  by
    artificially moving  diacritics up (or  down) if necessary
    * Tilde accent  glyphs get vertically stretched at small sizes so
    that they don't degenerate to horizontal lines.
    * Diacritics directly attached to a base glyph (like the ogonek in
    character 'ę') no longer distort the shape of the base glyph
    * The TrueType  instruction interpreter  was optimized to
    produce a 15% gain in the glyph loading speed.
    * Handling of Variation Fonts is now considerably faster
    * TrueType and CFF glyph loading speed has been improved by 5-10%
    on modern 64-bit platforms  as  a result of better handling of
    fixed-point multiplication.
    * The BDF driver now loads fonts 75% faster.

------------------------------------------------------------------
------------------  2025-11-13  -  Nov 13 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311-core:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311-core:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311-core:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311-core:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311-core:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ unbound:

  - Fix CVE-2025-11411 (possible domain hijacking attack).
    Since this minimal patch interferes with most of the unit tests,
    the '%check' section has been removed from the spec file.
    [CVE-2025-11411, bsc#1252525, unbound-1.22-CVE-2025-11411.patch]

++++ python311:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ python311:

  - Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
    quadratic complexity vulnerabilities of os.path.expandvars()
    (CVE-2025-6075, bsc#1252974).
  - Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

++++ qemu:

  - Bugfixes:
    * io: fix use after free in websocket handshake code (bsc#1250984, CVE-2025-11234)
    * io: move websock resource release to close method (bsc#1250984, CVE-2025-11234)
    * io: release active GSource in TLS channel finalizer (bsc#1250984, CVE-2025-11234)
    * block/curl: fix curl internal handles handling (bsc#1252768, CVE-2025-11234)

++++ qemu:

  - Bugfixes:
    * io: fix use after free in websocket handshake code (bsc#1250984, CVE-2025-11234)
    * io: move websock resource release to close method (bsc#1250984, CVE-2025-11234)
    * io: release active GSource in TLS channel finalizer (bsc#1250984, CVE-2025-11234)
    * block/curl: fix curl internal handles handling (bsc#1252768, CVE-2025-11234)

------------------------------------------------------------------
------------------  2025-11-11  -  Nov 11 2025  -------------------
------------------------------------------------------------------

++++ cloud-init:

  - Fix dependency replace -serial with -pyserial

------------------------------------------------------------------
------------------  2025-11-9  -  Nov 9 2025  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.29. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.29>
    * CVE-2024-25621 bsc#1253126
    * CVE-2025-64329 bsc#1253132
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.29. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.29>
    * CVE-2024-25621 bsc#1253126
    * CVE-2025-64329 bsc#1253132
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

------------------------------------------------------------------
------------------  2025-11-7  -  Nov 7 2025  -------------------
------------------------------------------------------------------

++++ openssh:

  - Add openssh-cve-2025-61984-username-validation.patch
    (bsc#1251198, CVE-2025-61984).
  - Add openssh-cve-2025-61985-nul-url-encode.patch
    (bsc#1251199, CVE-2025-61985).

------------------------------------------------------------------
------------------  2025-11-6  -  Nov 6 2025  -------------------
------------------------------------------------------------------

++++ podman:

  - Add patch for CVE-2025-31133,CVE-2025-52565,CVE-2025-52881 (bsc#1252376):
    * 0011-CVE-2025-52881-backport-subset-of-patch-from-runc.patch
  - Add patch for bsc#1252543:
    * 0010-vendor-buildah-Don-t-set-ambient-capabilities.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch

++++ podman:

  - Add patch for CVE-2025-31133,CVE-2025-52565,CVE-2025-52881 (bsc#1252376):
    * 0011-CVE-2025-52881-backport-subset-of-patch-from-runc.patch
  - Add patch for bsc#1252543:
    * 0010-vendor-buildah-Don-t-set-ambient-capabilities.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch

++++ podman:

  - Add patch for CVE-2025-31133,CVE-2025-52565,CVE-2025-52881 (bsc#1252376):
    * 0011-CVE-2025-52881-backport-subset-of-patch-from-runc.patch
  - Add patch for bsc#1252543:
    * 0010-vendor-buildah-Don-t-set-ambient-capabilities.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch

------------------------------------------------------------------
------------------  2025-11-5  -  Nov 5 2025  -------------------
------------------------------------------------------------------

++++ runc:

  - Update to runc v1.3.3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.3>. bsc#1252232
    * CVE-2025-31133
    * CVE-2025-52565
    * CVE-2025-52881
  - Remove upstreamed patches for bsc#1252232:
  - 2025-11-05-CVEs.patch

++++ runc:

  - Update to runc v1.3.3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.3>. bsc#1252232
    * CVE-2025-31133
    * CVE-2025-52565
    * CVE-2025-52881
  - Remove upstreamed patches for bsc#1252232:
  - 2025-11-05-CVEs.patch

------------------------------------------------------------------
------------------  2025-11-4  -  Nov 4 2025  -------------------
------------------------------------------------------------------

++++ dracut:

  - Update to version 059+suse.607.g05002594:
    * fix(kernel-modules-extra): remove stray \ before / (bsc#1253029)

------------------------------------------------------------------
------------------  2025-10-28  -  Oct 28 2025  -------------------
------------------------------------------------------------------

++++ libgcrypt:

  - Fix running the test suite in FIPS mode [bsc#1246934]
    * Add libgcrypt-fix-pkcs12-test-in-FIPS-mode.patch
    * Rebase libgcrypt-FIPS-SLI-kdf-leylength.patch

------------------------------------------------------------------
------------------  2025-10-27  -  Oct 27 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Enable SELinux in default daemon.json config (--selinux-enabled). This has no
    practical impact on non-SELinux systems. bsc#1252290

++++ docker:

  - Enable SELinux in default daemon.json config (--selinux-enabled). This has no
    practical impact on non-SELinux systems. bsc#1252290

------------------------------------------------------------------
------------------  2025-10-22  -  Oct 22 2025  -------------------
------------------------------------------------------------------

++++ gpgme:

  - Treat empty DISPLAY variable as unset. [bsc#1252425, bsc#1231055]
    * To avoid gpgme constructing an invalid gpg command line when
    the DISPLAY variable is empty it can be treated as unset.
    * Add gpgme-Treat-empty-DISPLAY-variable-as-unset.patch
    * Reported upstream: dev.gnupg.org/T7919

------------------------------------------------------------------
------------------  2025-10-21  -  Oct 21 2025  -------------------
------------------------------------------------------------------

++++ sqlite3:

  - bsc#1252217: Add a %license file.

++++ sqlite3:

  - bsc#1252217: Add a %license file.

------------------------------------------------------------------
------------------  2025-10-19  -  Oct 19 2025  -------------------
------------------------------------------------------------------

++++ util-linux:

  - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
    util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

++++ util-linux:

  - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
    util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

++++ util-linux:

  - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
    util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

++++ util-linux-systemd:

  - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
    util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

++++ util-linux-systemd:

  - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
    util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

++++ util-linux-systemd:

  - lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
    util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

------------------------------------------------------------------
------------------  2025-10-17  -  Oct 17 2025  -------------------
------------------------------------------------------------------

++++ freetype2:

  - package FTL.TXT and GPLv2.TXT [bsc#1252148]

++++ libsoup:

  - Update libsoup-CVE-2025-11021.patch: Add NULL check for
    soup_date_time_to_string() (bsc#1250562, CVE-2025-11021,
    glgo#GNOME/libsoup!483).

++++ libsoup:

  - Update libsoup-CVE-2025-11021.patch: Add NULL check for
    soup_date_time_to_string() (bsc#1250562, CVE-2025-11021,
    glgo#GNOME/libsoup!483).

++++ libsoup:

  - Update libsoup-CVE-2025-11021.patch: Add NULL check for
    soup_date_time_to_string() (bsc#1250562, CVE-2025-11021,
    glgo#GNOME/libsoup!483).

++++ libsoup:

  - Update libsoup-CVE-2025-11021.patch: Add NULL check for
    soup_date_time_to_string() (bsc#1250562, CVE-2025-11021,
    glgo#GNOME/libsoup!483).

++++ libsoup:

  - Update libsoup-CVE-2025-11021.patch: Add NULL check for
    soup_date_time_to_string() (bsc#1250562, CVE-2025-11021,
    glgo#GNOME/libsoup!483).

++++ libsoup:

  - Update libsoup-CVE-2025-11021.patch: Add NULL check for
    soup_date_time_to_string() (bsc#1250562, CVE-2025-11021,
    glgo#GNOME/libsoup!483).

------------------------------------------------------------------
------------------  2025-10-16  -  Oct 16 2025  -------------------
------------------------------------------------------------------

++++ runc:

    [ This update was only released for SLE 12 and 15. ]
  - Backport patches for three CVEs. All three vulnerabilities ultimately allow
    (through different methods) for full container breakouts by bypassing runc's
    restrictions for writing to arbitrary /proc files. bsc#1252232
    * CVE-2025-31133
    * CVE-2025-52565
    * CVE-2025-52881
    + 2025-11-05-CVEs.patch

++++ runc:

    [ This update was only released for SLE 12 and 15. ]
  - Backport patches for three CVEs. All three vulnerabilities ultimately allow
    (through different methods) for full container breakouts by bypassing runc's
    restrictions for writing to arbitrary /proc files. bsc#1252232
    * CVE-2025-31133
    * CVE-2025-52565
    * CVE-2025-52881
    + 2025-11-05-CVEs.patch

------------------------------------------------------------------
------------------  2025-10-15  -  Oct 15 2025  -------------------
------------------------------------------------------------------

++++ libxslt:

  - security update
  - added patches
    CVE-2025-11731 [bsc#1251979], type confusion in exsltFuncResultCompfunction leading to denial of service
    * libxslt-CVE-2025-11731.patch

++++ libxslt:

  - security update
  - added patches
    CVE-2025-11731 [bsc#1251979], type confusion in exsltFuncResultCompfunction leading to denial of service
    * libxslt-CVE-2025-11731.patch

++++ python311-core:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311-core:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311-core:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311-core:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311-core:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311-core:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

++++ python311:

  - Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
    * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
    * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
    * Null character (U+0000) no longer ends the tag name.
    * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
    * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
    * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
  - Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

------------------------------------------------------------------
------------------  2025-10-13  -  Oct 13 2025  -------------------
------------------------------------------------------------------

++++ libsoup:

  - Add libsoup-CVE-2025-11021.patch: Ignore invalid date when
    processing cookies to prevent out-of-bounds read (bsc#1250562,
    CVE-2025-11021, glgo#GNOME/libsoup!482).

++++ libsoup:

  - Add libsoup-CVE-2025-11021.patch: Ignore invalid date when
    processing cookies to prevent out-of-bounds read (bsc#1250562,
    CVE-2025-11021, glgo#GNOME/libsoup!482).

++++ libsoup:

  - Add libsoup-CVE-2025-11021.patch: Ignore invalid date when
    processing cookies to prevent out-of-bounds read (bsc#1250562,
    CVE-2025-11021, glgo#GNOME/libsoup!482).

++++ libsoup:

  - Add libsoup-CVE-2025-11021.patch: Ignore invalid date when
    processing cookies to prevent out-of-bounds read (bsc#1250562,
    CVE-2025-11021, glgo#GNOME/libsoup!482).

++++ libsoup:

  - Add libsoup-CVE-2025-11021.patch: Ignore invalid date when
    processing cookies to prevent out-of-bounds read (bsc#1250562,
    CVE-2025-11021, glgo#GNOME/libsoup!482).

++++ libsoup:

  - Add libsoup-CVE-2025-11021.patch: Ignore invalid date when
    processing cookies to prevent out-of-bounds read (bsc#1250562,
    CVE-2025-11021, glgo#GNOME/libsoup!482).

------------------------------------------------------------------
------------------  2025-10-10  -  Oct 10 2025  -------------------
------------------------------------------------------------------

++++ qemu:

  - fix bsc#1230042:
    * .gitmodules: move u-boot mirrors to qemu-project-mirrors
    * [openSUSE] rpm/spec: qemu-vgabios is required on ppc (bsc#1230042)

++++ qemu:

  - fix bsc#1230042:
    * .gitmodules: move u-boot mirrors to qemu-project-mirrors
    * [openSUSE] rpm/spec: qemu-vgabios is required on ppc (bsc#1230042)

++++ runc:

    [ This update was only released for SLE 12 and 15. ]
  - Update to runc v1.2.7. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.7>.

++++ runc:

    [ This update was only released for SLE 12 and 15. ]
  - Update to runc v1.2.7. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.7>.

------------------------------------------------------------------
------------------  2025-10-8  -  Oct 8 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2851>
  - Rebased patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
    * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch
  - Remove upstreamed patch:
  - 0007-Add-back-vendor.sum.patch

++++ docker:

  - Update to Docker 28.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2851>
  - Rebased patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
    * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch
  - Remove upstreamed patch:
  - 0007-Add-back-vendor.sum.patch

++++ selinux-policy:

  - Update to version 20230523+git32.d521aa73b:
    * Ensure dbus communication is allowed bidirectionally
    * policy module for kiwi
    * Label /var/livepatches as lib_t for ULP on micro (bsc#1228879, bsc#1249832)

++++ selinux-policy:

  - Update to version 20230523+git32.d521aa73b:
    * Ensure dbus communication is allowed bidirectionally
    * policy module for kiwi
    * Label /var/livepatches as lib_t for ULP on micro (bsc#1228879, bsc#1249832)

++++ selinux-policy:

  - Update to version 20230523+git32.d521aa73b:
    * Ensure dbus communication is allowed bidirectionally
    * policy module for kiwi
    * Label /var/livepatches as lib_t for ULP on micro (bsc#1228879, bsc#1249832)

------------------------------------------------------------------
------------------  2025-10-7  -  Oct 7 2025  -------------------
------------------------------------------------------------------

++++ mozilla-nss:

  - Add bmo1990242.patch to move NSS DB password hash away from SHA-1

++++ mozilla-nss:

  - Add bmo1990242.patch to move NSS DB password hash away from SHA-1

------------------------------------------------------------------
------------------  2025-10-6  -  Oct 6 2025  -------------------
------------------------------------------------------------------

++++ mozilla-nss:

  - update to NSS 3.112.2
    * bmo#1970079 - Prevent leaks during pkcs12 decoding.
    * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  - Adding patch bmo1980465.patch to fix bug on s390x (bmo#1980465)
  - Adding patch bmo1956754.patch to fix possible undefined behaviour (bmo#1956754)

++++ mozilla-nss:

  - update to NSS 3.112.2
    * bmo#1970079 - Prevent leaks during pkcs12 decoding.
    * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
  - Adding patch bmo1980465.patch to fix bug on s390x (bmo#1980465)
  - Adding patch bmo1956754.patch to fix possible undefined behaviour (bmo#1956754)

------------------------------------------------------------------
------------------  2025-10-5  -  Oct 5 2025  -------------------
------------------------------------------------------------------

++++ haproxy:

  - VUL-0: CVE-2025-11230: haproxy: issue in the mjson JSON decoder leads
    to excessive resource consumption when processing numbers with large exponents
    (bsc#1250983)  Add upstream patch:
    0001-BUG-CRITICAL-mjson-fix-possible-DoS-when-parsing-num.patch

++++ haproxy:

  - VUL-0: CVE-2025-11230: haproxy: issue in the mjson JSON decoder leads
    to excessive resource consumption when processing numbers with large exponents
    (bsc#1250983)  Add upstream patch:
    0001-BUG-CRITICAL-mjson-fix-possible-DoS-when-parsing-num.patch

------------------------------------------------------------------
------------------  2025-10-4  -  Oct 4 2025  -------------------
------------------------------------------------------------------

++++ runc:

  - Update to runc v1.3.2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.2> bsc#1252110
  - Includes an important fix for the CPUSet translation for cgroupv2.

++++ runc:

  - Update to runc v1.3.2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.2> bsc#1252110
  - Includes an important fix for the CPUSet translation for cgroupv2.

------------------------------------------------------------------
------------------  2025-10-3  -  Oct 3 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.5.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2850>
  - Backport <https://github.com/moby/moby/pull/51091> to re-add vendor.sum,
    fixing our builds.
    + 0007-Add-back-vendor.sum.patch
  - Rebased patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
    * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

++++ docker:

  - Update to Docker 28.5.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2850>
  - Backport <https://github.com/moby/moby/pull/51091> to re-add vendor.sum,
    fixing our builds.
    + 0007-Add-back-vendor.sum.patch
  - Rebased patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
    * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

++++ colord:

  - Rework colord-CVE-2021-42523.patch based on what is now upstream.
    The original fix was wrong and did not properly free the error,
    resulting in a crash (bsc#1250750).

++++ podman:

  - Add patch for CVE-2025-9566 (bsc#1249154):
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch

++++ podman:

  - Add patch for CVE-2025-9566 (bsc#1249154):
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch

++++ podman:

  - Add patch for CVE-2025-9566 (bsc#1249154):
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch

++++ podman:

  - Add patch for CVE-2025-9566 (bsc#1249154):
    * 0009-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch

------------------------------------------------------------------
------------------  2025-10-2  -  Oct 2 2025  -------------------
------------------------------------------------------------------

++++ libxslt:

  - security update
  - added patches
    CVE-2025-10911 [bsc#1250553], use-after-free with key data stored cross-RVT
    * libxslt-CVE-2025-10911.patch

++++ libxslt:

  - security update
  - added patches
    CVE-2025-10911 [bsc#1250553], use-after-free with key data stored cross-RVT
    * libxslt-CVE-2025-10911.patch

------------------------------------------------------------------
------------------  2025-10-1  -  Oct 1 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to docker-buildx v0.29.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.29.0>

++++ docker:

  - Update to docker-buildx v0.29.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.29.0>

------------------------------------------------------------------
------------------  2025-9-30  -  Sep 30 2025  -------------------
------------------------------------------------------------------

++++ cloud-init:

  - Drop unneeded test dependency on httpretty, fixed long ago
    * https://github.com/canonical/cloud-init/pull/1720

------------------------------------------------------------------
------------------  2025-9-29  -  Sep 29 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Remove git-core recommends also on openSUSE: the below argument
    is valid for those users too.
  - Remove git-core recommends on SLE. Most SLE systems have
    installRecommends=yes by default and thus end up installing git with Docker.
    bsc#1250508
    This feature is mostly intended for developers ("docker build git://") so
    most users already have the dependency installed, and the error when git is
    missing is fairly straightforward (so they can easily figure out what they
    need to install).

++++ docker:

  - Remove git-core recommends also on openSUSE: the below argument
    is valid for those users too.
  - Remove git-core recommends on SLE. Most SLE systems have
    installRecommends=yes by default and thus end up installing git with Docker.
    bsc#1250508
    This feature is mostly intended for developers ("docker build git://") so
    most users already have the dependency installed, and the error when git is
    missing is fairly straightforward (so they can easily figure out what they
    need to install).

++++ expat:

  - Fix CVE-2025-59375 / bsc#1249584.
  - Add patch file:
    * CVE-2025-59375

++++ expat:

  - Fix CVE-2025-59375 / bsc#1249584.
  - Add patch file:
    * CVE-2025-59375

++++ expat:

  - Fix CVE-2025-59375 / bsc#1249584.
  - Add patch file:
    * CVE-2025-59375

++++ python311-core:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311-core:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311-core:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311-core:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311-core:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311-core:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

++++ python311:

  - Add gh139257-Support-docutils-0.22.patch to fix build with latest
    docutils (>=0.22) gh#python/cpython#139257

------------------------------------------------------------------
------------------  2025-9-25  -  Sep 25 2025  -------------------
------------------------------------------------------------------

++++ afterburn:

  - Update to version 5.9.0.git21.a73f509:
    * docs/release-notes: update for release 5.10.0
    * cargo: update dependencies
    * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
    * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
    * microsoft/azure: Fix SharedConfig parsing of XML attributes
    * microsoft/azure: Mock goalstate.SharedConfig output in tests
    * providers/azure: switch SSH key retrieval from certs endpoint to IMDS
    as azure stopped providing keys in the old one, fixes bsc#1250471
    * build(deps): bump the build group with 8 updates
    * build(deps): bump slab from 0.4.10 to 0.4.11
    * build(deps): bump actions/checkout from 4 to 5
    * upcloud: implement UpCloud provider
    * build(deps): bump the build group with 4 updates
    * Sync repo templates ⚙

------------------------------------------------------------------
------------------  2025-9-24  -  Sep 24 2025  -------------------
------------------------------------------------------------------

++++ openssl-3:

  - Security fix: [bsc#1250232 CVE-2025-9230]
    * Fix out-of-bounds read & write in RFC 3211 KEK unwrap
    * Add patch openssl3-CVE-2025-9230.patch
  - Disable LTO for userspace livepatching [jsc#PED-13245]

++++ openssl-3:

  - Security fix: [bsc#1250232 CVE-2025-9230]
    * Fix out-of-bounds read & write in RFC 3211 KEK unwrap
    * Add patch openssl3-CVE-2025-9230.patch
  - Disable LTO for userspace livepatching [jsc#PED-13245]

++++ openssl-3:

  - Security fix: [bsc#1250232 CVE-2025-9230]
    * Fix out-of-bounds read & write in RFC 3211 KEK unwrap
    * Add patch openssl3-CVE-2025-9230.patch
  - Disable LTO for userspace livepatching [jsc#PED-13245]

++++ openssl-3:

  - Security fix: [bsc#1250232 CVE-2025-9230]
    * Fix out-of-bounds read & write in RFC 3211 KEK unwrap
    * Add patch openssl3-CVE-2025-9230.patch
  - Disable LTO for userspace livepatching [jsc#PED-13245]

------------------------------------------------------------------
------------------  2025-9-23  -  Sep 23 2025  -------------------
------------------------------------------------------------------

++++ zypper:

  - Fixed `bash-completion`: `zypper refresh` now ignores
    repository priority lines.
  - Changes to support building against restructured libzypp in
    stack build (bsc#1230267)
  - version 1.14.94

------------------------------------------------------------------
------------------  2025-9-22  -  Sep 22 2025  -------------------
------------------------------------------------------------------

++++ libzypp:

  - runposttrans: strip root prefix from tmppath (bsc#1250343)
  - fixup! Make ld.so ignore the subarch packages during install
    (bsc#1246912)
  - version 17.37.18 (35)

++++ libzypp:

  - runposttrans: strip root prefix from tmppath (bsc#1250343)
  - fixup! Make ld.so ignore the subarch packages during install
    (bsc#1246912)
  - version 17.37.18 (35)

------------------------------------------------------------------
------------------  2025-9-19  -  Sep 19 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311-core:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311-core:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311-core:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311-core:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311-core:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ libssh:

  - Security fix: [CVE-2025-8277, bsc#1249375]
    * Memory Exhaustion via Repeated Key Exchange
    * Add patches:
  - libssh-CVE-2025-8277-packet-Adjust-packet-filter-to-work-wh.patch
  - libssh-CVE-2025-8277-Fix-memory-leak-of-unused-ephemeral-ke.patch
  - libssh-CVE-2025-8277-ecdh-Free-previously-allocated-pubkeys.patch

++++ libssh:

  - Security fix: [CVE-2025-8277, bsc#1249375]
    * Memory Exhaustion via Repeated Key Exchange
    * Add patches:
  - libssh-CVE-2025-8277-packet-Adjust-packet-filter-to-work-wh.patch
  - libssh-CVE-2025-8277-Fix-memory-leak-of-unused-ephemeral-ke.patch
  - libssh-CVE-2025-8277-ecdh-Free-previously-allocated-pubkeys.patch

++++ python311:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

++++ python311:

  - Drop AppStream buildrequires and don't run appstreamcli validate
    as part of the build process: the appdata.xml is not updated by
    source directly, so we have more contol. Having Appstream or the
    deprecated appstream-glib result in a build cycle.

------------------------------------------------------------------
------------------  2025-9-18  -  Sep 18 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311-core:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311-core:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311-core:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311-core:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311-core:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ libssh:

  - Security fix: [CVE-2025-8114, bsc#1246974]
    * NULL pointer dereference when calculating session ID during KEX
    * Add libssh-CVE-2025-8114.patch

++++ libssh:

  - Security fix: [CVE-2025-8114, bsc#1246974]
    * NULL pointer dereference when calculating session ID during KEX
    * Add libssh-CVE-2025-8114.patch

++++ systemd:

  - systemd.spec: use %sysusers_generate_pre so that some systemd users are
    already available in %pre. This is important because D-Bus automatically
    reloads its configuration whenever new configuration files are installed,
    i.e. between %pre and %post. (bsc#1248501)
    No needs for systemd and udev packages as they are always installed during
    the initial installation.

++++ systemd:

  - systemd.spec: use %sysusers_generate_pre so that some systemd users are
    already available in %pre. This is important because D-Bus automatically
    reloads its configuration whenever new configuration files are installed,
    i.e. between %pre and %post. (bsc#1248501)
    No needs for systemd and udev packages as they are always installed during
    the initial installation.

++++ tiff:

  - Update to 4.7.1:
    Software configuration changes:
    * Define HAVE_JPEGTURBO_DUAL_MODE_8_12 and LERC_STATIC in tif_config.h.
    * CMake: define WORDS_BIGENDIAN via tif_config.h
    * doc/CMakeLists.txt: remove useless cmake_minimum_required()
    * CMake: fix build with LLVM/Clang 17 (fixes issue #651)
    * CMake: set CMP0074 new policy
    * Set LINKER_LANGUAGE for C targets with C deps
    * Export tiffxx cmake target (fixes issue #674)
    * autogen.sh: Enable verbose wget.
    * configure.ac: Syntax updates for Autoconf 2.71
    * autogen.sh: Re-implement based on autoreconf. Failure to update
    config.guess/config.sub does not return error (fixes issue #672)
    * CMake: fix CMake 4.0 warning when minimum required version is < 3.10.
    * CMake: Add build option tiff-static (fixes issue #709)
    Library changes:
    * Add TIFFOpenOptionsSetWarnAboutUnknownTags() for explicit control
    about emitting warnings for unknown tags. No longer emit warnings
    about unknown tags by default
    * tif_predict.c: speed-up decompression in some cases.
    Bug fixes:
    * tif_fax3: For fax group 3 data if no EOL is detected, reading is
    retried without synchronisation for EOLs. (fixes issue #54)
    * Updating TIFFMergeFieldInfo() with read_count=write_count=0 for
    FIELD_IGNORE. Updating TIFFMergeFieldInfo() with read_count=write_count=0 for
    FIELD_IGNORE. Improving handling when field_name = NULL. (fixes issue #532)
    * tiff.h: add COMPRESSION_JXL_DNG_1_7=52546 as used for JPEGXL compression in
    the DNG 1.7 specification
    * TIFFWriteDirectorySec: Increment string length for ASCII tags for codec tags
    defined with FIELD_xxx bits, as it is done for FIELD_CUSTOM tags. (fixes issue #648)
    * Do not error out on a tag whose tag count value is zero, just issue a warning.
    Fix parsing a private tag 0x80a6 (fixes issue #647)
    * TIFFDefaultTransferFunction(): give up beyond td_bitspersample = 24
    Fixes https://github.com/OSGeo/gdal/issues/10875)
    * tif_getimage.c: Remove unnecessary calls to TIFFRGBAImageOK() (fixes issue #175)
    * Fix writing a Predictor=3 file with non-native endianness
    * _TIFFVSetField(): fix potential use of unallocated memory (out-of-bounds
    * read / nullptr dereference) in case of out-of-memory situation when dealing with
    custom tags (fixes issue #663)
    * tif_fax3.c: Error out for CCITT fax encoding if SamplesPerPixel is not equal 1 and
    PlanarConfiguration = Contiguous (fixes issue #26)
    * tif_fax3.c: error out after a number of times end-of-line or unexpected bad code
    words have been reached. (fixes issue #670)
    * Fix memory leak in TIFFSetupStrips() (fixes issue #665)
    * tif_zip.c: Provide zlib allocation functions. Otherwise for zlib built with
  - DZ_SOLO inflating will fail.
    * Fix memory leak in _TIFFSetDefaultCompressionState. (fixes issue #676)
    * tif_predict.c: Don’t overwrite input buffer of TIFFWriteScanline() if "prediction"
    is enabled. Use extra working buffer in PredictorEncodeRow(). (fixes issue #5)
    * tif_getimage.c: update some integer overflow checks (fixes issue #79)
    * tif_getimage.c: Fix buffer underflow crash for less raster rows at
    TIFFReadRGBAImageOriented() (fixes issue #704, bsc#1250413, CVE-2025-9900)
    * TIFFReadRGBAImage(): several fixes to avoid buffer overflows.
    * Correct passing arguments to TIFFCvtIEEEFloatToNative() and TIFFCvtIEEEDoubleToNative()
    if HAVE_IEEEFP is not defined. (fixes issue #699)
    * LZWDecode(): avoid nullptr dereference when trying to read again after EOI marker
    has been found with remaining output bytes (fixes issue #698)
    * TIFFSetSubDirectory(): check _TIFFCheckDirNumberAndOffset() return.
    * TIFFUnlinkDirectory() and TIFFWriteDirectorySec(): clear tif_rawcp when clearing
    tif_rawdata (fixes issue #711)
    * JPEGEncodeRaw(): error out if a previous scanline failed to be written, to avoid
    out-of-bounds access (fixes issue #714)
    * tif_jpeg: Fix bug in JPEGDecodeRaw() if JPEG_LIB_MK1_OR_12BIT is defined for 8/12bit
    dual mode, introduced in libjpeg-turbo 2.2, which was actually released as 3.0.
    Fixes issue #717
    * add assert for TIFFReadCustomDirectory infoarray check.
    * ppm2tiff: Fix bug in pack_words trailing bytes, where last two bytes of each line
    were written wrongly. (fixes issue #467)
    * fax2ps: fix regression of commit 28c38d648b64a66c3218778c4745225fe3e3a06d where
    TIFFTAG_FAXFILLFUNC is being used rather than an output buffer (fixes issue #649)
    * tiff2pdf: Check TIFFTAG_TILELENGTH and TIFFTAGTILEWIDTH (fixes issue #650)
    * tiff2pdf: check h_samp and v_samp for range 1 to 4 to avoid division by zero.
    Fixes issue #654
    * tiff2pdf: avoid null pointer dereference. (fixes issue #741)
    * Improve non-secure integer overflow check (comparison of division result with
    multiplicant) at compiler optimisation in tiffcp, rgb2ycbcr and tiff2rgba.
    Fixes issue #546
    * tiff2rgba: fix some "a partial expression can generate an overflow before it is
    assigned to a broader type" warnings. (fixes issue #682)
    * tiffdither/tiffmedian: Don't skip the first line of the input image. (fixes issue #703)
    * tiffdither: avoid out-of-bounds read identified in issue #733
    * tiffmedian: error out if TIFFReadScanline() fails (fixes issue #707)
    * tiffmedian: close input file. (fixes issue #735)
    * thumbail: avoid potential out of bounds access (fixes issue #715)
    * tiffcrop: close open TIFF files and release allocated buffers before exiting in case
    of error to avoid memory leaks. (fixes issue #716)
    * tiffcrop: fix double-free and memory leak exposed by issue #721
    * tiffcrop: avoid buffer overflow. (fixes issue #740)
    * tiffcrop: avoid nullptr dereference. (fixes issue #734)
    * tiffdump: Fix coverity scan issue CID 1373365: Passing tainted expression *datamem
    to PrintData, which uses it as a divisor or modulus.
    * tiff2ps: check return of TIFFGetFiled() for TIFFTAG_STRIPBYTECOUNTS and
    TIFFTAG_TILEBYTECOUNTS to avoid NULL pointer dereference. (fixes issue #718)
    * tiffcmp: fix memory leak when second file cannot be opened. (fixes issue #718 and issue #729)
    * tiffcp: fix setting compression level for lossless codecs. (fixes issue #730)
    * raw2tiff: close input file before exit (fixes issue #742)
    Tools changes:
    * tiffinfo: add a -W switch to warn about unknown tags.
    * tiffdither: process all pages in input TIFF file.
    Documentation:
    * TIFFRGBAImage.rst note added for incorrect saving of images with TIFF orientation
    from 5 (LeftTop) to 8 (LeftBottom) in the raster.
    * TIFFRGBAImage.rst note added about un-associated alpha handling (fixes issue #67)
    * Update "Defining New TIFF Tags" description. (fixes issue #642)
    * Fix return type of TIFFReadEncodedTile()
    * Update the documentation to reflect deprecated typedefs.
    * TIFFWriteDirectory.rst: Clarify TIFFSetWriteOffset() only sets offset for image
    data and not for IFD data.
    * Update documentation on re-entrancy and thread safety.
    * Remove dead links to no more existing Awaresystems web-site.
    * Updating BigTIFF specification and some miscelaneous editions.
    * Replace some last links and remove last todos.
    * Added hints for correct allocation of TIFFYCbCrtoRGB structure and its
    associated buffers. (fixes issue #681)
    * Added chapter to "Using the TIFF Library" with links to handling multi-page TIFF
    and custom directories. (fixes issue #43)
    * update TIFFOpen.rst with the return values of mapproc and unmapproc. (fixes issue #12)
  - Drop upstreamed patches:
    * tiff-4.7.0-test_directory.patch
    * tiff-CVE-2025-8176.patch
    * tiff-CVE-2025-8177.patch
    * tiff-4.7.0-bsc1243503.patch
    * tiff-CVE-2025-8534.patch
    * tiff-CVE-2025-9165.patch
    * tiff-CVE-2024-13978.patch
    * tiff-CVE-2025-8961.patch

++++ python311:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

++++ python311:

  - Require AppStream to validate appdata file instead of deprecated
    appstream-glib.
  - Update idle3.appdata.xml to pass the more pedantic appstreamcli.

------------------------------------------------------------------
------------------  2025-9-17  -  Sep 17 2025  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to version 10.5.3
    + Move project setup to poetry and apply python standards
    + Fix use of logging facility
    Use logging facility in the desired way throughout the entire
    code base. This includes the following changes and refactor
    * Add handler and formatter for the logfile containing more
    information about function and position in code for the message
    * Add handler for stdout (INFO and WARNING)
    * Add handler for stderr (ERROR).
    * Implement Logger class providing the logging setup and methods
    * Drop the start_logging() method.
    * Fix and refactor all unit tests around the use of logging
    with a proper fixture and place all tests for registerutils
    into its own class TestRegisterUtils.
    * Add --debug switch for registercloudguest. Allow to increase
    logfile information. All messages produced via log.debug(...)
    in code will be part of the logfile. Debug messages will not
    be shown on the console
    * Update SLE12 patches due to logging refactor
    * Use --debug flag in guestregister service
    This Fixes #188

++++ cups:

  - Version upgrade to 2.4.14:
    See https://github.com/openprinting/cups/releases
    The hotfix release brings fix for installation process
    of localized templates and CUPS web UI home pages.
  - Version upgrade to 2.4.13:
    See https://github.com/openprinting/cups/releases
    The release 2.4.13 brings two CVE fixes
    fix for important CVE-2025-58060
    "Authentication bypass with AuthType Negotiate" (bsc#1249049)
    and fix for moderate CVE-2025-58364
    "Remote DoS via null dereference" (bsc#1249128)
    together with several bug fixes.
    The release includes a new feature - new attribute
    for printer and job objects - print-as-raster - which
    allows enforce rasterization of the file for
    IPP Everywhere/AirPrint printers, which supports PDF
    and raster document formats. The feature is useful for
    working around internal PDF issues in the printer firmware,
    for example missing diacritic when printing a PDF.
    Detailed list (from CHANGES.md):
    * Blocked authentication using alternate methods
    in cupsd (CVE-2025-58060)
    * Fixed extension tag handling in 'ipp_read_io()'
    in libcups (CVE-2025-58364)
    * Added 'print-as-raster' printer and job attributes
    for forcing rasterization (Issue #1282)
    * Updated documentation (Issue #1086)
    * Updated IPP backend to try a sanitized user name if the
    printer/server does not like the value (Issue #1145)
    * Updated the scheduler to send the "printer-added"
    or "printer-modified" events  whenever an IPP Everywhere PPD
    is installed (Issue #1244)
    * Updated the scheduler to send the "printer-modified" event
    whenever the system default printer is changed (Issue #1246)
    * Fixed a memory leak in 'httpClose' (Issue #1223)
    * Fixed missing commas in 'ippCreateRequestedArray'
    (Issue #1234)
    * Fixed subscription issues in the scheduler and D-Bus notifier
    (Issue #1235)
    * Fixed media-default reporting for custom sizes (Issue #1238)
    * Fixed support for IPP/PPD options with periods or underscores
    (Issue #1249)
    * Fixed parsing of real numbers in PPD compiler source files
    (Issue #1263)
    * Fixed scheduler freezing with zombie clients (Issue #1264)
    * Fixed support for the server name in the ErrorLog filename
    (Issue #1277)
    * Fixed job cleanup after daemon restart (Issue #1315)
    * Fixed handling of buggy DYMO USB printer serial numbers
    (Issue #1338)
    * Fixed unreachable block in IPP backend (Issue #1351)
    * Fixed memory leak in _cupsConvertOptions (Issue #1354)
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.14

++++ systemd:

  - Split systemd-network into two new sub-packages: systemd-networkd and
    systemd-resolved (bsc#1224386 jsc#PED-12669)

++++ systemd:

  - Split systemd-network into two new sub-packages: systemd-networkd and
    systemd-resolved (bsc#1224386 jsc#PED-12669)

------------------------------------------------------------------
------------------  2025-9-10  -  Sep 10 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - tool_operate: fix return code when --retry is used but not
    triggered [bsc#1249367]
    * Add curl-tool_operate-fix-return-code-when-retry-is-used.patch

++++ curl:

  - tool_operate: fix return code when --retry is used but not
    triggered [bsc#1249367]
    * Add curl-tool_operate-fix-return-code-when-retry-is-used.patch

++++ curl:

  - tool_operate: fix return code when --retry is used but not
    triggered [bsc#1249367]
    * Add curl-tool_operate-fix-return-code-when-retry-is-used.patch

++++ curl:

  - tool_operate: fix return code when --retry is used but not
    triggered [bsc#1249367]
    * Add curl-tool_operate-fix-return-code-when-retry-is-used.patch

++++ curl:

  - tool_operate: fix return code when --retry is used but not
    triggered [bsc#1249367]
    * Add curl-tool_operate-fix-return-code-when-retry-is-used.patch

++++ curl:

  - tool_operate: fix return code when --retry is used but not
    triggered [bsc#1249367]
    * Add curl-tool_operate-fix-return-code-when-retry-is-used.patch

------------------------------------------------------------------
------------------  2025-9-9  -  Sep 9 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fixes:
    * [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
    * [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
    * Add patches:
  - curl-CVE-2025-9086.patch
  - curl-CVE-2025-10148.patch

++++ curl:

  - Security fixes:
    * [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
    * [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
    * Add patches:
  - curl-CVE-2025-9086.patch
  - curl-CVE-2025-10148.patch

++++ curl:

  - Security fixes:
    * [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
    * [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
    * Add patches:
  - curl-CVE-2025-9086.patch
  - curl-CVE-2025-10148.patch

++++ curl:

  - Security fixes:
    * [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
    * [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
    * Add patches:
  - curl-CVE-2025-9086.patch
  - curl-CVE-2025-10148.patch

++++ curl:

  - Security fixes:
    * [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
    * [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
    * Add patches:
  - curl-CVE-2025-9086.patch
  - curl-CVE-2025-10148.patch

++++ curl:

  - Security fixes:
    * [bsc#1249191, CVE-2025-9086] Out of bounds read for cookie path
    * [bsc#1249348, CVE-2025-10148] Predictable WebSocket mask
    * Add patches:
  - curl-CVE-2025-9086.patch
  - curl-CVE-2025-10148.patch

------------------------------------------------------------------
------------------  2025-9-8  -  Sep 8 2025  -------------------
------------------------------------------------------------------

++++ tiff:

  - security update:
    * CVE-2025-8961 [bsc#1248117]
    Fix segmentation fault via main function of tiffcrop utility
    + tiff-CVE-2025-8961.patch

------------------------------------------------------------------
------------------  2025-9-6  -  Sep 6 2025  -------------------
------------------------------------------------------------------

++++ net-tools:

  - Drop 0004-By-default-do-not-fopen-anything-in-netrom_gr.patch. It
    was net-tools-1.60 specific leak fix and breaks netrom in
    net-tools-2.10 (bnc#544339#c2).

------------------------------------------------------------------
------------------  2025-9-5  -  Sep 5 2025  -------------------
------------------------------------------------------------------

++++ chrony:

  - Update to version 4.8:
    * Add maxunreach option to limit selection of unreachable sources
    * Add -u option to chronyc to drop root privileges (default
    chronyc user is set by configure script)
    * Fix refclock extpps option to work on Linux >= 6.15
    * Validate refclock samples for reachability updates
    * Obsoletes chrony-unix-socket.patch
    * Obsoletes chrony-remove-chmod.patch

------------------------------------------------------------------
------------------  2025-9-4  -  Sep 4 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to docker-buildx v0.28.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.28.0>
  - Update to Docker 28.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2840>
    * Fixes a nil pointer panic in "docker push". bsc#1248373
  - Rebased patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
    * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

++++ docker:

  - Update to docker-buildx v0.28.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.28.0>
  - Update to Docker 28.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2840>
    * Fixes a nil pointer panic in "docker push". bsc#1248373
  - Rebased patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
    * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

++++ docker:

  - Update to docker-buildx v0.28.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.28.0>
  - Update to Docker 28.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2840>
    * Fixes a nil pointer panic in "docker push". bsc#1248373
  - Rebased patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
    * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

++++ runc:

  - Update to runc v1.3.1. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.1>

++++ runc:

  - Update to runc v1.3.1. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.1>
  - Fix runc 1.3.x builds on SLE-12 by enabling --std=gnu11.

++++ runc:

  - Update to runc v1.3.1. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.1>
  - Fix runc 1.3.x builds on SLE-12 by enabling --std=gnu11.

------------------------------------------------------------------
------------------  2025-9-2  -  Sep 2 2025  -------------------
------------------------------------------------------------------

++++ krb5:

  - Remove des3-cbc-sha1 and arcfour-hmac-md5 from permitted
    enctypes unless new special options "allow_des3" or "allow_rc4"
    are set; (CVE-2025-3576); (bsc#1241219).
  - Add patch 0013-CVE-2025-3576.patch

------------------------------------------------------------------
------------------  2025-9-1  -  Sep 1 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update warnings and errors related to "docker buildx ..." so that they
    reference our openSUSE docker-buildx packages.
    + cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
  - Enable building docker-buildx for SLE15 systems with SUSEConnect secret
    injection enabled. PED-12534 PED-8905 bsc#1247594
    As docker-buildx does not support our SUSEConnect secret injection (and some
    users depend "docker build" working transparently), patch the docker CLI so
    that "docker build" will no longer automatically call "docker buildx build",
    effectively making DOCKER_BUILDKIT=0 the default configuration. Users can
    manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order
    to opt-in to using docker-buildx.
    Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0
    explicitly.
    In order to inject SCC credentials with docker-buildx, users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
    + cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

++++ docker:

  - Update warnings and errors related to "docker buildx ..." so that they
    reference our openSUSE docker-buildx packages.
    + cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
  - Enable building docker-buildx for SLE15 systems with SUSEConnect secret
    injection enabled. PED-12534 PED-8905 bsc#1247594
    As docker-buildx does not support our SUSEConnect secret injection (and some
    users depend "docker build" working transparently), patch the docker CLI so
    that "docker build" will no longer automatically call "docker buildx build",
    effectively making DOCKER_BUILDKIT=0 the default configuration. Users can
    manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order
    to opt-in to using docker-buildx.
    Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0
    explicitly.
    In order to inject SCC credentials with docker-buildx, users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
    + cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

++++ docker:

  - Update warnings and errors related to "docker buildx ..." so that they
    reference our openSUSE docker-buildx packages.
    + cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
  - Enable building docker-buildx for SLE15 systems with SUSEConnect secret
    injection enabled. PED-12534 PED-8905 bsc#1247594
    As docker-buildx does not support our SUSEConnect secret injection (and some
    users depend "docker build" working transparently), patch the docker CLI so
    that "docker build" will no longer automatically call "docker buildx build",
    effectively making DOCKER_BUILDKIT=0 the default configuration. Users can
    manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order
    to opt-in to using docker-buildx.
    Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0
    explicitly.
    In order to inject SCC credentials with docker-buildx, users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
    + cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

------------------------------------------------------------------
------------------  2025-8-28  -  Aug 28 2025  -------------------
------------------------------------------------------------------

++++ net-tools:

  - Drop old Fedora patch 0006-Allow-interface-stacking.patch. It
    provided a fix for CVE-2025-46836 (bsc#142461), but it was fixes
    by the upstream in 2025 in a different way. Revert interferring
    net-tools-CVE-2025-46836.patch back to the upstream version.
  - Fix stack buffer overflow in parse_hex (bsc#1248687,
    GHSA-h667-qrp8-gj58, net-tools-parse_hex-stack-overflow.patch).
  - Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687,
    GHSA-w7jq-cmw2-cq59,
    net-tools-proc_gen_fmt-buffer-overflow.patch).
  - Avoid unsafe memcpy in ifconfig (bsc#1248687,
    net-tools-ifconfig-avoid-unsafe-memcpy.patch).
  - Prevent overflow in ax25 and netrom (bsc#1248687,
    net-tools-ax25+netrom-overflow-1.patch,
    net-tools-ax25+netrom-overflow-2.patch).
  - Keep possibility to enter long interface names, even if they are
    not accepted by the kernel, because it was always possible up to
    CVE-2025-46836 fix. But issue a warning about an interface name
    concatenation (bsc#1248410,
    net-tools-ifconfig-long-name-warning.patch).

------------------------------------------------------------------
------------------  2025-8-27  -  Aug 27 2025  -------------------
------------------------------------------------------------------

++++ regionServiceClientConfigAzure:

  - Update to version 3.0.0 (bsc#1246995)
    + SLE 16 python-requests requiers SSL v3 certificates. Update 2
    region server certs to support SLE 16 when it gets released.

++++ regionServiceClientConfigEC2:

  - Update to version 5.0.0 (bsc#1246995)
    + SLE 16 python-requests requiers SSL v3 certificates. Update 2
    region server certs to support SLE 16 when it gets released.

++++ regionServiceClientConfigGCE:

  - Update to version 5.0.0 (bsc#1246995)
    + SLE 16 python-requests requiers SSL v3 certificates. Update 2
    region server certs to support SLE 16 when it gets released.

++++ regionServiceClientConfigGCE:

  - Update to version 5.0.0 (bsc#1246995)
    + SLE 16 python-requests requires SSL v3 certificates. Update 2
    region server certs to support SLE 16 when it gets released.

------------------------------------------------------------------
------------------  2025-8-26  -  Aug 26 2025  -------------------
------------------------------------------------------------------

++++ sqlite3:

  - bsc#1248586: Fix icu-enabled build.

++++ sqlite3:

  - bsc#1248586: Fix icu-enabled build.

------------------------------------------------------------------
------------------  2025-8-22  -  Aug 22 2025  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update version to 10.5.2 (bsc#1247539)
    + When an instance fails verification server side the default credentials
    were left behind requireing manual intervantion prior to the next
    registration attempt.
    + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0

++++ cloud-regionsrv-client:

  - Update version to 10.5.2 (bsc#1247539)
    + When an instance fails verification server side the default credentials
    were left behind requiring manual intervention prior to the next
    registration attempt.
    + Fix issue triggered when using instance-billing-flavor-check due to
    IP address handling as object rather than string introduced 10.5.0

++++ mozilla-nss:

  - update to NSS 3.112.1
    * bmo#1982742 - restore support for finding certificates by decoded serial number.

++++ mozilla-nss:

  - update to NSS 3.112.1
    * bmo#1982742 - restore support for finding certificates by decoded serial number.

++++ udisks2:

  - (CVE-2025-8067) VUL-0: missing bounds check can lead to out-of-bounds
    read in udisks daemon (bsc#1248502)
    + add 0001-udiskslinuxmanager-Add-lower-bounds-check-to-fd_inde.patch

------------------------------------------------------------------
------------------  2025-8-21  -  Aug 21 2025  -------------------
------------------------------------------------------------------

++++ tiff:

  - security update:
    * CVE-2025-8534 [bsc#1247582]
    Fix null pointer dereference in function PS_Lvl2page
    + tiff-CVE-2025-8534.patch
    * CVE-2025-9165 [bsc#1248330]
    Fix local execution manipulation can lead to memory leak
    + tiff-CVE-2025-9165.patch
    * CVE-2024-13978 [bsc#1247581]
    Fix null pointer dereference in tiff2pdf
    + tiff-CVE-2024-13978.patch

------------------------------------------------------------------
------------------  2025-8-20  -  Aug 20 2025  -------------------
------------------------------------------------------------------

++++ git:

  - Use zlib instead of zlib-ng for SLES16

++++ rust-keylime:

  - Update vendored crates (bsc#1248006, CVE-2025-55159)
    * slab 0.4.11
  - Add Cargo_lock.patch patch to update slab and other dependencies
  - Update to version 0.2.8+12:
    * build(deps): bump actions/checkout from 4 to 5
    * build(deps): bump cfg-if from 1.0.0 to 1.0.1
    * build(deps): bump openssl from 0.10.72 to 0.10.73
    * build(deps): bump clap from 4.5.39 to 4.5.45
    * build(deps): bump pest from 2.8.0 to 2.8.1
    * Fix clippy warnings
    * Use verifier-provided interval for continuous attestation timing
    * Add meta object with seconds_to_next_attestation to evidence response
    * Fix boot time retrieval
    * Fix IMA log format (it must be ['text/plain']) (#1073)
    * Remove unnecessary configuration fields
    * cargo: Bump retry-policies to version 0.4.0
    * Bump version to 0.2.8

++++ rust-keylime:

  - Update vendored crates (bsc#1248006, CVE-2025-55159)
    * slab 0.4.11
  - Add Cargo_lock.patch patch to update slab and other dependencies
  - Update to version 0.2.8+12:
    * build(deps): bump actions/checkout from 4 to 5
    * build(deps): bump cfg-if from 1.0.0 to 1.0.1
    * build(deps): bump openssl from 0.10.72 to 0.10.73
    * build(deps): bump clap from 4.5.39 to 4.5.45
    * build(deps): bump pest from 2.8.0 to 2.8.1
    * Fix clippy warnings
    * Use verifier-provided interval for continuous attestation timing
    * Add meta object with seconds_to_next_attestation to evidence response
    * Fix boot time retrieval
    * Fix IMA log format (it must be ['text/plain']) (#1073)
    * Remove unnecessary configuration fields
    * cargo: Bump retry-policies to version 0.4.0
    * Bump version to 0.2.8

++++ rust-keylime:

  - Update vendored crates (bsc#1248006, CVE-2025-55159)
    * slab 0.4.11
  - Add Cargo_lock.patch patch to update slab and other dependencies
  - Update to version 0.2.8+12:
    * build(deps): bump actions/checkout from 4 to 5
    * build(deps): bump cfg-if from 1.0.0 to 1.0.1
    * build(deps): bump openssl from 0.10.72 to 0.10.73
    * build(deps): bump clap from 4.5.39 to 4.5.45
    * build(deps): bump pest from 2.8.0 to 2.8.1
    * Fix clippy warnings
    * Use verifier-provided interval for continuous attestation timing
    * Add meta object with seconds_to_next_attestation to evidence response
    * Fix boot time retrieval
    * Fix IMA log format (it must be ['text/plain']) (#1073)
    * Remove unnecessary configuration fields
    * cargo: Bump retry-policies to version 0.4.0
    * Bump version to 0.2.8

------------------------------------------------------------------
------------------  2025-8-18  -  Aug 18 2025  -------------------
------------------------------------------------------------------

++++ gdk-pixbuf:

  - Add gdk-pixbuf-jpeg-icc-data.patch: be more careful with icc data
    (bsc#1246114 CVE-2025-7345 glgo@GNOME/gdk-pixbuf!217).

++++ gdk-pixbuf:

  - Add gdk-pixbuf-jpeg-icc-data.patch: be more careful with icc data
    (bsc#1246114 CVE-2025-7345 glgo@GNOME/gdk-pixbuf!217).

++++ git:

  - Update to 2.51.0
  - UI, Workflows & Features
  - Userdiff patterns for the R language have been added.
  - Documentation for "git send-email" has been updated with a
    bit more credential helper and OAuth information.
  - "git cat-file --batch" learns to understand %(objectmode)
    atom to allow the caller to tell missing objects (due to
    repository corruption) and submodules (whose commit objects
    are OK to be missing) apart.
  - "git diff --no-index dirA dirB" can limit the comparison with
    pathspec at the end of the command line, just like normal
    "git diff".
  - "git subtree" (in contrib/) learned to grok GPG signing its
    commits.
  - "git whatchanged" that is longer to type than "git log --raw"
    which is its modern rough equivalent has outlived its
    usefulness more than 10 years ago.  Plan to deprecate and
    remove it.
  - An interchange format for stash entries is defined, and
    subcommand of "git stash" to import/export has been added.
  - "git merge/pull" has been taught the "--compact-summary"
    option to use the compact-summary format, intead of diffstat,
    when showing the summary of the incoming changes.
  - "git imap-send" has been broken for a long time, which has
    been resurrected and then taught to talk OAuth2.0 etc.
  - Some error messages from "git imap-send" has been updated.
  - When "git daemon" sees a signal while attempting to accept()
    a new client, instead of retrying, it skipped it by mistake,
    which has been corrected.
  - The reftable ref backend has matured enough; Git 3.0 will
    make it the default format in a newly created repositories by
    default.
  - "netrc" credential helper has been improved to understand
    textual service names (like smtp) in addition to the numeric
    port numbers (like 25).
  - Lift the limitation to use changed-path filter in "git log"
    so that it can be used for a pathspec with multiple literal
    paths.
  - Clean up the way how signature on commit objects are exported
    to and imported from fast-import stream.
  - Remove unsupported, unused, and unsupportable old option from
    "git log".
  - Document recently added "git imap-send --list" with an
    example.
  - "git pull" learned to pay attention to pull.autostash
    configuration variable, which overrides
    rebase/merge.autostash.
  - "git for-each-ref" learns "--start-after" option to help
    applications that want to page its output.
  - "git switch" and "git restore" are declared to be no longer
    experimental.
  - "git -c alias.foo=bar foo -h baz" reported "'foo' is aliased
    to 'bar'" and then went on to run "git foo -h baz", which was
    unexpected.  Tighten the rule so that alias expansion is
    reported only when "-h" is the sole option.
  - Performance, Internal Implementation, Development Support etc.
  - "git pack-objects" learned to find delta bases from blobs at
    the same path, using the --path-walk API.
  - CodingGuidelines update.
  - Add settings for Solaris 10 & 11.
  - Meson-based build/test framework now understands TAP output
    generated by our tests.
  - "Do not explicitly initialize to zero" rule has been
    clarified in the CodingGuidelines document.
  - A test helper "test_seq" function learned the "-f <fmt>"
    option, which allowed us to simplify a lot of test scripts.
  - A lot of stale stuff has been removed from the contrib/
    hierarchy.
  - "git push" and "git fetch" are taught to update refs in
    batches to gain performance.
  - Some code paths in "git prune" used to ignore the passed-in
    repository object and used the `the_repository` singleton
    instance instead, which has been corrected.
  - Update ".clang-format" and ".editorconfig" to match our style
    guide a bit better.
  - "make coccicheck" succeeds even when spatch made suggestions,
    which has been updated to fail in such a case.
  - Code clean-up around object access API.
  - Define .precision to more canned parse-options type to avoid
    bugs coming from using a variable with a wrong type to
    capture the parsed values.
  - Flipping the default hash function to SHA-256 at Git 3.0
    boundary is planned.
  - Declare weather-balloon we raised for "bool" type 18 months
    ago a success and officially allow using the type in our
    codebase.
  - GIT_TEST_INSTALLED was not honored in the recent topic
    related to SHA256 hashes, which has been corrected.
  - The pop_most_recent_commit() function can have quite
    expensive worst case performance characteristics, which has
    been optimized by using prio-queue data structure.
  - Move structure definition from unrelated header file to where
    it belongs.
  - To help our developers, document what C99 language features
    are being considered for adoption, in addition to what past
    experiments have already decided.
  - The reftable unit tests are now ported to the "clar" unit
    testing framework.
  - Redefine where the multi-pack-index sits in the object
    subsystem, which recently was restructured to allow multiple
    backends that support a single object source that belongs to
    one repository.  A MIDX does span multiple "object sources".
  - Reduce implicit assumption and dependence on the_repository
    in the object-file subsystem.
  - Fixes since v2.50 Unless otherwise noted, all the changes in
    2.50.X maintenance track, including security updates, are
    included in this release.
  - A memory-leak in an error code path has been plugged. (merge
    7082da85cb ly/commit-graph-graph-write-leakfix later to
    maint).
  - A memory-leak in an error code path has been plugged. (merge
    aedebdb6b9 ly/fetch-pack-leakfix later to maint).
  - Some leftover references to documentation source files that
    no longer exist, due to recent ".txt" -> ".adoc" renaming,
    have been corrected. (merge 3717a5775a
    jw/doc-txt-to-adoc-refs later to maint).
  - "git stash -p <pathspec>" improvements. (merge 468817bab2
    pw/stash-p-pathspec-fixes later to maint).
  - "git send-email" incremented its internal message counter
    when a message was edited, which made logic that treats the
    first message specially misbehave, which has been corrected.
    (merge 2cc27b3501 ag/send-email-edit-threading-fix later to
    maint).
  - "git stash" recorded a wrong branch name when submodules are
    present in the current checkout, which has been corrected.
    (merge ffb36c64f2 kj/stash-onbranch-submodule-fix later to
    maint).
  - When asking to apply mailmap to both author and committer
    field while showing a commit object, the field that appears
    later was not correctly parsed and replaced, which has been
    corrected. (merge abf94a283f sa/multi-mailmap-fix later to
    maint).
  - "git maintenance" lacked the care "git gc" had to avoid
    holding onto the repository lock for too long during packing
    refs, which has been remedied. (merge 1b5074e614
    ps/maintenance-ref-lock later to maint).
  - Avoid regexp_constraint and instead use comparison_constraint
    when listing functions to exclude from application of
    coccinelle rules, as spatch can be built with different
    regexp engine X-<. (merge f2ad545813
    jc/cocci-avoid-regexp-constraint later to maint).
  - Updating submodules from the upstream did not work well when
    submodule's HEAD is detached, which has been improved. (merge
    ca62f524c1 jk/submodule-remote-lookup-cleanup later to
    maint).
  - Remove unnecessary check from "git daemon" code. (merge
    0c856224d2 cb/daemon-fd-check-fix later to maint).
  - Use of sysctl() system call to learn the total RAM size used
    on BSDs has been corrected. (merge 781c1cf571
    cb/total-ram-bsd-fix later to maint).
  - Drop FreeBSD 4 support and declare that we support only
    FreeBSD 12 or later, which has memmem() supported. (merge
    0392f976a7 bs/config-mak-freebsd later to maint).
  - A diff-filter with negative-only specification like "git log
  - -diff-filter=d" did not trigger correctly, which has been
    fixed. (merge 375ac087c5 jk/all-negative-diff-filter-fix
    later to maint).
  - A failure to open the index file for writing due to
    conflicting access did not state what went wrong, which has
    been corrected. (merge 9455397a5c
    hy/read-cache-lock-error-fix later to maint).
  - Tempfile removal fix in the codepath to sign commits with SSH
    keys. (merge 4498127b04 re/ssh-sign-buffer-fix later to
    maint).
  - Code and test clean-up around string-list API. (merge
    6e5b26c3ff sj/string-list later to maint).
  - "git apply -N" should start from the current index and
    register only new files, but it instead started from an empty
    index, which has been corrected. (merge 2b49d97fcb
    rp/apply-intent-to-add-fix later to maint).
  - Leakfix with a new and a bit invasive test on pack-bitmap
    files. (merge bfd5522e98 ly/load-bitmap-leakfix later to
    maint).
  - "git fetch --prune" used to be O(n^2) expensive when there
    are many refs, which has been corrected. (merge 87d8d8c5d0
    ph/fetch-prune-optim later to maint).
  - When a ref creation at refs/heads/foo/bar fails, the files
    backend now removes refs/heads/foo/ if the directory is
    otherwise not used. (merge a3a7f20516
    ps/refs-files-remove-empty-parent later to maint).
  - "pack-objects" has been taught to avoid pointing into objects
    in cruft packs from midx.
  - "git remote" now detects remote names that overlap with each
    other (e.g., remote nickname "outer" and "outer/inner" are
    used at the same time), as it will lead to overlapping
    remote-tracking branches. (merge a5a727c448
    jk/remote-avoid-overlapping-names later to maint).
  - The gpg.program configuration variable, which names a
    pathname to the (custom) GPG compatible program, can now be
    spelled with ~tilde expansion. (merge 7d275cd5c0
    jb/gpg-program-variable-is-a-pathname later to maint).
  - Our <sane-ctype.h> header file relied on that the
    system-supplied <ctype.h> header is not later included, which
    would override our macro definitions, but "amazon linux"
    broke this assumption.  Fix this by preemptively including
    <ctype.h> near the beginning of <sane-ctype.h> ourselves.
    (merge 9d3b33125f ps/sane-ctype-workaround later to maint).
  - Clean-up compat/bswap.h mess. (merge f4ac32c03a
    ss/compat-bswap-revamp later to maint).
  - Meson-based build did not handle libexecdir setting
    correctly, which has been corrected. (merge 056dbe8612
    rj/meson-libexecdir-fix later to maint).
  - Document that we do not require "real" name when signing your
    patches off. (merge 1f0fed312a
    bc/contribution-under-non-real-names later to maint).
  - "git commit" that concludes a conflicted merge failed to
    notice and remove existing comment added automatically (like
    "# Conflicts:") when the core.commentstring is set to 'auto'.
    (merge 92b7c7c9f5 ac/auto-comment-char-fix later to maint).
  - "git rebase -i" with bogus rebase.instructionFormat
    configuration failed to produce the todo file after recording
    the state files, leading to confused "git status"; this has
    been corrected. (merge ade14bffd7
    ow/rebase-verify-insn-fmt-before-initializing-state later to
    maint).
  - A few file descriptors left unclosed upon program completion
    in a few test helper programs are now closed. (merge
    0f1b33815b hl/test-helper-fd-close later to maint).
  - Interactive prompt code did not correctly strip CRLF from the
    end of line on Windows. (merge 711a20827b js/prompt-crlf-fix
    later to maint).
  - The config API had a set of convenience wrapper functions
    that implicitly use the_repository instance; they have been
    removed and inlined at the calling sites.
  - "git add/etc -p" now honor the diff.context configuration
    variable, and also they learn to honor the -U<n> command-line
    option. (merge 2b3ae04011 lm/add-p-context later to maint).
  - The case where a new submodule takes a path where there used
    to be a completely different subproject is now dealt with a
    bit better than before. (merge 5ed8c5b465
    kj/renamed-submodule later to maint).
  - The deflate codepath in "git archive --format=zip" had a
    longstanding bug coming from misuse of zlib API, which has
    been corrected.
  - drop patches included in update:
    0001-git-gui-Replace-null_sha1-with-nullid.patch
    0001-gitk-Add-support-of-SHA256-repo.patch
    0002-git-gui-Add-support-of-SHA256-repo.patch
  - refreshed patches:
    CVE-2024-24577.patch
    completion-wordbreaks.diff
    git-tcsh-completion-fixes.diff
    setup-don-t-fail-if-commondir-reference-is-deleted.patch
  - contrib/workdir is dropped. remove references for it.

++++ vim:

  - Added patches:
    * reorder-exit-raw-mode.patch
  - Refresh patches:
    * vim-7.3-filetype_ftl.patch
    * vim-7.3-filetype_spec.patch
    * vim-7.3-sh_is_bash.patch
  - Fix the following CVEs and bugs:
    * bsc#1246602 (CVE-2025-53906)
    * bsc#1246604 (CVE-2025-53905)
    * bsc#1247939 (CVE-2025-55158)
    * bsc#1247938 (CVE-2025-55157)
  - Update to 9.1.1629:
    9.1.1629: Vim9: Not able to use more than 10 type arguments in a generic function
    9.1.1628: fuzzy.c has a few issues
    9.1.1627: fuzzy matching can be improved
    9.1.1626: cindent: does not handle compound literals
    9.1.1625: Autocompletion slow with include- and tag-completion
    9.1.1624: Cscope not enabled on MacOS
    9.1.1623: Buffer menu does not handle unicode names correctly
    9.1.1622: Patch v9.1.1432 causes performance regressions
    9.1.1621: flicker in popup menu during cmdline autocompletion
    9.1.1620: filetype: composer.lock and symfony.lock files not recognized
    9.1.1619: Incorrect E535 error message
    9.1.1618: completion: incorrect selected index returned from complete_info()
    9.1.1617: Vim9: some error messages can be improved
    9.1.1616: xxd: possible buffer overflow with bitwise output
    9.1.1615: diff format erroneously detected
    9.1.1614: Vim9: possible variable type change
    9.1.1613: tests: test_search leaves a few swapfiles behind
    9.1.1612: Ctrl-G/Ctrl-T do not ignore the end search delimiter
    9.1.1611: possible undefined behaviour in mb_decompose()
    9.1.1610: completion: hang or E684 when 'tagfunc' calls complete()
    9.1.1609: complete: Heap-buffer overflow with complete function
    9.1.1608: No command-line completion for :unsilent {command}
    9.1.1607: :apple command detected as :append
    9.1.1606: filetype: a few more files are not recognized
    9.1.1605: cannot specify scope for chdir()
    9.1.1604: completion: incsearch highlight might be lost
    9.1.1603: completion: cannot use autoloaded funcs in 'complete' F{func}
    9.1.1602: filetype: requirements-*.txt files are not recognized
    9.1.1601: Patch v8.1.0425 was wrong
    9.1.1600: using diff anchors with hidden buffers fails silently
    9.1.1599: :bnext doesn't go to unlisted help buffers
    9.1.1598: filetype: waybar config file is not recognized
    9.1.1597: CI reports leaks in libgtk3 library
    9.1.1596: tests: Test_search_wildmenu_iminsert() depends on help file
    9.1.1595: Wayland: non-portable use of select()
    9.1.1594: completion: search completion throws errors
    9.1.1593: Confusing error when compiling incomplete try block
    9.1.1592: Vim9: crash with classes and garbage collection
    9.1.1591: VMS support can be improved
    9.1.1590: cannot perform autocompletion
    9.1.1589: Cannot disable cscope interface using configure
    9.1.1588: Vim9: cannot split dict inside command block
    9.1.1587: Wayland: timeout not updated before select()
    9.1.1586: Vim9: can define an enum/interface in a function
    9.1.1585: Wayland: gvim still needs GVIM_ENABLE_WAYLAND
    9.1.1584: using ints as boolean type
    9.1.1583: gvim window lost its icons
    9.1.1582: style issue in vim9type.c and vim9generics.c
    9.1.1581: possible memory leak in vim9generics.c
    9.1.1580: possible memory leak in vim9type.c
    9.1.1579: Coverity complains about unchecked return value
    9.1.1578: configure: comment still mentions autoconf 2.71
    9.1.1577: Vim9: no generic support yet
    9.1.1576: cannot easily trigger wildcard expansion
    9.1.1575: tabpanel not drawn correctly with wrapped lines
    9.1.1574: Dead code in mbyte.c
    9.1.1573: Memory leak when pressing Ctrl-D in cmdline mode
    9.1.1572: expanding $var does not escape whitespace for 'path'
    9.1.1571: CmdlineChanged triggered to often
    9.1.1570: Copilot suggested some improvements in cmdexpand.c
    9.1.1569: tests: Vim9 tests can be improved
    9.1.1568: need a few more default highlight groups
    9.1.1567: crash when using inline diff mode
    9.1.1566: self-referenced enum may not get freed
    9.1.1565: configure: does not consider tiny version for wayland
    9.1.1564: crash when opening popup to closing buffer
    9.1.1563: completion: ruler may disappear
    9.1.1562: close button always visible in the 'tabline'
    9.1.1561: configure: wayland test can be improved
    9.1.1560: configure: uses $PKG_CONFIG before it is defined
    9.1.1559: tests: Test_popup_complete_info_01() fails when run alone
    9.1.1558: str2blob() treats NULL string and empty string differently
    9.1.1557: not possible to anchor specific lines in difff mode
    9.1.1556: string handling in cmdexpand.c can be improved
    9.1.1555: completion: repeated insertion of leader
    9.1.1554: crash when omni-completion opens command-line window
    9.1.1553: Vim9: crash when accessing a variable in if condition
    9.1.1552: [security]: path traversal issue in tar.vim
    9.1.1551: [security]: path traversal issue in zip.vim
    9.1.1550: defaults: 'showcmd' is not enabled in non-compatible mode on Unix
    9.1.1549: filetype: pkl files are not recognized
    9.1.1548: filetype: OpenFGA files are not recognized
    9.1.1547: Wayland: missing ifdef
    9.1.1546: Vim9: error with has() and short circuit evaluation
    9.1.1545: typo in os_unix.c
    9.1.1544: :retab cannot be limited to indentation only
    9.1.1543: Wayland: clipboard appears to not be working
    9.1.1542: Coverity complains about uninitialized variable
    9.1.1541: Vim9: error when last enum value ends with a comma
    9.1.1540: completion: menu state wrong on interruption
    9.1.1539: completion: messages don't respect 'shm' setting
    9.1.1537: helptoc: still some issues when markdown code blocks
    9.1.1536: tests: test_plugin_comment uses wrong :Check command
    9.1.1535: the maximum search count uses hard-coded value 99
    9.1.1534: unnecessary code in tabpanel.c
    9.1.1533: helptoc: does not handle code sections in markdown well
    9.1.1532: termdebug: not enough ways to configure breakpoints
    9.1.1531: confusing error with nested legacy function
    9.1.1530: Missing version change in v9.1.1529
    9.1.1529: Win32: the toolbar in the GUI is old and dated
    9.1.1528: completion: crash with getcompletion()
    9.1.1527: Vim9: Crash with string compound assignment
    9.1.1526: completion: search completion match may differ in case
    9.1.1525: tests: testdir/ is a bit messy
    9.1.1524: tests: too many imports in the test suite
    9.1.1523: tests: test_clipmethod fails in non X11 environment
    9.1.1522: tests: still some ANSI escape sequences in test output
    9.1.1521: completion: pum does not reset scroll pos on reopen with 'noselect'
    9.1.1520: completion: search completion doesn't handle 'smartcase' well
    9.1.1519: tests: Test_termdebug_decimal_breakpoints() may fail
    9.1.1518: getcompletiontype() may crash
    9.1.1517: filetype: autopkgtest files are not recognized
    9.1.1516: tests: no test that 'incsearch' is updated after search completion
    9.1.1515: Coverity complains about potential unterminated strings
    9.1.1514: Coverity complains about the use of tmpfile()
    9.1.1513: resizing Vim window causes unexpected internal window width
    9.1.1512: completion: can only complete from keyword characters
    9.1.1511: tests: two edit tests change v:testing from 1 to 0
    9.1.1510: Search completion may use invalid memory
    9.1.1509: patch 9.1.1505 was not good
    9.1.1508: string manipulation can be improved in cmdexpand.c
    9.1.1507: symlinks are resolved on :cd commands
    9.1.1506: tests: missing cleanup in Test_search_cmdline_incsearch_highlight()
    9.1.1505: not possible to return completion type for :ex command
    9.1.1504: filetype: numbat files are not recognized
    9.1.1503: filetype: haxe files are not recognized
    9.1.1502: filetype: quickbms files are not recognized
    9.1.1501: filetype: flix files are not recognized
    9.1.1500: if_python: typo in python error variable
    9.1.1499: MS-Windows: no indication of ARM64 architecture
    9.1.1498: completion: 'complete' funcs behave different to 'omnifunc'
    9.1.1497: Link error with shm_open()
    9.1.1496: terminal: still not highlighting empty cells correctly
    9.1.1495: Wayland: uses $XDG_SEAT to determine seat
    9.1.1494: runtime(tutor): no French translation for Chapter 2
    9.1.1493: manually comparing positions on buffer
    9.1.1492: tests: failure when Wayland compositor fails to start
    9.1.1491: missing out-of-memory checks in cmdexpand.c
    9.1.1490: 'wildchar' does not work in search contexts
    9.1.1489: terminal: no visual highlight of empty cols with empty 'listchars'
    9.1.1488: configure: using obsolete macro AC_PROG_GCC_TRADITIONAL
    9.1.1487: :cl doesn't invoke :clist
    9.1.1486: documentation issues with Wayland
    9.1.1485: missing Wayland clipboard support
    9.1.1484: tests: Turkish locale tests fails on Mac
    9.1.1483: not possible to translation position in buffer
    9.1.1482: scrolling with 'splitkeep' and line()
    9.1.1481: gcc complains about uninitialized variable
    9.1.1480: Turkish translation outdated
    9.1.1479: regression when displaying localized percentage position
    9.1.1478: Unused assignment in ex_uniq()
    9.1.1476: no easy way to deduplicate text
    9.1.1476: missing out-of-memory checks in cmdexpand.c
    9.1.1475: completion: regression when "nearest" in 'completeopt'
    9.1.1474: missing out-of-memory check in mark.c
    9.1.1473: inconsistent range arg for :diffget/diffput
    9.1.1472: if_python: PySequence_Fast_{GET_SIZE,GET_ITEM} removed
    9.1.1471: completion: inconsistent ordering with CTRL-P
    9.1.1470: use-after-free with popup callback on error
    9.1.1469: potential buffer-underflow with invalid hl_id
    9.1.1468: filetype: bright(er)script files are not recognized
    9.1.1467: too many strlen() calls
    9.1.1466: filetype: not all lex files are recognized
    9.1.1465: tabpanel: not correctly drawn with 'equalalways'
    9.1.1464: gv does not work in operator-pending mode
    9.1.1463: Integer overflow in getmarklist() after linewise operation
    9.1.1462: missing change from patch v9.1.1461
    9.1.1461: tabpanel: tabpanel vanishes with popup menu
    9.1.1460: MS-Windows: too many strlen() calls in os_win32.c
    9.1.1459: xxd: coloring output is inefficient
    9.1.1458: tabpanel: tabs not properly updated with 'stpl'
    9.1.1457: compile warning with tabpanelopt
    9.1.1456: comment plugin fails toggling if 'cms' contains \
    9.1.1455: Haiku: dailog objects created with no reference
    9.1.1454: tests: no test for pum at line break position
    9.1.1453: tests: Test_geometry() may fail
    9.1.1452: completion: redundant check for completion flags
    9.1.1451: tabpanel rendering artifacts when scrolling
    9.1.1450: Session has wrong arglist with :tcd and :arglocal
    9.1.1449: typo in pum_display()
    9.1.1448: tabpanel is not displayed correctly when msg_scrolled
    9.1.1447: completion: crash when backspacing with fuzzy completion
    9.1.1446: filetype: cuda-gdb config files are not recognized
    9.1.1445: negative matchfuzzy scores although there is a match
    9.1.1444: Unused assignment in set_fuzzy_score()
    9.1.1443: potential buffer underflow in insertchar()
    9.1.1442: tests: Test_diff_fold_redraw() is insufficient
    9.1.1441: completion: code can be improved
    9.1.1440: too many strlen() calls in os_win32.c
    9.1.1439: Last diff folds not merged
    9.1.1438: tests: Test_breakindent_list_split() fails
    9.1.1437: MS-Windows: internal compile error in uc_list()
    9.1.1436: GUI control code is displayed on the console on startup
    9.1.1435: completion: various flaws in fuzzy completion
    9.1.1434: MS-Windows: missing out-of-memory checks in os_win32.c
    9.1.1433: Unnecessary :if when writing session
    9.1.1432: GTK GUI: Buffer menu does not handle unicode correctly
    9.1.1431: Hit-Enter Prompt when loading session files
    9.1.1430: tabpanel may flicker in the GUI
    9.1.1429: dragging outside the tabpanel changes tabpagenr
    9.1.1428: completion: register completion needs cleanup
    9.1.1427: rendering artifacts with the tabpanel
    9.1.1426: completion: register contents not completed
    9.1.1425: tabpanel: there are still some problems with the tabpanel
    9.1.1424: PMenu selection broken with multi-line selection and limits
    9.1.1423: :tag command not working correctly using Vim9 Script
    9.1.1422: scheduling of complete function can be improved
    9.1.1421: tests: need a test for the new-style tutor.tutor
    9.1.1420: tests: could need some more tests for shebang lines
    9.1.1419: It is difficult to ignore all but some events
    9.1.1418: configures GUI auto detection favors GTK2
    9.1.1417: missing info about register completion in complete_info()
    9.1.1416: completion limits not respected for fuzzy completions
    9.1.1415: potential use-after free when there is an error in 'tabpanel'
    9.1.1414: MS-Windows: compile warnings in os_win32.c
    9.1.1413: spurious CursorHold triggered in GUI on startup
    9.1.1412: tests: Test_tabpanel_tabonly() fails on larger screens
    9.1.1411: crash when calling non-existing function for tabpanel
    9.1.1410: out-of-bounds access with 'completefunc'
    9.1.1409: using f-flag in 'complete' conflicts with Neovim
    9.1.1408: not easily possible to complete from register content
    9.1.1407: Can't use getpos('v') in OptionSet when using setbufvar()
    9.1.1406: crash when importing invalid tuple
    9.1.1405: tests: no test for mapping with special keys in session file
    9.1.1404: wrong link to Chapter 2 in new-tutor
    9.1.1403: expansion of 'tabpanelopt' value adds wrong values
    9.1.1402: multi-byte mappings not properly stored in session file
    9.1.1401: list not materialized in prop_list()
    9.1.1400: [security]: use-after-free when evaluating tuple fails
    9.1.1399: tests: test_codestyle fails for auto-generated files
    9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
    9.1.1397: tabpanel not correctly updated on :tabonly
    9.1.1396: 'errorformat' is a global option
    9.1.1395: search_stat not reset when pattern differs in case
    9.1.1394: tabpanel not correctly redrawn on tabonly
    9.1.1393: missing test for switching buffers and reusing curbuf
    9.1.1392: missing patch number
    9.1.1391: Vim does not have a vertical tabpanel
    9.1.1390: style: more wrong indentation
    9.1.1389: completion: still some issue when 'isexpand' contains a space
    9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
    9.1.1387: memory leak when buflist_new() fails to reuse curbuf
    9.1.1386: MS-Windows: some minor problems building on AARCH64
    9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
    9.1.1384: still some problem with the new tutors filetype plugin
    9.1.1383: completion: 'isexpand' option does not handle space char correct
    9.1.1382: if_ruby: unused compiler warnings from ruby internals
    9.1.1381: completion: cannot return to original text
    9.1.1380: 'eventignorewin' only checked for current buffer
    9.1.1379: MS-Windows: error when running evim when space in path
    9.1.1378: sign without text overwrites number option
    9.1.1377: patch v9.1.1370 causes some GTK warning messages
    9.1.1376: quickfix dummy buffer may remain as dummy buffer
    9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
    9.1.1374: completion: 'smartcase' not respected when filtering matches
    9.1.1373: 'completeopt' checking logic can be simplified
    9.1.1372: style: braces issues in various files
    9.1.1371: style: indentation and brace issues in insexpand.c
    9.1.1370: CI Tests favor GTK2 over GTK3
    9.1.1369: configure still using autoconf 2.71
    9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
    9.1.1367: too many strlen() calls in gui.c
    9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
    9.1.1365: MS-Windows: compile warnings and too many strlen() calls
    9.1.1364: style: more indentation issues
    9.1.1363: style: inconsistent indentation in various files
    9.1.1362: Vim9: type ignored when adding tuple to instance list var
    9.1.1361: [security]: possible use-after-free when closing a buffer
    9.1.1360: filetype: GNU Radio companion files are not recognized
    9.1.1359: filetype: GNU Radio config files are not recognized
    9.1.1358: if_lua: compile warnings with gcc15
    9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
    9.1.1356: Vim9: crash when unletting variable
    9.1.1355: The pum_redraw() function is too complex
    9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
    9.1.1353: missing change from v9.1.1350
    9.1.1352: style: inconsistent indent in insexpand.c
    9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
    9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
    9.1.1349: CmdlineLeavePre may trigger twice
    9.1.1348: still E315 with the terminal feature
    9.1.1347: small problems with gui_w32.c
    9.1.1346: missing out-of-memory check in textformat.c
    9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
    9.1.1344: double free in f_complete_match() (after v9.1.1341)
    9.1.1343: filetype: IPython files are not recognized
    9.1.1342: Shebang filetype detection can be improved
    9.1.1341: cannot define completion triggers
    9.1.1340: cannot complete :filetype arguments
    9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
    9.1.1338: Calling expand() interferes with cmdcomplete_info()
    9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
    9.1.1336: comment plugin does not support case-insensitive 'commentstring'
    9.1.1335: Coverity complains about Null pointer dereferences
    9.1.1334: Coverity complains about unchecked return value
    9.1.1333: Coverity: complains about unutilized variable
    9.1.1332: Vim9: segfault when using super within a lambda
    9.1.1331: Leaking memory with cmdcomplete()
    9.1.1330: may receive E315 in terminal
    9.1.1329: cannot get information about command line completion
    9.1.1328: too many strlen() calls in indent.c
    9.1.1327: filetype: nroff detection can be improved
    9.1.1326: invalid cursor position after 'tagfunc'
    9.1.1325: tests: not checking error numbers properly
    9.1.1324: undefined behaviour if X11 connection dies
    9.1.1323: b:undo_ftplugin not executed when re-using buffer
    9.1.1322: small delete register cannot paste multi-line correctly
    9.1.1321: filetype: MS ixx and mpp files are not recognized
    9.1.1320: filetype: alsoft config files are not recognized
    9.1.1319: Various typos in the code, issue with test_inst_complete.vim
    9.1.1318: tests: test_format fails
    9.1.1317: noisy error when restoring folds from session fails
    9.1.1316: missing memory allocation failure in os_mswin.c
    9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
    9.1.1314: max allowed string width too small
    9.1.1313: compile warning about uninitialized value
    9.1.1312: tests: Test_backupskip() fails when HOME is defined
    9.1.1311: completion: not possible to limit number of matches
    9.1.1310: completion: redundant check for preinsert effect
    9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
    9.1.1308: completion: cannot order matches by distance to cursor
    9.1.1307: make syntax does not reliably detect different flavors
    9.1.1306: completion menu rendering can be improved
    9.1.1305: completion menu active after switching windows/tabs
    9.1.1304: filetype: some man files are not recognized
    9.1.1303: missing out-of-memory check in linematch.c
    9.1.1302: Coverity warns about using uninitialized value
    9.1.1301: completion: cannot configure completion functions with 'complete'
    9.1.1300: wrong detection of -inf
    9.1.1299: filetype: mbsyncrc files are not recognized
    9.1.1298: define_function() is too long
    9.1.1297: Ctrl-D scrolling can get stuck
    9.1.1296: completion: incorrect truncation logic
    9.1.1295: clientserver: does not handle :stopinsert correctly
    9.1.1294: gui tabline menu does not use confirm when closing tabs
    9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
    9.1.1292: statusline not correctly evaluated
    9.1.1291: too many strlen() calls in buffer.c
    9.1.1290: tests: missing cleanup in test_filetype.vim
    9.1.1289: tests: no test for matchparen plugin with WinScrolled event
    9.1.1288: Using wrong window in ll_resize_stack()
    9.1.1287: quickfix code can be further improved
    9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
    9.1.1285: Vim9: no error message for missing method after "super."
    9.1.1284: not possible to configure pum truncation char
    9.1.1283: quickfix stack is limited to 10 items
    9.1.1282: Build and test failure without job feature
    9.1.1281: extra newline output when editing stdin
    9.1.1280: trailing additional semicolon in get_matches_in_str()
    9.1.1279: Vim9: null_object and null_class are no reserved names
    9.1.1278: Vim9: too long functions in vim9type.c
    9.1.1277: tests: trailing comment char in test_popupwin
    9.1.1276: inline word diff treats multibyte chars as word char
    9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
    9.1.1274: Vim9: no support for object<type> as variable type
    9.1.1273: Coverity warns about using uninitialized value
    9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
    9.1.1271: filetype: Power Query files are not recognized
    9.1.1270: missing out-of-memory checks in buffer.c
    9.1.1269: completion: compl_shown_match is updated when starting keyword completion
    9.1.1268: filetype: dax files are not recognized
    9.1.1267: Vim9: no support for type list/dict<object<any>>
    9.1.1266: MS-Windows: type conversion warnings
    9.1.1265: tests: no tests for typing normal char during completion
    9.1.1264: Vim9: error when comparing objects
    9.1.1263: string length wrong in get_last_inserted_save()
    9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
    9.1.1261: No test for 'pummaxwidth' non-truncated items
    9.1.1260: Hang when filtering buffer with NUL bytes
    9.1.1259: some issues with comment package and tailing spaces
    9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
    9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
    9.1.1256: if_python: duplicate tuple data entries
    9.1.1255: missing test condition for 'pummaxwidth' setting
    9.1.1254: need more tests for the comment plugin
    9.1.1253: abort when closing window with attached quickfix data
    9.1.1252: typos in code and docs related to 'diffopt' "inline:"
    9.1.1251: if_python: build error with tuples and dynamic python
    9.1.1250: cannot set the maximum popup menu width
    9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
    9.1.1248: compile error when building without FEAT_QUICKFIX
    9.1.1247: fragile setup to get (preferred) keys from key_name_entry
    9.1.1246: coverity complains about some changes in v9.1.1243
    9.1.1245: need some more tests for curly braces evaluation
    9.1.1244: part of patch v9.1.1242 was wrong
    9.1.1243: diff mode is lacking for changes within lines
    9.1.1242: Crash when evaluating variable name
    9.1.1241: wrong preprocessort indentation in term.c
    9.1.1240: Regression with ic/ac text objects and comment plugin
    9.1.1239: if_python: no tuple data type support
    9.1.1238: wrong cursor column with 'set splitkeep=screen'
    9.1.1237: Compile error with C89 compiler in term.c
    9.1.1236: tests: test_comments leaves swapfiles around
    9.1.1235: cproto files are outdated
    9.1.1234: Compile error when SIZE_MAX is not defined
    9.1.1233: Coverity warns about NULL pointer when triggering WinResized
    9.1.1232: Vim script is missing the tuple data type
    9.1.1231: filetype: SPA JSON files are not recognized
    9.1.1230: inconsistent CTRL-C behaviour for popup windows
    9.1.1229: the comment plugin can be improved
    9.1.1228: completion: current position column wrong after got a match
    9.1.1227: no tests for the comment package
    9.1.1226: "shellcmdline" completion doesn't work with input()
    9.1.1225: extra NULL check in VIM_CLEAR()
    9.1.1224: cannot :put while keeping indent
    9.1.1223: wrong translation used for encoding failures
    9.1.1222: using wrong length for last inserted string
    9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
    9.1.1220: filetype: uv.lock file not recognized
    9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
    9.1.1218: missing out-of-memory check in filepath.c
    9.1.1217: tests: typos in test_matchfuzzy.vim
    9.1.1216: Pasting the '.' register multiple times may not work
    9.1.1215: Patch 9.1.1213 has some issues
    9.1.1214: matchfuzzy() can be improved for camel case matches
    9.1.1213: cannot :put while keeping indent
    9.1.1212: too many strlen() calls in edit.c
    9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
    9.1.1211: TabClosedPre is triggered just before the tab is being freed
    9.1.1210: translation(ru): missing Russian translation for the new tutor
    9.1.1209: colorcolumn not drawn after virtual text lines
    9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
    9.1.1207: MS-Windows: build warning in filepath.c
    9.1.1206: tests: test_filetype fails when a file is a directory
    9.1.1205: completion: preinserted text not removed when closing pum
    9.1.1204: MS-Windows: crash when passing long string to expand()
    9.1.1203: matchparen keeps cursor on case label in sh filetype
    9.1.1202: Missing TabClosedPre autocommand
    9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
    9.1.1200: cmdline pum not cleared for input() completion
    9.1.1199: gvim uses hardcoded xpm icon file
    9.1.1198: [security]: potential data loss with zip.vim
    9.1.1197: process_next_cpt_value() uses wrong condition
    9.1.1196: filetype: config files for container tools are not recognized
    9.1.1195: inside try-block: fn body executed with default arg undefined
    9.1.1194: filetype: false positive help filetype detection
    9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
    9.1.1192: Vim crashes with term response debug logging enabled
    9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
    9.1.1190: C indentation does not detect multibyte labels
    9.1.1189: if_python: build error due to incompatible pointer types
    9.1.1188: runtime(tera): tera support can be improved
    9.1.1187: matchparen plugin wrong highlights shell case statement
    9.1.1186: filetype: help files in git repos are not detected
    9.1.1185: endless loop with completefuzzycollect and no match found
    9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
    9.1.1083: "above" virtual text breaks cursorlineopt=number
    9.1.1182: No cmdline completion for 'completefuzzycollect'
    9.1.1181: Unnecessary STRLEN() calls in insexpand.c
    9.1.1180: short-description
    9.1.1179: too many strlen() calls in misc2.c
    9.1.1178: not possible to generate completion candidates using fuzzy matching
    9.1.1177: filetype: tera files not detected

++++ vim:

  - Added patches:
    * reorder-exit-raw-mode.patch
  - Refresh patches:
    * vim-7.3-filetype_ftl.patch
    * vim-7.3-filetype_spec.patch
    * vim-7.3-sh_is_bash.patch
  - Fix the following CVEs and bugs:
    * bsc#1246602 (CVE-2025-53906)
    * bsc#1246604 (CVE-2025-53905)
    * bsc#1247939 (CVE-2025-55158)
    * bsc#1247938 (CVE-2025-55157)
  - Update to 9.1.1629:
    9.1.1629: Vim9: Not able to use more than 10 type arguments in a generic function
    9.1.1628: fuzzy.c has a few issues
    9.1.1627: fuzzy matching can be improved
    9.1.1626: cindent: does not handle compound literals
    9.1.1625: Autocompletion slow with include- and tag-completion
    9.1.1624: Cscope not enabled on MacOS
    9.1.1623: Buffer menu does not handle unicode names correctly
    9.1.1622: Patch v9.1.1432 causes performance regressions
    9.1.1621: flicker in popup menu during cmdline autocompletion
    9.1.1620: filetype: composer.lock and symfony.lock files not recognized
    9.1.1619: Incorrect E535 error message
    9.1.1618: completion: incorrect selected index returned from complete_info()
    9.1.1617: Vim9: some error messages can be improved
    9.1.1616: xxd: possible buffer overflow with bitwise output
    9.1.1615: diff format erroneously detected
    9.1.1614: Vim9: possible variable type change
    9.1.1613: tests: test_search leaves a few swapfiles behind
    9.1.1612: Ctrl-G/Ctrl-T do not ignore the end search delimiter
    9.1.1611: possible undefined behaviour in mb_decompose()
    9.1.1610: completion: hang or E684 when 'tagfunc' calls complete()
    9.1.1609: complete: Heap-buffer overflow with complete function
    9.1.1608: No command-line completion for :unsilent {command}
    9.1.1607: :apple command detected as :append
    9.1.1606: filetype: a few more files are not recognized
    9.1.1605: cannot specify scope for chdir()
    9.1.1604: completion: incsearch highlight might be lost
    9.1.1603: completion: cannot use autoloaded funcs in 'complete' F{func}
    9.1.1602: filetype: requirements-*.txt files are not recognized
    9.1.1601: Patch v8.1.0425 was wrong
    9.1.1600: using diff anchors with hidden buffers fails silently
    9.1.1599: :bnext doesn't go to unlisted help buffers
    9.1.1598: filetype: waybar config file is not recognized
    9.1.1597: CI reports leaks in libgtk3 library
    9.1.1596: tests: Test_search_wildmenu_iminsert() depends on help file
    9.1.1595: Wayland: non-portable use of select()
    9.1.1594: completion: search completion throws errors
    9.1.1593: Confusing error when compiling incomplete try block
    9.1.1592: Vim9: crash with classes and garbage collection
    9.1.1591: VMS support can be improved
    9.1.1590: cannot perform autocompletion
    9.1.1589: Cannot disable cscope interface using configure
    9.1.1588: Vim9: cannot split dict inside command block
    9.1.1587: Wayland: timeout not updated before select()
    9.1.1586: Vim9: can define an enum/interface in a function
    9.1.1585: Wayland: gvim still needs GVIM_ENABLE_WAYLAND
    9.1.1584: using ints as boolean type
    9.1.1583: gvim window lost its icons
    9.1.1582: style issue in vim9type.c and vim9generics.c
    9.1.1581: possible memory leak in vim9generics.c
    9.1.1580: possible memory leak in vim9type.c
    9.1.1579: Coverity complains about unchecked return value
    9.1.1578: configure: comment still mentions autoconf 2.71
    9.1.1577: Vim9: no generic support yet
    9.1.1576: cannot easily trigger wildcard expansion
    9.1.1575: tabpanel not drawn correctly with wrapped lines
    9.1.1574: Dead code in mbyte.c
    9.1.1573: Memory leak when pressing Ctrl-D in cmdline mode
    9.1.1572: expanding $var does not escape whitespace for 'path'
    9.1.1571: CmdlineChanged triggered to often
    9.1.1570: Copilot suggested some improvements in cmdexpand.c
    9.1.1569: tests: Vim9 tests can be improved
    9.1.1568: need a few more default highlight groups
    9.1.1567: crash when using inline diff mode
    9.1.1566: self-referenced enum may not get freed
    9.1.1565: configure: does not consider tiny version for wayland
    9.1.1564: crash when opening popup to closing buffer
    9.1.1563: completion: ruler may disappear
    9.1.1562: close button always visible in the 'tabline'
    9.1.1561: configure: wayland test can be improved
    9.1.1560: configure: uses $PKG_CONFIG before it is defined
    9.1.1559: tests: Test_popup_complete_info_01() fails when run alone
    9.1.1558: str2blob() treats NULL string and empty string differently
    9.1.1557: not possible to anchor specific lines in difff mode
    9.1.1556: string handling in cmdexpand.c can be improved
    9.1.1555: completion: repeated insertion of leader
    9.1.1554: crash when omni-completion opens command-line window
    9.1.1553: Vim9: crash when accessing a variable in if condition
    9.1.1552: [security]: path traversal issue in tar.vim
    9.1.1551: [security]: path traversal issue in zip.vim
    9.1.1550: defaults: 'showcmd' is not enabled in non-compatible mode on Unix
    9.1.1549: filetype: pkl files are not recognized
    9.1.1548: filetype: OpenFGA files are not recognized
    9.1.1547: Wayland: missing ifdef
    9.1.1546: Vim9: error with has() and short circuit evaluation
    9.1.1545: typo in os_unix.c
    9.1.1544: :retab cannot be limited to indentation only
    9.1.1543: Wayland: clipboard appears to not be working
    9.1.1542: Coverity complains about uninitialized variable
    9.1.1541: Vim9: error when last enum value ends with a comma
    9.1.1540: completion: menu state wrong on interruption
    9.1.1539: completion: messages don't respect 'shm' setting
    9.1.1537: helptoc: still some issues when markdown code blocks
    9.1.1536: tests: test_plugin_comment uses wrong :Check command
    9.1.1535: the maximum search count uses hard-coded value 99
    9.1.1534: unnecessary code in tabpanel.c
    9.1.1533: helptoc: does not handle code sections in markdown well
    9.1.1532: termdebug: not enough ways to configure breakpoints
    9.1.1531: confusing error with nested legacy function
    9.1.1530: Missing version change in v9.1.1529
    9.1.1529: Win32: the toolbar in the GUI is old and dated
    9.1.1528: completion: crash with getcompletion()
    9.1.1527: Vim9: Crash with string compound assignment
    9.1.1526: completion: search completion match may differ in case
    9.1.1525: tests: testdir/ is a bit messy
    9.1.1524: tests: too many imports in the test suite
    9.1.1523: tests: test_clipmethod fails in non X11 environment
    9.1.1522: tests: still some ANSI escape sequences in test output
    9.1.1521: completion: pum does not reset scroll pos on reopen with 'noselect'
    9.1.1520: completion: search completion doesn't handle 'smartcase' well
    9.1.1519: tests: Test_termdebug_decimal_breakpoints() may fail
    9.1.1518: getcompletiontype() may crash
    9.1.1517: filetype: autopkgtest files are not recognized
    9.1.1516: tests: no test that 'incsearch' is updated after search completion
    9.1.1515: Coverity complains about potential unterminated strings
    9.1.1514: Coverity complains about the use of tmpfile()
    9.1.1513: resizing Vim window causes unexpected internal window width
    9.1.1512: completion: can only complete from keyword characters
    9.1.1511: tests: two edit tests change v:testing from 1 to 0
    9.1.1510: Search completion may use invalid memory
    9.1.1509: patch 9.1.1505 was not good
    9.1.1508: string manipulation can be improved in cmdexpand.c
    9.1.1507: symlinks are resolved on :cd commands
    9.1.1506: tests: missing cleanup in Test_search_cmdline_incsearch_highlight()
    9.1.1505: not possible to return completion type for :ex command
    9.1.1504: filetype: numbat files are not recognized
    9.1.1503: filetype: haxe files are not recognized
    9.1.1502: filetype: quickbms files are not recognized
    9.1.1501: filetype: flix files are not recognized
    9.1.1500: if_python: typo in python error variable
    9.1.1499: MS-Windows: no indication of ARM64 architecture
    9.1.1498: completion: 'complete' funcs behave different to 'omnifunc'
    9.1.1497: Link error with shm_open()
    9.1.1496: terminal: still not highlighting empty cells correctly
    9.1.1495: Wayland: uses $XDG_SEAT to determine seat
    9.1.1494: runtime(tutor): no French translation for Chapter 2
    9.1.1493: manually comparing positions on buffer
    9.1.1492: tests: failure when Wayland compositor fails to start
    9.1.1491: missing out-of-memory checks in cmdexpand.c
    9.1.1490: 'wildchar' does not work in search contexts
    9.1.1489: terminal: no visual highlight of empty cols with empty 'listchars'
    9.1.1488: configure: using obsolete macro AC_PROG_GCC_TRADITIONAL
    9.1.1487: :cl doesn't invoke :clist
    9.1.1486: documentation issues with Wayland
    9.1.1485: missing Wayland clipboard support
    9.1.1484: tests: Turkish locale tests fails on Mac
    9.1.1483: not possible to translation position in buffer
    9.1.1482: scrolling with 'splitkeep' and line()
    9.1.1481: gcc complains about uninitialized variable
    9.1.1480: Turkish translation outdated
    9.1.1479: regression when displaying localized percentage position
    9.1.1478: Unused assignment in ex_uniq()
    9.1.1476: no easy way to deduplicate text
    9.1.1476: missing out-of-memory checks in cmdexpand.c
    9.1.1475: completion: regression when "nearest" in 'completeopt'
    9.1.1474: missing out-of-memory check in mark.c
    9.1.1473: inconsistent range arg for :diffget/diffput
    9.1.1472: if_python: PySequence_Fast_{GET_SIZE,GET_ITEM} removed
    9.1.1471: completion: inconsistent ordering with CTRL-P
    9.1.1470: use-after-free with popup callback on error
    9.1.1469: potential buffer-underflow with invalid hl_id
    9.1.1468: filetype: bright(er)script files are not recognized
    9.1.1467: too many strlen() calls
    9.1.1466: filetype: not all lex files are recognized
    9.1.1465: tabpanel: not correctly drawn with 'equalalways'
    9.1.1464: gv does not work in operator-pending mode
    9.1.1463: Integer overflow in getmarklist() after linewise operation
    9.1.1462: missing change from patch v9.1.1461
    9.1.1461: tabpanel: tabpanel vanishes with popup menu
    9.1.1460: MS-Windows: too many strlen() calls in os_win32.c
    9.1.1459: xxd: coloring output is inefficient
    9.1.1458: tabpanel: tabs not properly updated with 'stpl'
    9.1.1457: compile warning with tabpanelopt
    9.1.1456: comment plugin fails toggling if 'cms' contains \
    9.1.1455: Haiku: dailog objects created with no reference
    9.1.1454: tests: no test for pum at line break position
    9.1.1453: tests: Test_geometry() may fail
    9.1.1452: completion: redundant check for completion flags
    9.1.1451: tabpanel rendering artifacts when scrolling
    9.1.1450: Session has wrong arglist with :tcd and :arglocal
    9.1.1449: typo in pum_display()
    9.1.1448: tabpanel is not displayed correctly when msg_scrolled
    9.1.1447: completion: crash when backspacing with fuzzy completion
    9.1.1446: filetype: cuda-gdb config files are not recognized
    9.1.1445: negative matchfuzzy scores although there is a match
    9.1.1444: Unused assignment in set_fuzzy_score()
    9.1.1443: potential buffer underflow in insertchar()
    9.1.1442: tests: Test_diff_fold_redraw() is insufficient
    9.1.1441: completion: code can be improved
    9.1.1440: too many strlen() calls in os_win32.c
    9.1.1439: Last diff folds not merged
    9.1.1438: tests: Test_breakindent_list_split() fails
    9.1.1437: MS-Windows: internal compile error in uc_list()
    9.1.1436: GUI control code is displayed on the console on startup
    9.1.1435: completion: various flaws in fuzzy completion
    9.1.1434: MS-Windows: missing out-of-memory checks in os_win32.c
    9.1.1433: Unnecessary :if when writing session
    9.1.1432: GTK GUI: Buffer menu does not handle unicode correctly
    9.1.1431: Hit-Enter Prompt when loading session files
    9.1.1430: tabpanel may flicker in the GUI
    9.1.1429: dragging outside the tabpanel changes tabpagenr
    9.1.1428: completion: register completion needs cleanup
    9.1.1427: rendering artifacts with the tabpanel
    9.1.1426: completion: register contents not completed
    9.1.1425: tabpanel: there are still some problems with the tabpanel
    9.1.1424: PMenu selection broken with multi-line selection and limits
    9.1.1423: :tag command not working correctly using Vim9 Script
    9.1.1422: scheduling of complete function can be improved
    9.1.1421: tests: need a test for the new-style tutor.tutor
    9.1.1420: tests: could need some more tests for shebang lines
    9.1.1419: It is difficult to ignore all but some events
    9.1.1418: configures GUI auto detection favors GTK2
    9.1.1417: missing info about register completion in complete_info()
    9.1.1416: completion limits not respected for fuzzy completions
    9.1.1415: potential use-after free when there is an error in 'tabpanel'
    9.1.1414: MS-Windows: compile warnings in os_win32.c
    9.1.1413: spurious CursorHold triggered in GUI on startup
    9.1.1412: tests: Test_tabpanel_tabonly() fails on larger screens
    9.1.1411: crash when calling non-existing function for tabpanel
    9.1.1410: out-of-bounds access with 'completefunc'
    9.1.1409: using f-flag in 'complete' conflicts with Neovim
    9.1.1408: not easily possible to complete from register content
    9.1.1407: Can't use getpos('v') in OptionSet when using setbufvar()
    9.1.1406: crash when importing invalid tuple
    9.1.1405: tests: no test for mapping with special keys in session file
    9.1.1404: wrong link to Chapter 2 in new-tutor
    9.1.1403: expansion of 'tabpanelopt' value adds wrong values
    9.1.1402: multi-byte mappings not properly stored in session file
    9.1.1401: list not materialized in prop_list()
    9.1.1400: [security]: use-after-free when evaluating tuple fails
    9.1.1399: tests: test_codestyle fails for auto-generated files
    9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
    9.1.1397: tabpanel not correctly updated on :tabonly
    9.1.1396: 'errorformat' is a global option
    9.1.1395: search_stat not reset when pattern differs in case
    9.1.1394: tabpanel not correctly redrawn on tabonly
    9.1.1393: missing test for switching buffers and reusing curbuf
    9.1.1392: missing patch number
    9.1.1391: Vim does not have a vertical tabpanel
    9.1.1390: style: more wrong indentation
    9.1.1389: completion: still some issue when 'isexpand' contains a space
    9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
    9.1.1387: memory leak when buflist_new() fails to reuse curbuf
    9.1.1386: MS-Windows: some minor problems building on AARCH64
    9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
    9.1.1384: still some problem with the new tutors filetype plugin
    9.1.1383: completion: 'isexpand' option does not handle space char correct
    9.1.1382: if_ruby: unused compiler warnings from ruby internals
    9.1.1381: completion: cannot return to original text
    9.1.1380: 'eventignorewin' only checked for current buffer
    9.1.1379: MS-Windows: error when running evim when space in path
    9.1.1378: sign without text overwrites number option
    9.1.1377: patch v9.1.1370 causes some GTK warning messages
    9.1.1376: quickfix dummy buffer may remain as dummy buffer
    9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
    9.1.1374: completion: 'smartcase' not respected when filtering matches
    9.1.1373: 'completeopt' checking logic can be simplified
    9.1.1372: style: braces issues in various files
    9.1.1371: style: indentation and brace issues in insexpand.c
    9.1.1370: CI Tests favor GTK2 over GTK3
    9.1.1369: configure still using autoconf 2.71
    9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
    9.1.1367: too many strlen() calls in gui.c
    9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
    9.1.1365: MS-Windows: compile warnings and too many strlen() calls
    9.1.1364: style: more indentation issues
    9.1.1363: style: inconsistent indentation in various files
    9.1.1362: Vim9: type ignored when adding tuple to instance list var
    9.1.1361: [security]: possible use-after-free when closing a buffer
    9.1.1360: filetype: GNU Radio companion files are not recognized
    9.1.1359: filetype: GNU Radio config files are not recognized
    9.1.1358: if_lua: compile warnings with gcc15
    9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
    9.1.1356: Vim9: crash when unletting variable
    9.1.1355: The pum_redraw() function is too complex
    9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
    9.1.1353: missing change from v9.1.1350
    9.1.1352: style: inconsistent indent in insexpand.c
    9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
    9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
    9.1.1349: CmdlineLeavePre may trigger twice
    9.1.1348: still E315 with the terminal feature
    9.1.1347: small problems with gui_w32.c
    9.1.1346: missing out-of-memory check in textformat.c
    9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
    9.1.1344: double free in f_complete_match() (after v9.1.1341)
    9.1.1343: filetype: IPython files are not recognized
    9.1.1342: Shebang filetype detection can be improved
    9.1.1341: cannot define completion triggers
    9.1.1340: cannot complete :filetype arguments
    9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
    9.1.1338: Calling expand() interferes with cmdcomplete_info()
    9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
    9.1.1336: comment plugin does not support case-insensitive 'commentstring'
    9.1.1335: Coverity complains about Null pointer dereferences
    9.1.1334: Coverity complains about unchecked return value
    9.1.1333: Coverity: complains about unutilized variable
    9.1.1332: Vim9: segfault when using super within a lambda
    9.1.1331: Leaking memory with cmdcomplete()
    9.1.1330: may receive E315 in terminal
    9.1.1329: cannot get information about command line completion
    9.1.1328: too many strlen() calls in indent.c
    9.1.1327: filetype: nroff detection can be improved
    9.1.1326: invalid cursor position after 'tagfunc'
    9.1.1325: tests: not checking error numbers properly
    9.1.1324: undefined behaviour if X11 connection dies
    9.1.1323: b:undo_ftplugin not executed when re-using buffer
    9.1.1322: small delete register cannot paste multi-line correctly
    9.1.1321: filetype: MS ixx and mpp files are not recognized
    9.1.1320: filetype: alsoft config files are not recognized
    9.1.1319: Various typos in the code, issue with test_inst_complete.vim
    9.1.1318: tests: test_format fails
    9.1.1317: noisy error when restoring folds from session fails
    9.1.1316: missing memory allocation failure in os_mswin.c
    9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
    9.1.1314: max allowed string width too small
    9.1.1313: compile warning about uninitialized value
    9.1.1312: tests: Test_backupskip() fails when HOME is defined
    9.1.1311: completion: not possible to limit number of matches
    9.1.1310: completion: redundant check for preinsert effect
    9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
    9.1.1308: completion: cannot order matches by distance to cursor
    9.1.1307: make syntax does not reliably detect different flavors
    9.1.1306: completion menu rendering can be improved
    9.1.1305: completion menu active after switching windows/tabs
    9.1.1304: filetype: some man files are not recognized
    9.1.1303: missing out-of-memory check in linematch.c
    9.1.1302: Coverity warns about using uninitialized value
    9.1.1301: completion: cannot configure completion functions with 'complete'
    9.1.1300: wrong detection of -inf
    9.1.1299: filetype: mbsyncrc files are not recognized
    9.1.1298: define_function() is too long
    9.1.1297: Ctrl-D scrolling can get stuck
    9.1.1296: completion: incorrect truncation logic
    9.1.1295: clientserver: does not handle :stopinsert correctly
    9.1.1294: gui tabline menu does not use confirm when closing tabs
    9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
    9.1.1292: statusline not correctly evaluated
    9.1.1291: too many strlen() calls in buffer.c
    9.1.1290: tests: missing cleanup in test_filetype.vim
    9.1.1289: tests: no test for matchparen plugin with WinScrolled event
    9.1.1288: Using wrong window in ll_resize_stack()
    9.1.1287: quickfix code can be further improved
    9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
    9.1.1285: Vim9: no error message for missing method after "super."
    9.1.1284: not possible to configure pum truncation char
    9.1.1283: quickfix stack is limited to 10 items
    9.1.1282: Build and test failure without job feature
    9.1.1281: extra newline output when editing stdin
    9.1.1280: trailing additional semicolon in get_matches_in_str()
    9.1.1279: Vim9: null_object and null_class are no reserved names
    9.1.1278: Vim9: too long functions in vim9type.c
    9.1.1277: tests: trailing comment char in test_popupwin
    9.1.1276: inline word diff treats multibyte chars as word char
    9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
    9.1.1274: Vim9: no support for object<type> as variable type
    9.1.1273: Coverity warns about using uninitialized value
    9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
    9.1.1271: filetype: Power Query files are not recognized
    9.1.1270: missing out-of-memory checks in buffer.c
    9.1.1269: completion: compl_shown_match is updated when starting keyword completion
    9.1.1268: filetype: dax files are not recognized
    9.1.1267: Vim9: no support for type list/dict<object<any>>
    9.1.1266: MS-Windows: type conversion warnings
    9.1.1265: tests: no tests for typing normal char during completion
    9.1.1264: Vim9: error when comparing objects
    9.1.1263: string length wrong in get_last_inserted_save()
    9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
    9.1.1261: No test for 'pummaxwidth' non-truncated items
    9.1.1260: Hang when filtering buffer with NUL bytes
    9.1.1259: some issues with comment package and tailing spaces
    9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
    9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
    9.1.1256: if_python: duplicate tuple data entries
    9.1.1255: missing test condition for 'pummaxwidth' setting
    9.1.1254: need more tests for the comment plugin
    9.1.1253: abort when closing window with attached quickfix data
    9.1.1252: typos in code and docs related to 'diffopt' "inline:"
    9.1.1251: if_python: build error with tuples and dynamic python
    9.1.1250: cannot set the maximum popup menu width
    9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
    9.1.1248: compile error when building without FEAT_QUICKFIX
    9.1.1247: fragile setup to get (preferred) keys from key_name_entry
    9.1.1246: coverity complains about some changes in v9.1.1243
    9.1.1245: need some more tests for curly braces evaluation
    9.1.1244: part of patch v9.1.1242 was wrong
    9.1.1243: diff mode is lacking for changes within lines
    9.1.1242: Crash when evaluating variable name
    9.1.1241: wrong preprocessort indentation in term.c
    9.1.1240: Regression with ic/ac text objects and comment plugin
    9.1.1239: if_python: no tuple data type support
    9.1.1238: wrong cursor column with 'set splitkeep=screen'
    9.1.1237: Compile error with C89 compiler in term.c
    9.1.1236: tests: test_comments leaves swapfiles around
    9.1.1235: cproto files are outdated
    9.1.1234: Compile error when SIZE_MAX is not defined
    9.1.1233: Coverity warns about NULL pointer when triggering WinResized
    9.1.1232: Vim script is missing the tuple data type
    9.1.1231: filetype: SPA JSON files are not recognized
    9.1.1230: inconsistent CTRL-C behaviour for popup windows
    9.1.1229: the comment plugin can be improved
    9.1.1228: completion: current position column wrong after got a match
    9.1.1227: no tests for the comment package
    9.1.1226: "shellcmdline" completion doesn't work with input()
    9.1.1225: extra NULL check in VIM_CLEAR()
    9.1.1224: cannot :put while keeping indent
    9.1.1223: wrong translation used for encoding failures
    9.1.1222: using wrong length for last inserted string
    9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
    9.1.1220: filetype: uv.lock file not recognized
    9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
    9.1.1218: missing out-of-memory check in filepath.c
    9.1.1217: tests: typos in test_matchfuzzy.vim
    9.1.1216: Pasting the '.' register multiple times may not work
    9.1.1215: Patch 9.1.1213 has some issues
    9.1.1214: matchfuzzy() can be improved for camel case matches
    9.1.1213: cannot :put while keeping indent
    9.1.1212: too many strlen() calls in edit.c
    9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
    9.1.1211: TabClosedPre is triggered just before the tab is being freed
    9.1.1210: translation(ru): missing Russian translation for the new tutor
    9.1.1209: colorcolumn not drawn after virtual text lines
    9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
    9.1.1207: MS-Windows: build warning in filepath.c
    9.1.1206: tests: test_filetype fails when a file is a directory
    9.1.1205: completion: preinserted text not removed when closing pum
    9.1.1204: MS-Windows: crash when passing long string to expand()
    9.1.1203: matchparen keeps cursor on case label in sh filetype
    9.1.1202: Missing TabClosedPre autocommand
    9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
    9.1.1200: cmdline pum not cleared for input() completion
    9.1.1199: gvim uses hardcoded xpm icon file
    9.1.1198: [security]: potential data loss with zip.vim
    9.1.1197: process_next_cpt_value() uses wrong condition
    9.1.1196: filetype: config files for container tools are not recognized
    9.1.1195: inside try-block: fn body executed with default arg undefined
    9.1.1194: filetype: false positive help filetype detection
    9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
    9.1.1192: Vim crashes with term response debug logging enabled
    9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
    9.1.1190: C indentation does not detect multibyte labels
    9.1.1189: if_python: build error due to incompatible pointer types
    9.1.1188: runtime(tera): tera support can be improved
    9.1.1187: matchparen plugin wrong highlights shell case statement
    9.1.1186: filetype: help files in git repos are not detected
    9.1.1185: endless loop with completefuzzycollect and no match found
    9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
    9.1.1083: "above" virtual text breaks cursorlineopt=number
    9.1.1182: No cmdline completion for 'completefuzzycollect'
    9.1.1181: Unnecessary STRLEN() calls in insexpand.c
    9.1.1180: short-description
    9.1.1179: too many strlen() calls in misc2.c
    9.1.1178: not possible to generate completion candidates using fuzzy matching
    9.1.1177: filetype: tera files not detected

++++ vim:

  - Added patches:
    * reorder-exit-raw-mode.patch
  - Refresh patches:
    * vim-7.3-filetype_ftl.patch
    * vim-7.3-filetype_spec.patch
    * vim-7.3-sh_is_bash.patch
  - Fix the following CVEs and bugs:
    * bsc#1246602 (CVE-2025-53906)
    * bsc#1246604 (CVE-2025-53905)
    * bsc#1247939 (CVE-2025-55158)
    * bsc#1247938 (CVE-2025-55157)
  - Update to 9.1.1629:
    9.1.1629: Vim9: Not able to use more than 10 type arguments in a generic function
    9.1.1628: fuzzy.c has a few issues
    9.1.1627: fuzzy matching can be improved
    9.1.1626: cindent: does not handle compound literals
    9.1.1625: Autocompletion slow with include- and tag-completion
    9.1.1624: Cscope not enabled on MacOS
    9.1.1623: Buffer menu does not handle unicode names correctly
    9.1.1622: Patch v9.1.1432 causes performance regressions
    9.1.1621: flicker in popup menu during cmdline autocompletion
    9.1.1620: filetype: composer.lock and symfony.lock files not recognized
    9.1.1619: Incorrect E535 error message
    9.1.1618: completion: incorrect selected index returned from complete_info()
    9.1.1617: Vim9: some error messages can be improved
    9.1.1616: xxd: possible buffer overflow with bitwise output
    9.1.1615: diff format erroneously detected
    9.1.1614: Vim9: possible variable type change
    9.1.1613: tests: test_search leaves a few swapfiles behind
    9.1.1612: Ctrl-G/Ctrl-T do not ignore the end search delimiter
    9.1.1611: possible undefined behaviour in mb_decompose()
    9.1.1610: completion: hang or E684 when 'tagfunc' calls complete()
    9.1.1609: complete: Heap-buffer overflow with complete function
    9.1.1608: No command-line completion for :unsilent {command}
    9.1.1607: :apple command detected as :append
    9.1.1606: filetype: a few more files are not recognized
    9.1.1605: cannot specify scope for chdir()
    9.1.1604: completion: incsearch highlight might be lost
    9.1.1603: completion: cannot use autoloaded funcs in 'complete' F{func}
    9.1.1602: filetype: requirements-*.txt files are not recognized
    9.1.1601: Patch v8.1.0425 was wrong
    9.1.1600: using diff anchors with hidden buffers fails silently
    9.1.1599: :bnext doesn't go to unlisted help buffers
    9.1.1598: filetype: waybar config file is not recognized
    9.1.1597: CI reports leaks in libgtk3 library
    9.1.1596: tests: Test_search_wildmenu_iminsert() depends on help file
    9.1.1595: Wayland: non-portable use of select()
    9.1.1594: completion: search completion throws errors
    9.1.1593: Confusing error when compiling incomplete try block
    9.1.1592: Vim9: crash with classes and garbage collection
    9.1.1591: VMS support can be improved
    9.1.1590: cannot perform autocompletion
    9.1.1589: Cannot disable cscope interface using configure
    9.1.1588: Vim9: cannot split dict inside command block
    9.1.1587: Wayland: timeout not updated before select()
    9.1.1586: Vim9: can define an enum/interface in a function
    9.1.1585: Wayland: gvim still needs GVIM_ENABLE_WAYLAND
    9.1.1584: using ints as boolean type
    9.1.1583: gvim window lost its icons
    9.1.1582: style issue in vim9type.c and vim9generics.c
    9.1.1581: possible memory leak in vim9generics.c
    9.1.1580: possible memory leak in vim9type.c
    9.1.1579: Coverity complains about unchecked return value
    9.1.1578: configure: comment still mentions autoconf 2.71
    9.1.1577: Vim9: no generic support yet
    9.1.1576: cannot easily trigger wildcard expansion
    9.1.1575: tabpanel not drawn correctly with wrapped lines
    9.1.1574: Dead code in mbyte.c
    9.1.1573: Memory leak when pressing Ctrl-D in cmdline mode
    9.1.1572: expanding $var does not escape whitespace for 'path'
    9.1.1571: CmdlineChanged triggered to often
    9.1.1570: Copilot suggested some improvements in cmdexpand.c
    9.1.1569: tests: Vim9 tests can be improved
    9.1.1568: need a few more default highlight groups
    9.1.1567: crash when using inline diff mode
    9.1.1566: self-referenced enum may not get freed
    9.1.1565: configure: does not consider tiny version for wayland
    9.1.1564: crash when opening popup to closing buffer
    9.1.1563: completion: ruler may disappear
    9.1.1562: close button always visible in the 'tabline'
    9.1.1561: configure: wayland test can be improved
    9.1.1560: configure: uses $PKG_CONFIG before it is defined
    9.1.1559: tests: Test_popup_complete_info_01() fails when run alone
    9.1.1558: str2blob() treats NULL string and empty string differently
    9.1.1557: not possible to anchor specific lines in difff mode
    9.1.1556: string handling in cmdexpand.c can be improved
    9.1.1555: completion: repeated insertion of leader
    9.1.1554: crash when omni-completion opens command-line window
    9.1.1553: Vim9: crash when accessing a variable in if condition
    9.1.1552: [security]: path traversal issue in tar.vim
    9.1.1551: [security]: path traversal issue in zip.vim
    9.1.1550: defaults: 'showcmd' is not enabled in non-compatible mode on Unix
    9.1.1549: filetype: pkl files are not recognized
    9.1.1548: filetype: OpenFGA files are not recognized
    9.1.1547: Wayland: missing ifdef
    9.1.1546: Vim9: error with has() and short circuit evaluation
    9.1.1545: typo in os_unix.c
    9.1.1544: :retab cannot be limited to indentation only
    9.1.1543: Wayland: clipboard appears to not be working
    9.1.1542: Coverity complains about uninitialized variable
    9.1.1541: Vim9: error when last enum value ends with a comma
    9.1.1540: completion: menu state wrong on interruption
    9.1.1539: completion: messages don't respect 'shm' setting
    9.1.1537: helptoc: still some issues when markdown code blocks
    9.1.1536: tests: test_plugin_comment uses wrong :Check command
    9.1.1535: the maximum search count uses hard-coded value 99
    9.1.1534: unnecessary code in tabpanel.c
    9.1.1533: helptoc: does not handle code sections in markdown well
    9.1.1532: termdebug: not enough ways to configure breakpoints
    9.1.1531: confusing error with nested legacy function
    9.1.1530: Missing version change in v9.1.1529
    9.1.1529: Win32: the toolbar in the GUI is old and dated
    9.1.1528: completion: crash with getcompletion()
    9.1.1527: Vim9: Crash with string compound assignment
    9.1.1526: completion: search completion match may differ in case
    9.1.1525: tests: testdir/ is a bit messy
    9.1.1524: tests: too many imports in the test suite
    9.1.1523: tests: test_clipmethod fails in non X11 environment
    9.1.1522: tests: still some ANSI escape sequences in test output
    9.1.1521: completion: pum does not reset scroll pos on reopen with 'noselect'
    9.1.1520: completion: search completion doesn't handle 'smartcase' well
    9.1.1519: tests: Test_termdebug_decimal_breakpoints() may fail
    9.1.1518: getcompletiontype() may crash
    9.1.1517: filetype: autopkgtest files are not recognized
    9.1.1516: tests: no test that 'incsearch' is updated after search completion
    9.1.1515: Coverity complains about potential unterminated strings
    9.1.1514: Coverity complains about the use of tmpfile()
    9.1.1513: resizing Vim window causes unexpected internal window width
    9.1.1512: completion: can only complete from keyword characters
    9.1.1511: tests: two edit tests change v:testing from 1 to 0
    9.1.1510: Search completion may use invalid memory
    9.1.1509: patch 9.1.1505 was not good
    9.1.1508: string manipulation can be improved in cmdexpand.c
    9.1.1507: symlinks are resolved on :cd commands
    9.1.1506: tests: missing cleanup in Test_search_cmdline_incsearch_highlight()
    9.1.1505: not possible to return completion type for :ex command
    9.1.1504: filetype: numbat files are not recognized
    9.1.1503: filetype: haxe files are not recognized
    9.1.1502: filetype: quickbms files are not recognized
    9.1.1501: filetype: flix files are not recognized
    9.1.1500: if_python: typo in python error variable
    9.1.1499: MS-Windows: no indication of ARM64 architecture
    9.1.1498: completion: 'complete' funcs behave different to 'omnifunc'
    9.1.1497: Link error with shm_open()
    9.1.1496: terminal: still not highlighting empty cells correctly
    9.1.1495: Wayland: uses $XDG_SEAT to determine seat
    9.1.1494: runtime(tutor): no French translation for Chapter 2
    9.1.1493: manually comparing positions on buffer
    9.1.1492: tests: failure when Wayland compositor fails to start
    9.1.1491: missing out-of-memory checks in cmdexpand.c
    9.1.1490: 'wildchar' does not work in search contexts
    9.1.1489: terminal: no visual highlight of empty cols with empty 'listchars'
    9.1.1488: configure: using obsolete macro AC_PROG_GCC_TRADITIONAL
    9.1.1487: :cl doesn't invoke :clist
    9.1.1486: documentation issues with Wayland
    9.1.1485: missing Wayland clipboard support
    9.1.1484: tests: Turkish locale tests fails on Mac
    9.1.1483: not possible to translation position in buffer
    9.1.1482: scrolling with 'splitkeep' and line()
    9.1.1481: gcc complains about uninitialized variable
    9.1.1480: Turkish translation outdated
    9.1.1479: regression when displaying localized percentage position
    9.1.1478: Unused assignment in ex_uniq()
    9.1.1476: no easy way to deduplicate text
    9.1.1476: missing out-of-memory checks in cmdexpand.c
    9.1.1475: completion: regression when "nearest" in 'completeopt'
    9.1.1474: missing out-of-memory check in mark.c
    9.1.1473: inconsistent range arg for :diffget/diffput
    9.1.1472: if_python: PySequence_Fast_{GET_SIZE,GET_ITEM} removed
    9.1.1471: completion: inconsistent ordering with CTRL-P
    9.1.1470: use-after-free with popup callback on error
    9.1.1469: potential buffer-underflow with invalid hl_id
    9.1.1468: filetype: bright(er)script files are not recognized
    9.1.1467: too many strlen() calls
    9.1.1466: filetype: not all lex files are recognized
    9.1.1465: tabpanel: not correctly drawn with 'equalalways'
    9.1.1464: gv does not work in operator-pending mode
    9.1.1463: Integer overflow in getmarklist() after linewise operation
    9.1.1462: missing change from patch v9.1.1461
    9.1.1461: tabpanel: tabpanel vanishes with popup menu
    9.1.1460: MS-Windows: too many strlen() calls in os_win32.c
    9.1.1459: xxd: coloring output is inefficient
    9.1.1458: tabpanel: tabs not properly updated with 'stpl'
    9.1.1457: compile warning with tabpanelopt
    9.1.1456: comment plugin fails toggling if 'cms' contains \
    9.1.1455: Haiku: dailog objects created with no reference
    9.1.1454: tests: no test for pum at line break position
    9.1.1453: tests: Test_geometry() may fail
    9.1.1452: completion: redundant check for completion flags
    9.1.1451: tabpanel rendering artifacts when scrolling
    9.1.1450: Session has wrong arglist with :tcd and :arglocal
    9.1.1449: typo in pum_display()
    9.1.1448: tabpanel is not displayed correctly when msg_scrolled
    9.1.1447: completion: crash when backspacing with fuzzy completion
    9.1.1446: filetype: cuda-gdb config files are not recognized
    9.1.1445: negative matchfuzzy scores although there is a match
    9.1.1444: Unused assignment in set_fuzzy_score()
    9.1.1443: potential buffer underflow in insertchar()
    9.1.1442: tests: Test_diff_fold_redraw() is insufficient
    9.1.1441: completion: code can be improved
    9.1.1440: too many strlen() calls in os_win32.c
    9.1.1439: Last diff folds not merged
    9.1.1438: tests: Test_breakindent_list_split() fails
    9.1.1437: MS-Windows: internal compile error in uc_list()
    9.1.1436: GUI control code is displayed on the console on startup
    9.1.1435: completion: various flaws in fuzzy completion
    9.1.1434: MS-Windows: missing out-of-memory checks in os_win32.c
    9.1.1433: Unnecessary :if when writing session
    9.1.1432: GTK GUI: Buffer menu does not handle unicode correctly
    9.1.1431: Hit-Enter Prompt when loading session files
    9.1.1430: tabpanel may flicker in the GUI
    9.1.1429: dragging outside the tabpanel changes tabpagenr
    9.1.1428: completion: register completion needs cleanup
    9.1.1427: rendering artifacts with the tabpanel
    9.1.1426: completion: register contents not completed
    9.1.1425: tabpanel: there are still some problems with the tabpanel
    9.1.1424: PMenu selection broken with multi-line selection and limits
    9.1.1423: :tag command not working correctly using Vim9 Script
    9.1.1422: scheduling of complete function can be improved
    9.1.1421: tests: need a test for the new-style tutor.tutor
    9.1.1420: tests: could need some more tests for shebang lines
    9.1.1419: It is difficult to ignore all but some events
    9.1.1418: configures GUI auto detection favors GTK2
    9.1.1417: missing info about register completion in complete_info()
    9.1.1416: completion limits not respected for fuzzy completions
    9.1.1415: potential use-after free when there is an error in 'tabpanel'
    9.1.1414: MS-Windows: compile warnings in os_win32.c
    9.1.1413: spurious CursorHold triggered in GUI on startup
    9.1.1412: tests: Test_tabpanel_tabonly() fails on larger screens
    9.1.1411: crash when calling non-existing function for tabpanel
    9.1.1410: out-of-bounds access with 'completefunc'
    9.1.1409: using f-flag in 'complete' conflicts with Neovim
    9.1.1408: not easily possible to complete from register content
    9.1.1407: Can't use getpos('v') in OptionSet when using setbufvar()
    9.1.1406: crash when importing invalid tuple
    9.1.1405: tests: no test for mapping with special keys in session file
    9.1.1404: wrong link to Chapter 2 in new-tutor
    9.1.1403: expansion of 'tabpanelopt' value adds wrong values
    9.1.1402: multi-byte mappings not properly stored in session file
    9.1.1401: list not materialized in prop_list()
    9.1.1400: [security]: use-after-free when evaluating tuple fails
    9.1.1399: tests: test_codestyle fails for auto-generated files
    9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
    9.1.1397: tabpanel not correctly updated on :tabonly
    9.1.1396: 'errorformat' is a global option
    9.1.1395: search_stat not reset when pattern differs in case
    9.1.1394: tabpanel not correctly redrawn on tabonly
    9.1.1393: missing test for switching buffers and reusing curbuf
    9.1.1392: missing patch number
    9.1.1391: Vim does not have a vertical tabpanel
    9.1.1390: style: more wrong indentation
    9.1.1389: completion: still some issue when 'isexpand' contains a space
    9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
    9.1.1387: memory leak when buflist_new() fails to reuse curbuf
    9.1.1386: MS-Windows: some minor problems building on AARCH64
    9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
    9.1.1384: still some problem with the new tutors filetype plugin
    9.1.1383: completion: 'isexpand' option does not handle space char correct
    9.1.1382: if_ruby: unused compiler warnings from ruby internals
    9.1.1381: completion: cannot return to original text
    9.1.1380: 'eventignorewin' only checked for current buffer
    9.1.1379: MS-Windows: error when running evim when space in path
    9.1.1378: sign without text overwrites number option
    9.1.1377: patch v9.1.1370 causes some GTK warning messages
    9.1.1376: quickfix dummy buffer may remain as dummy buffer
    9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
    9.1.1374: completion: 'smartcase' not respected when filtering matches
    9.1.1373: 'completeopt' checking logic can be simplified
    9.1.1372: style: braces issues in various files
    9.1.1371: style: indentation and brace issues in insexpand.c
    9.1.1370: CI Tests favor GTK2 over GTK3
    9.1.1369: configure still using autoconf 2.71
    9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
    9.1.1367: too many strlen() calls in gui.c
    9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
    9.1.1365: MS-Windows: compile warnings and too many strlen() calls
    9.1.1364: style: more indentation issues
    9.1.1363: style: inconsistent indentation in various files
    9.1.1362: Vim9: type ignored when adding tuple to instance list var
    9.1.1361: [security]: possible use-after-free when closing a buffer
    9.1.1360: filetype: GNU Radio companion files are not recognized
    9.1.1359: filetype: GNU Radio config files are not recognized
    9.1.1358: if_lua: compile warnings with gcc15
    9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
    9.1.1356: Vim9: crash when unletting variable
    9.1.1355: The pum_redraw() function is too complex
    9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
    9.1.1353: missing change from v9.1.1350
    9.1.1352: style: inconsistent indent in insexpand.c
    9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
    9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
    9.1.1349: CmdlineLeavePre may trigger twice
    9.1.1348: still E315 with the terminal feature
    9.1.1347: small problems with gui_w32.c
    9.1.1346: missing out-of-memory check in textformat.c
    9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
    9.1.1344: double free in f_complete_match() (after v9.1.1341)
    9.1.1343: filetype: IPython files are not recognized
    9.1.1342: Shebang filetype detection can be improved
    9.1.1341: cannot define completion triggers
    9.1.1340: cannot complete :filetype arguments
    9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
    9.1.1338: Calling expand() interferes with cmdcomplete_info()
    9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
    9.1.1336: comment plugin does not support case-insensitive 'commentstring'
    9.1.1335: Coverity complains about Null pointer dereferences
    9.1.1334: Coverity complains about unchecked return value
    9.1.1333: Coverity: complains about unutilized variable
    9.1.1332: Vim9: segfault when using super within a lambda
    9.1.1331: Leaking memory with cmdcomplete()
    9.1.1330: may receive E315 in terminal
    9.1.1329: cannot get information about command line completion
    9.1.1328: too many strlen() calls in indent.c
    9.1.1327: filetype: nroff detection can be improved
    9.1.1326: invalid cursor position after 'tagfunc'
    9.1.1325: tests: not checking error numbers properly
    9.1.1324: undefined behaviour if X11 connection dies
    9.1.1323: b:undo_ftplugin not executed when re-using buffer
    9.1.1322: small delete register cannot paste multi-line correctly
    9.1.1321: filetype: MS ixx and mpp files are not recognized
    9.1.1320: filetype: alsoft config files are not recognized
    9.1.1319: Various typos in the code, issue with test_inst_complete.vim
    9.1.1318: tests: test_format fails
    9.1.1317: noisy error when restoring folds from session fails
    9.1.1316: missing memory allocation failure in os_mswin.c
    9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
    9.1.1314: max allowed string width too small
    9.1.1313: compile warning about uninitialized value
    9.1.1312: tests: Test_backupskip() fails when HOME is defined
    9.1.1311: completion: not possible to limit number of matches
    9.1.1310: completion: redundant check for preinsert effect
    9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
    9.1.1308: completion: cannot order matches by distance to cursor
    9.1.1307: make syntax does not reliably detect different flavors
    9.1.1306: completion menu rendering can be improved
    9.1.1305: completion menu active after switching windows/tabs
    9.1.1304: filetype: some man files are not recognized
    9.1.1303: missing out-of-memory check in linematch.c
    9.1.1302: Coverity warns about using uninitialized value
    9.1.1301: completion: cannot configure completion functions with 'complete'
    9.1.1300: wrong detection of -inf
    9.1.1299: filetype: mbsyncrc files are not recognized
    9.1.1298: define_function() is too long
    9.1.1297: Ctrl-D scrolling can get stuck
    9.1.1296: completion: incorrect truncation logic
    9.1.1295: clientserver: does not handle :stopinsert correctly
    9.1.1294: gui tabline menu does not use confirm when closing tabs
    9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
    9.1.1292: statusline not correctly evaluated
    9.1.1291: too many strlen() calls in buffer.c
    9.1.1290: tests: missing cleanup in test_filetype.vim
    9.1.1289: tests: no test for matchparen plugin with WinScrolled event
    9.1.1288: Using wrong window in ll_resize_stack()
    9.1.1287: quickfix code can be further improved
    9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
    9.1.1285: Vim9: no error message for missing method after "super."
    9.1.1284: not possible to configure pum truncation char
    9.1.1283: quickfix stack is limited to 10 items
    9.1.1282: Build and test failure without job feature
    9.1.1281: extra newline output when editing stdin
    9.1.1280: trailing additional semicolon in get_matches_in_str()
    9.1.1279: Vim9: null_object and null_class are no reserved names
    9.1.1278: Vim9: too long functions in vim9type.c
    9.1.1277: tests: trailing comment char in test_popupwin
    9.1.1276: inline word diff treats multibyte chars as word char
    9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
    9.1.1274: Vim9: no support for object<type> as variable type
    9.1.1273: Coverity warns about using uninitialized value
    9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
    9.1.1271: filetype: Power Query files are not recognized
    9.1.1270: missing out-of-memory checks in buffer.c
    9.1.1269: completion: compl_shown_match is updated when starting keyword completion
    9.1.1268: filetype: dax files are not recognized
    9.1.1267: Vim9: no support for type list/dict<object<any>>
    9.1.1266: MS-Windows: type conversion warnings
    9.1.1265: tests: no tests for typing normal char during completion
    9.1.1264: Vim9: error when comparing objects
    9.1.1263: string length wrong in get_last_inserted_save()
    9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
    9.1.1261: No test for 'pummaxwidth' non-truncated items
    9.1.1260: Hang when filtering buffer with NUL bytes
    9.1.1259: some issues with comment package and tailing spaces
    9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
    9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
    9.1.1256: if_python: duplicate tuple data entries
    9.1.1255: missing test condition for 'pummaxwidth' setting
    9.1.1254: need more tests for the comment plugin
    9.1.1253: abort when closing window with attached quickfix data
    9.1.1252: typos in code and docs related to 'diffopt' "inline:"
    9.1.1251: if_python: build error with tuples and dynamic python
    9.1.1250: cannot set the maximum popup menu width
    9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
    9.1.1248: compile error when building without FEAT_QUICKFIX
    9.1.1247: fragile setup to get (preferred) keys from key_name_entry
    9.1.1246: coverity complains about some changes in v9.1.1243
    9.1.1245: need some more tests for curly braces evaluation
    9.1.1244: part of patch v9.1.1242 was wrong
    9.1.1243: diff mode is lacking for changes within lines
    9.1.1242: Crash when evaluating variable name
    9.1.1241: wrong preprocessort indentation in term.c
    9.1.1240: Regression with ic/ac text objects and comment plugin
    9.1.1239: if_python: no tuple data type support
    9.1.1238: wrong cursor column with 'set splitkeep=screen'
    9.1.1237: Compile error with C89 compiler in term.c
    9.1.1236: tests: test_comments leaves swapfiles around
    9.1.1235: cproto files are outdated
    9.1.1234: Compile error when SIZE_MAX is not defined
    9.1.1233: Coverity warns about NULL pointer when triggering WinResized
    9.1.1232: Vim script is missing the tuple data type
    9.1.1231: filetype: SPA JSON files are not recognized
    9.1.1230: inconsistent CTRL-C behaviour for popup windows
    9.1.1229: the comment plugin can be improved
    9.1.1228: completion: current position column wrong after got a match
    9.1.1227: no tests for the comment package
    9.1.1226: "shellcmdline" completion doesn't work with input()
    9.1.1225: extra NULL check in VIM_CLEAR()
    9.1.1224: cannot :put while keeping indent
    9.1.1223: wrong translation used for encoding failures
    9.1.1222: using wrong length for last inserted string
    9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
    9.1.1220: filetype: uv.lock file not recognized
    9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
    9.1.1218: missing out-of-memory check in filepath.c
    9.1.1217: tests: typos in test_matchfuzzy.vim
    9.1.1216: Pasting the '.' register multiple times may not work
    9.1.1215: Patch 9.1.1213 has some issues
    9.1.1214: matchfuzzy() can be improved for camel case matches
    9.1.1213: cannot :put while keeping indent
    9.1.1212: too many strlen() calls in edit.c
    9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
    9.1.1211: TabClosedPre is triggered just before the tab is being freed
    9.1.1210: translation(ru): missing Russian translation for the new tutor
    9.1.1209: colorcolumn not drawn after virtual text lines
    9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
    9.1.1207: MS-Windows: build warning in filepath.c
    9.1.1206: tests: test_filetype fails when a file is a directory
    9.1.1205: completion: preinserted text not removed when closing pum
    9.1.1204: MS-Windows: crash when passing long string to expand()
    9.1.1203: matchparen keeps cursor on case label in sh filetype
    9.1.1202: Missing TabClosedPre autocommand
    9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
    9.1.1200: cmdline pum not cleared for input() completion
    9.1.1199: gvim uses hardcoded xpm icon file
    9.1.1198: [security]: potential data loss with zip.vim
    9.1.1197: process_next_cpt_value() uses wrong condition
    9.1.1196: filetype: config files for container tools are not recognized
    9.1.1195: inside try-block: fn body executed with default arg undefined
    9.1.1194: filetype: false positive help filetype detection
    9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
    9.1.1192: Vim crashes with term response debug logging enabled
    9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
    9.1.1190: C indentation does not detect multibyte labels
    9.1.1189: if_python: build error due to incompatible pointer types
    9.1.1188: runtime(tera): tera support can be improved
    9.1.1187: matchparen plugin wrong highlights shell case statement
    9.1.1186: filetype: help files in git repos are not detected
    9.1.1185: endless loop with completefuzzycollect and no match found
    9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
    9.1.1083: "above" virtual text breaks cursorlineopt=number
    9.1.1182: No cmdline completion for 'completefuzzycollect'
    9.1.1181: Unnecessary STRLEN() calls in insexpand.c
    9.1.1180: short-description
    9.1.1179: too many strlen() calls in misc2.c
    9.1.1178: not possible to generate completion candidates using fuzzy matching
    9.1.1177: filetype: tera files not detected

++++ vim:

  - Added patches:
    * reorder-exit-raw-mode.patch
  - Refresh patches:
    * vim-7.3-filetype_ftl.patch
    * vim-7.3-filetype_spec.patch
    * vim-7.3-sh_is_bash.patch
  - Fix the following CVEs and bugs:
    * bsc#1246602 (CVE-2025-53906)
    * bsc#1246604 (CVE-2025-53905)
    * bsc#1247939 (CVE-2025-55158)
    * bsc#1247938 (CVE-2025-55157)
  - Update to 9.1.1629:
    9.1.1629: Vim9: Not able to use more than 10 type arguments in a generic function
    9.1.1628: fuzzy.c has a few issues
    9.1.1627: fuzzy matching can be improved
    9.1.1626: cindent: does not handle compound literals
    9.1.1625: Autocompletion slow with include- and tag-completion
    9.1.1624: Cscope not enabled on MacOS
    9.1.1623: Buffer menu does not handle unicode names correctly
    9.1.1622: Patch v9.1.1432 causes performance regressions
    9.1.1621: flicker in popup menu during cmdline autocompletion
    9.1.1620: filetype: composer.lock and symfony.lock files not recognized
    9.1.1619: Incorrect E535 error message
    9.1.1618: completion: incorrect selected index returned from complete_info()
    9.1.1617: Vim9: some error messages can be improved
    9.1.1616: xxd: possible buffer overflow with bitwise output
    9.1.1615: diff format erroneously detected
    9.1.1614: Vim9: possible variable type change
    9.1.1613: tests: test_search leaves a few swapfiles behind
    9.1.1612: Ctrl-G/Ctrl-T do not ignore the end search delimiter
    9.1.1611: possible undefined behaviour in mb_decompose()
    9.1.1610: completion: hang or E684 when 'tagfunc' calls complete()
    9.1.1609: complete: Heap-buffer overflow with complete function
    9.1.1608: No command-line completion for :unsilent {command}
    9.1.1607: :apple command detected as :append
    9.1.1606: filetype: a few more files are not recognized
    9.1.1605: cannot specify scope for chdir()
    9.1.1604: completion: incsearch highlight might be lost
    9.1.1603: completion: cannot use autoloaded funcs in 'complete' F{func}
    9.1.1602: filetype: requirements-*.txt files are not recognized
    9.1.1601: Patch v8.1.0425 was wrong
    9.1.1600: using diff anchors with hidden buffers fails silently
    9.1.1599: :bnext doesn't go to unlisted help buffers
    9.1.1598: filetype: waybar config file is not recognized
    9.1.1597: CI reports leaks in libgtk3 library
    9.1.1596: tests: Test_search_wildmenu_iminsert() depends on help file
    9.1.1595: Wayland: non-portable use of select()
    9.1.1594: completion: search completion throws errors
    9.1.1593: Confusing error when compiling incomplete try block
    9.1.1592: Vim9: crash with classes and garbage collection
    9.1.1591: VMS support can be improved
    9.1.1590: cannot perform autocompletion
    9.1.1589: Cannot disable cscope interface using configure
    9.1.1588: Vim9: cannot split dict inside command block
    9.1.1587: Wayland: timeout not updated before select()
    9.1.1586: Vim9: can define an enum/interface in a function
    9.1.1585: Wayland: gvim still needs GVIM_ENABLE_WAYLAND
    9.1.1584: using ints as boolean type
    9.1.1583: gvim window lost its icons
    9.1.1582: style issue in vim9type.c and vim9generics.c
    9.1.1581: possible memory leak in vim9generics.c
    9.1.1580: possible memory leak in vim9type.c
    9.1.1579: Coverity complains about unchecked return value
    9.1.1578: configure: comment still mentions autoconf 2.71
    9.1.1577: Vim9: no generic support yet
    9.1.1576: cannot easily trigger wildcard expansion
    9.1.1575: tabpanel not drawn correctly with wrapped lines
    9.1.1574: Dead code in mbyte.c
    9.1.1573: Memory leak when pressing Ctrl-D in cmdline mode
    9.1.1572: expanding $var does not escape whitespace for 'path'
    9.1.1571: CmdlineChanged triggered to often
    9.1.1570: Copilot suggested some improvements in cmdexpand.c
    9.1.1569: tests: Vim9 tests can be improved
    9.1.1568: need a few more default highlight groups
    9.1.1567: crash when using inline diff mode
    9.1.1566: self-referenced enum may not get freed
    9.1.1565: configure: does not consider tiny version for wayland
    9.1.1564: crash when opening popup to closing buffer
    9.1.1563: completion: ruler may disappear
    9.1.1562: close button always visible in the 'tabline'
    9.1.1561: configure: wayland test can be improved
    9.1.1560: configure: uses $PKG_CONFIG before it is defined
    9.1.1559: tests: Test_popup_complete_info_01() fails when run alone
    9.1.1558: str2blob() treats NULL string and empty string differently
    9.1.1557: not possible to anchor specific lines in difff mode
    9.1.1556: string handling in cmdexpand.c can be improved
    9.1.1555: completion: repeated insertion of leader
    9.1.1554: crash when omni-completion opens command-line window
    9.1.1553: Vim9: crash when accessing a variable in if condition
    9.1.1552: [security]: path traversal issue in tar.vim
    9.1.1551: [security]: path traversal issue in zip.vim
    9.1.1550: defaults: 'showcmd' is not enabled in non-compatible mode on Unix
    9.1.1549: filetype: pkl files are not recognized
    9.1.1548: filetype: OpenFGA files are not recognized
    9.1.1547: Wayland: missing ifdef
    9.1.1546: Vim9: error with has() and short circuit evaluation
    9.1.1545: typo in os_unix.c
    9.1.1544: :retab cannot be limited to indentation only
    9.1.1543: Wayland: clipboard appears to not be working
    9.1.1542: Coverity complains about uninitialized variable
    9.1.1541: Vim9: error when last enum value ends with a comma
    9.1.1540: completion: menu state wrong on interruption
    9.1.1539: completion: messages don't respect 'shm' setting
    9.1.1537: helptoc: still some issues when markdown code blocks
    9.1.1536: tests: test_plugin_comment uses wrong :Check command
    9.1.1535: the maximum search count uses hard-coded value 99
    9.1.1534: unnecessary code in tabpanel.c
    9.1.1533: helptoc: does not handle code sections in markdown well
    9.1.1532: termdebug: not enough ways to configure breakpoints
    9.1.1531: confusing error with nested legacy function
    9.1.1530: Missing version change in v9.1.1529
    9.1.1529: Win32: the toolbar in the GUI is old and dated
    9.1.1528: completion: crash with getcompletion()
    9.1.1527: Vim9: Crash with string compound assignment
    9.1.1526: completion: search completion match may differ in case
    9.1.1525: tests: testdir/ is a bit messy
    9.1.1524: tests: too many imports in the test suite
    9.1.1523: tests: test_clipmethod fails in non X11 environment
    9.1.1522: tests: still some ANSI escape sequences in test output
    9.1.1521: completion: pum does not reset scroll pos on reopen with 'noselect'
    9.1.1520: completion: search completion doesn't handle 'smartcase' well
    9.1.1519: tests: Test_termdebug_decimal_breakpoints() may fail
    9.1.1518: getcompletiontype() may crash
    9.1.1517: filetype: autopkgtest files are not recognized
    9.1.1516: tests: no test that 'incsearch' is updated after search completion
    9.1.1515: Coverity complains about potential unterminated strings
    9.1.1514: Coverity complains about the use of tmpfile()
    9.1.1513: resizing Vim window causes unexpected internal window width
    9.1.1512: completion: can only complete from keyword characters
    9.1.1511: tests: two edit tests change v:testing from 1 to 0
    9.1.1510: Search completion may use invalid memory
    9.1.1509: patch 9.1.1505 was not good
    9.1.1508: string manipulation can be improved in cmdexpand.c
    9.1.1507: symlinks are resolved on :cd commands
    9.1.1506: tests: missing cleanup in Test_search_cmdline_incsearch_highlight()
    9.1.1505: not possible to return completion type for :ex command
    9.1.1504: filetype: numbat files are not recognized
    9.1.1503: filetype: haxe files are not recognized
    9.1.1502: filetype: quickbms files are not recognized
    9.1.1501: filetype: flix files are not recognized
    9.1.1500: if_python: typo in python error variable
    9.1.1499: MS-Windows: no indication of ARM64 architecture
    9.1.1498: completion: 'complete' funcs behave different to 'omnifunc'
    9.1.1497: Link error with shm_open()
    9.1.1496: terminal: still not highlighting empty cells correctly
    9.1.1495: Wayland: uses $XDG_SEAT to determine seat
    9.1.1494: runtime(tutor): no French translation for Chapter 2
    9.1.1493: manually comparing positions on buffer
    9.1.1492: tests: failure when Wayland compositor fails to start
    9.1.1491: missing out-of-memory checks in cmdexpand.c
    9.1.1490: 'wildchar' does not work in search contexts
    9.1.1489: terminal: no visual highlight of empty cols with empty 'listchars'
    9.1.1488: configure: using obsolete macro AC_PROG_GCC_TRADITIONAL
    9.1.1487: :cl doesn't invoke :clist
    9.1.1486: documentation issues with Wayland
    9.1.1485: missing Wayland clipboard support
    9.1.1484: tests: Turkish locale tests fails on Mac
    9.1.1483: not possible to translation position in buffer
    9.1.1482: scrolling with 'splitkeep' and line()
    9.1.1481: gcc complains about uninitialized variable
    9.1.1480: Turkish translation outdated
    9.1.1479: regression when displaying localized percentage position
    9.1.1478: Unused assignment in ex_uniq()
    9.1.1476: no easy way to deduplicate text
    9.1.1476: missing out-of-memory checks in cmdexpand.c
    9.1.1475: completion: regression when "nearest" in 'completeopt'
    9.1.1474: missing out-of-memory check in mark.c
    9.1.1473: inconsistent range arg for :diffget/diffput
    9.1.1472: if_python: PySequence_Fast_{GET_SIZE,GET_ITEM} removed
    9.1.1471: completion: inconsistent ordering with CTRL-P
    9.1.1470: use-after-free with popup callback on error
    9.1.1469: potential buffer-underflow with invalid hl_id
    9.1.1468: filetype: bright(er)script files are not recognized
    9.1.1467: too many strlen() calls
    9.1.1466: filetype: not all lex files are recognized
    9.1.1465: tabpanel: not correctly drawn with 'equalalways'
    9.1.1464: gv does not work in operator-pending mode
    9.1.1463: Integer overflow in getmarklist() after linewise operation
    9.1.1462: missing change from patch v9.1.1461
    9.1.1461: tabpanel: tabpanel vanishes with popup menu
    9.1.1460: MS-Windows: too many strlen() calls in os_win32.c
    9.1.1459: xxd: coloring output is inefficient
    9.1.1458: tabpanel: tabs not properly updated with 'stpl'
    9.1.1457: compile warning with tabpanelopt
    9.1.1456: comment plugin fails toggling if 'cms' contains \
    9.1.1455: Haiku: dailog objects created with no reference
    9.1.1454: tests: no test for pum at line break position
    9.1.1453: tests: Test_geometry() may fail
    9.1.1452: completion: redundant check for completion flags
    9.1.1451: tabpanel rendering artifacts when scrolling
    9.1.1450: Session has wrong arglist with :tcd and :arglocal
    9.1.1449: typo in pum_display()
    9.1.1448: tabpanel is not displayed correctly when msg_scrolled
    9.1.1447: completion: crash when backspacing with fuzzy completion
    9.1.1446: filetype: cuda-gdb config files are not recognized
    9.1.1445: negative matchfuzzy scores although there is a match
    9.1.1444: Unused assignment in set_fuzzy_score()
    9.1.1443: potential buffer underflow in insertchar()
    9.1.1442: tests: Test_diff_fold_redraw() is insufficient
    9.1.1441: completion: code can be improved
    9.1.1440: too many strlen() calls in os_win32.c
    9.1.1439: Last diff folds not merged
    9.1.1438: tests: Test_breakindent_list_split() fails
    9.1.1437: MS-Windows: internal compile error in uc_list()
    9.1.1436: GUI control code is displayed on the console on startup
    9.1.1435: completion: various flaws in fuzzy completion
    9.1.1434: MS-Windows: missing out-of-memory checks in os_win32.c
    9.1.1433: Unnecessary :if when writing session
    9.1.1432: GTK GUI: Buffer menu does not handle unicode correctly
    9.1.1431: Hit-Enter Prompt when loading session files
    9.1.1430: tabpanel may flicker in the GUI
    9.1.1429: dragging outside the tabpanel changes tabpagenr
    9.1.1428: completion: register completion needs cleanup
    9.1.1427: rendering artifacts with the tabpanel
    9.1.1426: completion: register contents not completed
    9.1.1425: tabpanel: there are still some problems with the tabpanel
    9.1.1424: PMenu selection broken with multi-line selection and limits
    9.1.1423: :tag command not working correctly using Vim9 Script
    9.1.1422: scheduling of complete function can be improved
    9.1.1421: tests: need a test for the new-style tutor.tutor
    9.1.1420: tests: could need some more tests for shebang lines
    9.1.1419: It is difficult to ignore all but some events
    9.1.1418: configures GUI auto detection favors GTK2
    9.1.1417: missing info about register completion in complete_info()
    9.1.1416: completion limits not respected for fuzzy completions
    9.1.1415: potential use-after free when there is an error in 'tabpanel'
    9.1.1414: MS-Windows: compile warnings in os_win32.c
    9.1.1413: spurious CursorHold triggered in GUI on startup
    9.1.1412: tests: Test_tabpanel_tabonly() fails on larger screens
    9.1.1411: crash when calling non-existing function for tabpanel
    9.1.1410: out-of-bounds access with 'completefunc'
    9.1.1409: using f-flag in 'complete' conflicts with Neovim
    9.1.1408: not easily possible to complete from register content
    9.1.1407: Can't use getpos('v') in OptionSet when using setbufvar()
    9.1.1406: crash when importing invalid tuple
    9.1.1405: tests: no test for mapping with special keys in session file
    9.1.1404: wrong link to Chapter 2 in new-tutor
    9.1.1403: expansion of 'tabpanelopt' value adds wrong values
    9.1.1402: multi-byte mappings not properly stored in session file
    9.1.1401: list not materialized in prop_list()
    9.1.1400: [security]: use-after-free when evaluating tuple fails
    9.1.1399: tests: test_codestyle fails for auto-generated files
    9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
    9.1.1397: tabpanel not correctly updated on :tabonly
    9.1.1396: 'errorformat' is a global option
    9.1.1395: search_stat not reset when pattern differs in case
    9.1.1394: tabpanel not correctly redrawn on tabonly
    9.1.1393: missing test for switching buffers and reusing curbuf
    9.1.1392: missing patch number
    9.1.1391: Vim does not have a vertical tabpanel
    9.1.1390: style: more wrong indentation
    9.1.1389: completion: still some issue when 'isexpand' contains a space
    9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
    9.1.1387: memory leak when buflist_new() fails to reuse curbuf
    9.1.1386: MS-Windows: some minor problems building on AARCH64
    9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
    9.1.1384: still some problem with the new tutors filetype plugin
    9.1.1383: completion: 'isexpand' option does not handle space char correct
    9.1.1382: if_ruby: unused compiler warnings from ruby internals
    9.1.1381: completion: cannot return to original text
    9.1.1380: 'eventignorewin' only checked for current buffer
    9.1.1379: MS-Windows: error when running evim when space in path
    9.1.1378: sign without text overwrites number option
    9.1.1377: patch v9.1.1370 causes some GTK warning messages
    9.1.1376: quickfix dummy buffer may remain as dummy buffer
    9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
    9.1.1374: completion: 'smartcase' not respected when filtering matches
    9.1.1373: 'completeopt' checking logic can be simplified
    9.1.1372: style: braces issues in various files
    9.1.1371: style: indentation and brace issues in insexpand.c
    9.1.1370: CI Tests favor GTK2 over GTK3
    9.1.1369: configure still using autoconf 2.71
    9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
    9.1.1367: too many strlen() calls in gui.c
    9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
    9.1.1365: MS-Windows: compile warnings and too many strlen() calls
    9.1.1364: style: more indentation issues
    9.1.1363: style: inconsistent indentation in various files
    9.1.1362: Vim9: type ignored when adding tuple to instance list var
    9.1.1361: [security]: possible use-after-free when closing a buffer
    9.1.1360: filetype: GNU Radio companion files are not recognized
    9.1.1359: filetype: GNU Radio config files are not recognized
    9.1.1358: if_lua: compile warnings with gcc15
    9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
    9.1.1356: Vim9: crash when unletting variable
    9.1.1355: The pum_redraw() function is too complex
    9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
    9.1.1353: missing change from v9.1.1350
    9.1.1352: style: inconsistent indent in insexpand.c
    9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
    9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
    9.1.1349: CmdlineLeavePre may trigger twice
    9.1.1348: still E315 with the terminal feature
    9.1.1347: small problems with gui_w32.c
    9.1.1346: missing out-of-memory check in textformat.c
    9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
    9.1.1344: double free in f_complete_match() (after v9.1.1341)
    9.1.1343: filetype: IPython files are not recognized
    9.1.1342: Shebang filetype detection can be improved
    9.1.1341: cannot define completion triggers
    9.1.1340: cannot complete :filetype arguments
    9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
    9.1.1338: Calling expand() interferes with cmdcomplete_info()
    9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
    9.1.1336: comment plugin does not support case-insensitive 'commentstring'
    9.1.1335: Coverity complains about Null pointer dereferences
    9.1.1334: Coverity complains about unchecked return value
    9.1.1333: Coverity: complains about unutilized variable
    9.1.1332: Vim9: segfault when using super within a lambda
    9.1.1331: Leaking memory with cmdcomplete()
    9.1.1330: may receive E315 in terminal
    9.1.1329: cannot get information about command line completion
    9.1.1328: too many strlen() calls in indent.c
    9.1.1327: filetype: nroff detection can be improved
    9.1.1326: invalid cursor position after 'tagfunc'
    9.1.1325: tests: not checking error numbers properly
    9.1.1324: undefined behaviour if X11 connection dies
    9.1.1323: b:undo_ftplugin not executed when re-using buffer
    9.1.1322: small delete register cannot paste multi-line correctly
    9.1.1321: filetype: MS ixx and mpp files are not recognized
    9.1.1320: filetype: alsoft config files are not recognized
    9.1.1319: Various typos in the code, issue with test_inst_complete.vim
    9.1.1318: tests: test_format fails
    9.1.1317: noisy error when restoring folds from session fails
    9.1.1316: missing memory allocation failure in os_mswin.c
    9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
    9.1.1314: max allowed string width too small
    9.1.1313: compile warning about uninitialized value
    9.1.1312: tests: Test_backupskip() fails when HOME is defined
    9.1.1311: completion: not possible to limit number of matches
    9.1.1310: completion: redundant check for preinsert effect
    9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
    9.1.1308: completion: cannot order matches by distance to cursor
    9.1.1307: make syntax does not reliably detect different flavors
    9.1.1306: completion menu rendering can be improved
    9.1.1305: completion menu active after switching windows/tabs
    9.1.1304: filetype: some man files are not recognized
    9.1.1303: missing out-of-memory check in linematch.c
    9.1.1302: Coverity warns about using uninitialized value
    9.1.1301: completion: cannot configure completion functions with 'complete'
    9.1.1300: wrong detection of -inf
    9.1.1299: filetype: mbsyncrc files are not recognized
    9.1.1298: define_function() is too long
    9.1.1297: Ctrl-D scrolling can get stuck
    9.1.1296: completion: incorrect truncation logic
    9.1.1295: clientserver: does not handle :stopinsert correctly
    9.1.1294: gui tabline menu does not use confirm when closing tabs
    9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
    9.1.1292: statusline not correctly evaluated
    9.1.1291: too many strlen() calls in buffer.c
    9.1.1290: tests: missing cleanup in test_filetype.vim
    9.1.1289: tests: no test for matchparen plugin with WinScrolled event
    9.1.1288: Using wrong window in ll_resize_stack()
    9.1.1287: quickfix code can be further improved
    9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
    9.1.1285: Vim9: no error message for missing method after "super."
    9.1.1284: not possible to configure pum truncation char
    9.1.1283: quickfix stack is limited to 10 items
    9.1.1282: Build and test failure without job feature
    9.1.1281: extra newline output when editing stdin
    9.1.1280: trailing additional semicolon in get_matches_in_str()
    9.1.1279: Vim9: null_object and null_class are no reserved names
    9.1.1278: Vim9: too long functions in vim9type.c
    9.1.1277: tests: trailing comment char in test_popupwin
    9.1.1276: inline word diff treats multibyte chars as word char
    9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
    9.1.1274: Vim9: no support for object<type> as variable type
    9.1.1273: Coverity warns about using uninitialized value
    9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
    9.1.1271: filetype: Power Query files are not recognized
    9.1.1270: missing out-of-memory checks in buffer.c
    9.1.1269: completion: compl_shown_match is updated when starting keyword completion
    9.1.1268: filetype: dax files are not recognized
    9.1.1267: Vim9: no support for type list/dict<object<any>>
    9.1.1266: MS-Windows: type conversion warnings
    9.1.1265: tests: no tests for typing normal char during completion
    9.1.1264: Vim9: error when comparing objects
    9.1.1263: string length wrong in get_last_inserted_save()
    9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
    9.1.1261: No test for 'pummaxwidth' non-truncated items
    9.1.1260: Hang when filtering buffer with NUL bytes
    9.1.1259: some issues with comment package and tailing spaces
    9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
    9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
    9.1.1256: if_python: duplicate tuple data entries
    9.1.1255: missing test condition for 'pummaxwidth' setting
    9.1.1254: need more tests for the comment plugin
    9.1.1253: abort when closing window with attached quickfix data
    9.1.1252: typos in code and docs related to 'diffopt' "inline:"
    9.1.1251: if_python: build error with tuples and dynamic python
    9.1.1250: cannot set the maximum popup menu width
    9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
    9.1.1248: compile error when building without FEAT_QUICKFIX
    9.1.1247: fragile setup to get (preferred) keys from key_name_entry
    9.1.1246: coverity complains about some changes in v9.1.1243
    9.1.1245: need some more tests for curly braces evaluation
    9.1.1244: part of patch v9.1.1242 was wrong
    9.1.1243: diff mode is lacking for changes within lines
    9.1.1242: Crash when evaluating variable name
    9.1.1241: wrong preprocessort indentation in term.c
    9.1.1240: Regression with ic/ac text objects and comment plugin
    9.1.1239: if_python: no tuple data type support
    9.1.1238: wrong cursor column with 'set splitkeep=screen'
    9.1.1237: Compile error with C89 compiler in term.c
    9.1.1236: tests: test_comments leaves swapfiles around
    9.1.1235: cproto files are outdated
    9.1.1234: Compile error when SIZE_MAX is not defined
    9.1.1233: Coverity warns about NULL pointer when triggering WinResized
    9.1.1232: Vim script is missing the tuple data type
    9.1.1231: filetype: SPA JSON files are not recognized
    9.1.1230: inconsistent CTRL-C behaviour for popup windows
    9.1.1229: the comment plugin can be improved
    9.1.1228: completion: current position column wrong after got a match
    9.1.1227: no tests for the comment package
    9.1.1226: "shellcmdline" completion doesn't work with input()
    9.1.1225: extra NULL check in VIM_CLEAR()
    9.1.1224: cannot :put while keeping indent
    9.1.1223: wrong translation used for encoding failures
    9.1.1222: using wrong length for last inserted string
    9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
    9.1.1220: filetype: uv.lock file not recognized
    9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
    9.1.1218: missing out-of-memory check in filepath.c
    9.1.1217: tests: typos in test_matchfuzzy.vim
    9.1.1216: Pasting the '.' register multiple times may not work
    9.1.1215: Patch 9.1.1213 has some issues
    9.1.1214: matchfuzzy() can be improved for camel case matches
    9.1.1213: cannot :put while keeping indent
    9.1.1212: too many strlen() calls in edit.c
    9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
    9.1.1211: TabClosedPre is triggered just before the tab is being freed
    9.1.1210: translation(ru): missing Russian translation for the new tutor
    9.1.1209: colorcolumn not drawn after virtual text lines
    9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
    9.1.1207: MS-Windows: build warning in filepath.c
    9.1.1206: tests: test_filetype fails when a file is a directory
    9.1.1205: completion: preinserted text not removed when closing pum
    9.1.1204: MS-Windows: crash when passing long string to expand()
    9.1.1203: matchparen keeps cursor on case label in sh filetype
    9.1.1202: Missing TabClosedPre autocommand
    9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
    9.1.1200: cmdline pum not cleared for input() completion
    9.1.1199: gvim uses hardcoded xpm icon file
    9.1.1198: [security]: potential data loss with zip.vim
    9.1.1197: process_next_cpt_value() uses wrong condition
    9.1.1196: filetype: config files for container tools are not recognized
    9.1.1195: inside try-block: fn body executed with default arg undefined
    9.1.1194: filetype: false positive help filetype detection
    9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
    9.1.1192: Vim crashes with term response debug logging enabled
    9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
    9.1.1190: C indentation does not detect multibyte labels
    9.1.1189: if_python: build error due to incompatible pointer types
    9.1.1188: runtime(tera): tera support can be improved
    9.1.1187: matchparen plugin wrong highlights shell case statement
    9.1.1186: filetype: help files in git repos are not detected
    9.1.1185: endless loop with completefuzzycollect and no match found
    9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
    9.1.1083: "above" virtual text breaks cursorlineopt=number
    9.1.1182: No cmdline completion for 'completefuzzycollect'
    9.1.1181: Unnecessary STRLEN() calls in insexpand.c
    9.1.1180: short-description
    9.1.1179: too many strlen() calls in misc2.c
    9.1.1178: not possible to generate completion candidates using fuzzy matching
    9.1.1177: filetype: tera files not detected

++++ vim:

  - Added patches:
    * reorder-exit-raw-mode.patch
  - Refresh patches:
    * vim-7.3-filetype_ftl.patch
    * vim-7.3-filetype_spec.patch
    * vim-7.3-sh_is_bash.patch
  - Fix the following CVEs and bugs:
    * bsc#1246602 (CVE-2025-53906)
    * bsc#1246604 (CVE-2025-53905)
    * bsc#1247939 (CVE-2025-55158)
    * bsc#1247938 (CVE-2025-55157)
  - Update to 9.1.1629:
    9.1.1629: Vim9: Not able to use more than 10 type arguments in a generic function
    9.1.1628: fuzzy.c has a few issues
    9.1.1627: fuzzy matching can be improved
    9.1.1626: cindent: does not handle compound literals
    9.1.1625: Autocompletion slow with include- and tag-completion
    9.1.1624: Cscope not enabled on MacOS
    9.1.1623: Buffer menu does not handle unicode names correctly
    9.1.1622: Patch v9.1.1432 causes performance regressions
    9.1.1621: flicker in popup menu during cmdline autocompletion
    9.1.1620: filetype: composer.lock and symfony.lock files not recognized
    9.1.1619: Incorrect E535 error message
    9.1.1618: completion: incorrect selected index returned from complete_info()
    9.1.1617: Vim9: some error messages can be improved
    9.1.1616: xxd: possible buffer overflow with bitwise output
    9.1.1615: diff format erroneously detected
    9.1.1614: Vim9: possible variable type change
    9.1.1613: tests: test_search leaves a few swapfiles behind
    9.1.1612: Ctrl-G/Ctrl-T do not ignore the end search delimiter
    9.1.1611: possible undefined behaviour in mb_decompose()
    9.1.1610: completion: hang or E684 when 'tagfunc' calls complete()
    9.1.1609: complete: Heap-buffer overflow with complete function
    9.1.1608: No command-line completion for :unsilent {command}
    9.1.1607: :apple command detected as :append
    9.1.1606: filetype: a few more files are not recognized
    9.1.1605: cannot specify scope for chdir()
    9.1.1604: completion: incsearch highlight might be lost
    9.1.1603: completion: cannot use autoloaded funcs in 'complete' F{func}
    9.1.1602: filetype: requirements-*.txt files are not recognized
    9.1.1601: Patch v8.1.0425 was wrong
    9.1.1600: using diff anchors with hidden buffers fails silently
    9.1.1599: :bnext doesn't go to unlisted help buffers
    9.1.1598: filetype: waybar config file is not recognized
    9.1.1597: CI reports leaks in libgtk3 library
    9.1.1596: tests: Test_search_wildmenu_iminsert() depends on help file
    9.1.1595: Wayland: non-portable use of select()
    9.1.1594: completion: search completion throws errors
    9.1.1593: Confusing error when compiling incomplete try block
    9.1.1592: Vim9: crash with classes and garbage collection
    9.1.1591: VMS support can be improved
    9.1.1590: cannot perform autocompletion
    9.1.1589: Cannot disable cscope interface using configure
    9.1.1588: Vim9: cannot split dict inside command block
    9.1.1587: Wayland: timeout not updated before select()
    9.1.1586: Vim9: can define an enum/interface in a function
    9.1.1585: Wayland: gvim still needs GVIM_ENABLE_WAYLAND
    9.1.1584: using ints as boolean type
    9.1.1583: gvim window lost its icons
    9.1.1582: style issue in vim9type.c and vim9generics.c
    9.1.1581: possible memory leak in vim9generics.c
    9.1.1580: possible memory leak in vim9type.c
    9.1.1579: Coverity complains about unchecked return value
    9.1.1578: configure: comment still mentions autoconf 2.71
    9.1.1577: Vim9: no generic support yet
    9.1.1576: cannot easily trigger wildcard expansion
    9.1.1575: tabpanel not drawn correctly with wrapped lines
    9.1.1574: Dead code in mbyte.c
    9.1.1573: Memory leak when pressing Ctrl-D in cmdline mode
    9.1.1572: expanding $var does not escape whitespace for 'path'
    9.1.1571: CmdlineChanged triggered to often
    9.1.1570: Copilot suggested some improvements in cmdexpand.c
    9.1.1569: tests: Vim9 tests can be improved
    9.1.1568: need a few more default highlight groups
    9.1.1567: crash when using inline diff mode
    9.1.1566: self-referenced enum may not get freed
    9.1.1565: configure: does not consider tiny version for wayland
    9.1.1564: crash when opening popup to closing buffer
    9.1.1563: completion: ruler may disappear
    9.1.1562: close button always visible in the 'tabline'
    9.1.1561: configure: wayland test can be improved
    9.1.1560: configure: uses $PKG_CONFIG before it is defined
    9.1.1559: tests: Test_popup_complete_info_01() fails when run alone
    9.1.1558: str2blob() treats NULL string and empty string differently
    9.1.1557: not possible to anchor specific lines in difff mode
    9.1.1556: string handling in cmdexpand.c can be improved
    9.1.1555: completion: repeated insertion of leader
    9.1.1554: crash when omni-completion opens command-line window
    9.1.1553: Vim9: crash when accessing a variable in if condition
    9.1.1552: [security]: path traversal issue in tar.vim
    9.1.1551: [security]: path traversal issue in zip.vim
    9.1.1550: defaults: 'showcmd' is not enabled in non-compatible mode on Unix
    9.1.1549: filetype: pkl files are not recognized
    9.1.1548: filetype: OpenFGA files are not recognized
    9.1.1547: Wayland: missing ifdef
    9.1.1546: Vim9: error with has() and short circuit evaluation
    9.1.1545: typo in os_unix.c
    9.1.1544: :retab cannot be limited to indentation only
    9.1.1543: Wayland: clipboard appears to not be working
    9.1.1542: Coverity complains about uninitialized variable
    9.1.1541: Vim9: error when last enum value ends with a comma
    9.1.1540: completion: menu state wrong on interruption
    9.1.1539: completion: messages don't respect 'shm' setting
    9.1.1537: helptoc: still some issues when markdown code blocks
    9.1.1536: tests: test_plugin_comment uses wrong :Check command
    9.1.1535: the maximum search count uses hard-coded value 99
    9.1.1534: unnecessary code in tabpanel.c
    9.1.1533: helptoc: does not handle code sections in markdown well
    9.1.1532: termdebug: not enough ways to configure breakpoints
    9.1.1531: confusing error with nested legacy function
    9.1.1530: Missing version change in v9.1.1529
    9.1.1529: Win32: the toolbar in the GUI is old and dated
    9.1.1528: completion: crash with getcompletion()
    9.1.1527: Vim9: Crash with string compound assignment
    9.1.1526: completion: search completion match may differ in case
    9.1.1525: tests: testdir/ is a bit messy
    9.1.1524: tests: too many imports in the test suite
    9.1.1523: tests: test_clipmethod fails in non X11 environment
    9.1.1522: tests: still some ANSI escape sequences in test output
    9.1.1521: completion: pum does not reset scroll pos on reopen with 'noselect'
    9.1.1520: completion: search completion doesn't handle 'smartcase' well
    9.1.1519: tests: Test_termdebug_decimal_breakpoints() may fail
    9.1.1518: getcompletiontype() may crash
    9.1.1517: filetype: autopkgtest files are not recognized
    9.1.1516: tests: no test that 'incsearch' is updated after search completion
    9.1.1515: Coverity complains about potential unterminated strings
    9.1.1514: Coverity complains about the use of tmpfile()
    9.1.1513: resizing Vim window causes unexpected internal window width
    9.1.1512: completion: can only complete from keyword characters
    9.1.1511: tests: two edit tests change v:testing from 1 to 0
    9.1.1510: Search completion may use invalid memory
    9.1.1509: patch 9.1.1505 was not good
    9.1.1508: string manipulation can be improved in cmdexpand.c
    9.1.1507: symlinks are resolved on :cd commands
    9.1.1506: tests: missing cleanup in Test_search_cmdline_incsearch_highlight()
    9.1.1505: not possible to return completion type for :ex command
    9.1.1504: filetype: numbat files are not recognized
    9.1.1503: filetype: haxe files are not recognized
    9.1.1502: filetype: quickbms files are not recognized
    9.1.1501: filetype: flix files are not recognized
    9.1.1500: if_python: typo in python error variable
    9.1.1499: MS-Windows: no indication of ARM64 architecture
    9.1.1498: completion: 'complete' funcs behave different to 'omnifunc'
    9.1.1497: Link error with shm_open()
    9.1.1496: terminal: still not highlighting empty cells correctly
    9.1.1495: Wayland: uses $XDG_SEAT to determine seat
    9.1.1494: runtime(tutor): no French translation for Chapter 2
    9.1.1493: manually comparing positions on buffer
    9.1.1492: tests: failure when Wayland compositor fails to start
    9.1.1491: missing out-of-memory checks in cmdexpand.c
    9.1.1490: 'wildchar' does not work in search contexts
    9.1.1489: terminal: no visual highlight of empty cols with empty 'listchars'
    9.1.1488: configure: using obsolete macro AC_PROG_GCC_TRADITIONAL
    9.1.1487: :cl doesn't invoke :clist
    9.1.1486: documentation issues with Wayland
    9.1.1485: missing Wayland clipboard support
    9.1.1484: tests: Turkish locale tests fails on Mac
    9.1.1483: not possible to translation position in buffer
    9.1.1482: scrolling with 'splitkeep' and line()
    9.1.1481: gcc complains about uninitialized variable
    9.1.1480: Turkish translation outdated
    9.1.1479: regression when displaying localized percentage position
    9.1.1478: Unused assignment in ex_uniq()
    9.1.1476: no easy way to deduplicate text
    9.1.1476: missing out-of-memory checks in cmdexpand.c
    9.1.1475: completion: regression when "nearest" in 'completeopt'
    9.1.1474: missing out-of-memory check in mark.c
    9.1.1473: inconsistent range arg for :diffget/diffput
    9.1.1472: if_python: PySequence_Fast_{GET_SIZE,GET_ITEM} removed
    9.1.1471: completion: inconsistent ordering with CTRL-P
    9.1.1470: use-after-free with popup callback on error
    9.1.1469: potential buffer-underflow with invalid hl_id
    9.1.1468: filetype: bright(er)script files are not recognized
    9.1.1467: too many strlen() calls
    9.1.1466: filetype: not all lex files are recognized
    9.1.1465: tabpanel: not correctly drawn with 'equalalways'
    9.1.1464: gv does not work in operator-pending mode
    9.1.1463: Integer overflow in getmarklist() after linewise operation
    9.1.1462: missing change from patch v9.1.1461
    9.1.1461: tabpanel: tabpanel vanishes with popup menu
    9.1.1460: MS-Windows: too many strlen() calls in os_win32.c
    9.1.1459: xxd: coloring output is inefficient
    9.1.1458: tabpanel: tabs not properly updated with 'stpl'
    9.1.1457: compile warning with tabpanelopt
    9.1.1456: comment plugin fails toggling if 'cms' contains \
    9.1.1455: Haiku: dailog objects created with no reference
    9.1.1454: tests: no test for pum at line break position
    9.1.1453: tests: Test_geometry() may fail
    9.1.1452: completion: redundant check for completion flags
    9.1.1451: tabpanel rendering artifacts when scrolling
    9.1.1450: Session has wrong arglist with :tcd and :arglocal
    9.1.1449: typo in pum_display()
    9.1.1448: tabpanel is not displayed correctly when msg_scrolled
    9.1.1447: completion: crash when backspacing with fuzzy completion
    9.1.1446: filetype: cuda-gdb config files are not recognized
    9.1.1445: negative matchfuzzy scores although there is a match
    9.1.1444: Unused assignment in set_fuzzy_score()
    9.1.1443: potential buffer underflow in insertchar()
    9.1.1442: tests: Test_diff_fold_redraw() is insufficient
    9.1.1441: completion: code can be improved
    9.1.1440: too many strlen() calls in os_win32.c
    9.1.1439: Last diff folds not merged
    9.1.1438: tests: Test_breakindent_list_split() fails
    9.1.1437: MS-Windows: internal compile error in uc_list()
    9.1.1436: GUI control code is displayed on the console on startup
    9.1.1435: completion: various flaws in fuzzy completion
    9.1.1434: MS-Windows: missing out-of-memory checks in os_win32.c
    9.1.1433: Unnecessary :if when writing session
    9.1.1432: GTK GUI: Buffer menu does not handle unicode correctly
    9.1.1431: Hit-Enter Prompt when loading session files
    9.1.1430: tabpanel may flicker in the GUI
    9.1.1429: dragging outside the tabpanel changes tabpagenr
    9.1.1428: completion: register completion needs cleanup
    9.1.1427: rendering artifacts with the tabpanel
    9.1.1426: completion: register contents not completed
    9.1.1425: tabpanel: there are still some problems with the tabpanel
    9.1.1424: PMenu selection broken with multi-line selection and limits
    9.1.1423: :tag command not working correctly using Vim9 Script
    9.1.1422: scheduling of complete function can be improved
    9.1.1421: tests: need a test for the new-style tutor.tutor
    9.1.1420: tests: could need some more tests for shebang lines
    9.1.1419: It is difficult to ignore all but some events
    9.1.1418: configures GUI auto detection favors GTK2
    9.1.1417: missing info about register completion in complete_info()
    9.1.1416: completion limits not respected for fuzzy completions
    9.1.1415: potential use-after free when there is an error in 'tabpanel'
    9.1.1414: MS-Windows: compile warnings in os_win32.c
    9.1.1413: spurious CursorHold triggered in GUI on startup
    9.1.1412: tests: Test_tabpanel_tabonly() fails on larger screens
    9.1.1411: crash when calling non-existing function for tabpanel
    9.1.1410: out-of-bounds access with 'completefunc'
    9.1.1409: using f-flag in 'complete' conflicts with Neovim
    9.1.1408: not easily possible to complete from register content
    9.1.1407: Can't use getpos('v') in OptionSet when using setbufvar()
    9.1.1406: crash when importing invalid tuple
    9.1.1405: tests: no test for mapping with special keys in session file
    9.1.1404: wrong link to Chapter 2 in new-tutor
    9.1.1403: expansion of 'tabpanelopt' value adds wrong values
    9.1.1402: multi-byte mappings not properly stored in session file
    9.1.1401: list not materialized in prop_list()
    9.1.1400: [security]: use-after-free when evaluating tuple fails
    9.1.1399: tests: test_codestyle fails for auto-generated files
    9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
    9.1.1397: tabpanel not correctly updated on :tabonly
    9.1.1396: 'errorformat' is a global option
    9.1.1395: search_stat not reset when pattern differs in case
    9.1.1394: tabpanel not correctly redrawn on tabonly
    9.1.1393: missing test for switching buffers and reusing curbuf
    9.1.1392: missing patch number
    9.1.1391: Vim does not have a vertical tabpanel
    9.1.1390: style: more wrong indentation
    9.1.1389: completion: still some issue when 'isexpand' contains a space
    9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
    9.1.1387: memory leak when buflist_new() fails to reuse curbuf
    9.1.1386: MS-Windows: some minor problems building on AARCH64
    9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
    9.1.1384: still some problem with the new tutors filetype plugin
    9.1.1383: completion: 'isexpand' option does not handle space char correct
    9.1.1382: if_ruby: unused compiler warnings from ruby internals
    9.1.1381: completion: cannot return to original text
    9.1.1380: 'eventignorewin' only checked for current buffer
    9.1.1379: MS-Windows: error when running evim when space in path
    9.1.1378: sign without text overwrites number option
    9.1.1377: patch v9.1.1370 causes some GTK warning messages
    9.1.1376: quickfix dummy buffer may remain as dummy buffer
    9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
    9.1.1374: completion: 'smartcase' not respected when filtering matches
    9.1.1373: 'completeopt' checking logic can be simplified
    9.1.1372: style: braces issues in various files
    9.1.1371: style: indentation and brace issues in insexpand.c
    9.1.1370: CI Tests favor GTK2 over GTK3
    9.1.1369: configure still using autoconf 2.71
    9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
    9.1.1367: too many strlen() calls in gui.c
    9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
    9.1.1365: MS-Windows: compile warnings and too many strlen() calls
    9.1.1364: style: more indentation issues
    9.1.1363: style: inconsistent indentation in various files
    9.1.1362: Vim9: type ignored when adding tuple to instance list var
    9.1.1361: [security]: possible use-after-free when closing a buffer
    9.1.1360: filetype: GNU Radio companion files are not recognized
    9.1.1359: filetype: GNU Radio config files are not recognized
    9.1.1358: if_lua: compile warnings with gcc15
    9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
    9.1.1356: Vim9: crash when unletting variable
    9.1.1355: The pum_redraw() function is too complex
    9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
    9.1.1353: missing change from v9.1.1350
    9.1.1352: style: inconsistent indent in insexpand.c
    9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
    9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
    9.1.1349: CmdlineLeavePre may trigger twice
    9.1.1348: still E315 with the terminal feature
    9.1.1347: small problems with gui_w32.c
    9.1.1346: missing out-of-memory check in textformat.c
    9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
    9.1.1344: double free in f_complete_match() (after v9.1.1341)
    9.1.1343: filetype: IPython files are not recognized
    9.1.1342: Shebang filetype detection can be improved
    9.1.1341: cannot define completion triggers
    9.1.1340: cannot complete :filetype arguments
    9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
    9.1.1338: Calling expand() interferes with cmdcomplete_info()
    9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
    9.1.1336: comment plugin does not support case-insensitive 'commentstring'
    9.1.1335: Coverity complains about Null pointer dereferences
    9.1.1334: Coverity complains about unchecked return value
    9.1.1333: Coverity: complains about unutilized variable
    9.1.1332: Vim9: segfault when using super within a lambda
    9.1.1331: Leaking memory with cmdcomplete()
    9.1.1330: may receive E315 in terminal
    9.1.1329: cannot get information about command line completion
    9.1.1328: too many strlen() calls in indent.c
    9.1.1327: filetype: nroff detection can be improved
    9.1.1326: invalid cursor position after 'tagfunc'
    9.1.1325: tests: not checking error numbers properly
    9.1.1324: undefined behaviour if X11 connection dies
    9.1.1323: b:undo_ftplugin not executed when re-using buffer
    9.1.1322: small delete register cannot paste multi-line correctly
    9.1.1321: filetype: MS ixx and mpp files are not recognized
    9.1.1320: filetype: alsoft config files are not recognized
    9.1.1319: Various typos in the code, issue with test_inst_complete.vim
    9.1.1318: tests: test_format fails
    9.1.1317: noisy error when restoring folds from session fails
    9.1.1316: missing memory allocation failure in os_mswin.c
    9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
    9.1.1314: max allowed string width too small
    9.1.1313: compile warning about uninitialized value
    9.1.1312: tests: Test_backupskip() fails when HOME is defined
    9.1.1311: completion: not possible to limit number of matches
    9.1.1310: completion: redundant check for preinsert effect
    9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
    9.1.1308: completion: cannot order matches by distance to cursor
    9.1.1307: make syntax does not reliably detect different flavors
    9.1.1306: completion menu rendering can be improved
    9.1.1305: completion menu active after switching windows/tabs
    9.1.1304: filetype: some man files are not recognized
    9.1.1303: missing out-of-memory check in linematch.c
    9.1.1302: Coverity warns about using uninitialized value
    9.1.1301: completion: cannot configure completion functions with 'complete'
    9.1.1300: wrong detection of -inf
    9.1.1299: filetype: mbsyncrc files are not recognized
    9.1.1298: define_function() is too long
    9.1.1297: Ctrl-D scrolling can get stuck
    9.1.1296: completion: incorrect truncation logic
    9.1.1295: clientserver: does not handle :stopinsert correctly
    9.1.1294: gui tabline menu does not use confirm when closing tabs
    9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
    9.1.1292: statusline not correctly evaluated
    9.1.1291: too many strlen() calls in buffer.c
    9.1.1290: tests: missing cleanup in test_filetype.vim
    9.1.1289: tests: no test for matchparen plugin with WinScrolled event
    9.1.1288: Using wrong window in ll_resize_stack()
    9.1.1287: quickfix code can be further improved
    9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
    9.1.1285: Vim9: no error message for missing method after "super."
    9.1.1284: not possible to configure pum truncation char
    9.1.1283: quickfix stack is limited to 10 items
    9.1.1282: Build and test failure without job feature
    9.1.1281: extra newline output when editing stdin
    9.1.1280: trailing additional semicolon in get_matches_in_str()
    9.1.1279: Vim9: null_object and null_class are no reserved names
    9.1.1278: Vim9: too long functions in vim9type.c
    9.1.1277: tests: trailing comment char in test_popupwin
    9.1.1276: inline word diff treats multibyte chars as word char
    9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
    9.1.1274: Vim9: no support for object<type> as variable type
    9.1.1273: Coverity warns about using uninitialized value
    9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
    9.1.1271: filetype: Power Query files are not recognized
    9.1.1270: missing out-of-memory checks in buffer.c
    9.1.1269: completion: compl_shown_match is updated when starting keyword completion
    9.1.1268: filetype: dax files are not recognized
    9.1.1267: Vim9: no support for type list/dict<object<any>>
    9.1.1266: MS-Windows: type conversion warnings
    9.1.1265: tests: no tests for typing normal char during completion
    9.1.1264: Vim9: error when comparing objects
    9.1.1263: string length wrong in get_last_inserted_save()
    9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
    9.1.1261: No test for 'pummaxwidth' non-truncated items
    9.1.1260: Hang when filtering buffer with NUL bytes
    9.1.1259: some issues with comment package and tailing spaces
    9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
    9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
    9.1.1256: if_python: duplicate tuple data entries
    9.1.1255: missing test condition for 'pummaxwidth' setting
    9.1.1254: need more tests for the comment plugin
    9.1.1253: abort when closing window with attached quickfix data
    9.1.1252: typos in code and docs related to 'diffopt' "inline:"
    9.1.1251: if_python: build error with tuples and dynamic python
    9.1.1250: cannot set the maximum popup menu width
    9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
    9.1.1248: compile error when building without FEAT_QUICKFIX
    9.1.1247: fragile setup to get (preferred) keys from key_name_entry
    9.1.1246: coverity complains about some changes in v9.1.1243
    9.1.1245: need some more tests for curly braces evaluation
    9.1.1244: part of patch v9.1.1242 was wrong
    9.1.1243: diff mode is lacking for changes within lines
    9.1.1242: Crash when evaluating variable name
    9.1.1241: wrong preprocessort indentation in term.c
    9.1.1240: Regression with ic/ac text objects and comment plugin
    9.1.1239: if_python: no tuple data type support
    9.1.1238: wrong cursor column with 'set splitkeep=screen'
    9.1.1237: Compile error with C89 compiler in term.c
    9.1.1236: tests: test_comments leaves swapfiles around
    9.1.1235: cproto files are outdated
    9.1.1234: Compile error when SIZE_MAX is not defined
    9.1.1233: Coverity warns about NULL pointer when triggering WinResized
    9.1.1232: Vim script is missing the tuple data type
    9.1.1231: filetype: SPA JSON files are not recognized
    9.1.1230: inconsistent CTRL-C behaviour for popup windows
    9.1.1229: the comment plugin can be improved
    9.1.1228: completion: current position column wrong after got a match
    9.1.1227: no tests for the comment package
    9.1.1226: "shellcmdline" completion doesn't work with input()
    9.1.1225: extra NULL check in VIM_CLEAR()
    9.1.1224: cannot :put while keeping indent
    9.1.1223: wrong translation used for encoding failures
    9.1.1222: using wrong length for last inserted string
    9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
    9.1.1220: filetype: uv.lock file not recognized
    9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
    9.1.1218: missing out-of-memory check in filepath.c
    9.1.1217: tests: typos in test_matchfuzzy.vim
    9.1.1216: Pasting the '.' register multiple times may not work
    9.1.1215: Patch 9.1.1213 has some issues
    9.1.1214: matchfuzzy() can be improved for camel case matches
    9.1.1213: cannot :put while keeping indent
    9.1.1212: too many strlen() calls in edit.c
    9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
    9.1.1211: TabClosedPre is triggered just before the tab is being freed
    9.1.1210: translation(ru): missing Russian translation for the new tutor
    9.1.1209: colorcolumn not drawn after virtual text lines
    9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
    9.1.1207: MS-Windows: build warning in filepath.c
    9.1.1206: tests: test_filetype fails when a file is a directory
    9.1.1205: completion: preinserted text not removed when closing pum
    9.1.1204: MS-Windows: crash when passing long string to expand()
    9.1.1203: matchparen keeps cursor on case label in sh filetype
    9.1.1202: Missing TabClosedPre autocommand
    9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
    9.1.1200: cmdline pum not cleared for input() completion
    9.1.1199: gvim uses hardcoded xpm icon file
    9.1.1198: [security]: potential data loss with zip.vim
    9.1.1197: process_next_cpt_value() uses wrong condition
    9.1.1196: filetype: config files for container tools are not recognized
    9.1.1195: inside try-block: fn body executed with default arg undefined
    9.1.1194: filetype: false positive help filetype detection
    9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
    9.1.1192: Vim crashes with term response debug logging enabled
    9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
    9.1.1190: C indentation does not detect multibyte labels
    9.1.1189: if_python: build error due to incompatible pointer types
    9.1.1188: runtime(tera): tera support can be improved
    9.1.1187: matchparen plugin wrong highlights shell case statement
    9.1.1186: filetype: help files in git repos are not detected
    9.1.1185: endless loop with completefuzzycollect and no match found
    9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
    9.1.1083: "above" virtual text breaks cursorlineopt=number
    9.1.1182: No cmdline completion for 'completefuzzycollect'
    9.1.1181: Unnecessary STRLEN() calls in insexpand.c
    9.1.1180: short-description
    9.1.1179: too many strlen() calls in misc2.c
    9.1.1178: not possible to generate completion candidates using fuzzy matching
    9.1.1177: filetype: tera files not detected

------------------------------------------------------------------
------------------  2025-8-13  -  Aug 13 2025  -------------------
------------------------------------------------------------------

++++ podman:

  - Add patch for CVE-2025-6032 (bsc#1245320):
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch

++++ podman:

  - Add patch for CVE-2025-6032 (bsc#1245320):
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch

++++ podman:

  - Add patch for CVE-2025-6032 (bsc#1245320):
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch

++++ podman:

  - Add patch for CVE-2025-6032 (bsc#1245320):
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch

++++ podman:

  - Add patch for CVE-2025-6032 (bsc#1245320):
    * 0008-CVE-2025-6032-machine-init-fix-tls-check.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch

------------------------------------------------------------------
------------------  2025-8-12  -  Aug 12 2025  -------------------
------------------------------------------------------------------

++++ aide:

  - Security update:
    * null pointer dereference after reading incorrectly encoded xattr
    attributes from database (local DoS) (bsc#1247885, CVE-2025-54409).
    Add: aide-0.18_cve-2025-54409_xattr.patch
    * improper output neutralization (potential AIDE detection bypass)
    (bsc#1247884, CVE-2025-54389).
    Add: aide-0.18_cve-2025-54389_control_chars.patch

++++ dracut:

  - Update to version 059+suse.605.gc5a2b7ff:
    * fix(dracut-util): crash if CMDLINE ends with quotation mark (bsc#1247819)

++++ dracut:

  - Update to version 059+suse.605.gc5a2b7ff:
    * fix(dracut-util): crash if CMDLINE ends with quotation mark (bsc#1247819)

------------------------------------------------------------------
------------------  2025-8-11  -  Aug 11 2025  -------------------
------------------------------------------------------------------

++++ sqlite3:

  - Update to version 3.50.4:
    * Fix two long-standings cases of the use of uninitialized
    variables in obscure circumstances.

++++ sqlite3:

  - Update to version 3.50.4:
    * Fix two long-standings cases of the use of uninitialized
    variables in obscure circumstances.

++++ libzypp:

  - Make ld.so ignore the subarch packages during install
    (bsc#1246912)
  - version 17.37.17 (35)

++++ libzypp:

  - Make ld.so ignore the subarch packages during install
    (bsc#1246912)
  - version 17.37.17 (35)

++++ net-tools:

  - Provide more readable error for interface name size checking
    introduced by net-tools-CVE-2025-46836.patch
    (bsc#1243581, net-tools-CVE-2025-46836-error-reporting.patch).

++++ net-tools:

  - Provide more readable error for interface name size checking
    introduced by net-tools-CVE-2025-46836.patch
    (bsc#1243581, net-tools-CVE-2025-46836-error-reporting.patch).

------------------------------------------------------------------
------------------  2025-8-7  -  Aug 7 2025  -------------------
------------------------------------------------------------------

++++ libzypp:

  - Fix evaluation of libproxy results (bsc#1247690)
  - Replace URL variables inside mirrorlist/metalink files
    (fixes #667)
  - version 17.37.16 (35)

++++ libzypp:

  - Fix evaluation of libproxy results (bsc#1247690)
  - Replace URL variables inside mirrorlist/metalink files
    (fixes #667)
  - version 17.37.16 (35)

++++ rust-keylime:

  - Update vendored crates (bsc#1247193, CVE-2025-58266)
    * shlex 1.3.0
  - Rebase keylime-agent.conf.diff for current configuration
  - Drop Cargo_lock.patch patch, already present in Cargo.lock
  - Update to version 0.2.7+141:
    * service: Use WantedBy=multi-user.target
    * rpm: Add subpackage for push-attestation agent
    * push-model: implement continuous attestation with configurable intervals
    * Retry registration forever in the state machine
    * Add Verifier URL to configuration
    * Align exp.backoff to current configuration format
    * Increase coverage of state machine (using Context)
    * Increase coverage of struct_filler.rs
    * Groom code (remove dead code)
    * Fix exponential backoff (10secs, 4xx accepted)
    * test: Add documentation test to tests/run.sh
    * tpm: Avoid running code example during documentation tests
    * state_machine: Always start the agent from the Unregistered state
    * Add fixes for the URL construction
    * Refactor evidences collection in push attestation agent
    * push-model: refactor attestation logic into a state machine
    * Fix body sending by allowing serializing strings (#1057)
    * Log ResilientClient errors/response status codes (#1055)
    * Add AK signing scheme and hash algorithm to negotiation
    * tpm: Add method to extract signing scheme and hash algorithm from AK
    * Allow custom content-type/accept headers
    * Integrate exponential backoff to registration (#1052)
    * keylime/structures: Rename ShaValues to PcrBanks
    * Add resilient_client for exponential backoff (#1048)

++++ rust-keylime:

  - Update vendored crates (bsc#1247193, CVE-2025-58266)
    * shlex 1.3.0
  - Rebase keylime-agent.conf.diff for current configuration
  - Drop Cargo_lock.patch patch, already present in Cargo.lock
  - Update to version 0.2.7+141:
    * service: Use WantedBy=multi-user.target
    * rpm: Add subpackage for push-attestation agent
    * push-model: implement continuous attestation with configurable intervals
    * Retry registration forever in the state machine
    * Add Verifier URL to configuration
    * Align exp.backoff to current configuration format
    * Increase coverage of state machine (using Context)
    * Increase coverage of struct_filler.rs
    * Groom code (remove dead code)
    * Fix exponential backoff (10secs, 4xx accepted)
    * test: Add documentation test to tests/run.sh
    * tpm: Avoid running code example during documentation tests
    * state_machine: Always start the agent from the Unregistered state
    * Add fixes for the URL construction
    * Refactor evidences collection in push attestation agent
    * push-model: refactor attestation logic into a state machine
    * Fix body sending by allowing serializing strings (#1057)
    * Log ResilientClient errors/response status codes (#1055)
    * Add AK signing scheme and hash algorithm to negotiation
    * tpm: Add method to extract signing scheme and hash algorithm from AK
    * Allow custom content-type/accept headers
    * Integrate exponential backoff to registration (#1052)
    * keylime/structures: Rename ShaValues to PcrBanks
    * Add resilient_client for exponential backoff (#1048)

++++ rust-keylime:

  - Update vendored crates (bsc#1247193, CVE-2025-58266)
    * shlex 1.3.0
  - Rebase keylime-agent.conf.diff for current configuration
  - Drop Cargo_lock.patch patch, already present in Cargo.lock
  - Update to version 0.2.7+141:
    * service: Use WantedBy=multi-user.target
    * rpm: Add subpackage for push-attestation agent
    * push-model: implement continuous attestation with configurable intervals
    * Retry registration forever in the state machine
    * Add Verifier URL to configuration
    * Align exp.backoff to current configuration format
    * Increase coverage of state machine (using Context)
    * Increase coverage of struct_filler.rs
    * Groom code (remove dead code)
    * Fix exponential backoff (10secs, 4xx accepted)
    * test: Add documentation test to tests/run.sh
    * tpm: Avoid running code example during documentation tests
    * state_machine: Always start the agent from the Unregistered state
    * Add fixes for the URL construction
    * Refactor evidences collection in push attestation agent
    * push-model: refactor attestation logic into a state machine
    * Fix body sending by allowing serializing strings (#1057)
    * Log ResilientClient errors/response status codes (#1055)
    * Add AK signing scheme and hash algorithm to negotiation
    * tpm: Add method to extract signing scheme and hash algorithm from AK
    * Allow custom content-type/accept headers
    * Integrate exponential backoff to registration (#1052)
    * keylime/structures: Rename ShaValues to PcrBanks
    * Add resilient_client for exponential backoff (#1048)

------------------------------------------------------------------
------------------  2025-8-4  -  Aug 4 2025  -------------------
------------------------------------------------------------------

++++ libsolv:

  - fixed rare crash in the handling of allowuninstall in combination
    with forcebest updates
  - new pool_satisfieddep_map feature to test if a set of packages
    satisfies a dependency
  - bump version to 0.7.35

++++ libsolv:

  - fixed rare crash in the handling of allowuninstall in combination
    with forcebest updates
  - new pool_satisfieddep_map feature to test if a set of packages
    satisfies a dependency
  - bump version to 0.7.35

++++ tiff:

  - bsc#1243503:
    Fix TIFFMergeFieldInfo() read_count=write_count=0
    + tiff-4.7.0-bsc1243503.patch
  - security update:
    * CVE-2025-8176 [bsc#1247108]
    Fix heap use-after-free in tools/tiffmedian.c
    + tiff-CVE-2025-8176.patch
    * CVE-2025-8177 [bsc#1247106]
    Fix possible buffer overflow in tools/thumbnail.c:setrow()
    + tiff-CVE-2025-8177.patch

++++ net-tools:

  - Fix a regression in net-tools-CVE-2025-46836.patch (bsc#1246608).

++++ net-tools:

  - Fix a regression in net-tools-CVE-2025-46836.patch (bsc#1246608).

------------------------------------------------------------------
------------------  2025-8-1  -  Aug 1 2025  -------------------
------------------------------------------------------------------

++++ chrony:

  - bsc#1246544: Fix racy socket creation
    * Add chrony-unix-socket.patch
    * Add chrony-remove-chmod.patch
  - Update clknetsim to snapshot a2eb0b25.

++++ grub2:

  - Fix CVE-2024-56738: side-channel attack due to not constant-time
    algorithm in grub_crypto_memcmp (bsc#1234959)
    * grub2-constant-time-grub_crypto_memcmp.patch

++++ jq:

  - Add patches CVE-2025-48060-1.patch and CVE-2025-48060-2.patch
    (CVE-2025-48060, bsc#1244116)

++++ python311-core:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311-core:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311-core:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311-core:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311-core:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311-core:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311-core:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

++++ python311:

  - Add CVE-2025-8194-tarfile-no-neg-offsets.patch which now
    validates archives to ensure member offsets are non-negative
    (gh#python/cpython#130577, CVE-2025-8194, bsc#1247249).

------------------------------------------------------------------
------------------  2025-7-31  -  Jul 31 2025  -------------------
------------------------------------------------------------------

++++ systemd:

  - Remove the script used to help migrating the language and locale settings
    located in /etc/sysconfig/language on old systems to the systemd default
    locations (bsc#1247074)
    The script was introduced more than 7 years ago and all systems running TW
    should have been migrated since then. Moreover the installer supports the
    systemd default locations since approximately SLE15.

++++ systemd:

  - Remove the script used to help migrating the language and locale settings
    located in /etc/sysconfig/language on old systems to the systemd default
    locations (bsc#1247074)
    The script was introduced more than 7 years ago and all systems running TW
    should have been migrated since then. Moreover the installer supports the
    systemd default locations since approximately SLE15.

++++ systemd:

  - Remove the script used to help migrating the language and locale settings
    located in /etc/sysconfig/language on old systems to the systemd default
    locations (bsc#1247074)
    The script was introduced more than 7 years ago and all systems running TW
    should have been migrated since then. Moreover the installer supports the
    systemd default locations since approximately SLE15.

++++ libzypp:

  - Append RepoInfo::path() to the mirror URLs in Preloader
    (bsc#1247054)
  - version 17.37.15 (35)

++++ libzypp:

  - Append RepoInfo::path() to the mirror URLs in Preloader
    (bsc#1247054)
  - version 17.37.15 (35)

------------------------------------------------------------------
------------------  2025-7-29  -  Jul 29 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.3.3-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2833>
    CVE-2025-54388 bsc#1247367

++++ docker:

  - Update to Docker 28.3.3-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2833>
    CVE-2025-54388 bsc#1247367

++++ docker:

  - Update to Docker 28.3.3-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2833>
    CVE-2025-54388 bsc#1247367

++++ docker:

  - Update to Docker 28.3.3-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2833>
    CVE-2025-54388 bsc#1247367

++++ glibc:

  - regcomp-double-free.patch: posix: Fix double-free after allocation
    failure in regcomp (CVE-2025-8058, bsc#1246965, BZ #33185)

++++ glibc:

  - regcomp-double-free.patch: posix: Fix double-free after allocation
    failure in regcomp (CVE-2025-8058, bsc#1246965, BZ #33185)

------------------------------------------------------------------
------------------  2025-7-26  -  Jul 26 2025  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.28. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.28>

++++ containerd:

  - Update to containerd v1.7.28. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.28>

------------------------------------------------------------------
------------------  2025-7-25  -  Jul 25 2025  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update version to 10.5.1
    + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
    + Update scriptlet for package uninstall to avoid issues in the
    build service

++++ cloud-regionsrv-client:

  - Update version to 10.5.1
    + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
    + Update scriptlet for package uninstall to avoid issues in the
    build service

++++ cloud-regionsrv-client:

  - Update version to 10.5.1
    + Fix issue with picking up configured server names from the
    regionsrv config file. Previously only IP addresses were collected
    + Update scriptlet for package uninstall to avoid issues in the
    build service

------------------------------------------------------------------
------------------  2025-7-24  -  Jul 24 2025  -------------------
------------------------------------------------------------------

++++ afterburn:

  - Update to version 5.9.0:
    * cargo: Afterburn release 5.9.0
    * docs/release-notes: update for release 5.9.0
    * cargo: update dependencies
    * Add TMT test structure and basic smoke test
    * build(deps): bump openssl from 0.10.72 to 0.10.73
    * build(deps): bump reqwest from 0.12.15 to 0.12.18
    * docs/release-notes: Update changelog entry
    * dracut: Return 255 in module-setup
    * oraclecloud: add release note and move base URL to constant
    * oraclecloud: implement oraclecloud provider
    * build(deps): bump nix from 0.29.0 to 0.30.1
    * build(deps): bump zbus from 5.7.0 to 5.7.1
    * build(deps): bump serde-xml-rs from 0.6.0 to 0.8.1
    * build(deps): bump ipnetwork from 0.20.0 to 0.21.1
    * build(deps): bump clap from 4.5.38 to 4.5.39

++++ python-kiwi:

  - Bump version: 10.2.28 → 10.2.29
  - Fix return from repart stage
    If we return from the repart stage it's important to wait
    for the root device to appear. This is because the device
    setup from udev might still be held back due to a former
    lock on the device. This means if we return fast after
    locking for example when check_repart_possible() quickly
    finds out that it's not possible, then udev has not yet
    got the time to create the device nodes.
    This Fixes #2863

------------------------------------------------------------------
------------------  2025-7-23  -  Jul 23 2025  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update version to 10.5.0
    + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)

++++ cloud-regionsrv-client:

  - Update version to 10.5.0
    + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)

++++ cloud-regionsrv-client:

  - Update version to 10.5.0
    + Use region server IP addresses to determine Internet access rather
    than a generic address. Region server IP addresses may not be blocked
    in the network construct. (bsc#1245305)

++++ docker:

  - Update to docker-buildx v0.26.1. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.1>

++++ docker:

  - Update to docker-buildx v0.26.1. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.1>

++++ docker:

  - Update to docker-buildx v0.26.1. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.1>

++++ docker:

  - Update to docker-buildx v0.26.1. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.1>

++++ libzypp:

  - During installation indicate the backend being used (bsc#1246038)
    If some package actually needs to know, it should test for
    ZYPP_CLASSIC_RPMTRANS being set in the environment.
    Otherwise the transaction is driven by librpm.
  - version 17.37.14 (35)

++++ libzypp:

  - During installation indicate the backend being used (bsc#1246038)
    If some package actually needs to know, it should test for
    ZYPP_CLASSIC_RPMTRANS being set in the environment.
    Otherwise the transaction is driven by librpm.
  - version 17.37.14 (35)

------------------------------------------------------------------
------------------  2025-7-22  -  Jul 22 2025  -------------------
------------------------------------------------------------------

++++ cloud-init:

  - Update to version 25.1.3 (bsc#1245403)
    + Forward port
  - cloud-init-no-openstack-guess.patch
    + docs: provide example3 for PAM and ssh_pwauth behavior (#27)
    + fix: Make hotplug socket writable only by root (#25) (CVE-2024-11584)
    + fix: Don't attempt to identify non-x86 OpenStack instances (LP: #2069607)
    (CVE-2024-6174)
    From 25.1.2
    + fix: ensure MAAS datasource retries on failure (#6167)

++++ cloud-init:

  - Update to version 25.1.3 (bsc#1245401,bsc#1245403)
    + Forward port
  - cloud-init-no-openstack-guess.patch
    + docs: provide example3 for PAM and ssh_pwauth behavior (#27)
    + fix: Make hotplug socket writable only by root (#25) (CVE-2024-11584)
    + fix: Don't attempt to identify non-x86 OpenStack instances (LP: #2069607)
    (CVE-2024-6174)
    From 25.1.2
    + fix: ensure MAAS datasource retries on failure (#6167)

++++ libzypp:

  - Workaround 'rpm -vv' leaving scriptlets /var/tmp (bsc#1218459)
  - Verbose log libproxy results if PX_DEBUG=1 is set.
  - BuildRequires:  cmake >= 3.17.
  - version 17.37.13 (35)

++++ libzypp:

  - Workaround 'rpm -vv' leaving scriptlets /var/tmp (bsc#1218459)
  - Verbose log libproxy results if PX_DEBUG=1 is set.
  - BuildRequires:  cmake >= 3.17.
  - version 17.37.13 (35)

++++ qemu:

  - Fix bsc#1246566:
    * [roms] seabios: include "pciinit: don't misalign large BARs" (bsc#1246566)

++++ qemu:

  - Fix bsc#1246566:
    * [roms] seabios: include "pciinit: don't misalign large BARs" (bsc#1246566)

------------------------------------------------------------------
------------------  2025-7-21  -  Jul 21 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to docker-buildx v0.26.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.0>

++++ docker:

  - Update to docker-buildx v0.26.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.0>

++++ docker:

  - Update to docker-buildx v0.26.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.0>

++++ docker:

  - Update to docker-buildx v0.26.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.26.0>

------------------------------------------------------------------
------------------  2025-7-18  -  Jul 18 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.27 → 10.2.28
  - Fix dracut code to be POSIX compliant
    The redirect type "< <(...)" is not POSIX complians and leads
    to a syntax error in dracut which calls bash as "sh" leading
    it to be restricted to POSIX only

++++ gdk-pixbuf:

  - Add gdk-pixbuf-fix-decoder-written-bytes-reporting.patch: Fix
    memory leak caused by wrong written bytes reported by decoder
    (CVE-2025-6199, glgo#GNOME/gdk-pixbuf#257, bsc#1245227).

++++ gdk-pixbuf:

  - Add gdk-pixbuf-fix-decoder-written-bytes-reporting.patch: Fix
    memory leak caused by wrong written bytes reported by decoder
    (CVE-2025-6199, glgo#GNOME/gdk-pixbuf#257, bsc#1245227).

++++ libxml2:

  - security update
  - added patches
    CVE-2025-7425 [bsc#1246296], Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
    + libxml2-CVE-2025-7425.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-7425 [bsc#1246296], Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
    + libxml2-CVE-2025-7425.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-7425 [bsc#1246296], Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
    + libxml2-CVE-2025-7425.patch

++++ libxml2-python:

  - security update
  - added patches
    CVE-2025-7425 [bsc#1246296], Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr
    + libxml2-CVE-2025-7425.patch

++++ zypper:

  - Fix addrepo to handle explicit --check and --no-check requests
    (bsc#1246466)
  - Accept "show" as alias for "info" (bsc#1245985)
  - version 1.14.93

------------------------------------------------------------------
------------------  2025-7-17  -  Jul 17 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Go 1.24 for builds, to match upstream.

++++ docker:

  - Update to Go 1.24 for builds, to match upstream.

++++ docker:

  - Update to Go 1.24 for builds, to match upstream.

++++ docker:

  - Update to Go 1.24 for builds, to match upstream.

++++ docker:

  - Update to Go 1.24 for builds, to match upstream.

++++ python-kiwi:

  - Extend test-image-lvm integration test
    For testing a bit more complex resize procedure, update
    the lvm integration test to run more resize actions
    with required device locking
  - Apply proper udev locking
    Several commands during repart, resize and other actions
    require a proper lock to be set for udev such that other
    events knows about the locked state of a device and do
    not mess with it until the command for which the lock
    persists has completed. This commit applies proper udev
    locks to all commands that requires it. In addition
    incorrect code that was expected to prevent such race
    conditions got dropped from the implementation.
    This is related to bsc#1242987
  - relocate GPT at the end of disk using sfdisk
    Using sfdisk for relocation and verification makes this
    part more consistent. We also want to move away from gdisk.
    This is related to #2851
  - Do not strictly require config.partids in repart
    The kiwi-repart implementation requires a metadata file
    named config.partids which holds information about
    partition ids and more stored at the time the image was
    built. Depending on the complexity of the image and the
    resize request some of the information can be rebuilt
    in case the metadata file is missing. This commit adds
    the rebuild of the minimum required information to run
    a standard resize and therefore allows the kiwi-repart
    dracut module to work also without config.partids to be
    present in the system
  - Do not drop /config.partids
    The partition id metadata file is used in the kiwi-repart
    module. If a user wants to use the kiwi repart module
    permanently, this metadata file needs to stay in the system.
    Therefore it should not be automatically deleted by the
    cleanup. A disk.sh hook script can be used to force the
    deletion of the file though. This is related #2851

++++ libxslt:

  - security update
  - added patches
    CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between stylesheet and source nodes
    + libxslt-CVE-2025-7424.patch

++++ libxslt:

  - security update
  - added patches
    CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between stylesheet and source nodes
    + libxslt-CVE-2025-7424.patch

++++ libxslt:

  - security update
  - added patches
    CVE-2025-7424 [bsc#1246360], Type confusion in xmlNode.psvi between stylesheet and source nodes
    + libxslt-CVE-2025-7424.patch

++++ sqlite3:

  - Update to version 3.50.3:
    * Fix a possible memory error that can occur if a query is made
    against against FTS5 index that has been deliberately corrupted
    in a very specific way.
    * Fix the parser so that it ignored SQL comments in all places of
    a CREATE TRIGGER statement. This resolves a problem that was
    introduced by the introduction of the
    SQLITE_DBCONFIG_ENABLE_COMMENTS feature in version 3.49.0.
    * Fix an incorrect answer due to over-optimization of an AND
    operator.

++++ sqlite3:

  - Update to version 3.50.3:
    * Fix a possible memory error that can occur if a query is made
    against against FTS5 index that has been deliberately corrupted
    in a very specific way (CVE-2025-7709, bsc#1254670).
    * Fix the parser so that it ignored SQL comments in all places of
    a CREATE TRIGGER statement. This resolves a problem that was
    introduced by the introduction of the
    SQLITE_DBCONFIG_ENABLE_COMMENTS feature in version 3.49.0.
    * Fix an incorrect answer due to over-optimization of an AND
    operator.

++++ libzypp:

  - Allow explicit request to probe an added repo's URL
    (bsc#1246466)
  - Fix tests with -DISABLE_MEDIABACKEND_TESTS=1 (fixes #661)
  - version 17.37.12 (35)

++++ libzypp:

  - Allow explicit request to probe an added repo's URL
    (bsc#1246466)
  - Fix tests with -DISABLE_MEDIABACKEND_TESTS=1 (fixes #661)
  - version 17.37.12 (35)

------------------------------------------------------------------
------------------  2025-7-16  -  Jul 16 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix centos/test-image-live-disk-v10
    There is no package named iprutils
  - Fix centos/test-image-live-disk-v10
    Update package names
  - Added centos/test-image-live-disk-v10 build test
  - Fix tumbleweed/test-image-gce integration test
    Drop obsolete growpart
  - Followup fix to support older apt versions for bootstrap
    There are apt versions that do not create missing state files.
    Make sure the intermediate bootstrap state file is created in
    any case. This Fixes #2857
  - Fixed integration test builds
    Next round of fixes for integration tests. Missing
    or wrong service activations
  - Fix arm/tumbleweed/test-image-rpi
    Fix snapper setup for this integration test

++++ libarchive:

  - Fix CVE-2025-5918, reading past EOF may be triggered for piped file streams
    (CVE-2025-5918, bsc#1244279)
    * CVE-2025-5918.patch
  - Fix CVE-2025-5917, off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c
    (CVE-2025-5917, bsc#1244336)
    * CVE-2025-5917.patch
  - Fix CVE-2025-5916, integer overflow while reading warc files at archive_read_support_format_warc.c
    (CVE-2025-5916, bsc#1244270)
    * CVE-2025-5916.patch
  - Fix CVE-2025-5915, heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c
    (CVE-2025-5915, bsc#1244273)
    * CVE-2025-5915.patch
  - Fix CVE-2025-5914, double free due to an integer overflow in the archive_read_format_rar_seek_data() function
    (CVE-2025-5914, bsc#1244272)
    * CVE-2025-5914.patch

++++ rpm:

  - fix --runposttrans not working correctly with the --root
    option [bnc#1216091]
    * updated patch: posttrans.diff
    * added "rpm_fixed_runposttrans" provides for libzypp
  - print scriptlet messages in --runposttrans
    * needed to fix leaking tmp files [bsc#1218459]
    * updated patch: posttrans.diff
  - fix memory leak in str2locale [bsc#1241052]
    * updated patch: localetag.diff

++++ pcr-oracle:

  - Apply fix-bsc1241957-strcmp-for-alt-event.patch correctly
    (bsc#1241957)

++++ pcr-oracle:

  - Apply fix-bsc1241957-strcmp-for-alt-event.patch correctly
    (bsc#1241957)

------------------------------------------------------------------
------------------  2025-7-15  -  Jul 15 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed test-image-live-disk
    Added missing openssh-server package
  - Fixed test-image-azure
    Add missing python-azure-agent-config-default package
  - Fixed debian integration test builds
    secure shell service is named ssh and not sshd there
  - Fixed integration test builds
    Second round of fixes for integration tests. Again errors
    now became visible due to the refactoring of the script code
  - Fixed integration test builds
    Errors from scripts were no longer ignored due to the last
    cleanup of the integration test script code. This commit
    fixes the now exposed build errors
  - Fix check_target_dir_on_unsupported_filesystem
    Find the first existing path in the target path and
    check the filesystem capabilities for this path.
    This Fixes #2858

++++ git:

  - update git-gui sha256 patches after the upstream review:
    0001-git-gui-Replace-null_sha1-with-nullid.patch
    0002-git-gui-Add-support-of-SHA256-repo.patch

++++ polkit:

  - CVE-2025-7519: Fixed that a XML policy file with a large number of
    nested elements may lead to out-of-bounds write (bsc#1246472)
    added 0001-Nested-.policy-files-cause-xml-parsing-overflow-lead.patch

++++ polkit:

  - CVE-2025-7519: Fixed that a XML policy file with a large number of
    nested elements may lead to out-of-bounds write (bsc#1246472)
    added 0001-Nested-.policy-files-cause-xml-parsing-overflow-lead.patch

------------------------------------------------------------------
------------------  2025-7-14  -  Jul 14 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
    * tool_getparam: fix --ftp-pasv [5f805ee]
    * Add curl-fix--ftp-pasv.patch

++++ curl:

  - Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
    * tool_getparam: fix --ftp-pasv [5f805ee]
    * Add curl-fix--ftp-pasv.patch

++++ curl:

  - Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
    * tool_getparam: fix --ftp-pasv [5f805ee]
    * Add curl-fix--ftp-pasv.patch

++++ curl:

  - Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
    * tool_getparam: fix --ftp-pasv [5f805ee]
    * Add curl-fix--ftp-pasv.patch

++++ curl:

  - Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
    * tool_getparam: fix --ftp-pasv [5f805ee]
    * Add curl-fix--ftp-pasv.patch

++++ curl:

  - Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]
    * tool_getparam: fix --ftp-pasv [5f805ee]
    * Add curl-fix--ftp-pasv.patch

++++ python-kiwi:

  - Cleanup integration tests config.sh script code
    Add script code to shellcheck and fix all reported issues.
    Get rid of suseXX and baseXX methods as much as possible.
    Add set -ex for all script code. Do not allow any script
    code to fail.
  - defaults: Add patterns for shim/grub2 on riscv64
    A recent commit changed the way these are looked up and
    accidentally broke image building on riscv64, with
    KiwiBootLoaderGrubSecureBootError: Signed grub2 efi loader not found
    now being raised for kiwi recipes that worked just fine
    before that moment.
    Fixes: 197572378cf4f25103934beac2ceca4fbbcfcbc0
    Thanks: David Abdurachmanov <davidlt@rivosinc.com>
    Thanks: Marcus Schäfer <marcus.schaefer@gmail.com>
    Signed-off-by: Andrea Bolognani <abologna@redhat.com>

++++ gnutls:

  - Fix heap buffer overread when handling the CT SCT extension during X.509
    certificate parsing [bsc#1246233, CVE-2025-32989]
    * Add patch gnutls-CVE-2025-32989.patch
  - Fix double-free due to incorrect ownership handling in the export logic of
    SAN entries containing an otherName [bsc#1246232, CVE-2025-32988]
    * Add patch gnutls-CVE-2025-32988.patch
  - Fix 1-byte heap buffer overflow when parsing templates with certtool
    [bsc#1246267, CVE-2025-32990]
    * Add patch gnutls-CVE-2025-32990.patch
  - Fix NULL pointer dereference when 2nd Client Hello omits PSK
    [bsc#1246299, CVE-2025-6395]
    * Add patch gnutls-CVE-2025-6395.patch

++++ gnutls:

  - Fix heap buffer overread when handling the CT SCT extension during X.509
    certificate parsing [bsc#1246233, CVE-2025-32989]
    * Add patch gnutls-CVE-2025-32989.patch
  - Fix double-free due to incorrect ownership handling in the export logic of
    SAN entries containing an otherName [bsc#1246232, CVE-2025-32988]
    * Add patch gnutls-CVE-2025-32988.patch
  - Fix 1-byte heap buffer overflow when parsing templates with certtool
    [bsc#1246267, CVE-2025-32990]
    * Add patch gnutls-CVE-2025-32990.patch
  - Fix NULL pointer dereference when 2nd Client Hello omits PSK
    [bsc#1246299, CVE-2025-6395]
    * Add patch gnutls-CVE-2025-6395.patch

++++ gnutls:

  - Fix heap buffer overread when handling the CT SCT extension during X.509
    certificate parsing [bsc#1246233, CVE-2025-32989]
    * Add patch gnutls-CVE-2025-32989.patch
  - Fix double-free due to incorrect ownership handling in the export logic of
    SAN entries containing an otherName [bsc#1246232, CVE-2025-32988]
    * Add patch gnutls-CVE-2025-32988.patch
  - Fix 1-byte heap buffer overflow when parsing templates with certtool
    [bsc#1246267, CVE-2025-32990]
    * Add patch gnutls-CVE-2025-32990.patch
  - Fix NULL pointer dereference when 2nd Client Hello omits PSK
    [bsc#1246299, CVE-2025-6395]
    * Add patch gnutls-CVE-2025-6395.patch

++++ libzypp:

  - Add runtime check for a broken rpm-4.18.0 --runpostrans
    (bsc#1246149)
  - Add regression test for bsc#1245220 and some other filesize
    related tests.
  - version 17.37.11 (35)

++++ libzypp:

  - Add runtime check for a broken rpm-4.18.0 --runpostrans
    (bsc#1246149)
  - Add regression test for bsc#1245220 and some other filesize
    related tests.
  - version 17.37.11 (35)

++++ rust-keylime:

  - Update vendored crates (bsc#1242623, CVE-2025-3416)
    * openssl 0.10.73
  - Update to version 0.2.7+117:
    * Increase coverage in evidence handling structure
    * Add Capabilities Negotiations resp. missing fields
    * Fix UEFI test to check file access in all cases
    * context_info_handler: Do not assume /var/lib/keylime exists
    * Fix clippy warnings about uninlined format arguments
    * attestation: Allow unwrap() in tests
    * Increase coverage (groom code, extend unit tests)
    * Include IMA/UEFI logs in Evidence Handling request
    * Include method to get all IMA entries as string
    * Send correct list of pcr banks and sign algorithms
    * Try to fix TPM tests related issues
    * Define attestation perform asynchronous
    * Perform attestation in push model agent binary
    * Refactor code to use new attestation.rs
    * Create attestation.rs for Attestation stuff
    * Move ContextInfo management to its own handler
    * Adjust context_info.rs after rebase
    * Add attestation function to ContextInfo structure
    * Add prohibited signing algorithms, avoid ecschnorr
    * keylime/config: Use macro to implement PushModelConfigTrait
    * Introduce keylime-macros and define_view_trait
    * config: Remove KeylimeConfig structure
    * config: Remove unnecessary options and lazy initialization
    * Fix pcr_bank function to send all possible slots
    * Send Content-Type:application/json on request (#1039)
    * Send correct 'key_algorithm' in certification_keys (#1035)
    * Push Model: Persist Attestation Key to file
    * Add Keylime push model binary to root GNUmakefile
    * Use singleton to avoid multiple Context allocation
    * tests: Do not assume `/var/lib/keylime` exists (#1030)
    * lib/cert: Fix race condition due to use of same file path
    * payloads: Fix race condition in tests
    * Add uefi_log_handler.rs to parse UEFI binary
    * Use IMA log parser to send correct entry count
    * Add IMA log parser
    * build(deps): bump once_cell from 1.19.0 to 1.21.3
    * lib/config/base.rs: Add more unit tests
    * lib/permissions: Add unit tests
    * keylime-agent: move JsonWrapper from common.rs to the library
    * lib/agent_data: Move agent_data related tests from common
    * common: Replace APIVersion with the library Version structure
    * keylime_agent: Move secure_mount.rs to the library
    * lib: Rename keylime_error.rs as error.rs
    * config: Move config to keylime library
    * config: Rename push_model_config to push_model
    * lib: Move permissions.rs from keylime-agent to the lib
    * Extract Capabilities Negotiation info from TPM (#1014)

++++ rust-keylime:

  - Update vendored crates (bsc#1242623, CVE-2025-3416)
    * openssl 0.10.73
  - Update to version 0.2.7+117:
    * Increase coverage in evidence handling structure
    * Add Capabilities Negotiations resp. missing fields
    * Fix UEFI test to check file access in all cases
    * context_info_handler: Do not assume /var/lib/keylime exists
    * Fix clippy warnings about uninlined format arguments
    * attestation: Allow unwrap() in tests
    * Increase coverage (groom code, extend unit tests)
    * Include IMA/UEFI logs in Evidence Handling request
    * Include method to get all IMA entries as string
    * Send correct list of pcr banks and sign algorithms
    * Try to fix TPM tests related issues
    * Define attestation perform asynchronous
    * Perform attestation in push model agent binary
    * Refactor code to use new attestation.rs
    * Create attestation.rs for Attestation stuff
    * Move ContextInfo management to its own handler
    * Adjust context_info.rs after rebase
    * Add attestation function to ContextInfo structure
    * Add prohibited signing algorithms, avoid ecschnorr
    * keylime/config: Use macro to implement PushModelConfigTrait
    * Introduce keylime-macros and define_view_trait
    * config: Remove KeylimeConfig structure
    * config: Remove unnecessary options and lazy initialization
    * Fix pcr_bank function to send all possible slots
    * Send Content-Type:application/json on request (#1039)
    * Send correct 'key_algorithm' in certification_keys (#1035)
    * Push Model: Persist Attestation Key to file
    * Add Keylime push model binary to root GNUmakefile
    * Use singleton to avoid multiple Context allocation
    * tests: Do not assume `/var/lib/keylime` exists (#1030)
    * lib/cert: Fix race condition due to use of same file path
    * payloads: Fix race condition in tests
    * Add uefi_log_handler.rs to parse UEFI binary
    * Use IMA log parser to send correct entry count
    * Add IMA log parser
    * build(deps): bump once_cell from 1.19.0 to 1.21.3
    * lib/config/base.rs: Add more unit tests
    * lib/permissions: Add unit tests
    * keylime-agent: move JsonWrapper from common.rs to the library
    * lib/agent_data: Move agent_data related tests from common
    * common: Replace APIVersion with the library Version structure
    * keylime_agent: Move secure_mount.rs to the library
    * lib: Rename keylime_error.rs as error.rs
    * config: Move config to keylime library
    * config: Rename push_model_config to push_model
    * lib: Move permissions.rs from keylime-agent to the lib
    * Extract Capabilities Negotiation info from TPM (#1014)

++++ rust-keylime:

  - Update vendored crates (bsc#1242623, CVE-2025-3416)
    * openssl 0.10.73
  - Update to version 0.2.7+117:
    * Increase coverage in evidence handling structure
    * Add Capabilities Negotiations resp. missing fields
    * Fix UEFI test to check file access in all cases
    * context_info_handler: Do not assume /var/lib/keylime exists
    * Fix clippy warnings about uninlined format arguments
    * attestation: Allow unwrap() in tests
    * Increase coverage (groom code, extend unit tests)
    * Include IMA/UEFI logs in Evidence Handling request
    * Include method to get all IMA entries as string
    * Send correct list of pcr banks and sign algorithms
    * Try to fix TPM tests related issues
    * Define attestation perform asynchronous
    * Perform attestation in push model agent binary
    * Refactor code to use new attestation.rs
    * Create attestation.rs for Attestation stuff
    * Move ContextInfo management to its own handler
    * Adjust context_info.rs after rebase
    * Add attestation function to ContextInfo structure
    * Add prohibited signing algorithms, avoid ecschnorr
    * keylime/config: Use macro to implement PushModelConfigTrait
    * Introduce keylime-macros and define_view_trait
    * config: Remove KeylimeConfig structure
    * config: Remove unnecessary options and lazy initialization
    * Fix pcr_bank function to send all possible slots
    * Send Content-Type:application/json on request (#1039)
    * Send correct 'key_algorithm' in certification_keys (#1035)
    * Push Model: Persist Attestation Key to file
    * Add Keylime push model binary to root GNUmakefile
    * Use singleton to avoid multiple Context allocation
    * tests: Do not assume `/var/lib/keylime` exists (#1030)
    * lib/cert: Fix race condition due to use of same file path
    * payloads: Fix race condition in tests
    * Add uefi_log_handler.rs to parse UEFI binary
    * Use IMA log parser to send correct entry count
    * Add IMA log parser
    * build(deps): bump once_cell from 1.19.0 to 1.21.3
    * lib/config/base.rs: Add more unit tests
    * lib/permissions: Add unit tests
    * keylime-agent: move JsonWrapper from common.rs to the library
    * lib/agent_data: Move agent_data related tests from common
    * common: Replace APIVersion with the library Version structure
    * keylime_agent: Move secure_mount.rs to the library
    * lib: Rename keylime_error.rs as error.rs
    * config: Move config to keylime library
    * config: Rename push_model_config to push_model
    * lib: Move permissions.rs from keylime-agent to the lib
    * Extract Capabilities Negotiation info from TPM (#1014)

------------------------------------------------------------------
------------------  2025-7-12  -  Jul 12 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add SLFO test-image-disk-simple integration test
    Add simple disk test and allow for testing the new
    transparent container idea for the aws toolchain. also
    add SLFO builds to the helper script

------------------------------------------------------------------
------------------  2025-7-10  -  Jul 10 2025  -------------------
------------------------------------------------------------------

++++ net-tools:

  - Perform bound checks when parsing interface labels in
    /proc/net/dev (bsc#1243581, CVE-2025-46836,
    net-tools-CVE-2025-46836.patch,
    net-tools-CVE-2025-46836-regression.patch).

++++ net-tools:

  - Perform bound checks when parsing interface labels in
    /proc/net/dev (bsc#1243581, CVE-2025-46836, GHSA-pfwf-h6m3-63wf,
    net-tools-CVE-2025-46836.patch,
    net-tools-CVE-2025-46836-regression.patch).

------------------------------------------------------------------
------------------  2025-7-9  -  Jul 9 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.3.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2832>

++++ docker:

  - Update to Docker 28.3.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2832>

++++ docker:

  - Update to Docker 28.3.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2832>

++++ docker:

  - Update to Docker 28.3.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2832>

++++ docker:

  - Update to Docker 28.3.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2832>

++++ python-kiwi:

  - Fixed check for unallocated space on disk
    So far the check for unallocated space was only working for GPT
    and there it was also not really stable. The check was based on
    verifying if the backup GPT table is really at the end of the
    disk. Depending on which tool was used to dump the image on the
    target this "mistake" often got corrected by the tools that
    dumped the image. In this case the check no longer worked.
    This commit improves the check by another test which looks
    for the real free bytes on disk compared to the current
    partition geometry.
  - Move to neutral directory for calling osc
    When calling the helper/build_status.sh script to get an
    overview about the results of the integration tests, there
    is a stupid new behavior from the osc tool that it assumes
    a package name according to the name of the directory you
    are in probably connected to the fact that the data in this
    directory is a git checkout or some other strange assumption.
    This commit moves to a neutral directory where none of the
    osc internal assumptions applies and it just does what it
    should do... showing results of the given project.
  - Bump version: 10.2.26 → 10.2.27

++++ git:

  - refreshed gitk sha256 patches:
    0001-gitk-Add-support-of-SHA256-repo.patch
    0002-git-gui-Add-support-of-SHA256-repo.patch
  - update to 2.50.1 (boo#1245938 boo#1245939 boo#1245942 boo#1245943
    boo#1245946 boo#1245947)
    Security fixes for CVE-2025-27613, CVE-2025-27614,
    CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385,
    and CVE-2025-48386
    CVE-2025-27613, Gitk:
    When a user clones an untrusted repository and runs Gitk without
    additional command arguments, any writable file can be created and
    truncated. The option "Support per-file encoding" must have been
    enabled. The operation "Show origin of this line" is affected as
    well, regardless of the option being enabled or not.
    CVE-2025-27614, Gitk:
    A Git repository can be crafted in such a way that a user who has
    cloned the repository can be tricked into running any script
    supplied by the attacker by invoking `gitk filename`, where
    `filename` has a particular structure.
    CVE-2025-46334, Git GUI (Windows only):
    A malicious repository can ship versions of sh.exe or typical
    textconv filter programs such as astextplain. On Windows, path
    lookup can find such executables in the worktree. These programs
    are invoked when the user selects "Git Bash" or "Browse Files" from
    the menu.
    CVE-2025-46835, Git GUI:
    When a user clones an untrusted repository and is tricked into
    editing a file located in a maliciously named directory in the
    repository, then Git GUI can create and overwrite any writable
    file.
    CVE-2025-48384, Git:
    When reading a config value, Git strips any trailing carriage
    return and line feed (CRLF). When writing a config entry, values
    with a trailing CR are not quoted, causing the CR to be lost when
    the config is later read.  When initializing a submodule, if the
    submodule path contains a trailing CR, the altered path is read
    resulting in the submodule being checked out to an incorrect
    location. If a symlink exists that points the altered path to the
    submodule hooks directory, and the submodule contains an executable
    post-checkout hook, the script may be unintentionally executed
    after checkout.
    CVE-2025-48385, Git:
    When cloning a repository Git knows to optionally fetch a bundle
    advertised by the remote server, which allows the server-side to
    offload parts of the clone to a CDN. The Git client does not
    perform sufficient validation of the advertised bundles, which
    allows the remote side to perform protocol injection.
    This protocol injection can cause the client to write the fetched
    bundle to a location controlled by the adversary. The fetched
    content is fully controlled by the server, which can in the worst
    case lead to arbitrary code execution.
    CVE-2025-48386, Git:
    The wincred credential helper uses a static buffer (`target`) as a
    unique key for storing and comparing against internal storage. This
    credential helper does not properly bounds check the available
    space remaining in the buffer before appending to it with
    `wcsncat()`, leading to potential buffer overflows.

------------------------------------------------------------------
------------------  2025-7-8  -  Jul 8 2025  -------------------
------------------------------------------------------------------

++++ dracut:

  - Update to version 059+suse.603.g57891bd2:
    * fix(rngd): adjust license to match the license of the whole project
    * fix(dracut): kernel module name normalization in drivers lists (bsc#1241680)
    * fix(dracut-init): assign real path to srcmods (bsc#1241114)

++++ dracut:

  - Update to version 059+suse.603.g57891bd2:
    * fix(rngd): adjust license to match the license of the whole project
    * fix(dracut): kernel module name normalization in drivers lists (bsc#1241680)
    * fix(dracut-init): assign real path to srcmods (bsc#1241114)

++++ python-kiwi:

  - Fix regression in get_partition_node_name
    backwards compat for lsblk before 2.38
    if START column not supported, fall back to default sort
  - Add global option --setenv
    Allow to set environment variables in the caller environment
    via the commandline, e.g --setenv SOURCE_DATE_EPOCH=42
  - Seed filesystem UUIDs with SOURCE_DATE_EPOCH
    For reproducible builds the calculation of the filesystem UUID
    should be persistent with each rebuild of the image. To achieve
    this the UUID is calculated using the SOURCE_DATE_EPOCH from
    the environment plus a char-number representation of the filesystem
    label name as random seed. In kiwi every filesystem is created
    with a label, thus only in case there is no SOURCE_DATE_EPOCH
    available we continue to create the UUID as random data.
    This Fixes #2761
  - Add label attribute for <partition> section
    Allow to specify a filesystem label as part of a <partition>
    definition. So far the label was set by the name of the
    partition. With the new label attribute, a filesystem label
    different from the partition name can be set. This commit
    also updates/fixes the documentation in this regard.
  - Improve log message in SystemIdentifier
    Add some scope information such that we know from where
    this log information originates from.

------------------------------------------------------------------
------------------  2025-7-7  -  Jul 7 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add rd.kiwi.install.devicepersistency
    Allow to specify which type of persistent device name should
    be used to build up the list of installation disk devices.
    For example rd.kiwi.install.devicepersistency=by-path would
    use the by-path representations for the available disk
    devices. The default (by-id) stays untouched. In case an
    invalid or not present device representation is selected, kiwi
    falls back to the non persistent unix node names.

++++ libsolv:

  - add support for product-obsoletes() provides in the product
    autopackage generation code
  - bump version to 0.7.34

++++ libsolv:

  - add support for product-obsoletes() provides in the product
    autopackage generation code
  - bump version to 0.7.34

++++ libsolv:

  - add support for product-obsoletes() provides in the product
    autopackage generation code
  - bump version to 0.7.34

++++ systemd:

  - triggers.systemd: skip update of hwdb, journal-catalog if executed during an
    offline update.

++++ systemd:

  - triggers.systemd: skip update of hwdb, journal-catalog if executed during an
    offline update.

++++ systemd:

  - triggers.systemd: skip update of hwdb, journal-catalog if executed during an
    offline update.

++++ libzypp:

  - BuildRequires: %{libsolv_devel_package} >= 0.7.34 (bsc#1243486)
    Newer rpm versions no longer allow a ':' in rpm package names or
    obsoletes. So injecting an
    Obsoletes: product:oldproductname < oldproductversion
    into the -release package to indicate a product rename is no longer
    possible.
    Since libsolv-0.7.34 you can and should use:
    Provides: product-obsoletes(oldproductname) < oldproductversion
    in the -release package. libsolv will then inject the appropriate
    Obsoletes into the Product.
  - version 17.37.10 (35)

++++ libzypp:

  - BuildRequires: %{libsolv_devel_package} >= 0.7.34 (bsc#1243486)
    Newer rpm versions no longer allow a ':' in rpm package names or
    obsoletes. So injecting an
    Obsoletes: product:oldproductname < oldproductversion
    into the -release package to indicate a product rename is no longer
    possible.
    Since libsolv-0.7.34 you can and should use:
    Provides: product-obsoletes(oldproductname) < oldproductversion
    in the -release package. libsolv will then inject the appropriate
    Obsoletes into the Product.
  - version 17.37.10 (35)

++++ libzypp:

  - BuildRequires: %{libsolv_devel_package} >= 0.7.34 (bsc#1243486)
    Newer rpm versions no longer allow a ':' in rpm package names or
    obsoletes. So injecting an
    Obsoletes: product:oldproductname < oldproductversion
    into the -release package to indicate a product rename is no longer
    possible.
    Since libsolv-0.7.34 you can and should use:
    Provides: product-obsoletes(oldproductname) < oldproductversion
    in the -release package. libsolv will then inject the appropriate
    Obsoletes into the Product.
  - version 17.37.10 (35)

------------------------------------------------------------------
------------------  2025-7-4  -  Jul 4 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update test-image-disk
    Add NetworkManager for better remote debugging capabilities

++++ libzypp:

  - Ignore DeltaRpm download errors (bsc#1245672)
    DeltaRpms are in fact optional resources. In case of a failure
    the full rpm is downloaded.
  - Improve fix for incorrect filesize handling (bsc#1245220)
  - version 17.37.9 (35)

++++ libzypp:

  - Ignore DeltaRpm download errors (bsc#1245672)
    DeltaRpms are in fact optional resources. In case of a failure
    the full rpm is downloaded.
  - Improve fix for incorrect filesize handling (bsc#1245220)
  - version 17.37.9 (35)

++++ libzypp:

  - Ignore DeltaRpm download errors (bsc#1245672)
    DeltaRpms are in fact optional resources. In case of a failure
    the full rpm is downloaded.
  - Improve fix for incorrect filesize handling (bsc#1245220)
  - version 17.37.9 (35)

++++ salt:

  - Add `minion_legacy_req_warnings` option to avoid noisy warnings
  - Require M2Crypto >= 0.44.0 for SUSE Family distros
  - Added:
    * add-minion_legacy_req_warnings-option-to-avoid-noisy.patch

++++ salt:

  - Add `minion_legacy_req_warnings` option to avoid noisy warnings
  - Require M2Crypto >= 0.44.0 for SUSE Family distros
  - Added:
    * add-minion_legacy_req_warnings-option-to-avoid-noisy.patch

++++ salt:

  - Add `minion_legacy_req_warnings` option to avoid noisy warnings
  - Require M2Crypto >= 0.44.0 for SUSE Family distros
  - Added:
    * add-minion_legacy_req_warnings-option-to-avoid-noisy.patch

++++ zypper:

  - sh: Reset solver options after command (bsc#1245496)
  - Explicitly selecting DownloadAsNeeded also selects the
    classic_rpmtrans backend.
  - version 1.14.92

++++ zypper:

  - sh: Reset solver options after command (bsc#1245496)
  - Explicitly selecting DownloadAsNeeded also selects the
    classic_rpmtrans backend.
  - version 1.14.92

------------------------------------------------------------------
------------------  2025-7-3  -  Jul 3 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.3.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2831>

++++ docker:

  - Update to Docker 28.3.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2831>

++++ docker:

  - Update to Docker 28.3.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2831>

++++ docker:

  - Update to Docker 28.3.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2831>

++++ docker:

  - Update to Docker 28.3.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2831>

++++ systemd:

  - Import commit 247091bc99ba506cee501b520d1d0a11d772fc13 (merge of v254.27)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/aa12f501ae4749c542a091028d848796da4ef51b...247091bc99ba506cee501b520d1d0a11d772fc13
  - Import commit aa12f501ae4749c542a091028d848796da4ef51b
    aa12f501ae logs-show: get timestamp and boot ID only when necessary (bsc#1242827)
    e8b17d11bc sd-journal: drop to use Hashmap to manage journal files per boot ID
    ea80273738 tree-wide: set SD_JOURNAL_ASSUME_IMMUTABLE where appropriate
    a5b3b5344f sd-journal: introduce SD_JOURNAL_ASSUME_IMMUTABLE flag
    5fa0600b34 sd-journal: make journal_file_read_tail_timestamp() notify to the caller that some new journal entries added
    737e8193e7 sd-journal: cache last entry offset and journal file state
    057dca426f sd-journal: fix typo in function name

++++ systemd:

  - Import commit 247091bc99ba506cee501b520d1d0a11d772fc13 (merge of v254.27)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/aa12f501ae4749c542a091028d848796da4ef51b...247091bc99ba506cee501b520d1d0a11d772fc13
  - Import commit aa12f501ae4749c542a091028d848796da4ef51b
    aa12f501ae logs-show: get timestamp and boot ID only when necessary (bsc#1242827)
    e8b17d11bc sd-journal: drop to use Hashmap to manage journal files per boot ID
    ea80273738 tree-wide: set SD_JOURNAL_ASSUME_IMMUTABLE where appropriate
    a5b3b5344f sd-journal: introduce SD_JOURNAL_ASSUME_IMMUTABLE flag
    5fa0600b34 sd-journal: make journal_file_read_tail_timestamp() notify to the caller that some new journal entries added
    737e8193e7 sd-journal: cache last entry offset and journal file state
    057dca426f sd-journal: fix typo in function name

++++ systemd:

  - Import commit 247091bc99ba506cee501b520d1d0a11d772fc13 (merge of v254.27)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/aa12f501ae4749c542a091028d848796da4ef51b...247091bc99ba506cee501b520d1d0a11d772fc13
  - Import commit aa12f501ae4749c542a091028d848796da4ef51b
    aa12f501ae logs-show: get timestamp and boot ID only when necessary (bsc#1242827)
    e8b17d11bc sd-journal: drop to use Hashmap to manage journal files per boot ID
    ea80273738 tree-wide: set SD_JOURNAL_ASSUME_IMMUTABLE where appropriate
    a5b3b5344f sd-journal: introduce SD_JOURNAL_ASSUME_IMMUTABLE flag
    5fa0600b34 sd-journal: make journal_file_read_tail_timestamp() notify to the caller that some new journal entries added
    737e8193e7 sd-journal: cache last entry offset and journal file state
    057dca426f sd-journal: fix typo in function name

------------------------------------------------------------------
------------------  2025-7-2  -  Jul 2 2025  -------------------
------------------------------------------------------------------

++++ chrony:

  - Update to version 4.7:
    * Add opencommands directive to select remote monitoring
    commands
    * Add interval option to driftfile directive
    * Add waitsynced and waitunsynced options to local directive
    * Add sanity checks for integer values in configuration
    * Add support for systemd Type=notify service
    * Add RTC refclock driver
    * Allow PHC refclock to be specified with network interface name
    * Don’t require multiple refclock samples per poll to simplify
    filter configuration
    * Keep refclock reachable when dropping samples with large delay
    * Improve quantile-based filtering to adapt faster to larger
    delay
    * Improve logging of selection failures
    * Detect clock interference from other processes
    * Try to reopen message log (-l option) on cyclelogs command
    * Fix sourcedir reloading to not multiply sources
    * Fix tracking offset after failed clock step
    * Drop support for NTS with Nettle < 3.6 and GnuTLS < 3.6.14
    * Drop support for building without POSIX threads
  - Update clknetsim to snapshot 530d1a5.

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311-core:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ libzypp:

  - Do not trigger download data exceeded errors on HTTP non data
    responses (bsc#1245220)
    In some cases a HTTP 401 or 407 did trigger a "filesize exceeded"
    error, because the response payload size was compared against the
    expected filesize. This patch adds some checks if the response
    code is in the success range and only then takes expected
    filesize into account. Otherwise the response content-length is
    used or a fallback of 2Mb if no content-length is known.
  - version 17.37.8 (35)
  - Fix SEGV in MediaDISK handler (bsc#1245452)
  - Explicitly selecting DownloadAsNeeded also selects the
    classic_rpmtrans backend.
    DownloadAsNeeded can not be combined with the rpm singletrans
    installer backend because a rpm transaction requires all package
    headers to be available the the beginning of the transaction. So
    explicitly selecting this mode also turns on the classic_rpmtrans
    backend.
  - Fix evaluation of libproxy results (bsc#1244710)
  - version 17.37.7 (35)

++++ libzypp:

  - Do not trigger download data exceeded errors on HTTP non data
    responses (bsc#1245220)
    In some cases a HTTP 401 or 407 did trigger a "filesize exceeded"
    error, because the response payload size was compared against the
    expected filesize. This patch adds some checks if the response
    code is in the success range and only then takes expected
    filesize into account. Otherwise the response content-length is
    used or a fallback of 2Mb if no content-length is known.
  - version 17.37.8 (35)
  - Fix SEGV in MediaDISK handler (bsc#1245452)
  - Explicitly selecting DownloadAsNeeded also selects the
    classic_rpmtrans backend.
    DownloadAsNeeded can not be combined with the rpm singletrans
    installer backend because a rpm transaction requires all package
    headers to be available the the beginning of the transaction. So
    explicitly selecting this mode also turns on the classic_rpmtrans
    backend.
  - Fix evaluation of libproxy results (bsc#1244710)
  - version 17.37.7 (35)

++++ libzypp:

  - Do not trigger download data exceeded errors on HTTP non data
    responses (bsc#1245220)
    In some cases a HTTP 401 or 407 did trigger a "filesize exceeded"
    error, because the response payload size was compared against the
    expected filesize. This patch adds some checks if the response
    code is in the success range and only then takes expected
    filesize into account. Otherwise the response content-length is
    used or a fallback of 2Mb if no content-length is known.
  - version 17.37.8 (35)
  - Fix SEGV in MediaDISK handler (bsc#1245452)
  - Explicitly selecting DownloadAsNeeded also selects the
    classic_rpmtrans backend.
    DownloadAsNeeded can not be combined with the rpm singletrans
    installer backend because a rpm transaction requires all package
    headers to be available the the beginning of the transaction. So
    explicitly selecting this mode also turns on the classic_rpmtrans
    backend.
  - Fix evaluation of libproxy results (bsc#1244710)
  - version 17.37.7 (35)

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python311:

  - Add CVE-2025-6069-quad-complex-HTMLParser.patch to avoid worst
    case quadratic complexity when processing certain crafted
    malformed inputs with HTMLParser (CVE-2025-6069, bsc#1244705).

++++ python-urllib3:

  - Add patch CVE-2025-50181-poolmanager-redirects.patch:
    * Pool managers now properly control redirects when retries is passed
    (CVE-2025-50181, GHSA-pq67-6m6q-mj2v, bsc#1244925)

++++ python-urllib3:

  - Add patch CVE-2025-50181-poolmanager-redirects.patch:
    * Pool managers now properly control redirects when retries is passed
    (CVE-2025-50181, GHSA-pq67-6m6q-mj2v, bsc#1244925)

++++ python-urllib3:

  - Add patch CVE-2025-50181-poolmanager-redirects.patch:
    * Pool managers now properly control redirects when retries is passed
    (CVE-2025-50181, GHSA-pq67-6m6q-mj2v, bsc#1244925)

------------------------------------------------------------------
------------------  2025-7-1  -  Jul 1 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Make mbr-id deterministic
    Log the value of SDE so it is available to review,
    even if the build system does not tell about it.
    Update the tests to cover the new code-path.
    Co-Authored-By: Marcus Schäfer <marcus.schaefer@gmail.com>
  - Ensure dracut initrd is reproducible
    This helps a bit with issue #2358
    Add reproducible flag for UKI too
    Update tests accordingly
    Co-Authored-By: Marcus Schäfer <marcus.schaefer@gmail.com>

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311-core:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ sqlite3:

  - Update to 3.50.2:
    * Fix the concat_ws() SQL function so that it includes empty
    strings in the concatenation.
    * Avoid writing frames with no checksums into the wal file if a
    savepoint is rolled back after dirty pages have already been
    spilled into the wal file.
    * Fix the Bitvec object to avoid stack overflow when the
    database is within 60 pages of its maximum size.
    * Fix a problem with UPDATEs on fts5 tables that contain BLOB
    values.
    * Fix an issue with transitive IS constraints on a RIGHT JOIN.
    * CVE-2025-6965, bsc#1246597:
    Raise an error early if the number of aggregate terms in a
    query exceeds the maximum number of columns, to avoid
    downstream assertion faults.
    * Ensure that sqlite3_setlk_timeout() holds the database mutex.

++++ sqlite3:

  - Update to 3.50.2:
    * Fix the concat_ws() SQL function so that it includes empty
    strings in the concatenation.
    * Avoid writing frames with no checksums into the wal file if a
    savepoint is rolled back after dirty pages have already been
    spilled into the wal file.
    * Fix the Bitvec object to avoid stack overflow when the
    database is within 60 pages of its maximum size.
    * Fix a problem with UPDATEs on fts5 tables that contain BLOB
    values.
    * Fix an issue with transitive IS constraints on a RIGHT JOIN.
    * CVE-2025-6965, bsc#1246597:
    Raise an error early if the number of aggregate terms in a
    query exceeds the maximum number of columns, to avoid
    downstream assertion faults.
    * Ensure that sqlite3_setlk_timeout() holds the database mutex.

++++ sqlite3:

  - Update to 3.50.2:
    * Fix the concat_ws() SQL function so that it includes empty
    strings in the concatenation.
    * Avoid writing frames with no checksums into the wal file if a
    savepoint is rolled back after dirty pages have already been
    spilled into the wal file.
    * Fix the Bitvec object to avoid stack overflow when the
    database is within 60 pages of its maximum size.
    * Fix a problem with UPDATEs on fts5 tables that contain BLOB
    values.
    * Fix an issue with transitive IS constraints on a RIGHT JOIN.
    * CVE-2025-6965, bsc#1246597:
    Raise an error early if the number of aggregate terms in a
    query exceeds the maximum number of columns, to avoid
    downstream assertion faults.
    * Ensure that sqlite3_setlk_timeout() holds the database mutex.

++++ libxml2:

  - security update
  - added patches
    CVE-2025-49794 [bsc#1244554], heap use after free (UAF) can lead to Denial of service (DoS)
    CVE-2025-49796 [bsc#1244557], type confusion may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49794,49796.patch
    CVE-2025-49795 [bsc#1244555], null pointer dereference may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49795.patch
  - security update
  - added patches
    CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
    CVE-2025-6021 [bsc#1244580], Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
    + libxml2-CVE-2025-6170,6021.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-49794 [bsc#1244554], heap use after free (UAF) can lead to Denial of service (DoS)
    CVE-2025-49796 [bsc#1244557], type confusion may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49794,49796.patch
    CVE-2025-49795 [bsc#1244555], null pointer dereference may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49795.patch
  - security update
  - added patches
    CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
    CVE-2025-6021 [bsc#1244580], Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
    + libxml2-CVE-2025-6170,6021.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-49794 [bsc#1244554], heap use after free (UAF) can lead to Denial of service (DoS)
    CVE-2025-49796 [bsc#1244557], type confusion may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49794,49796.patch
    CVE-2025-49795 [bsc#1244555], null pointer dereference may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49795.patch
  - security update
  - added patches
    CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
    CVE-2025-6021 [bsc#1244580], Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
    + libxml2-CVE-2025-6170,6021.patch

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ python311:

  - Use one core to build doc. This will make sphinx doc build
    reproducible.
    bsc#1243155

++++ libxml2-python:

  - security update
  - added patches
    CVE-2025-49794 [bsc#1244554], heap use after free (UAF) can lead to Denial of service (DoS)
    CVE-2025-49796 [bsc#1244557], type confusion may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49794,49796.patch
    CVE-2025-49795 [bsc#1244555], null pointer dereference may lead to Denial of service (DoS)
    + libxml2-CVE-2025-49795.patch
  - security update
  - added patches
    CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
    CVE-2025-6021 [bsc#1244580], Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
    + libxml2-CVE-2025-6170,6021.patch

++++ salt:

  - Prevent tests failures when pygit2 is not present
  - Several fixes for security issues
  -   (bsc#1244561, CVE-2024-38822)
  -   (bsc#1244564, CVE-2024-38823)
  -   (bsc#1244565, CVE-2024-38824)
  -   (bsc#1244566, CVE-2024-38825)
  -   (bsc#1244567, CVE-2025-22240)
  -   (bsc#1244568, CVE-2025-22236)
  -   (bsc#1244570, CVE-2025-22241)
  -   (bsc#1244571, CVE-2025-22237)
  -   (bsc#1244572, CVE-2025-22238)
  -   (bsc#1244574, CVE-2025-22239)
  -   (bsc#1244575, CVE-2025-22242)
  -   * Request server hardening
  -   * Prevent traversal in local_cache::save_minions
  -   * Add test and fix for file_recv cve
  -   * Fix traversal in gitfs find_file
  -   * Fix traversal in salt.utils.virt
  -   * Fix traversal in pub_ret
  -   * Reasonable failures when pillars timeout
  -   * Make send_req_async wait longer
  -   * Remove token to prevent decoding errors
  -   * Fix checking of non-url style git remotes
  -   * Allow subdirs in GitFS find_file check
  - Add subsystem filter to udev.exportdb (bsc#1236621)
  - tornado.httputil: raise errors instead of logging in
  - multipart/form-data parsing (CVE-2025-47287, bsc#1243268)
  - Fix Ubuntu 24.04 edge-case test failures
  - Fix broken tests for Ubuntu 24.04
  - Fix refresh of osrelease and related grains on Python 3.10+
  - Make "salt" package to obsolete "python3-salt" package on SLE15SP7+
  - Fix issue requiring proper Python flavor for dependencies and recommended package
  - Added:
    * fix-tests-issues-in-salt-shaker-environments-721.patch
    * several-fixes-for-security-issues.patch
    * fix-of-cve-2025-47287-bsc-1243268-718.patch
    * add-subsystem-filter-to-udev.exportdb-bsc-1236621-71.patch
    * fix-ubuntu-24.04-specific-failures-716.patch
    * fix-debian-tests-715.patch
    * fix-refresh-of-osrelease-and-related-grains-on-pytho.patch

++++ salt:

  - Prevent tests failures when pygit2 is not present
  - Several fixes for security issues
  -   (bsc#1244561, CVE-2024-38822)
  -   (bsc#1244564, CVE-2024-38823)
  -   (bsc#1244565, CVE-2024-38824)
  -   (bsc#1244566, CVE-2024-38825)
  -   (bsc#1244567, CVE-2025-22240)
  -   (bsc#1244568, CVE-2025-22236)
  -   (bsc#1244570, CVE-2025-22241)
  -   (bsc#1244571, CVE-2025-22237)
  -   (bsc#1244572, CVE-2025-22238)
  -   (bsc#1244574, CVE-2025-22239)
  -   (bsc#1244575, CVE-2025-22242)
  -   * Request server hardening
  -   * Prevent traversal in local_cache::save_minions
  -   * Add test and fix for file_recv cve
  -   * Fix traversal in gitfs find_file
  -   * Fix traversal in salt.utils.virt
  -   * Fix traversal in pub_ret
  -   * Reasonable failures when pillars timeout
  -   * Make send_req_async wait longer
  -   * Remove token to prevent decoding errors
  -   * Fix checking of non-url style git remotes
  -   * Allow subdirs in GitFS find_file check
  - Add subsystem filter to udev.exportdb (bsc#1236621)
  - tornado.httputil: raise errors instead of logging in
  - multipart/form-data parsing (CVE-2025-47287, bsc#1243268)
  - Fix Ubuntu 24.04 edge-case test failures
  - Fix broken tests for Ubuntu 24.04
  - Fix refresh of osrelease and related grains on Python 3.10+
  - Make "salt" package to obsolete "python3-salt" package on SLE15SP7+
  - Fix issue requiring proper Python flavor for dependencies and recommended package
  - Added:
    * fix-tests-issues-in-salt-shaker-environments-721.patch
    * several-fixes-for-security-issues.patch
    * fix-of-cve-2025-47287-bsc-1243268-718.patch
    * add-subsystem-filter-to-udev.exportdb-bsc-1236621-71.patch
    * fix-ubuntu-24.04-specific-failures-716.patch
    * fix-debian-tests-715.patch
    * fix-refresh-of-osrelease-and-related-grains-on-pytho.patch

++++ salt:

  - Prevent tests failures when pygit2 is not present
  - Several fixes for security issues
  -   (bsc#1244561, CVE-2024-38822)
  -   (bsc#1244564, CVE-2024-38823)
  -   (bsc#1244565, CVE-2024-38824)
  -   (bsc#1244566, CVE-2024-38825)
  -   (bsc#1244567, CVE-2025-22240)
  -   (bsc#1244568, CVE-2025-22236)
  -   (bsc#1244570, CVE-2025-22241)
  -   (bsc#1244571, CVE-2025-22237)
  -   (bsc#1244572, CVE-2025-22238)
  -   (bsc#1244574, CVE-2025-22239)
  -   (bsc#1244575, CVE-2025-22242)
  -   * Request server hardening
  -   * Prevent traversal in local_cache::save_minions
  -   * Add test and fix for file_recv cve
  -   * Fix traversal in gitfs find_file
  -   * Fix traversal in salt.utils.virt
  -   * Fix traversal in pub_ret
  -   * Reasonable failures when pillars timeout
  -   * Make send_req_async wait longer
  -   * Remove token to prevent decoding errors
  -   * Fix checking of non-url style git remotes
  -   * Allow subdirs in GitFS find_file check
  - Add subsystem filter to udev.exportdb (bsc#1236621)
  - tornado.httputil: raise errors instead of logging in
  - multipart/form-data parsing (CVE-2025-47287, bsc#1243268)
  - Fix Ubuntu 24.04 edge-case test failures
  - Fix broken tests for Ubuntu 24.04
  - Fix refresh of osrelease and related grains on Python 3.10+
  - Make "salt" package to obsolete "python3-salt" package on SLE15SP7+
  - Fix issue requiring proper Python flavor for dependencies and recommended package
  - Added:
    * fix-tests-issues-in-salt-shaker-environments-721.patch
    * several-fixes-for-security-issues.patch
    * fix-of-cve-2025-47287-bsc-1243268-718.patch
    * add-subsystem-filter-to-udev.exportdb-bsc-1236621-71.patch
    * fix-ubuntu-24.04-specific-failures-716.patch
    * fix-debian-tests-715.patch
    * fix-refresh-of-osrelease-and-related-grains-on-pytho.patch

++++ supportutils:

  - Changes to version 3.2.11
    + Collect rsyslog frule files (bsc#1244003, pr#257)
    + Remove proxy passwords (bsc#1244011, pr#257)
    + Missing NetworkManager information (bsc#1241284, pr#257)
    + Include agama logs bsc#1244937, pr#256)
    + Additional NFS conf files (pr#253)
    + New fadump sysfs files (pr#252)
    + Fixed change log dates

------------------------------------------------------------------
------------------  2025-6-30  -  Jun 30 2025  -------------------
------------------------------------------------------------------

++++ gptfdisk:

  - fix boot failure with qcow and vmdk images (bsc#1242987)
    * 0001-Do-not-check-for-writable-device-if-we-don-t-need-it.patch

------------------------------------------------------------------
------------------  2025-6-27  -  Jun 27 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.25 → 10.2.26
  - Add kernel parameter support for dm-verity options
    Implement rd.kiwi.verity_options= parameter to allow runtime customization of veritysetup options
    Closes #2837
  - Fix shim lookup for arm on SUSE
    Add missing search path for shim binary on arm based SUSE
    systems. Also update the tumbleweed/test-image-live-disk
    integration test for arm to build with secure boot enabled
    to actually test a secure boot enabled ISO build.
    This Fixes #2842

++++ sudo:

  - Fix a possible local privilege escalation via the --host option
    [bsc#1245274, CVE-2025-32462]
  - Fix a possible local privilege Escalation via chroot option
    [bsc#1245275, CVE-2025-32463]

++++ sudo:

  - Fix a possible local privilege escalation via the --host option
    [bsc#1245274, CVE-2025-32462]
    * fix-CVE-2025-32462.patch
  - Fix a possible local privilege Escalation via chroot option
    [bsc#1245275, CVE-2025-32463]
    * fix-CVE-2025-32463.patch

------------------------------------------------------------------
------------------  2025-6-26  -  Jun 26 2025  -------------------
------------------------------------------------------------------

++++ git:

  - Fix git-gui citool SHA256 repo handling:
    refreshed 0002-git-gui-Add-support-of-SHA256-repo.patch

++++ gpg2:

  - Security fix: [bsc#1236931, bsc#1239119, CVE-2025-30258]
    * gpg: Fix regression for the recent malicious subkey DoS fix.
    * gpg: Fix another regression due to the T7547 fix.
    * The fix for CVE-2025-30258 was introduced in 2.5.5
    * Add patches:
  - gnupg-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
  - gnupg-gpg-Fix-another-regression-due-to-the-T7547-fix.patch

++++ gpg2:

  - Security fix: [bsc#1236931, bsc#1239119, CVE-2025-30258]
    * gpg: Fix regression for the recent malicious subkey DoS fix.
    * gpg: Fix another regression due to the T7547 fix.
    * gpg: Allow the use of an ADSK subkey as ADSK subkey.
    * Add patches:
  - gnupg-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
  - gnupg-gpg-Fix-another-regression-due-to-the-T7547-fix.patch
  - gnupg-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch
    * Rename the patch gnupg-fix-dos-subkey.patch to
    gnupg-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-the-keyring.patch

++++ gpg2:

  - Security fix: [bsc#1236931, bsc#1239119, CVE-2025-30258]
    * gpg: Fix regression for the recent malicious subkey DoS fix.
    * gpg: Fix another regression due to the T7547 fix.
    * gpg: Allow the use of an ADSK subkey as ADSK subkey.
    * Add patches:
  - gnupg-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
  - gnupg-gpg-Fix-another-regression-due-to-the-T7547-fix.patch
  - gnupg-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch
    * Rename the patch gnupg-fix-dos-subkey.patch to
    gnupg-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-the-keyring.patch

++++ gpg2:

  - Security fix: [bsc#1236931, bsc#1239119, CVE-2025-30258]
    * gpg: Fix regression for the recent malicious subkey DoS fix.
    * gpg: Fix another regression due to the T7547 fix.
    * gpg: Allow the use of an ADSK subkey as ADSK subkey.
    * Add patches:
  - gnupg-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
  - gnupg-gpg-Fix-another-regression-due-to-the-T7547-fix.patch
  - gnupg-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch
    * Rename the patch gnupg-fix-dos-subkey.patch to
    gnupg-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-the-keyring.patch

++++ gpg2:

  - Security fix: [bsc#1236931, bsc#1239119, CVE-2025-30258]
    * gpg: Fix regression for the recent malicious subkey DoS fix.
    * gpg: Fix another regression due to the T7547 fix.
    * gpg: Allow the use of an ADSK subkey as ADSK subkey.
    * Add patches:
  - gnupg-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
  - gnupg-gpg-Fix-another-regression-due-to-the-T7547-fix.patch
  - gnupg-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch
    * Rename the patch gnupg-fix-dos-subkey.patch to
    gnupg-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-the-keyring.patch

++++ xz:

  - Fix CVE-2025-31115 (bsc#1240414)
    * CVE-2025-31115.patch

------------------------------------------------------------------
------------------  2025-6-25  -  Jun 25 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.3.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2830>
    bsc#1246556
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.3.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2830>
    bsc#1246556
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.3.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2830>
    bsc#1246556
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.3.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2830>
    bsc#1246556
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.3.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2830>
    bsc#1246556
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ python-kiwi:

  - Add container_import template test
  - Bump version: 10.2.24 → 10.2.25
  - Fixed get_partition_node_name
    The function get_partition_node_name takes the disk device
    and the partition index as arguments to match against the
    respective device node for this partition index. The partition
    index is the position of the partition in the partition table
    according to their start offset. For the code to function
    properly it is required that the list of partitions provided
    by lsblk is ordered according to the start address of the
    partitions in the table. The way lsblk was called did not
    enforce this ordering. This commit enforces the order to
    be done against the start offset and fixes bsc#1245190

++++ libssh:

  - Fix CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)
    * Add patch libssh-CVE-2025-5372.patch
  - Fix CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL backend (bsc#1245317)
    * Add patch libssh-CVE-2025-5987.patch
  - Fix CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)
    * Add patch libssh-CVE-2025-4877.patch
  - Fix CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)
    * Add patches:
  - libssh-CVE-2025-4878-1.patch
  - libssh-CVE-2025-4878-2.patch
  - Fix CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)
    * Add patch libssh-CVE-2025-5318.patch
  - Fix CVE-2025-5351: Double free in functions exporting keys (bsc#1245312)
    * Add patch libssh-CVE-2025-5351.patch

++++ libssh:

  - Fix CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)
    * Add patch libssh-CVE-2025-5372.patch
  - Fix CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL backend (bsc#1245317)
    * Add patch libssh-CVE-2025-5987.patch
  - Fix CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)
    * Add patch libssh-CVE-2025-4877.patch
  - Fix CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)
    * Add patches:
  - libssh-CVE-2025-4878-1.patch
  - libssh-CVE-2025-4878-2.patch
  - Fix CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)
    * Add patch libssh-CVE-2025-5318.patch
  - Fix CVE-2025-5351: Double free in functions exporting keys (bsc#1245312)
    * Add patch libssh-CVE-2025-5351.patch

++++ libssh:

  - Fix CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)
    * Add patch libssh-CVE-2025-5372.patch
  - Fix CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL backend (bsc#1245317)
    * Add patch libssh-CVE-2025-5987.patch
  - Fix CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)
    * Add patch libssh-CVE-2025-4877.patch
  - Fix CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)
    * Add patches:
  - libssh-CVE-2025-4878-1.patch
  - libssh-CVE-2025-4878-2.patch
  - Fix CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)
    * Add patch libssh-CVE-2025-5318.patch
  - Fix CVE-2025-5351: Double free in functions exporting keys (bsc#1245312)
    * Add patch libssh-CVE-2025-5351.patch

------------------------------------------------------------------
------------------  2025-6-24  -  Jun 24 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add support for container-snap as a container-image engine
    With this commit, we can now pre-load images using container-snap directly
    during the kiwi image build
  - Update test-image-MicroOS for local build
    Fix bootstrap setup such that micro-os patterns can resolve
  - Fix logging of stderr data in command calls
    The stderr data was presented as one blob without line
    breaks. Hard to read and smells like a bug. This commit
    fixes the output to become readable
  - Update test-image-MicroOS/disk.sh
    Add a findmnt for / to check if there is a proper root
    device reference

++++ opensc:

  - Security fix: [CVE-2023-5992, bsc#1219386]
    * Add patch:
  - opensc-CVE-2023-5992.patch

++++ opensc:

  - Security fix: [CVE-2023-5992, bsc#1219386]
    * Add patch:
  - opensc-CVE-2023-5992.patch

------------------------------------------------------------------
------------------  2025-6-23  -  Jun 23 2025  -------------------
------------------------------------------------------------------

++++ docker:

    [ This update is a no-op, only needed to work around unfortunate automated
    packaging script behaviour on SLES. ]
  - The following patches were removed in openSUSE in the Docker 28.1.1-ce
    update, but the patch names were later renamed in a SLES-only update before
    Docker 28.1.1-ce was submitted to SLES.
    This causes the SLES build scripts to refuse the update because the patches
    are not referenced in the changelog. There is no obvious place to put the
    patch removals (the 28.1.1-ce update removing the patches chronologically
    predates their renaming in SLES), so they are included here a dummy changelog
    entry to work around the issue.
  - 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

    [ This update is a no-op, only needed to work around unfortunate automated
    packaging script behaviour on SLES. ]
  - The following patches were removed in openSUSE in the Docker 28.1.1-ce
    update, but the patch names were later renamed in a SLES-only update before
    Docker 28.1.1-ce was submitted to SLES.
    This causes the SLES build scripts to refuse the update because the patches
    are not referenced in the changelog. There is no obvious place to put the
    patch removals (the 28.1.1-ce update removing the patches chronologically
    predates their renaming in SLES), so they are included here a dummy changelog
    entry to work around the issue.
  - 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

    [ This update is a no-op, only needed to work around unfortunate automated
    packaging script behaviour on SLES. ]
  - The following patches were removed in openSUSE in the Docker 28.1.1-ce
    update, but the patch names were later renamed in a SLES-only update before
    Docker 28.1.1-ce was submitted to SLES.
    This causes the SLES build scripts to refuse the update because the patches
    are not referenced in the changelog. There is no obvious place to put the
    patch removals (the 28.1.1-ce update removing the patches chronologically
    predates their renaming in SLES), so they are included here a dummy changelog
    entry to work around the issue.
  - 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

    [ This update is a no-op, only needed to work around unfortunate automated
    packaging script behaviour on SLES. ]
  - The following patches were removed in openSUSE in the Docker 28.1.1-ce
    update, but the patch names were later renamed in a SLES-only update before
    Docker 28.1.1-ce was submitted to SLES.
    This causes the SLES build scripts to refuse the update because the patches
    are not referenced in the changelog. There is no obvious place to put the
    patch removals (the 28.1.1-ce update removing the patches chronologically
    predates their renaming in SLES), so they are included here a dummy changelog
    entry to work around the issue.
  - 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

    [ This update is a no-op, only needed to work around unfortunate automated
    packaging script behaviour on SLES. ]
  - The following patches were removed in openSUSE in the Docker 28.1.1-ce
    update, but the patch names were later renamed in a SLES-only update before
    Docker 28.1.1-ce was submitted to SLES.
    This causes the SLES build scripts to refuse the update because the patches
    are not referenced in the changelog. There is no obvious place to put the
    patch removals (the 28.1.1-ce update removing the patches chronologically
    predates their renaming in SLES), so they are included here a dummy changelog
    entry to work around the issue.
  - 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ python-kiwi:

  - Fix mount system for root_is_snapper_snapshot
    If root is a snapper snapshot we have to tell the
    chroot a proper root mount point which can be achieved
    by a bind mount pointing to itself. This Fixes
    bsc#1244668

------------------------------------------------------------------
------------------  2025-6-18  -  Jun 18 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to docker-buildx v0.25.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.25.0>

++++ docker:

  - Update to docker-buildx v0.25.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.25.0>

++++ docker:

  - Update to docker-buildx v0.25.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.25.0>

++++ docker:

  - Update to docker-buildx v0.25.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.25.0>

++++ docker:

  - Update to docker-buildx v0.25.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.25.0>

++++ python-kiwi:

  - There is no shim for aarch64 on SUSE
    Fix integration test for standard EFI (no secure boot)
    setup on arm

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-4476.patch (boo#1243422 CVE-2025-4476)
    + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
    + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
    + libsoup-CVE-2025-4945.patch (boo#1243314 CVE-2025-4945)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-4476.patch (boo#1243422 CVE-2025-4476)
    + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
    + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
    + libsoup-CVE-2025-4945.patch (boo#1243314 CVE-2025-4945)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-4476.patch (boo#1243422 CVE-2025-4476)
    + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
    + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
    + libsoup-CVE-2025-4945.patch (boo#1243314 CVE-2025-4945)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-4476.patch (boo#1243422 CVE-2025-4476)
    + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
    + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
    + libsoup-CVE-2025-4945.patch (boo#1243314 CVE-2025-4945)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-4476.patch (boo#1243422 CVE-2025-4476)
    + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
    + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
    + libsoup-CVE-2025-4945.patch (boo#1243314 CVE-2025-4945)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-4476.patch (boo#1243422 CVE-2025-4476)
    + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
    + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
    + libsoup-CVE-2025-4945.patch (boo#1243314 CVE-2025-4945)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-4476.patch (boo#1243422 CVE-2025-4476)
    + libsoup-CVE-2025-4948.patch (boo#1243332 CVE-2025-4948)
    + libsoup-CVE-2025-4969.patch (boo#1243423 CVE-2025-4969)
    + libsoup-CVE-2025-4945.patch (boo#1243314 CVE-2025-4945)

++++ libzypp:

  - Enhancements regarding mirror handling during repo refresh.
    Added  means to disable the use of mirrors when downloading
    security relevant files. Requires updaing zypper to 1.14.91.
  - Fix autotestcase writer if ZYPP_FULLLOG=1 (bsc#1244042)
    If ZYPP_FULLLOG=1 a solver testcase to
    "/var/log/YaST2/autoTestcase" should be written for each solver
    run. There was no testcase written for the very first solver run.
    This is now fixed.
  - Pass $1==2 to %posttrans script if it's an update (bsc#1243279)
  - version 17.37.6 (35)

++++ libzypp:

  - Enhancements regarding mirror handling during repo refresh.
    Added  means to disable the use of mirrors when downloading
    security relevant files. Requires updaing zypper to 1.14.91.
  - Fix autotestcase writer if ZYPP_FULLLOG=1 (bsc#1244042)
    If ZYPP_FULLLOG=1 a solver testcase to
    "/var/log/YaST2/autoTestcase" should be written for each solver
    run. There was no testcase written for the very first solver run.
    This is now fixed.
  - Pass $1==2 to %posttrans script if it's an update (bsc#1243279)
  - version 17.37.6 (35)

++++ libzypp:

  - Enhancements regarding mirror handling during repo refresh.
    Added  means to disable the use of mirrors when downloading
    security relevant files. Requires updaing zypper to 1.14.91.
  - Fix autotestcase writer if ZYPP_FULLLOG=1 (bsc#1244042)
    If ZYPP_FULLLOG=1 a solver testcase to
    "/var/log/YaST2/autoTestcase" should be written for each solver
    run. There was no testcase written for the very first solver run.
    This is now fixed.
  - Pass $1==2 to %posttrans script if it's an update (bsc#1243279)
  - version 17.37.6 (35)

++++ qemu:

  - Fix bsc#1240157:
    * [openSUSE][RPM] spec: Require ipxe and virtio-gpu packages for more arch-es (bsc#1240157)

++++ qemu:

  - Fix bsc#1240157:
    * [openSUSE][RPM] spec: Require ipxe and virtio-gpu packages for more arch-es (bsc#1240157)

++++ zypper:

  - BuildRequires:  libzypp-devel >= 17.37.6.
    Enhancements regarding mirror handling during repo refresh. Adapt
    to libzypp API changes. (bsc#1230267)
  - version 1.14.91

++++ zypper:

  - BuildRequires:  libzypp-devel >= 17.37.6.
    Enhancements regarding mirror handling during repo refresh. Adapt
    to libzypp API changes. (bsc#1230267)
  - version 1.14.91

------------------------------------------------------------------
------------------  2025-6-17  -  Jun 17 2025  -------------------
------------------------------------------------------------------

++++ afterburn:

  - Fix Requires in noarch package to not be arch specific (bsc#1244675)

++++ afterburn:

  - Fix Requires in noarch package to not be arch specific (bsc#1244675)

++++ git:

  - update to 2.50.0
    https://about.gitlab.com/blog/what-s-new-in-git-2-50-0/
    https://raw.githubusercontent.com/git/git/refs/tags/v2.50.0/Documentation/RelNotes/2.50.0.adoc

++++ ignition:

  - Add CVE-2025-22868.patch
    * Fixes [bsc#1239192]
  - Add CVE-2025-22870.patch
    * Fixes [bsc#1238681]

++++ ignition:

  - Add CVE-2025-22868.patch
    * Fixes [bsc#1239192]
  - Add CVE-2025-22870.patch
    * Fixes [bsc#1238681]

++++ jbigkit:

  - version update to 2.1
  - added patches
    CVE-2022-1210 [bsc#1198146], Malicious file leads to a denial of service in TIFF File Handler
    + jbigkit-CVE-2022-1210.patch

------------------------------------------------------------------
------------------  2025-6-16  -  Jun 16 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add driver configuration support for dracut initrd
    Add driver configuration support for dracut initrd
    Add support for specifying kernel drivers to be included or omitted
    in the dracut initrd configuration. This extends the existing dracut
    configuration capabilities like in the following example
    <initrd action="add">
    <dracut driver="erofs"/>
    </initrd>

------------------------------------------------------------------
------------------  2025-6-13  -  Jun 13 2025  -------------------
------------------------------------------------------------------

++++ git:

  - Refresh gitk SHA256 patch and add SHA256 support to git-gui (bsc#1239989):
    0001-gitk-Add-support-of-SHA256-repo.patch
    0002-git-gui-Add-support-of-SHA256-repo.patch
    The previous patches are dropped:
    0001-gitk-Add-a-basic-support-of-SHA256-repositories-into.patch
    0002-gitk-Add-auto-select-length-preference-for-SHA256.patch

++++ glib2:

  - Add glib2-CVE-2025-6052.patch: fix overflow check when expanding
    a GString (bsc#1244596 CVE-2025-6052).

++++ glib2:

  - Add glib2-CVE-2025-6052.patch: fix overflow check when expanding
    a GString (bsc#1244596 CVE-2025-6052).

++++ glib2:

  - Add glib2-CVE-2025-6052.patch: fix overflow check when expanding
    a GString (bsc#1244596 CVE-2025-6052).

++++ glib2:

  - Add glib2-CVE-2025-6052.patch: fix overflow check when expanding
    a GString (bsc#1244596 CVE-2025-6052).

++++ gstreamer-plugins-base:

  - Add more CVE fixes:
    + CVE-2025-47808.patch (boo#1244404 CVE-2025-47808)
    + CVE-2025-47807.patch (boo#1244403 CVE-2025-47807)
    + CVE-2025-47806.patch (boo#1244407 CVE-2025-47806)

++++ qemu:

  - Fix bsc#1243013:
    * [openSUSE] rpm: disable LTO for userspace emulation on 15.6
  - Update version to 8.2.10
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/7dd1fbc7-a58f-4b2c-82b9-735840246ab2@tls.msk.ru/
    * Some backports:
    hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
    target/ppc: Fix e200 duplicate SPRs
    linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
    docs/about/emulation: Fix broken link
    vdpa: Allow vDPA to work on big-endian machine
    vdpa: Fix endian bugs in shadow virtqueue
    target/loongarch: Fix vldi inst
    target/arm: Simplify pstate_sm check in sve_access_check
    target/arm: Make DisasContext.{fp, sve}_access_checked tristate
    util/cacheflush: Make first DSB unconditional on aarch64
    ui/cocoa: Temporarily ignore annoying deprecated declaration warnings
    docs: Rename default-configs to configs
    block: Zero block driver state before reopening
    hw/xen/hvm: Fix Aarch64 typo
    hw/net/smc91c111: Don't allow data register access to overrun buffer
    hw/net/smc91c111: Sanitize packet length on tx
    hw/net/smc91c111: Sanitize packet numbers
    hw/net/smc91c111: Ignore attempt to pop from empty RX fifo
    ppc/pnv/occ: Fix common area sensor offsets
    net: move backend cleanup to NIC cleanup
    net: parameterize the removing client from nc list
    util/qemu-timer.c: Don't warp timer from timerlist_rearm()
    target/arm: Correct STRD atomicity
    target/arm: Correct LDRD atomicity and fault behaviour
    ...

++++ qemu:

  - Fix bsc#1243013:
    * [openSUSE] rpm: disable LTO for userspace emulation on 15.6
  - Update version to 8.2.10
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/7dd1fbc7-a58f-4b2c-82b9-735840246ab2@tls.msk.ru/
    * Some backports:
    hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
    target/ppc: Fix e200 duplicate SPRs
    linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
    docs/about/emulation: Fix broken link
    vdpa: Allow vDPA to work on big-endian machine
    vdpa: Fix endian bugs in shadow virtqueue
    target/loongarch: Fix vldi inst
    target/arm: Simplify pstate_sm check in sve_access_check
    target/arm: Make DisasContext.{fp, sve}_access_checked tristate
    util/cacheflush: Make first DSB unconditional on aarch64
    ui/cocoa: Temporarily ignore annoying deprecated declaration warnings
    docs: Rename default-configs to configs
    block: Zero block driver state before reopening
    hw/xen/hvm: Fix Aarch64 typo
    hw/net/smc91c111: Don't allow data register access to overrun buffer
    hw/net/smc91c111: Sanitize packet length on tx
    hw/net/smc91c111: Sanitize packet numbers
    hw/net/smc91c111: Ignore attempt to pop from empty RX fifo
    ppc/pnv/occ: Fix common area sensor offsets
    net: move backend cleanup to NIC cleanup
    net: parameterize the removing client from nc list
    util/qemu-timer.c: Don't warp timer from timerlist_rearm()
    target/arm: Correct STRD atomicity
    target/arm: Correct LDRD atomicity and fault behaviour
    ...

------------------------------------------------------------------
------------------  2025-6-12  -  Jun 12 2025  -------------------
------------------------------------------------------------------

++++ jq:

  - Add patch CVE-2024-23337.patch (CVE-2024-23337, bsc#1243450)

++++ jq:

  - Add patch CVE-2024-23337.patch (CVE-2024-23337, bsc#1243450)

++++ libblockdev:

  - suppress privilege escalation during xfs fs resize (CVE-2025-6019)
    (bsc#1243285)
    add 0001-dont-allow-suid-and-dev-set-on-fs-resize.patch

++++ pam:

  - pam_namespace: convert functions that may operate on a user-controlled path
    to operate on file descriptors instead of absolute path. And keep the
    bind-mount protection from protect_mount() as a defense in depthmeasure.
    [bsc#1244509, CVE-2025-6020,
    pam_inline-introduce-pam_asprintf-pam_snprintf-and-p.patch,
    pam_namespace-fix-potential-privilege-escalation.patch,
    pam_namespace-add-flags-to-indicate-path-safety.patch,
    pam_namespace-secure_opendir-do-not-look-at-the-grou.patch]
  - pam_namespace-fix-potential-privilege-escalation.patch adapted and includes
    changes from upstream commits: ds6242a, bc856cd.
    * pam_namespace fix logic in return value handling
    * pam_namespace move functions around

------------------------------------------------------------------
------------------  2025-6-11  -  Jun 11 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
    * Add _multibuild
    * Remove patches fixed in the update:
  - curl-CVE-2024-11053.patch
  - curl-CVE-2024-2004.patch
  - curl-CVE-2024-2379.patch
  - curl-CVE-2024-2398.patch
  - curl-CVE-2024-2466.patch
  - curl-CVE-2024-6197.patch
  - curl-CVE-2024-7264.patch
  - curl-CVE-2024-8096.patch
  - curl-CVE-2024-9681.patch
  - curl-CVE-2025-0167.patch
  - curl-CVE-2025-0725.patch
  - curl-aws_sigv4-url-encode-the-canonical-path.patch
  - curl-mstp-starttls.patch

++++ curl:

  - Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
    * Add _multibuild
    * Remove patches fixed in the update:
  - curl-CVE-2024-11053.patch
  - curl-CVE-2024-2004.patch
  - curl-CVE-2024-2379.patch
  - curl-CVE-2024-2398.patch
  - curl-CVE-2024-2466.patch
  - curl-CVE-2024-6197.patch
  - curl-CVE-2024-7264.patch
  - curl-CVE-2024-8096.patch
  - curl-CVE-2024-9681.patch
  - curl-CVE-2025-0167.patch
  - curl-CVE-2025-0725.patch
  - curl-aws_sigv4-url-encode-the-canonical-path.patch
  - curl-mstp-starttls.patch

++++ curl:

  - Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
    * Add _multibuild
    * Remove patches fixed in the update:
  - curl-CVE-2024-11053.patch
  - curl-CVE-2024-2004.patch
  - curl-CVE-2024-2379.patch
  - curl-CVE-2024-2398.patch
  - curl-CVE-2024-2466.patch
  - curl-CVE-2024-6197.patch
  - curl-CVE-2024-7264.patch
  - curl-CVE-2024-8096.patch
  - curl-CVE-2024-9681.patch
  - curl-CVE-2025-0167.patch
  - curl-CVE-2025-0725.patch
  - curl-aws_sigv4-url-encode-the-canonical-path.patch
  - curl-mstp-starttls.patch

++++ curl:

  - Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
    * Add _multibuild
    * Remove patches fixed in the update:
  - curl-CVE-2024-11053.patch
  - curl-CVE-2024-2004.patch
  - curl-CVE-2024-2379.patch
  - curl-CVE-2024-2398.patch
  - curl-CVE-2024-2466.patch
  - curl-CVE-2024-6197.patch
  - curl-CVE-2024-7264.patch
  - curl-CVE-2024-8096.patch
  - curl-CVE-2024-9681.patch
  - curl-CVE-2025-0167.patch
  - curl-CVE-2025-0725.patch
  - curl-aws_sigv4-url-encode-the-canonical-path.patch
  - curl-mstp-starttls.patch

++++ curl:

  - Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
    * Add _multibuild
    * Remove patches fixed in the update:
  - curl-CVE-2024-11053.patch
  - curl-CVE-2024-2004.patch
  - curl-CVE-2024-2379.patch
  - curl-CVE-2024-2398.patch
  - curl-CVE-2024-2466.patch
  - curl-CVE-2024-6197.patch
  - curl-CVE-2024-7264.patch
  - curl-CVE-2024-8096.patch
  - curl-CVE-2024-9681.patch
  - curl-CVE-2025-0167.patch
  - curl-CVE-2025-0725.patch
  - curl-aws_sigv4-url-encode-the-canonical-path.patch
  - curl-mstp-starttls.patch

++++ curl:

  - Update to 8.14.1: [jsc#PED-13055, jsc#PED-13056]
    * Add _multibuild
    * Remove patches fixed in the update:
  - curl-CVE-2024-11053.patch
  - curl-CVE-2024-2004.patch
  - curl-CVE-2024-2379.patch
  - curl-CVE-2024-2398.patch
  - curl-CVE-2024-2466.patch
  - curl-CVE-2024-6197.patch
  - curl-CVE-2024-7264.patch
  - curl-CVE-2024-8096.patch
  - curl-CVE-2024-9681.patch
  - curl-CVE-2025-0167.patch
  - curl-CVE-2025-0725.patch
  - curl-aws_sigv4-url-encode-the-canonical-path.patch
  - curl-mstp-starttls.patch

++++ libgcrypt:

  - Security fix [bsc#1221107, CVE-2024-2236]
    * Add --enable-marvin-workaround to spec to enable workaround
    * Fix  timing based side-channel in RSA implementation ( Marvin attack )
    * Add libgcrypt-CVE-2024-2236_01.patch
    * Add libgcrypt-CVE-2024-2236_02.patch

++++ libgcrypt:

  - Security fix [bsc#1221107, CVE-2024-2236]
    * Add --enable-marvin-workaround to spec to enable workaround
    * Fix  timing based side-channel in RSA implementation ( Marvin attack )
    * Add libgcrypt-CVE-2024-2236_01.patch
    * Add libgcrypt-CVE-2024-2236_02.patch

++++ openssl-3:

  - Security fix: [bsc#1240366, CVE-2025-27587]
    * Minerva side channel vulnerability in P-384 on PPC arch
    * Add openssl-3-p384-minerva-ppc.patch
    * Add openssl-3-p384-minerva-ppc-p9.patch

++++ openssl-3:

  - Security fix: [bsc#1240366, CVE-2025-27587]
    * Minerva side channel vulnerability in P-384 on PPC arch
    * Add openssl-3-p384-minerva-ppc.patch
    * Add openssl-3-p384-minerva-ppc-p9.patch

++++ openssl-3:

  - Security fix: [bsc#1240366, CVE-2025-27587]
    * Minerva side channel vulnerability in P-384 on PPC arch
    * Add openssl-3-p384-minerva-ppc.patch
    * Add openssl-3-p384-minerva-ppc-p9.patch

++++ openssl-3:

  - Security fix: [bsc#1240366, CVE-2025-27587]
    * Minerva side channel vulnerability in P-384 on PPC arch
    * Add openssl-3-p384-minerva-ppc.patch
    * Add openssl-3-p384-minerva-ppc-p9.patch

++++ openssl-3:

  - Security fix: [bsc#1240366, CVE-2025-27587]
    * Minerva side channel vulnerability in P-384 on PPC arch
    * Add openssl-3-p384-minerva-ppc.patch
    * Add openssl-3-p384-minerva-ppc-p9.patch

++++ podman:

  - Added patch to remove using rw as a default mount option (bsc#1239776)
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch

++++ podman:

  - Added patch to remove using rw as a default mount option (bsc#1239776)
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch

++++ podman:

  - Added patch to remove using rw as a default mount option (bsc#1239776)
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch

++++ podman:

  - Added patch to remove using rw as a default mount option (bsc#1239776)
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch

++++ podman:

  - Added patch to remove using rw as a default mount option (bsc#1239776)
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch

++++ podman:

  - Added patch to remove using rw as a default mount option (bsc#1239776)
    * 0007-Fix-Remove-appending-rw-as-the-default-mount-option.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch

------------------------------------------------------------------
------------------  2025-6-10  -  Jun 10 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed rootfs size calculation with spare part
    In case a spare_part setup is combined with the root_clone feature,
    the size calculation for the rootfs did not take the cloning into
    account and lead to the wrong value. In addition when requesting
    the spare part to be last and no size information was given, the
    partition was not created at all. This commit fixes both defects
    and Fixes #2831

++++ iputils:

  - Security fix [bsc#1243772, CVE-2025-48964]
    * Fix  integer overflow in ping statistics via zero timestamp
    * Add iputils-CVE-2025-48964_01.patch
    * Add iputils-CVE-2025-48964_02.patch
    * Add iputils-CVE-2025-48964_03.patch
    * Add iputils-CVE-2025-48964_04.patch
    * Add iputils-CVE-2025-48964_regression.patch

------------------------------------------------------------------
------------------  2025-6-9  -  Jun 9 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311-core:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ sqlite3:

  - Update to 3.50 (3.50.1):
    * Improved handling and robust output of control characters
    * sqlite3_rsync no longer requires WAL mode and needs less
    bandwidth
    * Bug fixes and optimized JSON handling
    * Performance optimizations and developer visible fixes

++++ sqlite3:

  - Update to 3.50 (3.50.1):
    * Improved handling and robust output of control characters
    * sqlite3_rsync no longer requires WAL mode and needs less
    bandwidth
    * Bug fixes and optimized JSON handling
    * Performance optimizations and developer visible fixes

++++ sqlite3:

  - Update to 3.50 (3.50.1):
    * Improved handling and robust output of control characters
    * sqlite3_rsync no longer requires WAL mode and needs less
    bandwidth
    * Bug fixes and optimized JSON handling
    * Performance optimizations and developer visible fixes

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

++++ python311:

  - Update to 3.11.13:
  - Security
  - gh-135034: Fixes multiple issues that allowed tarfile
    extraction filters (filter="data" and filter="tar")
    to be bypassed using crafted symlinks and hard links.
    Addresses CVE-2024-12718 (bsc#1244056), CVE-2025-4138
    (bsc#1244059), CVE-2025-4330 (bsc#1244060), and
    CVE-2025-4517 (bsc#1244032). Also addresses CVE-2025-4435
    (gh#135034, bsc#1244061).
  - gh-133767: Fix use-after-free in the “unicode-escape”
    decoder with a non-“strict” error handler (CVE-2025-4516,
    bsc#1243273).
  - gh-128840: Short-circuit the processing of long IPv6
    addresses early in ipaddress to prevent excessive memory
    consumption and a minor denial-of-service.
  - Library
  - gh-128840: Fix parsing long IPv6 addresses with embedded
    IPv4 address.
  - gh-134062: ipaddress: fix collisions in __hash__() for
    IPv4Network and IPv6Network objects.
  - gh-123409: Fix ipaddress.IPv6Address.reverse_pointer output
    according to RFC 3596, §2.5. Patch by Bénédikt Tran.
  - bpo-43633: Improve the textual representation of
    IPv4-mapped IPv6 addresses (RFC 4291 Sections 2.2, 2.5.5.2)
    in ipaddress. Patch by Oleksandr Pavliuk.
  - Remove upstreamed patches:
  - gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
  - CVE-2025-4516-DecodeError-handler.patch

------------------------------------------------------------------
------------------  2025-6-8  -  Jun 8 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add dependency for isomd5sum for iso images and set in kiwi-settings
    This ensures that isomd5sum is pulled into the environment for ISO image
    builds, and the updated settings makes it so that kiwi boxes will use it.

------------------------------------------------------------------
------------------  2025-6-6  -  Jun 6 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
    * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
    when building the curl-mini package in SLE.
    * Add libssh minimum version requirements.
    * Use ldconfig_scriptlets when available.
    * Remove unused option --disable-ntlm-wb.

++++ curl:

  - Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
    * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
    when building the curl-mini package in SLE.
    * Add libssh minimum version requirements.
    * Use ldconfig_scriptlets when available.
    * Remove unused option --disable-ntlm-wb.

++++ curl:

  - Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
    * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
    when building the curl-mini package in SLE.
    * Add libssh minimum version requirements.
    * Use ldconfig_scriptlets when available.
    * Remove unused option --disable-ntlm-wb.

++++ curl:

  - Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
    * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
    when building the curl-mini package in SLE.
    * Add libssh minimum version requirements.
    * Use ldconfig_scriptlets when available.
    * Remove unused option --disable-ntlm-wb.

++++ curl:

  - Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
    * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
    when building the curl-mini package in SLE.
    * Add libssh minimum version requirements.
    * Use ldconfig_scriptlets when available.
    * Remove unused option --disable-ntlm-wb.

++++ curl:

  - Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]
    * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error
    when building the curl-mini package in SLE.
    * Add libssh minimum version requirements.
    * Use ldconfig_scriptlets when available.
    * Remove unused option --disable-ntlm-wb.

++++ libzypp:

  - Fix credential handling in HEAD requests (bsc#1244105)
  - version 17.37.5 (35)

++++ libzypp:

  - Fix credential handling in HEAD requests (bsc#1244105)
  - version 17.37.5 (35)

++++ libzypp:

  - Fix credential handling in HEAD requests (bsc#1244105)
  - version 17.37.5 (35)

++++ suseconnect-ng:

  - Version 1.14 public library release
    This version is only available on Github as a tag to release the
    new golang public library which can be consumed without the need
    to interface with SUSEConnect directly.

++++ suseconnect-ng:

  - Version 1.14 public library release
    This version is only available on Github as a tag to release the
    new golang public library which can be consumed without the need
    to interface with SUSEConnect directly.

++++ suseconnect-ng:

  - Version 1.14 public library release
    This version is only available on Github as a tag to release the
    new golang public library which can be consumed without the need
    to interface with SUSEConnect directly.

------------------------------------------------------------------
------------------  2025-6-5  -  Jun 5 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
    Docker does not have permission to access the host zypper credentials in this
    mode (and unprivileged users cannot disable the feature using
    /etc/docker/suse-secrets-enable.) bsc#1240150
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
    Docker does not have permission to access the host zypper credentials in this
    mode (and unprivileged users cannot disable the feature using
    /etc/docker/suse-secrets-enable.) bsc#1240150
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
    Docker does not have permission to access the host zypper credentials in this
    mode (and unprivileged users cannot disable the feature using
    /etc/docker/suse-secrets-enable.) bsc#1240150
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
    Docker does not have permission to access the host zypper credentials in this
    mode (and unprivileged users cannot disable the feature using
    /etc/docker/suse-secrets-enable.) bsc#1240150
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
    Docker does not have permission to access the host zypper credentials in this
    mode (and unprivileged users cannot disable the feature using
    /etc/docker/suse-secrets-enable.) bsc#1240150
    * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - Rebase patches:
    * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
    * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ glib2:

  - Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
    (bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).

++++ glib2:

  - Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
    (bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).

++++ glib2:

  - Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
    (bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).

++++ glib2:

  - Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
    (bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).

++++ perl:

  - do not change the current directory when cloning an open
    directory handle [bnc#1244079] [CVE-2025-40909]
    new patch: perl-dirdup.diff

++++ python-requests:

  - Add CVE-2024-47081.patch upstream patch, fixes netrc credential leak
    (gh#psf/requests#6965, CVE-2024-47081, bsc#1244039)

++++ python-requests:

  - Add CVE-2024-47081.patch upstream patch, fixes netrc credential leak
    (gh#psf/requests#6965, CVE-2024-47081, bsc#1244039)

++++ rust-keylime:

  - Update vendored crates (bsc#1243861, CVE-2024-12224)
    * idna 1.0.3
  - Add Cargo_lock.patch to adjust versions that will allow the
    compilation of mbox crate
  - Update to version 0.2.7+70:
    * build(deps): bump wiremock from 0.6.2 to 0.6.3
    * build(deps): bump uuid from 1.16.0 to 1.17.0
    * lib: Introduce AgentIdentity structure
    * gitignore: Add *.swp and *.orig to be ignored
    * build(deps): bump clap from 4.5.38 to 4.5.39
    * build(deps): bump tokio from 1.45.0 to 1.45.1
    * Unify Push Model structures time formats to UTC (#1016)
    * Add Quote related structures to Keylime library
    * Remove configuration file trailing whitespaces (#1012)
    * keylime-agent.conf: add all accepted TPM encryption algs
    * tpm: add policy auth for EK to activate crendential
    * Enable non standard key sizes and curves for EK and AK
    * config: Use next_back() instead of last() for iterators
    * Update to tss-esapi v7.6.0
    * Avoid duplicated call to ctx.create_ek
    * build(deps): bump clap from 4.5.23 to 4.5.38
    * Add registration for Push Model client
    * build(deps): bump tokio from 1.44.2 to 1.45.0
    * build(deps): bump chrono from 0.4.40 to 0.4.41
    * build(deps): bump tempfile from 3.17.1 to 3.20.0
    * Refactor code: move error, registration to lib
    * Move structure filling and URL selection code (#999)
    * build(deps): bump pest_derive from 2.7.15 to 2.8.0
    * build(deps): bump pest from 2.7.15 to 2.8.0
    * build(deps): bump libc from 0.2.169 to 0.2.172
    * Add Evidence/Authentication messages to prototype
    * build(deps): bump uuid from 1.15.1 to 1.16.0
    * build(deps): bump thiserror from 2.0.11 to 2.0.12
    * build(deps): bump signal-hook from 0.3.17 to 0.3.18
    * build(deps): bump log from 0.4.25 to 0.4.27
    * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
    * build(deps): bump actix-web from 4.9.0 to 4.10.2
    * build(deps): bump reqwest from 0.12.12 to 0.12.15
    * build(deps): bump serde from 1.0.217 to 1.0.219
    * Add unit tests for sessions.rs structures
    * Add auth(sessions) structures
    * Fix minor README.md issue (#988)
    * Define EvidenceHandling structures (#971)
    * Add mockoon test scenario
    * Add client certificates to push-attestation prototype
    * Cargo: bump url crate to version 2.5.4
    * Add logging to the push attestation prototype
    * Do not use certificate on insecure mode
    * common: Move the EncryptedData structure from common to the library
    * common: Move AuthTag from common to the library
    * build(deps): bump openssl from 0.10.71 to 0.10.72
    * common: Move Symmkey to library as crypto::symmkey
    * common: Remove unused constants and static values
    * build(deps): bump tokio from 1.43.0 to 1.44.2
    * Refactor code: Include AgentIdentity structure
    * Push model prototype
    * Add support for ek certificate chain, stored in TPM NVRAM.
    * Recover key_class field and set it as "asymmetric"
    * Update push model structures to latest values
    * build(deps): bump serde_json from 1.0.138 to 1.0.140
    * packit: Add identifier for each copr_build job
    * keylime-agent.conf: only mention ecdsa and rsassa for signing
    * build(deps): bump openssl from 0.10.70 to 0.10.71
    * build(deps): bump uuid from 1.13.2 to 1.15.1
    * Add capabilities_negotiation structures
    * packit: Add compatibility/api_version_compatibility test
    * build(deps): bump uuid from 1.11.0 to 1.13.2
    * build(deps): bump serde_json from 1.0.135 to 1.0.138
    * build(deps): bump thiserror from 2.0.9 to 2.0.11
    * build(deps): bump tempfile from 3.14.0 to 3.17.1
    * Allow agent to start as non-root
    * scripts: Fix coverage information downloading script
    * build(deps): bump openssl from 0.10.68 to 0.10.70
    * build(deps): bump tokio from 1.42.0 to 1.43.0

++++ rust-keylime:

  - Update vendored crates (bsc#1243861, CVE-2024-12224)
    * idna 1.0.3
  - Add Cargo_lock.patch to adjust versions that will allow the
    compilation of mbox crate
  - Update to version 0.2.7+70:
    * build(deps): bump wiremock from 0.6.2 to 0.6.3
    * build(deps): bump uuid from 1.16.0 to 1.17.0
    * lib: Introduce AgentIdentity structure
    * gitignore: Add *.swp and *.orig to be ignored
    * build(deps): bump clap from 4.5.38 to 4.5.39
    * build(deps): bump tokio from 1.45.0 to 1.45.1
    * Unify Push Model structures time formats to UTC (#1016)
    * Add Quote related structures to Keylime library
    * Remove configuration file trailing whitespaces (#1012)
    * keylime-agent.conf: add all accepted TPM encryption algs
    * tpm: add policy auth for EK to activate crendential
    * Enable non standard key sizes and curves for EK and AK
    * config: Use next_back() instead of last() for iterators
    * Update to tss-esapi v7.6.0
    * Avoid duplicated call to ctx.create_ek
    * build(deps): bump clap from 4.5.23 to 4.5.38
    * Add registration for Push Model client
    * build(deps): bump tokio from 1.44.2 to 1.45.0
    * build(deps): bump chrono from 0.4.40 to 0.4.41
    * build(deps): bump tempfile from 3.17.1 to 3.20.0
    * Refactor code: move error, registration to lib
    * Move structure filling and URL selection code (#999)
    * build(deps): bump pest_derive from 2.7.15 to 2.8.0
    * build(deps): bump pest from 2.7.15 to 2.8.0
    * build(deps): bump libc from 0.2.169 to 0.2.172
    * Add Evidence/Authentication messages to prototype
    * build(deps): bump uuid from 1.15.1 to 1.16.0
    * build(deps): bump thiserror from 2.0.11 to 2.0.12
    * build(deps): bump signal-hook from 0.3.17 to 0.3.18
    * build(deps): bump log from 0.4.25 to 0.4.27
    * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
    * build(deps): bump actix-web from 4.9.0 to 4.10.2
    * build(deps): bump reqwest from 0.12.12 to 0.12.15
    * build(deps): bump serde from 1.0.217 to 1.0.219
    * Add unit tests for sessions.rs structures
    * Add auth(sessions) structures
    * Fix minor README.md issue (#988)
    * Define EvidenceHandling structures (#971)
    * Add mockoon test scenario
    * Add client certificates to push-attestation prototype
    * Cargo: bump url crate to version 2.5.4
    * Add logging to the push attestation prototype
    * Do not use certificate on insecure mode
    * common: Move the EncryptedData structure from common to the library
    * common: Move AuthTag from common to the library
    * build(deps): bump openssl from 0.10.71 to 0.10.72
    * common: Move Symmkey to library as crypto::symmkey
    * common: Remove unused constants and static values
    * build(deps): bump tokio from 1.43.0 to 1.44.2
    * Refactor code: Include AgentIdentity structure
    * Push model prototype
    * Add support for ek certificate chain, stored in TPM NVRAM.
    * Recover key_class field and set it as "asymmetric"
    * Update push model structures to latest values
    * build(deps): bump serde_json from 1.0.138 to 1.0.140
    * packit: Add identifier for each copr_build job
    * keylime-agent.conf: only mention ecdsa and rsassa for signing
    * build(deps): bump openssl from 0.10.70 to 0.10.71
    * build(deps): bump uuid from 1.13.2 to 1.15.1
    * Add capabilities_negotiation structures
    * packit: Add compatibility/api_version_compatibility test
    * build(deps): bump uuid from 1.11.0 to 1.13.2
    * build(deps): bump serde_json from 1.0.135 to 1.0.138
    * build(deps): bump thiserror from 2.0.9 to 2.0.11
    * build(deps): bump tempfile from 3.14.0 to 3.17.1
    * Allow agent to start as non-root
    * scripts: Fix coverage information downloading script
    * build(deps): bump openssl from 0.10.68 to 0.10.70
    * build(deps): bump tokio from 1.42.0 to 1.43.0

++++ rust-keylime:

  - Update vendored crates (bsc#1243861, CVE-2024-12224)
    * idna 1.0.3
  - Add Cargo_lock.patch to adjust versions that will allow the
    compilation of mbox crate
  - Update to version 0.2.7+70:
    * build(deps): bump wiremock from 0.6.2 to 0.6.3
    * build(deps): bump uuid from 1.16.0 to 1.17.0
    * lib: Introduce AgentIdentity structure
    * gitignore: Add *.swp and *.orig to be ignored
    * build(deps): bump clap from 4.5.38 to 4.5.39
    * build(deps): bump tokio from 1.45.0 to 1.45.1
    * Unify Push Model structures time formats to UTC (#1016)
    * Add Quote related structures to Keylime library
    * Remove configuration file trailing whitespaces (#1012)
    * keylime-agent.conf: add all accepted TPM encryption algs
    * tpm: add policy auth for EK to activate crendential
    * Enable non standard key sizes and curves for EK and AK
    * config: Use next_back() instead of last() for iterators
    * Update to tss-esapi v7.6.0
    * Avoid duplicated call to ctx.create_ek
    * build(deps): bump clap from 4.5.23 to 4.5.38
    * Add registration for Push Model client
    * build(deps): bump tokio from 1.44.2 to 1.45.0
    * build(deps): bump chrono from 0.4.40 to 0.4.41
    * build(deps): bump tempfile from 3.17.1 to 3.20.0
    * Refactor code: move error, registration to lib
    * Move structure filling and URL selection code (#999)
    * build(deps): bump pest_derive from 2.7.15 to 2.8.0
    * build(deps): bump pest from 2.7.15 to 2.8.0
    * build(deps): bump libc from 0.2.169 to 0.2.172
    * Add Evidence/Authentication messages to prototype
    * build(deps): bump uuid from 1.15.1 to 1.16.0
    * build(deps): bump thiserror from 2.0.11 to 2.0.12
    * build(deps): bump signal-hook from 0.3.17 to 0.3.18
    * build(deps): bump log from 0.4.25 to 0.4.27
    * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
    * build(deps): bump actix-web from 4.9.0 to 4.10.2
    * build(deps): bump reqwest from 0.12.12 to 0.12.15
    * build(deps): bump serde from 1.0.217 to 1.0.219
    * Add unit tests for sessions.rs structures
    * Add auth(sessions) structures
    * Fix minor README.md issue (#988)
    * Define EvidenceHandling structures (#971)
    * Add mockoon test scenario
    * Add client certificates to push-attestation prototype
    * Cargo: bump url crate to version 2.5.4
    * Add logging to the push attestation prototype
    * Do not use certificate on insecure mode
    * common: Move the EncryptedData structure from common to the library
    * common: Move AuthTag from common to the library
    * build(deps): bump openssl from 0.10.71 to 0.10.72
    * common: Move Symmkey to library as crypto::symmkey
    * common: Remove unused constants and static values
    * build(deps): bump tokio from 1.43.0 to 1.44.2
    * Refactor code: Include AgentIdentity structure
    * Push model prototype
    * Add support for ek certificate chain, stored in TPM NVRAM.
    * Recover key_class field and set it as "asymmetric"
    * Update push model structures to latest values
    * build(deps): bump serde_json from 1.0.138 to 1.0.140
    * packit: Add identifier for each copr_build job
    * keylime-agent.conf: only mention ecdsa and rsassa for signing
    * build(deps): bump openssl from 0.10.70 to 0.10.71
    * build(deps): bump uuid from 1.13.2 to 1.15.1
    * Add capabilities_negotiation structures
    * packit: Add compatibility/api_version_compatibility test
    * build(deps): bump uuid from 1.11.0 to 1.13.2
    * build(deps): bump serde_json from 1.0.135 to 1.0.138
    * build(deps): bump thiserror from 2.0.9 to 2.0.11
    * build(deps): bump tempfile from 3.14.0 to 3.17.1
    * Allow agent to start as non-root
    * scripts: Fix coverage information downloading script
    * build(deps): bump openssl from 0.10.68 to 0.10.70
    * build(deps): bump tokio from 1.42.0 to 1.43.0

++++ rust-keylime:

  - Update vendored crates (bsc#1243861, CVE-2024-12224)
    * idna 1.0.3
  - Add Cargo_lock.patch to adjust versions that will allow the
    compilation of mbox crate
  - Update to version 0.2.7+70:
    * build(deps): bump wiremock from 0.6.2 to 0.6.3
    * build(deps): bump uuid from 1.16.0 to 1.17.0
    * lib: Introduce AgentIdentity structure
    * gitignore: Add *.swp and *.orig to be ignored
    * build(deps): bump clap from 4.5.38 to 4.5.39
    * build(deps): bump tokio from 1.45.0 to 1.45.1
    * Unify Push Model structures time formats to UTC (#1016)
    * Add Quote related structures to Keylime library
    * Remove configuration file trailing whitespaces (#1012)
    * keylime-agent.conf: add all accepted TPM encryption algs
    * tpm: add policy auth for EK to activate crendential
    * Enable non standard key sizes and curves for EK and AK
    * config: Use next_back() instead of last() for iterators
    * Update to tss-esapi v7.6.0
    * Avoid duplicated call to ctx.create_ek
    * build(deps): bump clap from 4.5.23 to 4.5.38
    * Add registration for Push Model client
    * build(deps): bump tokio from 1.44.2 to 1.45.0
    * build(deps): bump chrono from 0.4.40 to 0.4.41
    * build(deps): bump tempfile from 3.17.1 to 3.20.0
    * Refactor code: move error, registration to lib
    * Move structure filling and URL selection code (#999)
    * build(deps): bump pest_derive from 2.7.15 to 2.8.0
    * build(deps): bump pest from 2.7.15 to 2.8.0
    * build(deps): bump libc from 0.2.169 to 0.2.172
    * Add Evidence/Authentication messages to prototype
    * build(deps): bump uuid from 1.15.1 to 1.16.0
    * build(deps): bump thiserror from 2.0.11 to 2.0.12
    * build(deps): bump signal-hook from 0.3.17 to 0.3.18
    * build(deps): bump log from 0.4.25 to 0.4.27
    * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
    * build(deps): bump actix-web from 4.9.0 to 4.10.2
    * build(deps): bump reqwest from 0.12.12 to 0.12.15
    * build(deps): bump serde from 1.0.217 to 1.0.219
    * Add unit tests for sessions.rs structures
    * Add auth(sessions) structures
    * Fix minor README.md issue (#988)
    * Define EvidenceHandling structures (#971)
    * Add mockoon test scenario
    * Add client certificates to push-attestation prototype
    * Cargo: bump url crate to version 2.5.4
    * Add logging to the push attestation prototype
    * Do not use certificate on insecure mode
    * common: Move the EncryptedData structure from common to the library
    * common: Move AuthTag from common to the library
    * build(deps): bump openssl from 0.10.71 to 0.10.72
    * common: Move Symmkey to library as crypto::symmkey
    * common: Remove unused constants and static values
    * build(deps): bump tokio from 1.43.0 to 1.44.2
    * Refactor code: Include AgentIdentity structure
    * Push model prototype
    * Add support for ek certificate chain, stored in TPM NVRAM.
    * Recover key_class field and set it as "asymmetric"
    * Update push model structures to latest values
    * build(deps): bump serde_json from 1.0.138 to 1.0.140
    * packit: Add identifier for each copr_build job
    * keylime-agent.conf: only mention ecdsa and rsassa for signing
    * build(deps): bump openssl from 0.10.70 to 0.10.71
    * build(deps): bump uuid from 1.13.2 to 1.15.1
    * Add capabilities_negotiation structures
    * packit: Add compatibility/api_version_compatibility test
    * build(deps): bump uuid from 1.11.0 to 1.13.2
    * build(deps): bump serde_json from 1.0.135 to 1.0.138
    * build(deps): bump thiserror from 2.0.9 to 2.0.11
    * build(deps): bump tempfile from 3.14.0 to 3.17.1
    * Allow agent to start as non-root
    * scripts: Fix coverage information downloading script
    * build(deps): bump openssl from 0.10.68 to 0.10.70
    * build(deps): bump tokio from 1.42.0 to 1.43.0

------------------------------------------------------------------
------------------  2025-6-4  -  Jun 4 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.14.1:
    * Security fixes:
  - [bsc#1243933, CVE-2025-5399] libcurl can possibly get
    trapped in an endless busy-loop when processing specially
    crafted packets [d1145df2]
    * Bugfixes:
  - asyn-thrdd: fix cleanup when RR fails due to OOM
  - ftp: fix teardown of DATA connection in done
  - http: fail early when rewind of input failed when following redirects
  - multi: fix add_handle resizing
  - tls BIOs: handle BIO_CTRL_EOF correctly
  - tool_getparam: make --no-anyauth not be accepted
  - wolfssl: fix sending of early data
  - ws: handle blocked sends better
  - ws: tests and fixes

++++ curl:

  - Update to 8.14.1:
    * Security fixes:
  - [bsc#1243933, CVE-2025-5399] libcurl can possibly get
    trapped in an endless busy-loop when processing specially
    crafted packets [d1145df2]
    * Bugfixes:
  - asyn-thrdd: fix cleanup when RR fails due to OOM
  - ftp: fix teardown of DATA connection in done
  - http: fail early when rewind of input failed when following redirects
  - multi: fix add_handle resizing
  - tls BIOs: handle BIO_CTRL_EOF correctly
  - tool_getparam: make --no-anyauth not be accepted
  - wolfssl: fix sending of early data
  - ws: handle blocked sends better
  - ws: tests and fixes

++++ curl:

  - Update to 8.14.1:
    * Security fixes:
  - [bsc#1243933, CVE-2025-5399] libcurl can possibly get
    trapped in an endless busy-loop when processing specially
    crafted packets [d1145df2]
    * Bugfixes:
  - asyn-thrdd: fix cleanup when RR fails due to OOM
  - ftp: fix teardown of DATA connection in done
  - http: fail early when rewind of input failed when following redirects
  - multi: fix add_handle resizing
  - tls BIOs: handle BIO_CTRL_EOF correctly
  - tool_getparam: make --no-anyauth not be accepted
  - wolfssl: fix sending of early data
  - ws: handle blocked sends better
  - ws: tests and fixes

++++ curl:

  - Update to 8.14.1:
    * Security fixes:
  - [bsc#1243933, CVE-2025-5399] libcurl can possibly get
    trapped in an endless busy-loop when processing specially
    crafted packets [d1145df2]
    * Bugfixes:
  - asyn-thrdd: fix cleanup when RR fails due to OOM
  - ftp: fix teardown of DATA connection in done
  - http: fail early when rewind of input failed when following redirects
  - multi: fix add_handle resizing
  - tls BIOs: handle BIO_CTRL_EOF correctly
  - tool_getparam: make --no-anyauth not be accepted
  - wolfssl: fix sending of early data
  - ws: handle blocked sends better
  - ws: tests and fixes

++++ curl:

  - Update to 8.14.1:
    * Security fixes:
  - [bsc#1243933, CVE-2025-5399] libcurl can possibly get
    trapped in an endless busy-loop when processing specially
    crafted packets [d1145df2]
    * Bugfixes:
  - asyn-thrdd: fix cleanup when RR fails due to OOM
  - ftp: fix teardown of DATA connection in done
  - http: fail early when rewind of input failed when following redirects
  - multi: fix add_handle resizing
  - tls BIOs: handle BIO_CTRL_EOF correctly
  - tool_getparam: make --no-anyauth not be accepted
  - wolfssl: fix sending of early data
  - ws: handle blocked sends better
  - ws: tests and fixes

++++ curl:

  - Update to 8.14.1:
    * Security fixes:
  - [bsc#1243933, CVE-2025-5399] libcurl can possibly get
    trapped in an endless busy-loop when processing specially
    crafted packets [d1145df2]
    * Bugfixes:
  - asyn-thrdd: fix cleanup when RR fails due to OOM
  - ftp: fix teardown of DATA connection in done
  - http: fail early when rewind of input failed when following redirects
  - multi: fix add_handle resizing
  - tls BIOs: handle BIO_CTRL_EOF correctly
  - tool_getparam: make --no-anyauth not be accepted
  - wolfssl: fix sending of early data
  - ws: handle blocked sends better
  - ws: tests and fixes

++++ docker:

    [NOTE: This update was only ever released in SLES and Leap.]
  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
    + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
    + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
    + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
    + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
    + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
    + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
    + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
    + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
    + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
    + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ docker:

  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Always clear SUSEConnect suse_* secrets when starting containers regardless
    of whether the daemon was built with SUSEConnect support. Not doing this
    causes containers from SUSEConnect-enabled daemons to fail to start when
    running with SUSEConnect-disabled (i.e. upstream) daemons.
    This was a long-standing issue with our secrets support but until recently
    this would've required migrating from SLE packages to openSUSE packages
    (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
    away from in-built SUSEConnect support, this is now a practical issue users
    will run into. bsc#1244035
    + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  - Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
    + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
    + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

++++ libzypp:

  - RepoInfo: use pathNameSetTrailingSlash (fixes #643)
  - Fix wrong userdata parameter type when running zypp with debug
    verbosity (bsc#1239012)
  - version 17.37.4 (35)

++++ libzypp:

  - RepoInfo: use pathNameSetTrailingSlash (fixes #643)
  - Fix wrong userdata parameter type when running zypp with debug
    verbosity (bsc#1239012)
  - version 17.37.4 (35)

++++ libzypp:

  - RepoInfo: use pathNameSetTrailingSlash (fixes #643)
  - Fix wrong userdata parameter type when running zypp with debug
    verbosity (bsc#1239012)
  - version 17.37.4 (35)

------------------------------------------------------------------
------------------  2025-6-3  -  Jun 3 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Allow /boot to be a btrfs subvolume
    In a btrfs based design, allow to put /boot as subvolume.
    This required a small fix in the mount order in a way that
    boot/efi gets mounted after the subvolume mounts are done.
    The respective integration test has been updated to test
    this functionality. This Fixes #2824

++++ gpg2:

  - Don't install expired sks certificate [bsc#1243069]
    * Add patch gnupg-dirmngr-Don-t-install-expired-sks-certificate.patch

++++ gpg2:

  - Don't install expired sks certificate [bsc#1243069]
    * Add patch gnupg-dirmngr-Don-t-install-expired-sks-certificate.patch

++++ gpg2:

  - Don't install expired sks certificate [bsc#1243069]
    * Add patch gnupg-dirmngr-Don-t-install-expired-sks-certificate.patch

++++ gpg2:

  - Don't install expired sks certificate [bsc#1243069]
    * Add patch gnupg-dirmngr-Don-t-install-expired-sks-certificate.patch

++++ libsolv:

  - improve transaction ordering by allowing more uninst->uninst
    edges [bsc#1243457]
  - implement color filtering when adding update targets
  - support orderwithrequires dependencies in susedata.xml
  - bump version to 0.7.33

++++ libsolv:

  - improve transaction ordering by allowing more uninst->uninst
    edges [bsc#1243457]
  - implement color filtering when adding update targets
  - support orderwithrequires dependencies in susedata.xml
  - bump version to 0.7.33

++++ libsolv:

  - improve transaction ordering by allowing more uninst->uninst
    edges [bsc#1243457]
  - implement color filtering when adding update targets
  - support orderwithrequires dependencies in susedata.xml
  - bump version to 0.7.33

------------------------------------------------------------------
------------------  2025-6-2  -  Jun 2 2025  -------------------
------------------------------------------------------------------

++++ coreutils:

  - coreutils-9.4.sort-CVE-2025-5278.patch: Add upstream patch:
    sort with key character offsets of SIZE_MAX, could induce
    a read of 1 byte before an allocated heap buffer.
    (CVE-2025-5278, bsc#1243767)
  - coreutils-9.4.sort-CVE-2025-5278.patch: Add upstream patch:
    sort with key character offsets of SIZE_MAX, could induce
    a read of 1 byte before an allocated heap buffer.
    (CVE-2025-5278, bsc#1243767)

++++ python-kiwi:

  - Use f-strings where feasible
    This is a slightly shorter and easier to read syntax
  - Allow multiple EFI arch binaries/modules
    Allow to lookup and included EFI binaries/modules for
    multiple architectures. For testing the integration
    test in rawhide/test-image-live-disk has been adapted
    accordingly to install 32bit and 64bit EFI binaries.
    This Fixes #2822
  - Log warning message for disabled runtime checks
    Complete type hints for RuntimeConfig class and log
    a warning message for each disabled runtime check
  - Fix static type argument int vs. str
  - Move it inside the context that actually uses it
    also rename it to "supported" as that seems to closer match
    what it resembles
  - Add overlayfs as supporting xattr/ACLs as well
  - Fix disk_type validation for zipl loader
    If the targettype is set to GPT in combination with plain
    zipl as loader, the code to validate the targettype against
    the targetgeometry was not effective and zipl failed.
    This Fixes #2821

++++ systemd:

  - Import commit 656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0 (merge of v254.25)
    This merge includes the following fix:
    7fc7aa5a4d coredump: use %d in kernel core pattern (CVE-2025-4598)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/41d2be2fb502e62e671db2b22ee330af8fade7e2...656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0
  - Import commit 41d2be2fb502e62e671db2b22ee330af8fade7e2
    41d2be2fb5 Revert "macro: terminate the temporary VA_ARGS_FOREACH() array with a sentinel" (SUSE specific)

++++ systemd:

  - Import commit 656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0 (merge of v254.25)
    This merge includes the following fix:
    7fc7aa5a4d coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/41d2be2fb502e62e671db2b22ee330af8fade7e2...656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0
  - Import commit 41d2be2fb502e62e671db2b22ee330af8fade7e2
    41d2be2fb5 Revert "macro: terminate the temporary VA_ARGS_FOREACH() array with a sentinel" (SUSE specific)

++++ systemd:

  - Import commit 656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0 (merge of v254.25)
    This merge includes the following fix:
    7fc7aa5a4d coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/41d2be2fb502e62e671db2b22ee330af8fade7e2...656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0
  - Import commit 41d2be2fb502e62e671db2b22ee330af8fade7e2
    41d2be2fb5 Revert "macro: terminate the temporary VA_ARGS_FOREACH() array with a sentinel" (SUSE specific)

++++ systemd:

  - Import commit 656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0 (merge of v254.25)
    This merge includes the following fix:
    7fc7aa5a4d coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/41d2be2fb502e62e671db2b22ee330af8fade7e2...656494acfaf4b7ac5f3137c09b96b8c4bf08f7d0
  - Import commit 41d2be2fb502e62e671db2b22ee330af8fade7e2
    41d2be2fb5 Revert "macro: terminate the temporary VA_ARGS_FOREACH() array with a sentinel" (SUSE specific)

++++ libzypp:

  - Do not warn about no mirrors if mirrorlist was switched on
    automatically. (bsc#1243901)
  - Relax permission of cached packages to 0644 & ~umask
    (bsc#1243887)
  - version 17.37.3 (35)

++++ libzypp:

  - Do not warn about no mirrors if mirrorlist was switched on
    automatically. (bsc#1243901)
  - Relax permission of cached packages to 0644 & ~umask
    (bsc#1243887)
  - version 17.37.3 (35)

++++ libzypp:

  - Do not warn about no mirrors if mirrorlist was switched on
    automatically. (bsc#1243901)
  - Relax permission of cached packages to 0644 & ~umask
    (bsc#1243887)
  - version 17.37.3 (35)

------------------------------------------------------------------
------------------  2025-5-30  -  May 30 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.2.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2822>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Update to Docker 28.2.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
    <https://github.com/moby/moby/releases/tag/v28.2.1>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.2.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2822>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Update to Docker 28.2.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
    <https://github.com/moby/moby/releases/tag/v28.2.1>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.2.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2822>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Update to Docker 28.2.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
    <https://github.com/moby/moby/releases/tag/v28.2.1>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.2.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2822>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Update to Docker 28.2.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
    <https://github.com/moby/moby/releases/tag/v28.2.1>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Update to Docker 28.2.2-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2822>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Update to Docker 28.2.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
    <https://github.com/moby/moby/releases/tag/v28.2.1>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

------------------------------------------------------------------
------------------  2025-5-28  -  May 28 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.14.0:
    * Security fixes:
  - [CVE-2025-4947, bsc#1243397] QUIC certificate check skip with wolfSSL
  - [CVE-2025-5025, bsc#1243706] No QUIC certificate pinning with wolfSSL
    * Changes:
  - mqtt: send ping at upkeep interval
  - schannel: handle pkcs12 client certificates containing CA certificates
  - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
  - vquic: ngtcp2 + openssl support
  - wcurl: import v2025.04.20 script + docs
  - websocket: add option to disable auto-pong reply
    * Bugfixes:
  - asny-thrdd: fix detach from running thread
  - async-threaded resolver: use ref counter
  - async: DoH improvements
  - build: enable gcc-12/13+, clang-10+ picky warnings
  - build: enable gcc-15 picky warnings
  - certs: drop unused `default_bits` from `.prm` files
  - cf-https-connect: use the passed in dns struct pointer
  - cf-socket: fix FTP accept connect
  - cfilters: remove assert
  - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
  - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
  - cmake: revert `CURL_LTO` behavior for multi-config generators
  - configure: fix --disable-rt
  - CONTRIBUTE: add project guidelines for AI use
  - cpool/cshutdown: force close connections under pressure
  - curl: fix memory leak when -h is used in config file
  - curl_get_line: handle lines ending on the buffer boundary
  - headers: enforce a max number of response header to accept
  - http: fix HTTP/2 handling of TE request header using "trailers"
  - lib: include files using known path
  - lib: unify conversions to/from hex
  - libssh: add NULL check for Curl_meta_get()
  - libssh: fix memory leak
  - mqtt: use conn/easy meta hash
  - multi: do transfer book keeping using mid
  - multi: init_do(): check result
  - netrc: avoid NULL deref on weird input
  - netrc: avoid strdup NULL
  - netrc: deal with null token better
  - openssl-quic: avoid potential `-Wnull-dereference`, add assert
  - openssl-quic: fix shutdown when stream not open
  - openssl: enable builds for *both* engines and providers
  - openssl: set the cipher string before doing private cert
  - progress: avoid integer overflow when gathering total transfer size
  - rand: update comment on Curl_rand_bytes weak random
  - rustls: make max size of cert and key reasonable
  - smb: avoid integer overflow on weird input date
  - urlapi: redirecting to "" is considered fine
    * Remove curl-8.13.0-CloseSocket.patch upstream
    * Rebase libcurl-ocloexec.patch

++++ curl:

  - Update to 8.14.0:
    * Security fixes:
  - [CVE-2025-4947, bsc#1243397] QUIC certificate check skip with wolfSSL
  - [CVE-2025-5025, bsc#1243706] No QUIC certificate pinning with wolfSSL
    * Changes:
  - mqtt: send ping at upkeep interval
  - schannel: handle pkcs12 client certificates containing CA certificates
  - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
  - vquic: ngtcp2 + openssl support
  - wcurl: import v2025.04.20 script + docs
  - websocket: add option to disable auto-pong reply
    * Bugfixes:
  - asny-thrdd: fix detach from running thread
  - async-threaded resolver: use ref counter
  - async: DoH improvements
  - build: enable gcc-12/13+, clang-10+ picky warnings
  - build: enable gcc-15 picky warnings
  - certs: drop unused `default_bits` from `.prm` files
  - cf-https-connect: use the passed in dns struct pointer
  - cf-socket: fix FTP accept connect
  - cfilters: remove assert
  - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
  - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
  - cmake: revert `CURL_LTO` behavior for multi-config generators
  - configure: fix --disable-rt
  - CONTRIBUTE: add project guidelines for AI use
  - cpool/cshutdown: force close connections under pressure
  - curl: fix memory leak when -h is used in config file
  - curl_get_line: handle lines ending on the buffer boundary
  - headers: enforce a max number of response header to accept
  - http: fix HTTP/2 handling of TE request header using "trailers"
  - lib: include files using known path
  - lib: unify conversions to/from hex
  - libssh: add NULL check for Curl_meta_get()
  - libssh: fix memory leak
  - mqtt: use conn/easy meta hash
  - multi: do transfer book keeping using mid
  - multi: init_do(): check result
  - netrc: avoid NULL deref on weird input
  - netrc: avoid strdup NULL
  - netrc: deal with null token better
  - openssl-quic: avoid potential `-Wnull-dereference`, add assert
  - openssl-quic: fix shutdown when stream not open
  - openssl: enable builds for *both* engines and providers
  - openssl: set the cipher string before doing private cert
  - progress: avoid integer overflow when gathering total transfer size
  - rand: update comment on Curl_rand_bytes weak random
  - rustls: make max size of cert and key reasonable
  - smb: avoid integer overflow on weird input date
  - urlapi: redirecting to "" is considered fine
    * Remove curl-8.13.0-CloseSocket.patch upstream
    * Rebase libcurl-ocloexec.patch

++++ curl:

  - Update to 8.14.0:
    * Security fixes:
  - [CVE-2025-4947, bsc#1243397] QUIC certificate check skip with wolfSSL
  - [CVE-2025-5025, bsc#1243706] No QUIC certificate pinning with wolfSSL
    * Changes:
  - mqtt: send ping at upkeep interval
  - schannel: handle pkcs12 client certificates containing CA certificates
  - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
  - vquic: ngtcp2 + openssl support
  - wcurl: import v2025.04.20 script + docs
  - websocket: add option to disable auto-pong reply
    * Bugfixes:
  - asny-thrdd: fix detach from running thread
  - async-threaded resolver: use ref counter
  - async: DoH improvements
  - build: enable gcc-12/13+, clang-10+ picky warnings
  - build: enable gcc-15 picky warnings
  - certs: drop unused `default_bits` from `.prm` files
  - cf-https-connect: use the passed in dns struct pointer
  - cf-socket: fix FTP accept connect
  - cfilters: remove assert
  - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
  - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
  - cmake: revert `CURL_LTO` behavior for multi-config generators
  - configure: fix --disable-rt
  - CONTRIBUTE: add project guidelines for AI use
  - cpool/cshutdown: force close connections under pressure
  - curl: fix memory leak when -h is used in config file
  - curl_get_line: handle lines ending on the buffer boundary
  - headers: enforce a max number of response header to accept
  - http: fix HTTP/2 handling of TE request header using "trailers"
  - lib: include files using known path
  - lib: unify conversions to/from hex
  - libssh: add NULL check for Curl_meta_get()
  - libssh: fix memory leak
  - mqtt: use conn/easy meta hash
  - multi: do transfer book keeping using mid
  - multi: init_do(): check result
  - netrc: avoid NULL deref on weird input
  - netrc: avoid strdup NULL
  - netrc: deal with null token better
  - openssl-quic: avoid potential `-Wnull-dereference`, add assert
  - openssl-quic: fix shutdown when stream not open
  - openssl: enable builds for *both* engines and providers
  - openssl: set the cipher string before doing private cert
  - progress: avoid integer overflow when gathering total transfer size
  - rand: update comment on Curl_rand_bytes weak random
  - rustls: make max size of cert and key reasonable
  - smb: avoid integer overflow on weird input date
  - urlapi: redirecting to "" is considered fine
    * Remove curl-8.13.0-CloseSocket.patch upstream
    * Rebase libcurl-ocloexec.patch

++++ curl:

  - Update to 8.14.0:
    * Security fixes:
  - [CVE-2025-4947, bsc#1243397] QUIC certificate check skip with wolfSSL
  - [CVE-2025-5025, bsc#1243706] No QUIC certificate pinning with wolfSSL
    * Changes:
  - mqtt: send ping at upkeep interval
  - schannel: handle pkcs12 client certificates containing CA certificates
  - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
  - vquic: ngtcp2 + openssl support
  - wcurl: import v2025.04.20 script + docs
  - websocket: add option to disable auto-pong reply
    * Bugfixes:
  - asny-thrdd: fix detach from running thread
  - async-threaded resolver: use ref counter
  - async: DoH improvements
  - build: enable gcc-12/13+, clang-10+ picky warnings
  - build: enable gcc-15 picky warnings
  - certs: drop unused `default_bits` from `.prm` files
  - cf-https-connect: use the passed in dns struct pointer
  - cf-socket: fix FTP accept connect
  - cfilters: remove assert
  - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
  - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
  - cmake: revert `CURL_LTO` behavior for multi-config generators
  - configure: fix --disable-rt
  - CONTRIBUTE: add project guidelines for AI use
  - cpool/cshutdown: force close connections under pressure
  - curl: fix memory leak when -h is used in config file
  - curl_get_line: handle lines ending on the buffer boundary
  - headers: enforce a max number of response header to accept
  - http: fix HTTP/2 handling of TE request header using "trailers"
  - lib: include files using known path
  - lib: unify conversions to/from hex
  - libssh: add NULL check for Curl_meta_get()
  - libssh: fix memory leak
  - mqtt: use conn/easy meta hash
  - multi: do transfer book keeping using mid
  - multi: init_do(): check result
  - netrc: avoid NULL deref on weird input
  - netrc: avoid strdup NULL
  - netrc: deal with null token better
  - openssl-quic: avoid potential `-Wnull-dereference`, add assert
  - openssl-quic: fix shutdown when stream not open
  - openssl: enable builds for *both* engines and providers
  - openssl: set the cipher string before doing private cert
  - progress: avoid integer overflow when gathering total transfer size
  - rand: update comment on Curl_rand_bytes weak random
  - rustls: make max size of cert and key reasonable
  - smb: avoid integer overflow on weird input date
  - urlapi: redirecting to "" is considered fine
    * Remove curl-8.13.0-CloseSocket.patch upstream
    * Rebase libcurl-ocloexec.patch

++++ curl:

  - Update to 8.14.0:
    * Security fixes:
  - [CVE-2025-4947, bsc#1243397] QUIC certificate check skip with wolfSSL
  - [CVE-2025-5025, bsc#1243706] No QUIC certificate pinning with wolfSSL
    * Changes:
  - mqtt: send ping at upkeep interval
  - schannel: handle pkcs12 client certificates containing CA certificates
  - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
  - vquic: ngtcp2 + openssl support
  - wcurl: import v2025.04.20 script + docs
  - websocket: add option to disable auto-pong reply
    * Bugfixes:
  - asny-thrdd: fix detach from running thread
  - async-threaded resolver: use ref counter
  - async: DoH improvements
  - build: enable gcc-12/13+, clang-10+ picky warnings
  - build: enable gcc-15 picky warnings
  - certs: drop unused `default_bits` from `.prm` files
  - cf-https-connect: use the passed in dns struct pointer
  - cf-socket: fix FTP accept connect
  - cfilters: remove assert
  - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
  - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
  - cmake: revert `CURL_LTO` behavior for multi-config generators
  - configure: fix --disable-rt
  - CONTRIBUTE: add project guidelines for AI use
  - cpool/cshutdown: force close connections under pressure
  - curl: fix memory leak when -h is used in config file
  - curl_get_line: handle lines ending on the buffer boundary
  - headers: enforce a max number of response header to accept
  - http: fix HTTP/2 handling of TE request header using "trailers"
  - lib: include files using known path
  - lib: unify conversions to/from hex
  - libssh: add NULL check for Curl_meta_get()
  - libssh: fix memory leak
  - mqtt: use conn/easy meta hash
  - multi: do transfer book keeping using mid
  - multi: init_do(): check result
  - netrc: avoid NULL deref on weird input
  - netrc: avoid strdup NULL
  - netrc: deal with null token better
  - openssl-quic: avoid potential `-Wnull-dereference`, add assert
  - openssl-quic: fix shutdown when stream not open
  - openssl: enable builds for *both* engines and providers
  - openssl: set the cipher string before doing private cert
  - progress: avoid integer overflow when gathering total transfer size
  - rand: update comment on Curl_rand_bytes weak random
  - rustls: make max size of cert and key reasonable
  - smb: avoid integer overflow on weird input date
  - urlapi: redirecting to "" is considered fine
    * Remove curl-8.13.0-CloseSocket.patch upstream
    * Rebase libcurl-ocloexec.patch

++++ curl:

  - Update to 8.14.0:
    * Security fixes:
  - [CVE-2025-4947, bsc#1243397] QUIC certificate check skip with wolfSSL
  - [CVE-2025-5025, bsc#1243706] No QUIC certificate pinning with wolfSSL
    * Changes:
  - mqtt: send ping at upkeep interval
  - schannel: handle pkcs12 client certificates containing CA certificates
  - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
  - vquic: ngtcp2 + openssl support
  - wcurl: import v2025.04.20 script + docs
  - websocket: add option to disable auto-pong reply
    * Bugfixes:
  - asny-thrdd: fix detach from running thread
  - async-threaded resolver: use ref counter
  - async: DoH improvements
  - build: enable gcc-12/13+, clang-10+ picky warnings
  - build: enable gcc-15 picky warnings
  - certs: drop unused `default_bits` from `.prm` files
  - cf-https-connect: use the passed in dns struct pointer
  - cf-socket: fix FTP accept connect
  - cfilters: remove assert
  - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`
  - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options
  - cmake: revert `CURL_LTO` behavior for multi-config generators
  - configure: fix --disable-rt
  - CONTRIBUTE: add project guidelines for AI use
  - cpool/cshutdown: force close connections under pressure
  - curl: fix memory leak when -h is used in config file
  - curl_get_line: handle lines ending on the buffer boundary
  - headers: enforce a max number of response header to accept
  - http: fix HTTP/2 handling of TE request header using "trailers"
  - lib: include files using known path
  - lib: unify conversions to/from hex
  - libssh: add NULL check for Curl_meta_get()
  - libssh: fix memory leak
  - mqtt: use conn/easy meta hash
  - multi: do transfer book keeping using mid
  - multi: init_do(): check result
  - netrc: avoid NULL deref on weird input
  - netrc: avoid strdup NULL
  - netrc: deal with null token better
  - openssl-quic: avoid potential `-Wnull-dereference`, add assert
  - openssl-quic: fix shutdown when stream not open
  - openssl: enable builds for *both* engines and providers
  - openssl: set the cipher string before doing private cert
  - progress: avoid integer overflow when gathering total transfer size
  - rand: update comment on Curl_rand_bytes weak random
  - rustls: make max size of cert and key reasonable
  - smb: avoid integer overflow on weird input date
  - urlapi: redirecting to "" is considered fine
    * Remove curl-8.13.0-CloseSocket.patch upstream
    * Rebase libcurl-ocloexec.patch

++++ python-kiwi:

  - Fixup overlay unit enablement
  - Fixup overlay mount dependencies
  - Update test-image-overlayroot integration test
    Use proper systemd mount units to setup the custom overlay.
    The handling of fstab entries by systemd is limited and
    should be better handled by self managed mount units
  - Use proper mount units for overlay setup
    Instead of manual mounting create a proper systemd mount
    unit. This allows to manage mount dependencies and the order
    of nested mounts in a clean way

++++ pcr-oracle:

  - Add fix-bsc1241957-strcmp-for-alt-event.patch to fix the strcmp
    statement for the alternative event (bsc#1241957)

++++ pcr-oracle:

  - Add fix-bsc1241957-strcmp-for-alt-event.patch to fix the strcmp
    statement for the alternative event (bsc#1241957)

++++ pcr-oracle:

  - Add fix-bsc1241957-strcmp-for-alt-event.patch to fix the strcmp
    statement for the alternative event (bsc#1241957)

------------------------------------------------------------------
------------------  2025-5-27  -  May 27 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.23 → 10.2.24

++++ libzypp:

  - Add a note to service maintained .repo file entries (fixes #638)
  - Support using %{url} variable in a RIS service's repo section.
  - version 17.37.2 (35)

++++ libzypp:

  - Add a note to service maintained .repo file entries (fixes #638)
  - Support using %{url} variable in a RIS service's repo section.
  - version 17.37.2 (35)

++++ libzypp:

  - Add a note to service maintained .repo file entries (fixes #638)
  - Support using %{url} variable in a RIS service's repo section.
  - version 17.37.2 (35)

------------------------------------------------------------------
------------------  2025-5-26  -  May 26 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Cleanup build metadata
    Make sure the final image rootfs does not contain unneeded
    metadata files used during build time. The respective cleanup
    call is performed after the root sync and after all initrd/boot
    processing has been done. This is because up to that point it's
    still possible that the information is required. This means
    when building images with a read-only rootfs, it might not be
    possible that the metadata can be deleted due to a chicken&egg
    situation. Furthermore the cleanup is applied to the disk
    builder only as other builders do not really suffer from
    this data and for the container builder the metadata can
    also be used for the stackbuild feature when building images
    derived from containers. This Fixes #2668

++++ mozilla-nss:

  - update to NSS 3.112
    * bmo#1963792 - Fix alias for mac workers on try
    * bmo#1966786 - ensure all options can be configured with SSL_OptionSet and SSL_OptionSetDefault
    * bmo#1931930 - ABI/API break in ssl certificate processing
    * bmo#1955971 - remove unnecessary assertion in sec_asn1d_init_state_based_on_template
    * bmo#1965754 - update taskgraph to v14.2.1
    * bmo#1964358 - Workflow for automation of the release on GitHub when pushing a tag
    * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
    * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
    * bmo#1951396 - update taskgraph to v14.1.1
    * bmo#1962503 - Partial fix for ACVP build CI job
    * bmo#1961827 - Initialize find in sftk_searchDatabase
    * bmo#1963121 - Add clang-18 to extra builds
    * bmo#1963044 - Fault tolerant git fetch for fuzzing
    * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
    * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or CMSDEBUG are set
    * bmo#1961835 - fix content type tag check in NSS_CMSMessage_ContainsCertsOrCrls
    * bmo#1963102 - Remove Cryptofuzz CI version check

++++ mozilla-nss:

  - update to NSS 3.112
    * bmo#1963792 - Fix alias for mac workers on try
    * bmo#1966786 - ensure all options can be configured with SSL_OptionSet and SSL_OptionSetDefault
    * bmo#1931930 - ABI/API break in ssl certificate processing
    * bmo#1955971 - remove unnecessary assertion in sec_asn1d_init_state_based_on_template
    * bmo#1965754 - update taskgraph to v14.2.1
    * bmo#1964358 - Workflow for automation of the release on GitHub when pushing a tag
    * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
    * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
    * bmo#1951396 - update taskgraph to v14.1.1
    * bmo#1962503 - Partial fix for ACVP build CI job
    * bmo#1961827 - Initialize find in sftk_searchDatabase
    * bmo#1963121 - Add clang-18 to extra builds
    * bmo#1963044 - Fault tolerant git fetch for fuzzing
    * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
    * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or CMSDEBUG are set
    * bmo#1961835 - fix content type tag check in NSS_CMSMessage_ContainsCertsOrCrls
    * bmo#1963102 - Remove Cryptofuzz CI version check

++++ python-tornado6:

  - Add patch CVE-2025-47287.patch:
    * httputil: Raise errors instead of logging in multipart/form-data parsing
    (CVE-2025-47287, bsc#1243268, gh#tornadoweb/tornado#3497)

++++ python-tornado6:

  - Add patch CVE-2025-47287.patch:
    * httputil: Raise errors instead of logging in multipart/form-data parsing
    (CVE-2025-47287, bsc#1243268, gh#tornadoweb/tornado#3497)

++++ python-tornado6:

  - Add patch CVE-2025-47287.patch:
    * httputil: Raise errors instead of logging in multipart/form-data parsing
    (CVE-2025-47287, bsc#1243268, gh#tornadoweb/tornado#3497)

++++ selinux-policy:

  - Update to version 20230523+git27.6fee49569:
    * qemu-guest-agent: fix denial for guest-get-fsinfo (bsc#1243389)

++++ selinux-policy:

  - Update to version 20230523+git27.6fee49569:
    * qemu-guest-agent: fix denial for guest-get-fsinfo (bsc#1243389)

++++ selinux-policy:

  - Update to version 20230523+git27.6fee49569:
    * qemu-guest-agent: fix denial for guest-get-fsinfo (bsc#1243389)

++++ selinux-policy:

  - Update to version 20230523+git27.6fee49569:
    * qemu-guest-agent: fix denial for guest-get-fsinfo (bsc#1243389)

------------------------------------------------------------------
------------------  2025-5-25  -  May 25 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update overlay integration test for partial write
    Update the sdboot_uki_verity_erofs profile of the
    test-image-overlayroot integration test with a custom
    fstab example to overlay only parts of the system
    for writing. This Fixes #2815
  - bootloader setup without overlay write partition
    If overlayroot_write_partition="false" is set, no system
    indicator was stored. This cause the bootloader setup to
    be skipped completely which is not required for e.g.
    systemd-boot.
  - Make sure to create overlay directories
    Create overlay directories even if rd.root.overlay.readonly
    is set. This allows individual fstab overlays mounts to be
    performed

------------------------------------------------------------------
------------------  2025-5-23  -  May 23 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed rd.root.overlay.readonly overlay mode
    When booting an overlayroot image with rd.root.overlay.readonly
    set, the system will boot with only the read-only root mounted.
    There was a bug in the dracut code which prevented this mount
    from succeeding when the read-only rootfs is different from
    squashfs. This commit changes the mount to be a simple bind
    mount, independent of the origin filesystem. This works because
    the read-only mount is performed in the dracut overlay code
    anyway. This is related to Issue #2815

++++ libzypp:

  - Use a cookie file to validate mirrorlist cache.
    This patch extends the mirrorlist code to use a cookie file to
    validate the contents of the cache against the source URL, making
    sure that we do not accidentially use a old cache when the
    mirrorlist url was changed. For example when migrating a system
    from one release to the next where the same repo alias might just
    have a different URL.
  - Let Service define and update gpgkey, mirrorlist and metalink.
  - Preserve a mirrorlist file in the raw cache during refresh.
  - version 17.37.1 (35)

++++ libzypp:

  - Use a cookie file to validate mirrorlist cache.
    This patch extends the mirrorlist code to use a cookie file to
    validate the contents of the cache against the source URL, making
    sure that we do not accidentially use a old cache when the
    mirrorlist url was changed. For example when migrating a system
    from one release to the next where the same repo alias might just
    have a different URL.
  - Let Service define and update gpgkey, mirrorlist and metalink.
  - Preserve a mirrorlist file in the raw cache during refresh.
  - version 17.37.1 (35)

++++ libzypp:

  - Use a cookie file to validate mirrorlist cache.
    This patch extends the mirrorlist code to use a cookie file to
    validate the contents of the cache against the source URL, making
    sure that we do not accidentially use a old cache when the
    mirrorlist url was changed. For example when migrating a system
    from one release to the next where the same repo alias might just
    have a different URL.
  - Let Service define and update gpgkey, mirrorlist and metalink.
  - Preserve a mirrorlist file in the raw cache during refresh.
  - version 17.37.1 (35)

------------------------------------------------------------------
------------------  2025-5-22  -  May 22 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to docker-buildx v0.24.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.24.0>

++++ docker:

  - Update to docker-buildx v0.24.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.24.0>

++++ docker:

  - Update to docker-buildx v0.24.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.24.0>

++++ docker:

  - Update to docker-buildx v0.24.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.24.0>

++++ docker:

  - Update to docker-buildx v0.24.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.24.0>

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311-core:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ libzypp:

  - Code16: Enable curl2 backend and parallel package download by
    default. In Code15 it's optional.
    Environment variables ZYPP_CURL2=<0|1> and ZYPP_PCK_PRELOAD=<0|1>
    can be used to turn the features on or off.
  - Make gpgKeyUrl the default source for gpg keys.
    When refreshing zypp now primarily uses gpgKeyUrl information
    from the repo files and only falls back to a automatically
    generated key Url if a gpgKeyUrl was not specified.
  - Introduce mirrors into the Media backends (bsc#1240132)
  - Drop MediaMultiCurl backend.
  - Throttle progress updates when preloading packages (bsc#1239543)
  - Check if request is in valid state in CURL callbacks (fixes
    openSUSE/zypper#605)
  - spec/CMake: add conditional build
    '--with[out] classic_rpmtrans_as_default'.
    classic_rpmtrans is the current builtin default for SUSE,
    otherwise it's single_rpmtrans.
    The `enable_preview_single_rpmtrans_as_default_for_zypper` switch
    was removed from the spec file.  Accordingly the CMake option
    ENABLE_PREVIEW_SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER was removed.
  - version 17.37.0 (35)

++++ libzypp:

  - Code16: Enable curl2 backend and parallel package download by
    default. In Code15 it's optional.
    Environment variables ZYPP_CURL2=<0|1> and ZYPP_PCK_PRELOAD=<0|1>
    can be used to turn the features on or off.
  - Make gpgKeyUrl the default source for gpg keys.
    When refreshing zypp now primarily uses gpgKeyUrl information
    from the repo files and only falls back to a automatically
    generated key Url if a gpgKeyUrl was not specified.
  - Introduce mirrors into the Media backends (bsc#1240132)
  - Drop MediaMultiCurl backend.
  - Throttle progress updates when preloading packages (bsc#1239543)
  - Check if request is in valid state in CURL callbacks (fixes
    openSUSE/zypper#605)
  - spec/CMake: add conditional build
    '--with[out] classic_rpmtrans_as_default'.
    classic_rpmtrans is the current builtin default for SUSE,
    otherwise it's single_rpmtrans.
    The `enable_preview_single_rpmtrans_as_default_for_zypper` switch
    was removed from the spec file.  Accordingly the CMake option
    ENABLE_PREVIEW_SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER was removed.
  - version 17.37.0 (35)

++++ libzypp:

  - Code16: Enable curl2 backend and parallel package download by
    default. In Code15 it's optional.
    Environment variables ZYPP_CURL2=<0|1> and ZYPP_PCK_PRELOAD=<0|1>
    can be used to turn the features on or off.
  - Make gpgKeyUrl the default source for gpg keys.
    When refreshing zypp now primarily uses gpgKeyUrl information
    from the repo files and only falls back to a automatically
    generated key Url if a gpgKeyUrl was not specified.
  - Introduce mirrors into the Media backends (bsc#1240132)
  - Drop MediaMultiCurl backend.
  - Throttle progress updates when preloading packages (bsc#1239543)
  - Check if request is in valid state in CURL callbacks (fixes
    openSUSE/zypper#605)
  - spec/CMake: add conditional build
    '--with[out] classic_rpmtrans_as_default'.
    classic_rpmtrans is the current builtin default for SUSE,
    otherwise it's single_rpmtrans.
    The `enable_preview_single_rpmtrans_as_default_for_zypper` switch
    was removed from the spec file.  Accordingly the CMake option
    ENABLE_PREVIEW_SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER was removed.
  - version 17.37.0 (35)

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ python311:

  - Add CVE-2025-4516-DecodeError-handler.patch fixing
    CVE-2025-4516 (bsc#1243273) blocking DecodeError handling
    vulnerability, which could lead to DoS.

++++ regionServiceClientConfigAzure:

  - Update dependency name for metadata package, name change in SLE 16
    (bsc#1243419)

++++ regionServiceClientConfigEC2:

  - Update dependency to accomodate metadata binary package name change
    in SLE 16 (bsc#1243419)

++++ zypper:

  - BuildRequires:  libzypp-devel >= 17.37.0.
  - Use libzypp improvements for preload and mirror handling.
  - xmlout.rnc: Update repo-element (bsc#1241463)
    Add the "metalink" attribute and reflect that the "url" elements
    list may in fact be empty, if no baseurls are defined in the
    .repo files.
  - man: update --allow-unsigned-rpm description.
    Explain how to achieve the same for packages provided by
    repositories.
  - version 1.14.90

++++ zypper:

  - BuildRequires:  libzypp-devel >= 17.37.0.
  - Use libzypp improvements for preload and mirror handling.
  - xmlout.rnc: Update repo-element (bsc#1241463)
    Add the "metalink" attribute and reflect that the "url" elements
    list may in fact be empty, if no baseurls are defined in the
    .repo files.
  - man: update --allow-unsigned-rpm description.
    Explain how to achieve the same for packages provided by
    repositories.
  - version 1.14.90

------------------------------------------------------------------
------------------  2025-5-21  -  May 21 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - The way we build debs requires setuptools
    debbuild doesn't work when setuptools is not there
  - Drop use of setuptools
    Since we moved to poetry and no code using setuptools anymore,
    this requirement can be dropped. The commit also updates the
    plugin documentation which was still based on setup.py

++++ mozilla-nss:

  - update to NSS 3.111
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1957685 - Turn off Websites Trust Bit from CAs
    * bmo#1937338 - Update nssckbi version following April 2025 Batch of Changes
    * bmo#1943135 - Disable SMIME ‘trust bit’ for GoDaddy CAs
    * bmo#1874383 - Replaced deprecated sprintf function with snprintf in dbtool.c
    * bmo#1954612 - Need up update NSS for PKCS 3.1
    * bmo#1773374 - avoid leaking localCert if it is already set in ssl3_FillInCachedSID
    * bmo#1953097 - Decrease ASAN quarantine size for Cryptofuzz in CI
    * bmo#1943962 - selfserv: Add support for zlib certificate compression

++++ mozilla-nss:

  - update to NSS 3.111
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1957685 - Turn off Websites Trust Bit from CAs
    * bmo#1937338 - Update nssckbi version following April 2025 Batch of Changes
    * bmo#1943135 - Disable SMIME ‘trust bit’ for GoDaddy CAs
    * bmo#1874383 - Replaced deprecated sprintf function with snprintf in dbtool.c
    * bmo#1954612 - Need up update NSS for PKCS 3.1
    * bmo#1773374 - avoid leaking localCert if it is already set in ssl3_FillInCachedSID
    * bmo#1953097 - Decrease ASAN quarantine size for Cryptofuzz in CI
    * bmo#1943962 - selfserv: Add support for zlib certificate compression

------------------------------------------------------------------
------------------  2025-5-20  -  May 20 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update live boot remote boot features
    Like the upstream module also support the root=live:http://...
    remote boot options. The kiwi-live dracut module is scheduled
    to become obsolete, but it's still in use and should support
    remote boot not only for AoE. As we got more issue reports than
    working AoE remote boot success, this commit also updates the
    documentation and switches to the capabilities of this PR.

++++ python-setuptools:

  - Add patch CVE-2025-47273.patch to fix A path traversal
    vulnerability.
    (bsc#1243313, CVE-2025-47273, gh#pypa/setuptools@250a6d17978f)

------------------------------------------------------------------
------------------  2025-5-19  -  May 19 2025  -------------------
------------------------------------------------------------------

++++ afterburn:

  - Update to version 5.8.2:
    * cargo: Afterburn release 5.8.2
    * docs/release-notes: update for release 5.8.2
    * cargo: update dependencies
    * cargo: Afterburn release 5.8.1
    * cargo: Afterburn release 5.8.0
    * docs/release-notes: update for release 5.8.0
    * cargo: update dependencies
    * packit: add initial support

++++ afterburn:

  - Update to version 5.8.2:
    * cargo: Afterburn release 5.8.2
    * docs/release-notes: update for release 5.8.2
    * cargo: update dependencies
    * cargo: Afterburn release 5.8.1
    * cargo: Afterburn release 5.8.0
    * docs/release-notes: update for release 5.8.0
    * cargo: update dependencies
    * packit: add initial support

++++ python-kiwi:

  - Add UKI support for the grub bootloader
    In addition to systemd_boot also add support for UKI creation
    when grub is used. This includes the creation of a UKI image
    via dracut in the same way as it's done for systemd_boot.
    In addition an earlyboot grub script chainloads the UKI and
    bypasses any written grub configuration. In Theory this should
    also allow to use the shim loader for chainloading an UKI.
    However I haven't done testing in this direction and I also
    expect security issues with this approach because loading
    any non signed data by shim is not expected to work. A new
    profile named grub_uki_verity_erofs has been added to the
    integration test that experiments with UKIs
  - Bump version: 10.2.22 → 10.2.23

++++ glibc:

  - static-setuid-ld-library-path.patch: elf: Ignore LD_LIBRARY_PATH and
    debug env var for setuid for static (CVE-2025-4802, bsc#1243317)

++++ glibc:

  - static-setuid-ld-library-path.patch: elf: Ignore LD_LIBRARY_PATH and
    debug env var for setuid for static (CVE-2025-4802, bsc#1243317)

++++ glibc:

  - static-setuid-ld-library-path.patch: elf: Ignore LD_LIBRARY_PATH and
    debug env var for setuid for static (CVE-2025-4802, bsc#1243317)

++++ pam_pkcs11:

  - Removes pam_env from auth stack for security reason
    [bsc#1243226, CVE-2025-6018]

------------------------------------------------------------------
------------------  2025-5-17  -  May 17 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Use extended %autopatch.

++++ python311-core:

  - Use extended %autopatch.

++++ python311-core:

  - Use extended %autopatch.

++++ python311-core:

  - Use extended %autopatch.

++++ python311-core:

  - Use extended %autopatch.

++++ python311-core:

  - Use extended %autopatch.

++++ python311-core:

  - Use extended %autopatch.

++++ python311-core:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

++++ python311:

  - Use extended %autopatch.

------------------------------------------------------------------
------------------  2025-5-16  -  May 16 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add support for <initrd> section as part of <type>
    Extend scope and content of the <initrd> section to be allowed
    as part of the <type> section. This allows to specify custom
    call options and modules for the dracut tool. In particular
    this commit implementes support for passing the uefi option
    to dracut to enable building an UKI EFI binary as follows:
    <initrd action="setup">
    <dracut uefi="true"/>
    </initrd>
    This Fixes #2809 and Fixes #2408
  - Fix systemd-boot loader setup
    To make sure only loader entries from /boot/efi/loader/entries
    kiwi deleted eventually existing entry files from /boot/loader.
    However that is a problem for read-only systems and should actually
    also not performed by kiwi. This Fixes #2805

++++ systemd:

  - Import commit 806c21e22ba4e3038817c20da19633b483b3ee80
    806c21e22b umount: do not move busy network mounts (bsc#1236177)

++++ systemd:

  - Import commit 806c21e22ba4e3038817c20da19633b483b3ee80
    806c21e22b umount: do not move busy network mounts (bsc#1236177)

++++ systemd:

  - Import commit 806c21e22ba4e3038817c20da19633b483b3ee80
    806c21e22b umount: do not move busy network mounts (bsc#1236177)

++++ systemd:

  - Import commit 806c21e22ba4e3038817c20da19633b483b3ee80
    806c21e22b umount: do not move busy network mounts (bsc#1236177)

++++ pam-config:

  - Stop adding pam_env in AUTH stack, and be sure to put this module at the
    really end of the SESSION stack.
    [bsc#1243226, CVE-2025-6018, remove-pam_env-from-auth-stack.patch]

------------------------------------------------------------------
------------------  2025-5-15  -  May 15 2025  -------------------
------------------------------------------------------------------

++++ cloud-init:

  - Update to version 25.1.1 (bsc#1239715,jsc#PED-8680,bsc#1228414)
    + Removed included upstream
  - pep-594-drop-pipes.patch
  - cloud-init-fix-python313.patch
  - cloud-init-dont-assume-ordering-of-ThreadPoolExecutor.patch
  - cloud-init-direxist.patch
  - cloud-init-wait-for-net.patch
  - cloud-init-usr-sudoers.patch
  - cloud-init-no-nmcfg-needed.patch
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  - cloud-init-pckg-reboot.patch
  - cloud-init-ds-deterministic.patch
  - cloud-init-write-routes.patch
  - cloud-init-skip-empty-conf.patch
    + Forward port
  - cloud-init-no-tempnet-oci.patch
  - cloud-init-no-openstack-guess.patch
  - cloud-init-lint-set-interpreter.patch
    + Add
  - cloud-init-ssh-usrmerge.patch (bsc#1237764)
  - cloud-init-lint-set-interpreter.patch
  - cloud-init-lint-fix.patch
  - cloud-init-no-single-process.patch
  - cloud-init-needs-action.patch
    + Drop hidesensitivedata in 16 & greater
    + test: pytestify cc_chef tests, add migration test
    + chef: migrate files in old config directories for backups and cache
    + fix: correct the path for Chef's backups (#5994)
    + fix(Azure): don't reraise FileNotFoundError during ephemeral setup (#6113)
    + fix(azure): handle unexpected exceptions during obtain_lease() (#6092)
    [Ksenija Stanojevic]
    + Allow to set mac_address for VLAN subinterface (#6081)
    [jumpojoy] (GH: 5364)
    + fix: Remove erroneous EC2 reference from 503 warning (#6077)
    + fix: NM reload and bring up individual network conns (#6073) [Ani Sinha]
    + fix: stop warning on dual-stack request failure (#6044)
    + fix: install_method: pip cannot find ansible-pull command path (#6021)
    [Hasan Aliyev] (GH: 5720)
    + fix: Fix DataSourceAliYun exception_cb signature (#6068) (GH: 6066)
    + fix: Update OauthUrlHelper to use readurl exception_cb signature
    (GH: 6065)
    + test: add OauthUrlHelper tests
    + test: Remove CiTestCase from test_url_helper.py
    + test: pytestify test_url_helper.py
    + fix: track more removed modules (#6043)
  - From 25.1
    + ci: fix post-merge packaging CI (#6038)
    + feat(azure): Fix imds-based ssh_pwauth (#6002) [Ksenija Stanojevic]
    + ci: check for sorted patches (#6036)
    + feat: aliyun datasource support crawl metadata at once (#5942)
    [jinkangkang]
    + docs: document /usr merge breaking change (#6032)
    + test: Add integration test for /var mounts (#6033)
    + test: Ensure pre-24.2 custom modules work (#6034)
    + doc: Update references to older keys (#6022) [Pedro Ribeiro]
    + fix: untyped-defs in tests/unittests/{config, net, sources} (#6023)
    [Romain]
    + fix: don't reference PR in post-merged CI (#6019)
    + chore: explicitly skip broken ansible integration tests (#5996) [a-dubs]
    + tests(oracle): fix test_install_missing_deps apt race condition (#5996)
    [a-dubs]
    + test(oracle): fix test_ubuntu_drivers_installed (#5996) [a-dubs]
    + test(oracle): fix test_frequency_override integration test (#5996)
    [a-dubs]
    + chore: add type hint to IntegrationCloud's cloud_instance field (#5996)
    [a-dubs]
    + test(oracle): fix modules/test_lxd.py::test_storage_lvm on noble (#5996)
    [a-dubs]
    + commit 9e591fff266be9d4c83f74ec02a717b74993304d [a-dubs]
    + net/sysconfig: do not remove all existing settings of
    /etc/sysconfig/network (#5991) [Ani Sinha] (GH: 5990)
    + fix: remove wrong return when checking if network necessary (#6013)
    + fix: typing for rsyslog, ubuntu_pro, power_state_change (#5985)
    [MostafaTarek124eru]
    + fix: Retry on OpenStack HTTP status codes (#5943) [weiyang] (GH: 5687)
    + fix: Ensure fqdn is treated as string in get_hostname_fqdn (#5993)
    [MKhatibzadeh] (GH: 5989)
    + feat(vmware): Convert imc network config to v2 (#5937) [PengpengSun]
    + ci: add upstream post-merge test
    + ci: check if upstream commit causes ubuntu patch conflicts
    + ci: organize cla tests together
    + test: eliminate obsolete cases, add non-error case
    + chore: remove redundant manual schema validation
    + doc: clarify subiquity docs
    + chore: cleanup `len' usage (#5956) [Shreenidhi Shedi]
    + Fix: GCE _get_data crashes if DHCP lease fails (#5998) [Bryan Fraschetti]
    + Fixes GH-5997
    + fix: correct the path for Chef's cache (#5994)
    [MostafaTarek124eru] (GH: 5090)
    + fix: Run ansible with run_user instead of root for distro install_method
    (#5986) [Amirhossein Shaerpour] (GH: 4092)
    + fix: retry AWS hotplug for async IMDS (#5995) (GH: 5373)
    + feat(integration_tests): add optional INSTANCE_TYPE setting (#5988)
    [Alec Warren]
    + feat(integration-tests): set boto3 and botocore to INFO to prevent
    log spamming [a-dubs]
    + ci: add 'tox -e integration-tests-fast' command [a-dubs]
    + chore: Add feature flag for manual network waiting (#5977)
    + Release 24.4.1
    + fix: Use /usr/lib/ rather than /lib in packaging code (#5970)
    + Use log_with_downgradable_level for user password warnings (#5927)
    [Ani Sinha]
    + doc: change to hyphenated keys (#5909) (GH: 5555)
    + fix: Wait for udev on openstack (#5947) [Robert Schweikert] (GH: 4125)
    + test: disambiguate resource cleanup from test failure (#5926)
    + fix: use program name of netcat as installed by upstream, "nc" (#5933)
    (#5933) [Andreas K. Hüttel]
    + ci: bump canonical/setup-lxd to version v0.1.2 (#5948)
    + feat(cc_chef): Allow change of Chef configuration file (#5925)
    [Sean Smith]
    + docs: fix typo in generated file in LXD tutorial (#5941) [Pavel Shpak]
    + feat: Identify Samsung Cloud Platform as OpenStack (#5924) [us0310306]
    + fix: don't deadlock when starting network service with systemctl (#5935)
    + feat: Custom keys for apt archives (#5828) [Bryan Fraschetti] (GH: 5473)
    + test: improve test initialization error path (#5920)
    + chore: improve logging when lxd detection fails (#5919)
    + fix: Add "manual" to allowed subnet types  (#5875)
    [Math Marchand] (GH: 5769)
    + fix: remove bad ssh_svcname setting for Gentoo/OpenRC (#5918)
    [Andreas K. Hüttel]
    + feat(gentoo): Add compatibility for Gentoo with systemd (#5918)
    [Andreas K. Hüttel]
    + fix(ovf): no warning should be log when rpctool found no value (#5915)
    [PengpengSun] (GH: 5914)
    + Move DS VMware to be in front of DS OVF (#5912) [PengpengSun] (GH: 4030)
    + ci: Add proper 'Breaks: ' to integration testing simple deb (#5923)
    + chore: Add akhuettel to CLA signers file (#5917) [Andreas K. Hüttel]
    + chore: eliminate calls at import time (#5889) (GH: 5344)
    + test: Add pyserial to test-requirements.txt (#5907)
    + test: Allow unknown size in growpart test (#5876)
    + doc: Update tutorials [Sally]
    + fix: bump azure key size to 3072 (#5841)
    24.4.1
    + fix: Ensure _should_wait_via_user_data() handles all user data types (#5976)
    + fix: Don't log error in wait_for_url (#5972)
    + feat(url_helper): Retry on 503 error (#5938)
    + fix: Don't break modules that use get_meta_doc() (#5953)
    + refactor: Pass deprecation log args as tuple (#5953)
    + fix: uninstall custom signal handlers before shutdown (#5913)
    24.4
    + test: Ensure unit ordering in ftp tests includes downstream units (#5892)
    + test: re-decrement expected webhook events (#5894)
    + test: allow relative path in apt-get test (#5891)
    + Fix metric setting of nmconnection for rhel (#5878) [Amy Chen]
    + chore: remove unused code(#5887)
    + feat(ephemeral): replace old has_url_connectivity() with new
    _check_connectivity_to_imds() [a-dubs]
    + feat(oracle): add true single stack ipv6 support [a-dubs]
    + feat(ephemeral): refactor ephemeralIP and add ipv6 connectivity check
    [a-dubs]
    + test: Decrement expected webhook events (#5888)
    + chore: remove `--docs` option from `cloud-init schema` (#5857) (GH: 5756)
    + test: pytestify "tests/unittests/config/test_cc_timezone.py" (#5885)
    [Mahesh Ghumare]
    + ci: bump integration tests to use plucky
    + test: add grub_dpkg to inactive modules
    + test: move default behavior tests into their own module
    + test(apt): add plucky version for hello pkg (#5883)
    + Docs: improved mermaid diagram for better visibility. Add "MaheshG11"
    as contributor (#5874) [Mahesh Ghumare] (GH: 5837)
    + fix(ntp): Fix RockyLinux OS support  (#5864) [Sid Shukla]
    + chore(jsonschema): migrate from deprecated Validator.iter_errors (#5856)
    + chore: remove deprecation warning getting jsonschema's version (#5856)
    + chore: use filter arg for tar.extractall (#5856)
    + chore: remove __init__ from pytest test class (#5856)
    + chore: do not test element's truth value directly (#5856)
    + chore: migrate from deprecated datetime.datetime.utcfromtimestamp (#5856)
    + chore: migrate from deprecated datetime.datetime.utcnow() (#5856)
    + chore: set recursive=False for ensure_dir if parent path is "/" (#5816)
    [sxt1001]
    + ci: fix broken daily dependencies (#5867)
    + ci: fix packaging tests (#5865)
    + feat(vultr): add override for network interface detection (#5847)
    [Andrew Davis]
    + feat(networkd): Support RequiredForOnline option (#5852) [Dan McGregor]
    + Prevent NM from handling DNS when network interfaces have DNS config
    (#5846) [Ani Sinha]
    + fix(smartos): Add `addrconf` IPv6 support (#5831)
    [blackhelicoptersdotnet]
    + freebsd: adjust to match the new pyyaml package name (#5844)
    [Gonéri Le Bouder]
    + fix: disable grub-dpkg by default (#5840)
    + fix(openbsd): Enable sysv init scripts in OpenBSD build script (#5790)
    [Hyacinthe Cartiaux] (LP: 4036, #1992853)
    + test: Fix duplicate judgment conditions in password generation (#5835)
    [sxt1001]
    + chore: don't render non-templated unit files (#5830)
    + chore: simplify and standardize cloud-final.service (#5830)
    + chore: simplify Conflicts=shutdown.target (#5830)
    + chore: remove redundant Before=NetworkManager.service (#5830)
    + chore: remove unnecessary systemd settings (#5830)
    + chore: eliminate redundant ordering dependencies (#5819)
    + fix: fix ordering cycle for distros with default deps (#5819) (GH: 5755)
    + test: unbreak pytest-xdist (#5829)
    + feat: Conditionally remove networkd online dependency on Ubuntu (#5772)
    + feat: Ensure random passwords contain multiple character types (#5815)
    [sxt1001] (GH: 5814)
    + docs: split example page into example library (#5645) [Sally]
    + doc: clarify workarounds required for single process changes (#5817)
    + chore: add 3.13 to PR CI runs, 3.14 to scheduled (#5825)
    + fix: Render v2 bridges correctly on network-manager with set-name
    (#5740) (GH: 5717)
    + test: add no_thinpool unit test (#5802)
    + chore: split lxd init config into separate function (#5802)
    + test: pytestify test_cc_lxd.py (#5802)
    + fix: Correctly handle missing thinpool in cc_lxd (#5802)
    + fix: Render bridges correctly for v2 on sysconfig with set-name (#5674)
    (GH: 5574)
    + tests(minimal): rsyslog not in minimal images expect warning (#5811)
    + tests(lxd): avoid failure on multiple calls to --show-log (#5811)
    + chore: update netplan import semantics and related tests (#5805)
    (GH: 5804)
    + lint: fix untyped-defs on /tests/unittest/cmd (#5800) [iru]
    + test: actually use devel release and verify_clean_boot enhancements
    (#5801)
    + feat(locale): locales install on minimal images when cfg requests (#5799)
    + feat(byobu): support byobu install on minimal images when cfg requests
    (#5799)
    + chore: Use devel release and no sbuild in integration CI (#5798)
    + test: Update integration tests from netplan backport (#5796)
    + test: add get_syslog_or_console for minimal images without syslog (#5793)
    + chore: Remove resize_root_tmp from cloud.cfg.tmpl (#5795) (GH: 5786)
    + docs: Fix field name from `contents` to `content` (#5787) [Igor Akkerman]
    + chore: bump pycloudlib to required version (#5792)
    + fix: avoid deprecation logs for calling cli stages (#5770) (GH: 5726)
    + tests: bump pycloudlib deps to include gce bug fix for id str (#5783)
    + fix(test): convert use p.gce.instance.id instead of instance_id (#5783)
    + fix(network-manager): bond properties and network schema (#5768)
    [Denis Kadyshev]
    + Fix metric setting for ifcfg network connections for rhel (#5777)
    [Ani Sinha] (GH: 5776)
    + fix(akamai): handle non-string user data in base64 decoding (#5751)
    [Jesse Alter]
    + fix(ci): do not auto stale issues (#5775)
    + Make pytest more verbose for easier debugging (#5778) [Ani Sinha]
    + ci: fix tox.ini pytest cmd to use cloudinit dir for coverage reporting
    (#5774) [Alec Warren]
    + tests: add OS_IMAGE_TYPE setting to allow for minimal tests (#5682)
    + test(hotplug): Simplify test_multi_nic_hotplug (#5763)
    + test(hotplug): increase nc timeout (#5763)
    + test: pytestify test_main.py (#5758)
    + test(ec2-dual-stack): fix int-test (#5762)
    + test: make verify_clean_boot really respect return code (#5761)
    + test: bump timeout in test_order (#5759)
    + docs: Properly document the cc_ubuntu_autoinstall module (#5757)
    + docs: fix WSL tutorial (#5752) (GH: 5746)
    + test: make verify_clean_boot respect return code by environment (#5754)
    + feat(integration_test): add CLOUD_INIT_PKG setting (#5739)
    + fix(ci): fix packaging check merge operation (#5750)
    + doc: do not document user.meta-data key (#5745)
    + test: avoid undocumented lxd key (#5748)
    + test: Refactor test_cc_set_hostname.py and test_cc_ntp.py (#5727)
    + chore: update docs URLs to cloud-init.io (#5741)
    + test: fix timer logging change expected logs (#5734)
    + fix: type annotations for several modules (#5733)
    + chore: add timer to io and string manipulation code
    + feat: add log package and performance module
    + remove newline injected for cloud-init status --wait (#5700)
    [Andrew Nelson] (GH: 5863)
    + test: webhook require_deprecation msg on 24.3 (#5731)
    + test: fix test_nocloud message typo introduced by 313390f8 (#5731)
    + test: Fix test_log_message_on_missing_version_file (#5730)
    + tests: assert info level warnings instead of require_deprecation
    + tests: fix test to ignore_warnings not require Used fallback ds
    + chore: clean up pytest warnings (#5721)
    + tests(pro): bump pycloudlib add noble release to pro tests (#5719)
    + fix(hotplugd.socket): remove basic.target as dependency (#5722)
    (LP: #2081124)
    + ci: fix integration test positional argument (#5718)
    + Create datasource for CloudCIX (#1351) [BrianKelleher]
    + ci: colorize output (#5716)
    + fix(schema): Allow for locale: false in schema add tests (#5647)
    + ci: fix packaging patch check (#5713)
    + chore: clean up old pickle workaround (#5714)
    + fix: force sftp cleanup when done with instance (#5698)
    + test(hotplug): reenable vpc test in focal (#5492)
    + chore: fix typing of userdata_raw (#5710)
    + fix(NetworkManager): Fix network activator (#5620)
    + fix: lxd do not check for thinpool kernel module (#5709)
    + docs: fix typo in docstring (#5708)
    + Scaleway: Force on-link: true for static networks (#5654)
    [Louis Bouchard] (LP: 5523, #2073869)
    + fix: Invalid "seedfrom" in NoCloud system configuration (#5701)
    + tests: pytestify test_nocloud.py (#5701)
    + test: make verify_clean_boot respect return code by series (#5695)
    + fix: use cross-distro netcat name (#5696)
    + ci: fix labeler (#5697)
    + chore(actions): add packaging label for any branches modifying debian/*
    + (#5693)
    + test: add verify_clean_boot() calls alongside verify_clean_log() (#5671)
    + test: add deprecation support to verify_clean_boot (#5671)
    + doc: remove misleading warning (#5681)
    + chore: Prefer other methods over $INSTANCE_ID (#5661)
    + ci: fix packaging test when no patches (#5680)
    + chore: fix tip-ruff and update to latest version (#5676)
    + chore: make ansible test serial (#5677)
    + feat(ec2): Bump url_max_timeout to 240s from 120s. (#5565)
    [Robert Nickel]
    + chore: fix typo in requirements.txt (#5637)
    + feat: make pyserial an optional dependency (#5637)
    + chore: bump ci dependency versions (#5660)
    + chore: drop broken optimization (#5666)
    24.3.1
    + test: add test coverage for iproute2 commands (#5651)
    + fix(netops): fix ip addr flush command (#5651) (GH: 5648)
    24.3
    + docs: Clarify v2 set-name behavior (#5639)
    + fix: properly handle blank lines in fstab (#5643)
    + fix: cc_user_groups incorrectly assumes "useradd" never locks password
    field (#5355) [dermotbradley]
    + tests: assert cloud-init user-data cert is the only root cert (#5641)
    + feat: add automation for ubuntu/* branches asserting quilt patches apply
    (#5622)
    + fix(sources/wsl): no error with empty .cloud-init dir (SC-1862) (#5633)
    + feat(azure): add PPS support for azure-proxy-agent (#5601)
    [Ksenija Stanojevic]
    + fix(tests): use instance.clean/restart instead of clean --reboot (#5636)
    + test: fix cmd/test_schema int test (#5629)
    + test: fix test_honor_cloud_dir int test (#5627)
    + docs: alphabetize dsname lookup table. update comment to create the csv
    (#5624)
    + docs: new datasources should update reference/ds_dsname_map (#5624)
    + test: fix ca_certs int test (#5626)
    + chore: update schema docs to use RST bold for config key names (#5562)
    + fix(doc): italics around deprecation prefix, description bolds key names
    (#5562)
    + feat(doc): add env vars to debug config module doc builds (#5562)
    + fix(doc): doc of nested objects under JSON schema items.oneOf (#5562)
    + fix(doc): object type check if patternProperties or properties (#5562)
    + doc(schema): schema descriptions should end with trailing stop (#5562)
    + fix(wsl): Properly assemble multipart data (#5538) [Carlos Nihelton]
    + feat: collect-logs improvements (#5619)
    + tests: fix test_ca_certs.py for gcp (#5621)
    + fix(nm): Ensure bond property name formatting matches schema definition
    (#5383) [Curt Moore]
    + Update behavior of base bond interface with NetworkManager (#5385)
    [Curt Moore]
    + ci: Drop Python 3.6 and 3.7 (#5607)
    + chore(black): Bump version (#5607)
    + chore(mypy): Fix failures on newer versions of mypy (#5607)
    + chore(tox.ini): Simplify configuration, fix minor bugs (#5607)
    + chore(mypy): Lint log module (#5607)
    + fix(systemd): Correct location of installed drop-in files(#5615)
    [Noah Meyerhans]
    + fix(btrfs): Version parsing (#5618)
    + docs: Remove unnecessary section, add feature flag page (#5617)
    + docs: Drop Python 3.6 and 3.7 support (#5617)
    + chore: explain other use of oauth (#5616)
    + chore(actions): add doc label for any doc related subdir file matches
    (#5602)
    + doc: Add misc links, improve wording (#5595)
    + doc(boot): Make first boot a dedicated page (#5595)
    + doc: Describe all stages in a single process (#5595)
    + chore: Deprecate old commands in help output (#5595)
    + chore: add comment explaining the NetworkManager may-fail setting
    (#5598) [Ani Sinha]
    + Revert "fix(vmware): Set IPv6 to dhcp when there is no IPv6 addr
    (#5471)" (#5596) [PengpengSun]
    + fix: read_optional_seed to set network-config when present (#5593)
    + feat(snap): avoid refresh on package_upgrade: true and refresh.hold
    (#5426)
    + fix: Fix tests which have outdated strings (#5585)
    + fix: Fix ftp failures (#5585)
    + doc: improve integration testing configuration instructions (#5556)
    [Alec Warren]
    + azure: check azure-proxy-agent status (#5138) [Ksenija Stanojevic]
    + refactor: refactor and fix mypy in DataSourceIBMCloud.py (#5509)
    [Alec Warren]
    + fix: Update default LXD meta-data with user meta-data (#5584)
    + chore: Fix log message in url_helper.py (#5583)
    + fix: nocloud no fail when network-config absent (#5580)
    + feat: Single process optimization (#5489)
    + chore: Add helper, refactor utilities into separate module (#5573)
    + refactor: update handle function of cc_mounts (#5498)
    + fix: Integration tests (#5576)
    + fix(NoCloudNet): Add network-config support (#5566)
    + feat: Eliminate redundant configuration reads (#5536)
    + fix(actions): correct typo in cloudinit/config/schemas/ match (#5570)
    + fix: add host template for AOSC (#5557) [Yuanhang Sun]
    + chore(debian): Remove vestigial postinst and preinst code (#5569)
    + fix(actions): doc labeler needs all clause instead of default any (#5568)
    + docs: Overhaul user data formats documentation (#5551)
    + chore: Deprecate ENI as an input configuration format (#5561)
    + doc: improve drop-in custom modules (#5548)
    + doc(NoCloud): Categorize the different configuration types (#5521)
    + doc(autoinstall): Remove incorrect statements, be more direct (#5545)
    + chore: remove unneeded doc-lint tox env config (#5547)
    + fix(doc-spelling): config spelling_word_list_filename (#5547)
    + doc(modules): add section to wrap modules' doc (#5550)
    + doc: Update docs on boothooks (#5546)
    + fix: doc auto label to consider schema json changes as doc PRs (#5543)
    + feat(schema): add chef_license schema enum (#5543)
    + doc: add diagram with boot stages (#5539)
    + docs: improve qemu command line (#5540) [Christian Ehrhardt]
    + fix: auto label doc PRs (#5542)
    + fix(wsl): Put back the "path" argument to wsl_path in ds-identify
    + (#5537) [Carlos Nihelton]
    + test: fix test_kernel_command_line_match (#5529)
    + test: fix no ds cache tests (#5529)
    + fix(azurelinux): Change default usr_lib_exec path (#5526) [Minghe Ren]
    + feat: Support URI sources in `write_files` module (#5505)
    [Lucas Ritzdorf]
    + add openeuler to distros in cc_spacewalk.py (#5530) [sxt1001]
    + feat(wsl): Special handling Landscape client config tags (#5460)
    [Carlos Nihelton]
    + chore: Deprecate partially supported system config (#5515)
    + chore: Improve detection logging for user clarity (#5515)
    + fix(ds-identify): Detect nocloud when seedfrom url exists (#5515)
    + refactor: logs.py add typing and small misc refactors (#5414)
    + refactor: logs.py pathlib changes (#5414)
    + refactor: replace verbosity with log levels in logs.py (#5414)
    + feat: Add trace-level logger (#5414)
    + chore(formatting): fix squashed commit test formatting (#5524)
    + fix: Clean cache if no datasource fallback (#5499)
    + Support setting mirrorlist in yum repository config (#5522) [Ani Sinha]
    + doc(OFV): Document how to configure cloud-init (#5519)
    + fix: Update DNS behavior for NetworkManager interfaces (#5496)
    [Curt Moore]
    + Fix configuration of DNS servers via OpenStack (#5384) [Curt Moore]
    + test: Unconditionally skip test_multi_nic_hotplug_vpc (#5503)
    + tests: revert expectation of exit 2 from cloud-init init --local (#5504)
    + fix(test): Fix ip printer for non-lxd (#5488)
    + feat(systemd): convert warning level message to deprecation (#5209)
    + test: allow verify_clean_boot to ignore all or specific tracebacks
    (#5209)
    + test: Don't fail tests which call cloud-init as a command (#5209)
    + feat(systemd): Warn user of unexpected run mode (#5209)
    + fix: add schema rules for 'baseurl' and 'metalink' in yum repo config
    (#5501) [Ani Sinha]
    + Set MTU for bond parent interface (#5495) [Curt Moore]
    + refactor: util.mounts to handle errors (#5490)
    + refactor: util.get_proc_env to work with strs (#5490)
    + typing: fix check_untyped_defs in cloudinit.util (#5490)
    + test: Add missing assert to test_status.py (#5494)
    + test: Ensure mkcert executable in ftp tests (#5493)
    + test: pytestify and cleanup test_cc_mounts.py (#5459)
    + fix(vmware): Set IPv6 to dhcp when there is no IPv6 addr (#5471)
    [PengpengSun]
    + fix(openbsd): fix mtu on newline in hostname files (#5412) [Tobias Urdin]
    + feat(aosc): Add 'AOSC OS' support (#5310) [Yuanhang Sun]
    24.2
    + test: Fix no default user in test_status.py (#5478)
    + fix: correct deprecated_version=22.2 for users.sudo
    + test: Add jsonschema guard in test_cc_ubuntu_pro.py (#5479)
    + fix(test): Fix pycloudlib types in integration tests (#5350)
    + fix(test): Fix ip printing for non-lxd instances (#5350)
    + chore(mypy): Drop unused missing import exclusions (#5350)
    + type: Add stub types for network v1/v2 config (#5350)
    + chore: Auto-format network jsonschema in ci (#5350)
    + fix(tox): Update tox.ini (#5350)
    + chore(typing): Remove type ignores and casts (#5350)
    + refactor(typing): Remove unused code paths (#5350)
    + fix(typing): Add / update type annotations (#5350)
    + fix(typing): Remove type annotation for unused variable (#5350)
    + fix(typing): Remove invalid type annotations (#5350)
    + ci(mypy): Set default follow_imports value (#5350)
    + test: Update integration tests to pass on focal (#5476)
    + tests: update ubuntu_pro test to account for info-level deprecations
    (#5475)
    + tests: update nocloud deprecation test for boundary version (#5474)
    + fix(rh_subscription): add string type to org (#5453)
    + tests: integration tests aware of features.DEPRECATION_INFO_BOUNDARY
    + tests: update keyserver PPA key fur curtin-dev (#5472)
    + test: Fix deprecation test failures (#5466)
    + chore: fix schema.py formatting (#5465)
    + fix: dont double-log deprecated INFOs (#5465)
    + fix(test): Mock version boundary (#5464)
    + fix(schema): Don't report changed keys as deprecated (#5464)
    + test: fix unit test openstack vlan mac_address (#5367)
    + fix: Ensure properties for bonded interfaces are properly translated
    (#5367) [Curt Moore]
    + fix(schema): permit deprecated hyphenated keys under users key (#5456)
    + fix: Do not add the vlan_mac_address field into the VLAN object (#5365)
    [Curt Moore]
    + doc(refactor): Convert module docs to new system (#5427) [Sally]
    + test: Add unit tests for features.DEPRECATION_INFO_BOUNDARY (#5411)
    + feat: Add deprecation boundary support to schema validator (#5411)
    + feat: Add deprecation boundary to logger (#5411)
    + fix: Gracefully handle missing files (#5397) [Curt Moore]
    + test(openstack): Test bond mac address (#5369)
    + fix(openstack): Fix bond mac_address (#5369) [Curt Moore]
    + test: Add ds-identify integration test coverage (#5394)
    + chore(cmdline): Update comments (#5458)
    + fix: Add get_connection_with_tls_context() for requests 2.32.2+ (#5435)
    [eaglegai]
    + fix(net): klibc ipconfig PROTO compatibility (#5437)
    [Alexsander de Souza] (LP: #2065787)
    + Support metalink in yum repository config (#5444) [Ani Sinha]
    + tests: hard-code curtin-dev ppa instead of canonical-kernel-team (#5450)
    + ci: PR update checklist GH- anchors to align w/ later template (#5449)
    + test: update validate error message in test_networking (#5436)
    + ci: Add PR checklist (#5446)
    + chore: fix W0105 in t/u/s/h/test_netlink.py (#5409)
    + chore(pyproject.toml): migrate to booleans (#5409)
    + typing: add check_untyped_defs (#5409)
    + fix(openstack): Append interface / scope_id for IPv6 link-local metadata
    address (#5419) [Christian Rohmann]
    + test: Update validation error in test_cli.py test (#5430)
    + test: Update schema validation error in integration test (#5429)
    + test: bump pycloudlib to get azure oracular images (#5428)
    + fix(azure): fix discrepancy for monotonic() vs time() (#5420)
    [Chris Patterson]
    + fix(pytest): Fix broken pytest gdb flag (#5415)
    + fix: Use monotonic time (#5423)
    + docs: Remove mention of resolv.conf (#5424)
    + perf(netplan): Improve network v1 -> network v2 performance (#5391)
    + perf(set_passwords): Run module in Network stage (#5395)
    + fix(test): Remove temporary directory side effect (#5416)
    + Improve schema validator warning messages (#5404) [Ani Sinha]
    + feat(sysconfig): Add DNS from interface config to resolv.conf (#5401)
    [Ani Sinha]
    + typing: add no_implicit_optional lint (#5408)
    + doc: update examples to reflect alternative ways to provide `sudo`
    option (#5418) [Ani Sinha]
    + fix(jsonschema): Add missing sudo definition (#5418)
    + chore(doc): migrate cc modules i through r to templates (#5313)
    + chore(doc): migrate grub_dpkg to tmpl add changed/deprecation (#5313)
    + chore(json): migrate cc_apt_configure and json schema indents (#5313)
    + chore(doc): migrate ca_certs/chef to template, flatten schema (#5313)
    + chore(doc): migrate cc_byobu to templates (#5313)
    + chore(doc): migrate cc_bootcmd to templates (#5313)
    + fix(apt): Enable calling apt update multiple times (#5230)
    + chore(VMware): Modify section of instance-id in the customization config
    (#5356) [PengpengSun]
    + fix(treewide): Remove dead code (#5332) [Shreenidhi Shedi]
    + doc: network-config v2 ethernets are of type object (#5381) [Malte Poll]
    + Release 24.1.7 (#5375)
    + fix(azure): url_helper: specify User-Agent when using headers_cb with
    readurl() (#5298) [Ksenija Stanojevic]
    + fix: Stop attempting to resize ZFS in cc_growpart on Linux (#5370)
    + doc: update docs adding YAML 1.1 spec and jinja template references
    + fix(final_message): do not warn on datasourcenone when single ds
    + fix(growpart): correct growpart log message to include value of mode
    + feat(hotplug): disable hotplugd.socket (#5058)
    + feat(hotlug): trigger hotplug after cloud-init.service (#5058)
    + test: add function to push and enable systemd units (#5058)
    + test(util): fix wait_until_cloud_init exit code 2 (#5058)
    + test(hotplug): fix race getting ipv6 (#5271)
    + docs: Adjust CSS to increase font weight across the docs (#5363) [Sally]
    + fix(ec2): Correctly identify netplan renderer (#5361)
    + tests: fix expect logging from growpart on devent with partition (#5360)
    + test: Add v2 test coverage to test_net.py (#5247)
    + refactor: Simplify collect_logs() in logs.py (#5268)
    + fix: Ensure no subp from logs.py import (#5268)
    + tests: fix integration tests for ubuntu pro 32.3 release (#5351)
    + tests: add oracular's hello package for pkg upgrade test (#5354)
    + growpart: Fix behaviour for ZFS datasets (#5169) [Mina Galić]
    + device_part_info: do not recurse if we did not match anything (#5169)
    [Mina Galić]
    + feat(alpine): add support for Busybox adduser/addgroup (#5176)
    [dermotbradley]
    + ci: Move lint tip and py3-dev jobs to daily (#5347)
    + fix(netplan): treat netplan warnings on stderr as debug for cloud-init
    (#5348)
    + feat(disk_setup): Add support for nvme devices (#5263)
    + fix(log): Do not warn when doing requested operation (#5263)
    + Support sudoers in the "/usr/usr merge" location (#5161)
    [Robert Schweikert]
    + doc(nocloud): Document network-config file (#5204)
    + fix(netplan): Fix predictable interface rename issue (#5339)
    + cleanup: Don't execute code on import (#5295)
    + fix(net): Make duplicate route add succeed. (#5343)
    + fix(freebsd): correct configuration of IPv6 routes (#5291) [Théo Bertin]
    + fix(azure): disable use-dns for secondary nics (#5314)
    + chore: fix lint failure (#5320)
    + Update pylint version to support python 3.12 (#5338) [Ani Sinha]
    + fix(tests): use regex to avoid focal whitespace in jinja debug test
    (#5335)
    + chore: Add docstrings and types to Version class (#5262)
    + ci(mypy): add type-jinja2 stubs (#5337)
    + tests(alpine): github trust lxc mounted source dir cloud-init-ro (#5329)
    + test: Add oracular release to integration tests (#5328)
    + Release 24.1.6 (#5326)
    + test: Fix failing test_ec2.py test (#5324)
    + fix: Check renderer for netplan-specific code (#5321)
    + docs: Removal of top-level --file breaking change (#5308)
    + fix: typo correction of delaycompress (#5317)
    + docs: Renderers/Activators have downstream overrides (#5322)
    + fix(ec2): Ensure metadata exists before configuring PBR (#5287)
    + fix(lxd): Properly handle unicode from LXD socket (#5309)
    + docs: Prefer "artifact" over "artefact" (#5311) [Arthur Le Maitre]
    + chore(doc): migrate cc_byobu to templates
    + chore(doc): migrate cc_bootcmd to templates
    + chore(doc): migrate apt_pipelining and apk_configure to templates
    + tests: in_place mount module-docs into lxd vm/container
    + feat(docs): generate rtd module schema from rtd/module-docs
    + feat: Set RH ssh key permissions when no 'ssh_keys' group (#5296)
    [Ani Sinha]
    + test: Avoid circular import in Azure tests (#5280)
    + test: Fix test_failing_userdata_modules_exit_codes (#5279)
    + chore: Remove CPY check from ruff (#5281)
    + chore: Clean up docstrings
    + chore(ruff): Bump to version 0.4.3
    + feat(systemd): Improve AlmaLinux OS and CloudLinux OS support (#5265)
    [Elkhan Mammadli]
    + feat(ca_certs): Add AlmaLinux OS and CloudLinux OS support (#5264)
    [Elkhan Mammadli]
    + docs: cc_apt_pipelining docstring typo fix (#5273) [Alex Ratner]
    + feat(azure): add request identifier to IMDS requests (#5218)
    [Ksenija Stanojevic]
    + test: Fix TestFTP integration test (#5237) [d1r3ct0r]
    + feat(ifconfig): prepare for CIDR output (#5272) [Mina Galić]
    + fix: stop manually dropping dhcp6 key in integration test (#5267)
    [Alec Warren]
    + test: Remove some CiTestCase tests (#5256)
    + fix: Warn when signal is handled (#5186)
    + fix(snapd): ubuntu do not snap refresh when snap absent (LP: #2064300)
    + feat(landscape-client): handle already registered client (#4784)
    [Fabian Lichtenegger-Lukas]
    + doc: Show how to debug external services blocking cloud-init (#5255)
    + fix(pdb): Enable running cloud-init under pdb (#5217)
    + chore: Update systemd description (#5250)
    + fix(time): Harden cloud-init to system clock changes
    + fix: Update analyze timestamp uptime
    + fix(schema): no network validation on netplan systems without API
    + fix(mount): Don't run cloud-init.service if cloud-init disabled (#5226)
    + fix(ntp): Fix AlmaLinux OS and CloudLinux OS support (#5235)
    [Elkhan Mammadli]
    + tests: force version of cloud-init from PPA regardless of version (#5251)
    + ci: Print isort diff (#5242)
    + test: Fix integration test dependencies (#5248)
    + fix(ec2): Fix broken uuid match with other-endianness (#5236)
    + fix(schema): allow networkv2 schema without top-level key (#5239)
    [Cat Red]
    + fix(cmd): Do not hardcode reboot command (#5208)
    + test: Run Alpine tests without network (#5220)
    + docs: Add base config reference from explanation (#5241)
    + docs: Remove preview from WSL tutorial (#5225)
    + chore: Remove broken maas code (#5219)
    + feat(WSL): Add support for Ubuntu Pro configs (#5116) [Ash]
    + chore: sync ChangeLog and version.py from 24.1.x (#5228)
    + bug(package_update): avoid snap refresh in images without snap command
    (LP: #2064132)
    + ci: Skip package build on tox runs (#5210)
    + chore: Fix test skip message
    + test(ec2): adopt pycloudlib public ip creation while launching instances
    + test(ec2): add ipv6 testing for multi-nic instances
    + test(ec2): adopt pycloudlib enable_ipv6 while launching instances
    + feat: tool to print diff between netplan and networkv2 schema (#5200)
    [Cat Red]
    + test: mock internet access in test_upgrade (#5212)
    + ci: Add timezone for alpine unit tests (#5216)
    + fix: Ensure dump timestamps parsed as UTC (#5214)
    + docs: Add WSL tutorial (#5206)
    + feature(schema): add networkv2 schema (#4892) [Cat Red]
    + Add alpine unittests to ci (#5121)
    + test: Fix invalid openstack datasource name (#4905)
    + test: Fix MAAS test and mark xfail (#4905)
    + chore(ds-identify): Update shellcheck ignores (#4905)
    + fix(ds-identify): Prevent various false positives and false negatives
    (#4905)
    + Use grep for faster parsing of cloud config in ds-identify (#4905)
    [Scott Moser] (LP: #2030729)
    + tests: validate netplan API YAML instead of strict content (#5195)
    + chore(templates): update ubuntu universe wording (#5199)
    + Deprecate the users ssh-authorized-keys property (#5162)
    [Anders Björklund]
    + doc(nocloud): Describe ftp and ftp over tls implementation (#5193)
    + feat(net): provide network config to netplan.State for render (#4981)
    + docs: Add breaking datasource identification changes (#5171)
    + fix(openbsd): Update build-on-openbsd python dependencies (#5172)
    [Hyacinthe Cartiaux]
    + fix: Add subnet ipv4/ipv6  to network schema (#5191)
    + docs: Add deprecated system_info to schema (#5168)
    + docs: Add DataSourceNone documentation (#5165)
    + test: Skip test if console log is None (#5188)
    + fix(dhcp): Enable interactively running cloud-init init --local (#5166)
    + test: Update message for netplan apply dbus issue
    + test: install software-properties-common if absent during PPA setup
    + test: bump pycloudlib to use latest version
    + test: Update version of hello package installed on noble
    + test: universally ignore netplan apply dbus issue (#5178)
    + chore: Remove obsolete nose workaround
    + feat: Add support for FTP and FTP over TLS (#4834)
    + feat(opennebula): Add support for posix shell
    + test: Make analyze tests not depend on GNU date
    + test: Eliminate bash dependency from subp tests
    + docs: Add breaking changes section to reference docs (#5147) [Cat Red]
    + util: add log_level kwarg for logexc() (#5125) [Chris Patterson]
    + refactor: Make device info part of distro definition (#5067)
    + refactor: Distro-specific growpart code (#5067)
    + test(ec2): fix mocking with responses==0.9.0 (focal) (#5163)
    + chore(safeyaml): Remove unicode helper for Python2 (#5142)
    + Revert "test: fix upgrade dhcp6 on ec2 (#5131)" (#5148)
    + refactor(net): Reuse netops code
    + refactor(iproute2): Make expressions multi-line for legibility
    + feat(freebsd): support freebsd find part by gptid and ufsid (#5122)
    [jinkangkang]
    + feat: Determining route metric based on NIC name (#5070) [qidong.ld]
    + test: Enable profiling in integration tests (#5130)
    + dhcp: support configuring static routes for dhclient's unknown-121
    option (#5146) [Chris Patterson]
    + feat(azure): parse ProvisionGuestProxyAgent as bool (#5126)
    [Ksenija Stanojevic]
    + fix(url_helper): fix TCP connection leak on readurl() retries (#5144)
    [Chris Patterson]
    + test: pytest-ify t/u/sources/test_ec2.py
    + Revert "ec2: Do not enable dhcp6 on EC2 (#5104)" (#5145) [Major Hayden]
    + fix: Logging sensitive data
    + test: Mock ds-identify systemd path (#5119)
    + fix(dhcpcd): Make lease parsing more robust (#5129)
    + test: fix upgrade dhcp6 on ec2 (#5131)
    + net/dhcp: raise InvalidDHCPLeaseFileError on error parsing dhcpcd lease
    (#5128) [Chris Patterson]
    + fix: Fix runtime file locations for cloud-init (#4820)
    + ci: fix linkcheck.yml invalid yaml (#5123)
    + net/dhcp: bump dhcpcd timeout to 300s (#5127) [Chris Patterson]
    + ec2: Do not enable dhcp6 on EC2 (#5104) [Major Hayden]
    + fix: Fall back to cached local ds if no valid ds found (#4997)
    [PengpengSun]
    + ci: Make linkcheck a scheduled job (#5118)
    + net: Warn when interface rename fails
    + ephemeral(dhcpcd): Set dhcpcd interface down
    + Release 24.1.3
    + chore: Handle all level 1 TiCS security violations (#5103)
    + fix: Always use single datasource if specified (#5098)
    + fix(tests): Leaked mocks (#5097)
    + fix(rhel)!: Fix network boot order in upstream cloud-init
    + fix(rhel): Fix network ordering in sysconfig
    + feat: Use NetworkManager renderer by default in RHEL family
    + fix: Allow caret at the end of apt package (#5099)
    + test: Add missing mocks to prevent bleed through (#5082)
    [Robert Schweikert]
    + fix: Ensure network config in DataSourceOracle can be unpickled (#5073)
    + docs: set the home directory using homedir, not home (#5101)
    [Olivier Gayot] (LP: #2047796)
    + fix(cacerts): Correct configuration customizations for Photon (#5077)
    [Christopher McCann]
    + fix(test): Mock systemd fs path for non-systemd distros
    + fix(tests): Leaked subp.which mock
    + fix(networkd): add GatewayOnLink flag when necessary (#4996) [王煎饼]
    + Release 24.1.2
    + test: fix `disable_sysfs_net` mock (#5065)
    + refactor: don't import subp function directly (#5065)
    + test: Remove side effects from tests (#5074)
    + refactor: Import log module rather than functions (#5074)
    + fix: Fix breaking changes in package install (#5069)
    + fix: Undeprecate 'network' in schema route definition (#5072)
    + refactor(ec2): simplify convert_ec2_metadata_network_config
    + fix(ec2): fix ipv6 policy routing
    + fix: document and add 'accept-ra' to network schema (#5060)
    + bug(maas): register the correct DatasourceMAASLocal in init-local
    (#5068) (LP: #2057763)
    + ds-identify: Improve ds-identify testing flexibility (#5047)
    + fix(ansible): Add verify_commit and inventory to ansible.pull schema
    (#5032) [Fionn Fitzmaurice]
    + doc: Explain breaking change in status code (#5049)
    + gpg: Handle temp directory containing files (#5063)
    + distro(freebsd): add_user: respect homedir (#5061) [Mina Galić]
    + doc: Install required dependencies (#5054)
    + networkd: Always respect accept-ra if set (#4928) [Phil Sphicas]
    + chore: ignore all cloud-init_*.tar.gz in .gitignore (#5059)
    + test: Don't assume ordering of ThreadPoolExecutor submissions (#5052)
    + feat: Add new distro 'azurelinux' for Microsoft Azure Linux. (#4931)
    [Dan Streetman]
    + fix(gpg): Make gpg resilient to host configuration changes (#5026)
    + Sync 24.1.1 changelog and version
    + DS VMware: Fix ipv6 addr converter from netinfo to netifaces (#5029)
    [PengpengSun]
    + packages/debian: remove dependency on isc-dhcp-client (#5041)
    [Chris Patterson]
    + test: Allow fake_filesystem to work with TemporaryDirectory (#5035)
    + tests: Don't wait for GCE instance teardown (#5037)
    + fix: Include DataSourceCloudStack attribute in unpickle test (#5039)
    + bug(vmware): initialize new DataSourceVMware attributes at unpickle
    (#5021) (LP: #2056439)
    + fix(apt): Don't warn on apt 822 source format (#5028)
    + fix(atomic_helper.py): ensure presence of parent directories (#4938)
    [Shreenidhi Shedi]
    + fix: Add "broadcast" to network v1 schema (#5034) (LP: #2056460)
    + pro: honor but warn on custom ubuntu_advantage in /etc/cloud/cloud.cfg
    (#5030)
    + net/dhcp: handle timeouts for dhcpcd (#5022) [Chris Patterson]
    + fix: Make wait_for_url respect explicit arguments
    + test: Fix scaleway retry assumptions
    + fix: Make DataSourceOracle more resilient to early network issues
    (#5025) (LP: #2056194)
    + chore(cmd-modules): fix exit code when --mode init (#5017)
    + feat: pylint: enable W0201 - attribute-defined-outside-init
    + refactor: Ensure no attributes defined outside __init__
    + chore: disable attribute-defined-outside-init check in tests
    + refactor: Use _unpickle rather than hasattr() in sources
    + chore: remove unused vendordata "_pure" variables
    + chore(cmd-modules): deprecate --mode init (#5005)
    + tests: drop CiTestCase and convert to pytest
    + bug(tests): mock reads of host's /sys/class/net via get_sys_class_path
    + fix: log correct disabled path in ds-identify (#5016)
    + tests: ec2 dont spend > 1 second retrying 19 times when 3 times will do
    + tests: openstack mock expected ipv6 IMDS
    + bug(wait_for_url): when exceptions occur url is unset, use url_exc
    (LP: #2055077)
    + feat(run-container): Run from arbitrary commitish (#5015)
    + tests: Fix wsl test (#5008)
    + feat(ds-identify): Don't run unnecessary systemd-detect-virt (#4633)
    + chore(ephemeral): add debug log when bringing up ephemeral network
    (#5010) [Alec Warren]
    + release: sync changelog and version (#5011)
    + Cleanup test_net.py (#4840)
    + refactor: remove dependency on netifaces (#4634) [Cat Red]
    + feat: make lxc binary configurable (#5000)
    + docs: update 404 page for new doc site and bug link
    + test(aws): local network connectivity on multi-nics (#4982)
    + test: Make integration test output more useful (#4984)
    From 24.1.7
    + fix(ec2): Correctly identify netplan renderer (#5361)
    From 24.1.6
    + fix(ec2): Ensure metadata exists before configuring PBR (#5287)
    + fix: Check renderer for netplan-specific code (#5321)
    + test: Fix failing test_ec2.py test (#5324)
    From 24.1.5
    + fix(package_update): avoid snap refresh in images without snap command
    (LP: #2064132)
    From 24.1.4
    + fix(dhcpcd): Make lease parsing more robust (#5129)
    + net/dhcp: raise InvalidDHCPLeaseFileError on error parsing dhcpcd lease
    + (#5128) [Chris Patterson]
    + fix: Fix runtime file locations for cloud-init (#4820)
    + net/dhcp: bump dhcpcd timeout to 300s (#5127) [Chris Patterson]
    + net: Warn when interface rename fails
    + ephemeral(dhcpcd): Set dhcpcd interface down
    + test: Remove side effects from tests (#5074)
    + refactor: Import log module rather than functions (#5074)
    From 24.1.3
    + fix: Always use single datasource if specified (#5098)
    + fix: Allow caret at the end of apt package (#5099)
    From 24.1.2
    + test: Don't assume ordering of ThreadPoolExecutor submissions (#5052)
    + refactor(ec2): simplify convert_ec2_metadata_network_config
    + tests: drop CiTestCase and convert to pytest
    + bug(tests): mock reads of host's /sys/class/net via get_sys_class_path
    + fix: Fix breaking changes in package install (#5069)
    + fix: Undeprecate 'network' in schema route definition (#5072)
    + fix(ec2): fix ipv6 policy routing
    + fix: document and add 'accept-ra' to network schema (#5060)
    + bug(maas): register the correct DatasourceMAASLocal in init-local
    (#5068) (LP: #2057763)
    From 24.1.1
    + fix: Include DataSourceCloudStack attribute in unpickle test (#5039)
    + bug(vmware): initialize new DataSourceVMware attributes at unpickle (#5021)
    + fix(apt): Don't warn on apt 822 source format (#5028)
    + fix: Add "broadcast" to network v1 schema (#5034)
    + pro: honor but warn on custom ubuntu_advantage in /etc/cloud/cloud.cfg
    (#5030)
    + net/dhcp: handle timeouts for dhcpcd (#5022)
    + fix: Make wait_for_url respect explicit arguments
    + bug(wait_for_url): when exceptions occur url is unset, use url_exc
    + test: Fix scaleway retry assumptions
    + fix: Make DataSourceOracle more resilient to early network issues (#5025)
    + tests: Fix wsl test (#5008)
    From 24.1
    + fix: Don't warn on vendor directory (#4986)
    + apt: kill spawned keyboxd after gpg cmd interaction
    + tests: upgrade tests should only validate current boot log
    + net/dhcp: fix maybe_perform_dhcp_discovery check for interface=None
    [Chris Patterson]
    + doc(network-v2): fix section nesting levels
    + fix(tests): don't check for clean log on minimal image (#4965) [Cat Red]
    + fix(cc_resize): Don't warn if zpool command not found (#4969)
    (LP: #2055219)
    + feat(subp): Make invalid command warning more user-friendly (#4972)
    + docs: Remove statement about device path matching (#4966)
    + test: Fix xfail to check the dhcp client name (#4971)
    + tests: avoid console prompts when removing gpg on Noble
    + test: fix test_get_status_systemd_failure
    + fix: Remove hardcoded /var/lib/cloud hotplug path (#4940)
    + refactor: Refactor status.py (#4864)
    + test: Use correct lxd network-config keys (#4950)
    + test: limit temp dhcp6 changes to < NOBLE (#4942)
    + test: allow downgrades when install debs (#4941)
    + tests: on noble, expect default /etc/apt/sources.list
    + tests: lxd_vm early boot status test ordered After=systemd-remount-fs
    (#4936)
    + tests: pro integration tests supply ubuntu_advantage until pro v32
    (#4935)
    + feat(hotplug): add cmd to enable hotplug (#4821)
    + test: fix test_combined_cloud_config_json (#4925)
    + test: xfail udhcpc on azure (#4924)
    + feat: Implement the WSL datasource (#4786) [Carlos Nihelton]
    + refactor(openrc):  Improve the OpenRC files (#4916) [dermotbradley]
    + tests: use apt install instead of dpkg -i to install pkg deps
    + tests: inactive module rename ubuntu_advantage to ubuntu_pro
    + test: fix tmpdir in test_cc_apk_configure (#4914)
    + test: fix jsonschema version checking in pro test (#4915)
    + feat(dhcp): Make dhcpcd the default dhcp client (#4912)
    + feat(Alpine) cc_growpart.py: fix handling of /dev/mapper devices (#4876)
    [dermotbradley]
    + test: Retry longer in test_status.py integration test (#4910)
    + test: fix kernel override test (#4913)
    + chore: Rename sysvinit/gentoo directory to sysvinit/openrc (#4906)
    [dermotbradley]
    + doc: update ubuntu_advantage references to pro
    + chore: rename cc_ubuntu_advantage to cc_ubuntu_pro (SC-1555)
    + feat(ubuntu pro): deprecate ubuntu_pro key in favor of ubuntu_advantage
    + feat(schema): support ubuntu_pro key and deprecate ubuntu_advantage
    + test: fix verify_clean_log (#4903)
    + test: limit test_no_hotplug_triggered_by_docker to stable releases
    + tests: generalize warning Open vSwitch warning from netplan apply (#4894)
    + fix(hotplug): remove literal quotes in args
    + feat(apt): skip known /etc/apt/sources.list content
    + feat(apt): use APT deb822 source format by default
    + test(ubuntu-pro): change livepatch to esm-infra
    + doc(ec2): fix metadata urls (#4880)
    + fix: unpin jsonschema and update tests (#4882)
    + distro: add eject FreeBSD code path (#4838) [Mina Galić]
    + feat(ec2): add hotplug as a default network update event (#4799)
    + feat(ec2): support instances with repeated device-number (#4799)
    + feat(cc_install_hotplug): trigger hook on known ec2 drivers (#4799)
    + feat(ec2): support multi NIC/IP setups (#4799)
    + feat(hotplug): hook-hotplug is now POSIX shell add OpenRC init script
    [dermotbradley]
    + test: harden test_dhcp.py::test_noble_and_newer_force_client
    + test: fix test_combined_cloud_config_json (#4868)
    + feat(apport): Disable hook when disabled (#4874)
    + chore: Add pyright ignore comments (#4874)
    + bug(apport): Fix invalid typing (#4874)
    + refactor: Move general apport hook to main branch (#4874)
    + feat(bootspeed)!: cloud-config.service drop After=snapd.seeded
    + chore: update CI package build to oldest supported Ubuntu release focal
    (#4871)
    + test: fix test_cli.test_valid_userdata
    + feat: handle error when log file is empty (#4859) [Hasan]
    + test: fix test_ec2_ipv6
    + fix: Address TIOBE abstract interpretation issues (#4866)
    + feat(dhcp): Make udhcpc use same client id (#4830)
    + feat(dhcp): Support InfiniBand with dhcpcd (#4830)
    + feat(azure): Add ProvisionGuestProxyAgent OVF setting (#4860)
    [Ksenija Stanojevic]
    + test: Bring back dhcp6 integration test changes (#4855)
    + tests: add status --wait blocking test from early boot
    + tests: fix retry decorator to return the func value
    + docs: add create_hostname_file to all hostname user-data examples
    (#4727) [Cat Red]
    + fix: Fix typos (#4850) [Viktor Szépe]
    + feat(dhcpcd): Read dhcp option 245 for azure wireserver (#4835)
    + tests(dhcp): Add udhcpc client to test matrix (#4839)
    + fix: Add types to network v1 schema (#4841)
    + docs(vmware): fixed indentation on example userdata yaml (#4854)
    [Alec Warren]
    + tests: Remove invalid keyword from method call
    + fix: Handle systemctl when dbus not ready (#4842) (LP: #2046483)
    + fix(schema cli): avoid netplan validation on net-config version 1
    + tests: reduce expected reports due to dropped rightscale module
    + tests(net-config): add awareness of netplan on stable Ubuntu
    [Gilbert Gilb's]
    + feat: fall back to cdrom_id eject if eject is not available (#4769)
    [Cat Red]
    + fix(packages/bddeb): restrict debhelper-compat to 12 in focal (#4831)
    + tests: Add kernel commandline test (#4833)
    + fix: Ensure NetworkManager renderer works without gateway (#4829)
    + test: Correct log parsing in schema test (#4832)
    + refactor: Remove cc_rightscale_userdata (#4813)
    + refactor: Replace load_file with load_binary_file to simplify typing
    (#4823)
    + refactor: Add load_text_file function to simplify typing (#4823)
    + refactor: Change variable name for consistent typing (#4823)
    + feat(dhcp): Add support for dhcpcd (#4746)
    + refactor: Remove unused networking code (#4810)
    + test: Add more DNS net tests
    + BREAKING CHANGE: Stop adding network v2 DNS to global DNS
    + doc: update DataSource.default_update_events doc (#4815)
    + chore: do not modify instance attribute (#4815)
    + test: fix mocking leaks (#4815)
    + Revert "ci: Pin pytest<8.0.0. (#4816)" (#4815)
    + test: Update tests for passlib (#4818)
    + fix(net-schema): no warn when skipping schema check on non-netplan
    + feat(SUSE): reboot marker file is written as /run/reboot-needed (#4788)
    [Robert Schweikert]
    + test: Cleanup unwanted logger setup calls (#4817)
    + refactor(cloudinit.util): Modernize error handling, add better warnings
    (#4812)
    + ci: Pin pytest<8.0.0. (#4816)
    + fix(tests): fixing KeyError on integrations tests (#4811) [Cat Red]
    + tests: integration for network schema on netplan systems (#4767)
    + feat(schema): use netplan API to validate network-config (#4767)
    + chore: define CLOUDINIT_NETPLAN_FILE static var (#4767)
    + fix: cli schema config-file option report network-config type (#4767)
    + refactor(azure): replace BrokenAzureDataSource with reportable errors
    (#4807) [Chris Patterson]
    + Fix Alpine and Mariner /etc/hosts templates (#4780) [dermotbradley]
    + tests: revert #4792 as noble images no longer return 2 (#4809) [Cat Red]
    + tests: use client fixture instead of class_client in cleantest (#4806)
    + tests: enable ds-idenitfy xfail test LXD-kvm-not-MAAS-1 (#4808)
    + fix(tests): failing integration tests due to missing ua token (#4802)
    [Cat Red]
    + Revert "Use grep for faster parsing of cloud config in ds-identify
    (#4327)"
    + tests: Demonstrate ds-identify yaml parsing broken
    + tests: add exit 2 on noble from cloud-init status (#4792)
    + fix: linkcheck for ci to ignore scaleway anchor URL (#4793)
    + feat: Update cacerts to support VMware Photon (#4763)
    [Christopher McCann]
    + fix: netplan rendering integrations tests (#4795) [Cat Red]
    + azure: remove cloud-init.log reporting via KVP (#4715) [Chris Patterson]
    + feat(Alpine): Modify ds-identify for Alpine support and add OpenRC
    init.d script (#4785) [dermotbradley]
    + doc: Add DatasourceScaleway documentation (#4773) [Louis Bouchard]
    + fix: packaged logrotate file lacks suffix on ubuntu (#4790)
    + feat(logrotate): config flexibility more backups (#4790)
    + fix(clean): stop warning when running clean command (#4761) [d1r3ct0r]
    + feat: network schema v1 strict on nic name length 15 (#4774)
    + logrotate config (#4721) [Fabian Lichtenegger-Lukas]
    + test: Enable coverage in integration tests (#4682)
    + test: Move unit test helpers to global test helpers (#4682)
    + test: Remove snapshot option from install_new_cloud_init (#4682)
    + docs: fix cloud-init single param docs (#4682)
    + Alpine: fix location of dhclient leases file (#4782) [dermotbradley]
    + test(jsonschema): Pin jsonschema version (#4781)
    + refactor(IscDhclient): discover DHCP leases at distro-provided location
    (#4683) [Phsm Qwerty]
    + feat: datasource check for WSL (#4730) [Carlos Nihelton]
    + test: Update hostname integration tests (#4744)
    + test: Add mantic and noble releases to integration tests (#4744)
    + refactor: Ensure internal DNS state same for v1 and v2 (#4756)
    + feat: Add v2 route mtu rendering to NetworkManager (#4748)
    + tests: stable ubuntu releases will not exit 2 on warnings (#4757)
    + doc(ds-identify): Describe ds-identify irrespective of distro (#4742)
    + fix: relax NetworkManager renderer rules (#4745)
    + fix: fix growpart race (#4618)
    + feat: apply global DNS to interfaces in network-manager  (#4723)
    [Florian Apolloner]
    + feat(apt): remove /etc/apt/sources.list when deb22 preferred (#4740)
    + chore: refactor schema data as enums and namedtuples (#4585)
    + feat(schema): improve CLI message on unprocessed data files (#4585)
    + fix(config): relocate /run to /var/run on BSD (canonical#4677)
    [Mina Galić]
    + fix(ds-identify): relocate /run on *BSD (#4677) [Mina Galić]
    + fix(sysvinit): make code a bit more consistent (#4677) [Mina Galić]
    + doc: Document how cloud-init is, not how it was (#4737)
    + tests: add expected exit 2 on noble from cloud-init status (#4738)
    + test(linkcheck): ignore github md and rst link headers (#4734)
    + test: Update webhook test due to removed cc_migrator module (#4726)
    + fix(ds-identify): Return code 2 is a valid result, use cached value
    + fix(cloudstack): Use parsed lease file for virtual router in cloudstack
    + fix(dhcp): Guard against FileNotFoundError and NameError exceptions
    + fix(apt_configure): disable sources.list if rendering deb822 (#4699)
    (LP: #2045086)
    + docs: Add link to contributing to docs (#4725) [Cat Red]
    + chore: remove commented code (#4722)
    + chore: Add log message when create_hostname_file key is false (#4724)
    [Cat Red]
    + fix: Correct v2 NetworkManager route rendering (#4637)
    + azure/imds: log http failures as warnings instead of info (#4714)
    [Chris Patterson]
    + fix(setup): Relocate libexec on OpenBSD (#4708) [Mina Galić]
    + feat(jinja): better jinja feedback and error catching (#4629)
    [Alec Warren]
    + test: Fix silent swallowing of unexpected subp error (#4702)
    + fix: Move cloud-final.service after time-sync.target (#4610)
    [Dave Jones] (LP: #1951639)
    + feat(log): Make logger name more useful for __init__.py
    + chore: Remove cc_migrator module (#4690)
    + fix(tests): make cmd/devel/tests work on non-GNU [Mina Galić]
    + chore: Remove cmdline from spelling list (#4670)
    + doc: Document boot status meaning (#4670)
    + doc: Set expectations for new datasources (#4670)
    + ci: Show linkcheck broken links in job output (#4670)
    + dmi: Add support for OpenBSD (#4654) [Mina Galić]
    + ds-identify: fake dmidecode support on OpenBSD (#4654) [Mina Galić]
    + ds-identify: add OpenBSD support in uname (#4654) [Mina Galić]
    + refactor: Ensure '_cfg' in Init class is dict (#4674)
    + refactor: Make event scope required in stages.py (#4674)
    + refactor: Remove unused argument (#4674)
    + chore: Move from lintian to a sphinx spelling plugin (#3639)
    + fix(doc): Fix spelling errors found by sphinxcontrib-spelling (#3639)
    + ci: Add Python 3.13 (#4567)
    + Add AlexSv04047 to CLA signers file (#4671) [AlexSv04047]
    + fix(openbsd): services & build tool (#4660) [CodeBleu]
    + tests/unittests: add a new unit test for network manager net activator
    (#4672) [Ani Sinha]
    + Implement DataSourceCloudStack.get_hostname() (#4433) [Phsm Qwerty]
    + net/nm: check for presence of ifcfg files when nm connection files
    are absent (#4645) [Ani Sinha]
    + doc: Overhaul debugging documentation (#4578)
    + doc: Move dangerous commands to dev docs (#4578)
    + doc: Relocate file location docs (#4578)
    + doc: Remove the debugging page (#4578)
    + fix(util): Fix boottime to work on OpenBSD (#4667) [Mina Galić]
    + net: allow dhcp6 configuration from generate_fallback_configuration()
    [Ani Sinha]
    + net/network_manager: do not set "may-fail" to False for both ipv4 and
    ipv6 dhcp [Ani Sinha]
    + feat(subp): Measure subprocess command time (#4606)
    + fix(python3.13): Fix import error for passlib on Python 3.13 (#4669)
    + style(brpm/bddeb): add black and ruff for packages build scripts (#4666)
    + copr: remove TODO.rst from spec file
    + fix(packages/brpm): correct syntax error and typo
    + style(ruff): fix tip target
    + config: Module documentation updates (#4599)
    + refactor(subp): Remove redundant parameter 'env' (#4555)
    + refactor(subp): Remove unused parameter 'target' (#4555)
    + refactor: Remove 'target' boilerplate from cc_apt_configure (#4555)
    + refactor(subp): Re-add return type to subp() (#4555)
    + refactor(subp): Add type information to args (#4555)
    + refactor(subp): Use subprocess.DEVNULL (#4555)
    + refactor(subp): Remove parameter 'combine_capture' (#4555)
    + refactor(subp): Remove unused parameter 'status_cb' (#4555)
    + fix(cli): fix parsing of argparse subcommands (#4559)
    [Calvin Mwadime] (LP: #2040325)
    + chore!: drop support for dsa ssh hostkeys in docs and schema (#4456)
    + chore!: do not generate ssh dsa host keys (#4456) [shixuantong]
    From 23.4.4
    + fix(nocloud): smbios datasource definition
    + tests: Check that smbios seed works
    + fix(source): fix argument boundaries when parsing cmdline (#4825)
    From 23.4.3
    + fix: Handle systemctl when dbus not ready (#4842)
    (LP: #2046483)
    From 23.4.2
    + fix: Handle invalid user configuration gracefully (#4797)
    (LP: #2051147)
    From 23.4.1
    + fix: Handle systemctl commands when dbus not ready (#4681)
    From 23.4
    + tests: datasourcenone use client.restart to block until done (#4635)
    + tests: increase number of retries across reboot to 90 (#4651)
    + fix: Add schema for merge types (#4648)
    + feat: Allow aliyun ds to fetch data in init-local (#4590) [qidong.ld]
    + azure: report failure to eject as error instead of debug (#4643)
    [Chris Patterson]
    + bug(schema): write network-config if instance dir present (#4635)
    + test: fix schema fuzzing test (#4639)
    + Update build-on-openbsd dependencies (#4644) [CodeBleu]
    + fix(test): Fix expected log for ipv6-only ephemeral network (#4641)
    + refactor: Remove metaclass from network_state.py (#4638)
    + schema: non-root fallback to default paths on perm errors (# 4631)
    + fix: Don't loosen the permissions of the log file (#4628)
    + Revert "logging: keep current file mode of log file if its stricter
    than the new mode (#4250)"
    + ephemeral: Handle link up failure for both ipv4 and ipv6  (#4547)
    + fix(main): Don't call logging too early (#4595)
    + fix: Remove Ubuntu-specific kernel naming convention assertion (#4617)
    + fix(log): Do not implement handleError with a self parameter (#4617)
    + fix(log): Don't try to reuse stderr logger (#4617)
    + feat: Standardize logging output to stderr (#4617)
    + chore: Sever unmaintained TODO.rst (#4625)
    + test: Skip failing tests
    + distros: Add suse
    + test: Add default hello package version (#4614)
    + fix(net): Improve DHCPv4 SUSE code, add test
    + net: Fix DHCPv4 not enabled on SUSE in some cases [bin456789]
    + fix(schema): Warn if missing dependency (#4616)
    + fix(cli): main source cloud_config for schema validation (#4562)
    + feat(schema): annotation path for invalid top-level keys (#4562)
    + feat(schema): top-level additionalProperties: false (#4562)
    + test: ensure top-level properties tests will pass (#4562)
    + fix(schema): Add missing schema definitions (#4562)
    + test: Fix snap tests (#4562)
    + azure: Check for stale pps data from IMDS (#4596) [Ksenija Stanojevic]
    + test: Undo dhcp6 integration test changes (#4612)
    + azure: update diagnostic from warning level to debug [Chris Patterson]
    + azure/imds: remove limit for connection errors if route present (#4604)
    + [Chris Patterson]
    + [enhancement]: Add shellcheck to CI (#4488) [Aviral Singh]
    + chore: add conventional commits template (#4593)
    + Revert "net: allow dhcp6 configuration from
    generate_fallback_configuration()" (#4607)
    + azure: workaround to disable reporting IMDS failures on Azure Stack
    [Chris Patterson]
    + cc_apt_pipelining: Update docs, deprecate options (#4571)
    + test: add gh workflows on push to main, update status badges (#4597)
    + util: Remove function abs_join() (#4587)
    + url_helper: Remove unused function retry_on_url_exc() (#4587)
    + cc_resizefs: Add bcachefs resize support (#4594)
    + integration_tests: Support non-Ubuntu distros (#4586)
    + fix(cmdline): fix cmdline parsing with MAC containing cc:
    + azure/errors: include http code in reason for IMDS failure
    [Chris Patterson]
    + tests: cloud-init schema --system does not return exit code 2
    + github: allow pull request to specify desired rebase and merge
    + tests: fix integration test expectations of exit 2 on schema warning
    + tests: fix schema test expected cli output Valid schema <type>
    + fix(schema cli): check raw userdata when processed cloud-config empty
    + azure: report failure to host if ephemeral DHCP secondary NIC (#4558)
    [Chris Patterson]
    + man: Document cloud-init error codes (#4500)
    + Add support for cloud-init "degraded" state (#4500)
    + status.json: Don't override detail key with error condition (#4500)
    + status: Remove duplicated data (#4500)
    + refactor: Rename exported_errors in status.json (#4500)
    + test: Remove stale status.json value (#4500)
    + tools/render-template: Make yaml loading opt-in, fix setup.py (#4564)
    + Add summit digest/trip report to docs (#4561) [Sally]
    + doc: Fix incorrect statement about `cloud-init analyze`
    + azure/imds: ensure new errors are logged immediately when retrying
    (#4468) [Chris Patterson]
    + Clarify boothook docs (#4543)
    + boothook: allow stdout/stderr to emit to cloud-init-output.log
    + summit-notes: add 2023 notes for reference in mailinglist/discourse
    + fix: added mock to stop leaking journalctl that slows down unit test
    (#4556) [Alec Warren]
    + tests: maas test for DataSourceMAASLocal get_data
    + maas tests: avoid using CiTest case and prefer pytest.tmpdir fixture
    + MAAS: Add datasource to init-local timeframe
    + Ensure all tests passed and/or are skipped
    + Support QEMU in integration tests
    + fix(read-dependencies): handle version specifiers containing [~!]
    + test: unpin pytest
    + schema: network-config optional network key. route uses oneOf (#4482)
    + schema: add cloud_init_deepest_matches for best error message (#4482)
    + network: warn invalid cfg add /run/cloud-init/network-config  (#4482)
    + schema: add network-config support to schema subcommand (#4482)
    + Update version number and merge ChangeLog from 23.3.3 into main (#4553)
    + azure: check for primary interface when performing DHCP (#4465)
    [Chris Patterson]
    + Fix hypothesis failure
    + subp: add a log when skipping a file for execution for lack of exe
    permission (#4506) [Ani Sinha]
    + azure/imds: refactor max_connection_errors definition (#4467)
    [Chris Patterson]
    + chore: fix PR template rendering (#4526)
    + fix(cc_apt_configure): avoid unneeded call to apt-install (#4519)
    + comment difference between sysconfig and NetworkManager renderer (#4517)
    [Ani Sinha]
    + Set Debian's default locale to be c.UTF-8 (#4503) (LP: #2038945)
    + Convert test_debian.py to pytest (#4503)
    + doc: fix cloudstack link
    + doc: fix development/contributing.html references
    + doc: hide duplicated links
    + Revert "ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen
    (#4281)" (#4511) (LP: #2039453)
    + Fix the missing mcopy argument [Vladimir Pouzanov]
    + tests: Add logging fix (#4499)
    + Update upgrade test to account for dhcp6
    + Remove logging of PPID path (#4502)
    + Make Python 3.12 CI test non-experimental (#4498)
    + ds-identify: exit 2 on disabled state from marker or cmdline (#4399)
    + cloud-init-generator: Various performance optimizations (#4399)
    + systemd: Standardize cloud-init systemd enablement (#4399)
    + benchmark: benchmark cloud-init-generator independent of ds-identify
    (#4399)
    + tests/integration_tests: add cloud-init disablement coverage (#4399)
    + doc: Describe disabling cloud-init using an environment variable (#4399)
    + fix: cloud-init status --wait broken with KERNEL_CMDLINE (#4399)
    + azure/imds: retry on 429 errors for reprovisiondata (#4470)
    [Chris Patterson]
    + cmd: Don't write json status files for non-boot stages (#4478)
    + ds-identify: Allow disable service and override environment (#4485)
    [Mina Galić]
    + Update DataSourceNWCS.py (#4496) [shell-skrimp]
    + Add r00ta to CLA signers file
    + Fix override of systemd_locale_conf in rhel [Jacopo Rota]
    + ci(linkcheck): minor fixes (#4495)
    + integration test fix for deb822 URI format (#4492)
    + test: use a mantic-compatible tz in t/i/m/test_combined.py (#4494)
    + ua: shift CLI command from ua to pro for all interactions
    + pro: avoid double-dash when enabling inviddual services on CLI
    + net: allow dhcp6 configuration from generate_fallback_configuration()
    (#4474) [Ani Sinha]
    + tests: apt re.search to match alternative ordering of installed pkgs
    + apt: doc apt_pkg performance improvement over subp apt-config dump
    + Tidy up contributing docs (#4469) [Sally]
    + [enhancement]: Automatically linkcheck in CI (#4479) [Aviral Singh]
    + Revert allowing pro service warnings (#4483)
    + Export warning logs to status.json (#4455)
    + Fix regression in package installation (#4466)
    + schema: cloud-init schema in early boot or in dev environ (#4448)
    + schema: annotation of nested dicts lists in schema marks (#4448)
    + feat(apport): collect ubuntu-pro logs if ubuntu-advantage.log present
    (#4443)
    + apt_configure: add deb822 support for default sources file (#4437)
    + net: remove the word "on instance boot" from cloud-init generated config
    (#4457) [Ani Sinha]
    + style: Make cloudinit.log functions use snake case (#4449)
    + Don't recommend using cloud-init as a library (#4459)
    + vmware: Fall back to vmtoolsd if vmware-rpctool errs (#4444)
    [Andrew Kutz]
    + azure: add option to enable/disable secondary ip config (#4432)
    + [Ksenija Stanojevic]
    + Allow installing snaps via package_update_upgrade_install module (#4202)
    + docs: Add cloud-init overview/introduction (#4440) [Sally]
    + apt: install software-properties-common when absent but needed (#4441)
    + sources/Azure: Ignore system volume information folder while scanning
    for files in the ntfs resource disk (#4446) [Anh Vo]
    + refactor: Remove unnecessary __main__.py file
    + style: Drop vi format comments
    + cloudinit.log: Use more appropriate exception (#4435)
    + cloudinit.log: Don't configure NullHandler (#4435)
    + commit 6bbbfbbb030831c72b5aa2bba9cb8492f19d56f4
    + cloudinit.log: Remove unnecessary module function and variables (#4435)
    + cloudinit.log: Remove unused getLogger wrapper (#4435)
    + cloudinit.log: Standardize use of cloudinit's logging module (#4435)
    + Remove unnecessary logging wrapper in Cloud class (#4435)
    + integration test: allow pro service warnings (#4447)
    + integration tests: fix mount indentation (#4445)
    + sources/Azure: fix for conflicting reports to platform (#4434)
    [Chris Patterson]
    + docs: link the cloud-config validation service (#4442)
    + Fix pip-managed ansible on pip < 23.0.1 (#4403)
    + Install gnupg if gpg not found (#4431)
    + Add "phsm" as contributor (#4429) [Phsm Qwerty]
    + cc_ubuntu_advantage: do not rely on uaclient.messages module (#4397)
    [Grant Orndorff]
    + tools/ds-identify: match Azure datasource's ds_detect() behavior (#4430)
    [Chris Patterson]
    + Refactor test_apt_source_v1.py to use pytest (#4427)
    + sources: do not override datasource detection if None is in list (#4426)
    [Chris Patterson]
    + feat: check for create_hostname_file key before writing /etc/hostname
    (SC-1588) (#4330) [Cat Red]
    + Pytestify apt config test modules (#4424)
    + upstream gentoo patch (#4422)
    + Work around no instance ip (#4419)
    + Fix typing issues in subp module (#4401)
    + net: fix ipv6_dhcpv6_stateful/stateless/slaac configuration for rhel
    (#4395) [Ani Sinha]
    + Release 23.3.1
    + apt: kill dirmngr/gpg-agent without gpgconf dependency (LP: #2034273)
    + integration tests: fix mount indentation (#4405)
    + Use grep for faster parsing of cloud config in ds-identify (#4327)
    [Scott Moser] (LP: #2030729)
    + doc: fix instructions on how to disable cloud-init from kernel command
    line (#4406) [Ani Sinha]
    + doc/vmware: Update contents relevant to disable_vmware_customization
    [PengpengSun]
    + Bring back flake8 for python 3.6 (#4394)
    + integration tests: Fix cgroup parsing (#4402)
    + summary: Update template parameter descriptions in docs [MJ Moshiri]
    + Log PPID for better debugging (#4398)
    + integration tests: don't clean when KEEP_* flags true (#4400)
    + clean: add a new option to clean generated config files [Ani Sinha]
    + pep-594: drop deprecated pipes module import
    From 23.3.3
    + Fix pip-managed ansible on pip < 23.0.1 (#4403)
    From 23.3.2
    + Revert "ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen"
    (#4281) (#4511) (LP: #2039453)
    From 23.3.1
    + apt: kill dirmngr/gpg-agent without gpgconf dependency (LP: #2034273)
    + integration tests: Fix cgroup parsing (#4402)

++++ cloud-init:

  - Update to version 25.1.1 (bsc#1239715,jsc#PED-8680,bsc#1228414)
    + Removed included upstream
  - pep-594-drop-pipes.patch
  - cloud-init-fix-python313.patch
  - cloud-init-dont-assume-ordering-of-ThreadPoolExecutor.patch
  - cloud-init-direxist.patch
  - cloud-init-wait-for-net.patch
  - cloud-init-usr-sudoers.patch
  - cloud-init-no-nmcfg-needed.patch
  - cloud-init-keep-flake.patch
  - cloud-init-lint-fixes.patch
  - cloud-init-pckg-reboot.patch
  - cloud-init-ds-deterministic.patch
  - cloud-init-write-routes.patch
  - cloud-init-skip-empty-conf.patch
    + Forward port
  - cloud-init-no-tempnet-oci.patch
  - cloud-init-no-openstack-guess.patch
  - cloud-init-lint-set-interpreter.patch
    + Add
  - cloud-init-ssh-usrmerge.patch (bsc#1237764)
  - cloud-init-lint-set-interpreter.patch
  - cloud-init-lint-fix.patch
  - cloud-init-no-single-process.patch
  - cloud-init-needs-action.patch
    + Drop hidesensitivedata in 16 & greater
    + test: pytestify cc_chef tests, add migration test
    + chef: migrate files in old config directories for backups and cache
    + fix: correct the path for Chef's backups (#5994)
    + fix(Azure): don't reraise FileNotFoundError during ephemeral setup (#6113)
    + fix(azure): handle unexpected exceptions during obtain_lease() (#6092)
    [Ksenija Stanojevic]
    + Allow to set mac_address for VLAN subinterface (#6081)
    [jumpojoy] (GH: 5364)
    + fix: Remove erroneous EC2 reference from 503 warning (#6077)
    + fix: NM reload and bring up individual network conns (#6073) [Ani Sinha]
    + fix: stop warning on dual-stack request failure (#6044)
    + fix: install_method: pip cannot find ansible-pull command path (#6021)
    [Hasan Aliyev] (GH: 5720)
    + fix: Fix DataSourceAliYun exception_cb signature (#6068) (GH: 6066)
    + fix: Update OauthUrlHelper to use readurl exception_cb signature
    (GH: 6065)
    + test: add OauthUrlHelper tests
    + test: Remove CiTestCase from test_url_helper.py
    + test: pytestify test_url_helper.py
    + fix: track more removed modules (#6043)
  - From 25.1
    + ci: fix post-merge packaging CI (#6038)
    + feat(azure): Fix imds-based ssh_pwauth (#6002) [Ksenija Stanojevic]
    + ci: check for sorted patches (#6036)
    + feat: aliyun datasource support crawl metadata at once (#5942)
    [jinkangkang]
    + docs: document /usr merge breaking change (#6032)
    + test: Add integration test for /var mounts (#6033)
    + test: Ensure pre-24.2 custom modules work (#6034)
    + doc: Update references to older keys (#6022) [Pedro Ribeiro]
    + fix: untyped-defs in tests/unittests/{config, net, sources} (#6023)
    [Romain]
    + fix: don't reference PR in post-merged CI (#6019)
    + chore: explicitly skip broken ansible integration tests (#5996) [a-dubs]
    + tests(oracle): fix test_install_missing_deps apt race condition (#5996)
    [a-dubs]
    + test(oracle): fix test_ubuntu_drivers_installed (#5996) [a-dubs]
    + test(oracle): fix test_frequency_override integration test (#5996)
    [a-dubs]
    + chore: add type hint to IntegrationCloud's cloud_instance field (#5996)
    [a-dubs]
    + test(oracle): fix modules/test_lxd.py::test_storage_lvm on noble (#5996)
    [a-dubs]
    + commit 9e591fff266be9d4c83f74ec02a717b74993304d [a-dubs]
    + net/sysconfig: do not remove all existing settings of
    /etc/sysconfig/network (#5991) [Ani Sinha] (GH: 5990)
    + fix: remove wrong return when checking if network necessary (#6013)
    + fix: typing for rsyslog, ubuntu_pro, power_state_change (#5985)
    [MostafaTarek124eru]
    + fix: Retry on OpenStack HTTP status codes (#5943) [weiyang] (GH: 5687)
    + fix: Ensure fqdn is treated as string in get_hostname_fqdn (#5993)
    [MKhatibzadeh] (GH: 5989)
    + feat(vmware): Convert imc network config to v2 (#5937) [PengpengSun]
    + ci: add upstream post-merge test
    + ci: check if upstream commit causes ubuntu patch conflicts
    + ci: organize cla tests together
    + test: eliminate obsolete cases, add non-error case
    + chore: remove redundant manual schema validation
    + doc: clarify subiquity docs
    + chore: cleanup `len' usage (#5956) [Shreenidhi Shedi]
    + Fix: GCE _get_data crashes if DHCP lease fails (#5998) [Bryan Fraschetti]
    + Fixes GH-5997
    + fix: correct the path for Chef's cache (#5994)
    [MostafaTarek124eru] (GH: 5090)
    + fix: Run ansible with run_user instead of root for distro install_method
    (#5986) [Amirhossein Shaerpour] (GH: 4092)
    + fix: retry AWS hotplug for async IMDS (#5995) (GH: 5373)
    + feat(integration_tests): add optional INSTANCE_TYPE setting (#5988)
    [Alec Warren]
    + feat(integration-tests): set boto3 and botocore to INFO to prevent
    log spamming [a-dubs]
    + ci: add 'tox -e integration-tests-fast' command [a-dubs]
    + chore: Add feature flag for manual network waiting (#5977)
    + Release 24.4.1
    + fix: Use /usr/lib/ rather than /lib in packaging code (#5970)
    + Use log_with_downgradable_level for user password warnings (#5927)
    [Ani Sinha]
    + doc: change to hyphenated keys (#5909) (GH: 5555)
    + fix: Wait for udev on openstack (#5947) [Robert Schweikert] (GH: 4125)
    + test: disambiguate resource cleanup from test failure (#5926)
    + fix: use program name of netcat as installed by upstream, "nc" (#5933)
    (#5933) [Andreas K. Hüttel]
    + ci: bump canonical/setup-lxd to version v0.1.2 (#5948)
    + feat(cc_chef): Allow change of Chef configuration file (#5925)
    [Sean Smith]
    + docs: fix typo in generated file in LXD tutorial (#5941) [Pavel Shpak]
    + feat: Identify Samsung Cloud Platform as OpenStack (#5924) [us0310306]
    + fix: don't deadlock when starting network service with systemctl (#5935)
    + feat: Custom keys for apt archives (#5828) [Bryan Fraschetti] (GH: 5473)
    + test: improve test initialization error path (#5920)
    + chore: improve logging when lxd detection fails (#5919)
    + fix: Add "manual" to allowed subnet types  (#5875)
    [Math Marchand] (GH: 5769)
    + fix: remove bad ssh_svcname setting for Gentoo/OpenRC (#5918)
    [Andreas K. Hüttel]
    + feat(gentoo): Add compatibility for Gentoo with systemd (#5918)
    [Andreas K. Hüttel]
    + fix(ovf): no warning should be log when rpctool found no value (#5915)
    [PengpengSun] (GH: 5914)
    + Move DS VMware to be in front of DS OVF (#5912) [PengpengSun] (GH: 4030)
    + ci: Add proper 'Breaks: ' to integration testing simple deb (#5923)
    + chore: Add akhuettel to CLA signers file (#5917) [Andreas K. Hüttel]
    + chore: eliminate calls at import time (#5889) (GH: 5344)
    + test: Add pyserial to test-requirements.txt (#5907)
    + test: Allow unknown size in growpart test (#5876)
    + doc: Update tutorials [Sally]
    + fix: bump azure key size to 3072 (#5841)
    24.4.1
    + fix: Ensure _should_wait_via_user_data() handles all user data types (#5976)
    + fix: Don't log error in wait_for_url (#5972)
    + feat(url_helper): Retry on 503 error (#5938)
    + fix: Don't break modules that use get_meta_doc() (#5953)
    + refactor: Pass deprecation log args as tuple (#5953)
    + fix: uninstall custom signal handlers before shutdown (#5913)
    24.4
    + test: Ensure unit ordering in ftp tests includes downstream units (#5892)
    + test: re-decrement expected webhook events (#5894)
    + test: allow relative path in apt-get test (#5891)
    + Fix metric setting of nmconnection for rhel (#5878) [Amy Chen]
    + chore: remove unused code(#5887)
    + feat(ephemeral): replace old has_url_connectivity() with new
    _check_connectivity_to_imds() [a-dubs]
    + feat(oracle): add true single stack ipv6 support [a-dubs]
    + feat(ephemeral): refactor ephemeralIP and add ipv6 connectivity check
    [a-dubs]
    + test: Decrement expected webhook events (#5888)
    + chore: remove `--docs` option from `cloud-init schema` (#5857) (GH: 5756)
    + test: pytestify "tests/unittests/config/test_cc_timezone.py" (#5885)
    [Mahesh Ghumare]
    + ci: bump integration tests to use plucky
    + test: add grub_dpkg to inactive modules
    + test: move default behavior tests into their own module
    + test(apt): add plucky version for hello pkg (#5883)
    + Docs: improved mermaid diagram for better visibility. Add "MaheshG11"
    as contributor (#5874) [Mahesh Ghumare] (GH: 5837)
    + fix(ntp): Fix RockyLinux OS support  (#5864) [Sid Shukla]
    + chore(jsonschema): migrate from deprecated Validator.iter_errors (#5856)
    + chore: remove deprecation warning getting jsonschema's version (#5856)
    + chore: use filter arg for tar.extractall (#5856)
    + chore: remove __init__ from pytest test class (#5856)
    + chore: do not test element's truth value directly (#5856)
    + chore: migrate from deprecated datetime.datetime.utcfromtimestamp (#5856)
    + chore: migrate from deprecated datetime.datetime.utcnow() (#5856)
    + chore: set recursive=False for ensure_dir if parent path is "/" (#5816)
    [sxt1001]
    + ci: fix broken daily dependencies (#5867)
    + ci: fix packaging tests (#5865)
    + feat(vultr): add override for network interface detection (#5847)
    [Andrew Davis]
    + feat(networkd): Support RequiredForOnline option (#5852) [Dan McGregor]
    + Prevent NM from handling DNS when network interfaces have DNS config
    (#5846) [Ani Sinha]
    + fix(smartos): Add `addrconf` IPv6 support (#5831)
    [blackhelicoptersdotnet]
    + freebsd: adjust to match the new pyyaml package name (#5844)
    [Gonéri Le Bouder]
    + fix: disable grub-dpkg by default (#5840)
    + fix(openbsd): Enable sysv init scripts in OpenBSD build script (#5790)
    [Hyacinthe Cartiaux] (LP: 4036, #1992853)
    + test: Fix duplicate judgment conditions in password generation (#5835)
    [sxt1001]
    + chore: don't render non-templated unit files (#5830)
    + chore: simplify and standardize cloud-final.service (#5830)
    + chore: simplify Conflicts=shutdown.target (#5830)
    + chore: remove redundant Before=NetworkManager.service (#5830)
    + chore: remove unnecessary systemd settings (#5830)
    + chore: eliminate redundant ordering dependencies (#5819)
    + fix: fix ordering cycle for distros with default deps (#5819) (GH: 5755)
    + test: unbreak pytest-xdist (#5829)
    + feat: Conditionally remove networkd online dependency on Ubuntu (#5772)
    + feat: Ensure random passwords contain multiple character types (#5815)
    [sxt1001] (GH: 5814)
    + docs: split example page into example library (#5645) [Sally]
    + doc: clarify workarounds required for single process changes (#5817)
    + chore: add 3.13 to PR CI runs, 3.14 to scheduled (#5825)
    + fix: Render v2 bridges correctly on network-manager with set-name
    (#5740) (GH: 5717)
    + test: add no_thinpool unit test (#5802)
    + chore: split lxd init config into separate function (#5802)
    + test: pytestify test_cc_lxd.py (#5802)
    + fix: Correctly handle missing thinpool in cc_lxd (#5802)
    + fix: Render bridges correctly for v2 on sysconfig with set-name (#5674)
    (GH: 5574)
    + tests(minimal): rsyslog not in minimal images expect warning (#5811)
    + tests(lxd): avoid failure on multiple calls to --show-log (#5811)
    + chore: update netplan import semantics and related tests (#5805)
    (GH: 5804)
    + lint: fix untyped-defs on /tests/unittest/cmd (#5800) [iru]
    + test: actually use devel release and verify_clean_boot enhancements
    (#5801)
    + feat(locale): locales install on minimal images when cfg requests (#5799)
    + feat(byobu): support byobu install on minimal images when cfg requests
    (#5799)
    + chore: Use devel release and no sbuild in integration CI (#5798)
    + test: Update integration tests from netplan backport (#5796)
    + test: add get_syslog_or_console for minimal images without syslog (#5793)
    + chore: Remove resize_root_tmp from cloud.cfg.tmpl (#5795) (GH: 5786)
    + docs: Fix field name from `contents` to `content` (#5787) [Igor Akkerman]
    + chore: bump pycloudlib to required version (#5792)
    + fix: avoid deprecation logs for calling cli stages (#5770) (GH: 5726)
    + tests: bump pycloudlib deps to include gce bug fix for id str (#5783)
    + fix(test): convert use p.gce.instance.id instead of instance_id (#5783)
    + fix(network-manager): bond properties and network schema (#5768)
    [Denis Kadyshev]
    + Fix metric setting for ifcfg network connections for rhel (#5777)
    [Ani Sinha] (GH: 5776)
    + fix(akamai): handle non-string user data in base64 decoding (#5751)
    [Jesse Alter]
    + fix(ci): do not auto stale issues (#5775)
    + Make pytest more verbose for easier debugging (#5778) [Ani Sinha]
    + ci: fix tox.ini pytest cmd to use cloudinit dir for coverage reporting
    (#5774) [Alec Warren]
    + tests: add OS_IMAGE_TYPE setting to allow for minimal tests (#5682)
    + test(hotplug): Simplify test_multi_nic_hotplug (#5763)
    + test(hotplug): increase nc timeout (#5763)
    + test: pytestify test_main.py (#5758)
    + test(ec2-dual-stack): fix int-test (#5762)
    + test: make verify_clean_boot really respect return code (#5761)
    + test: bump timeout in test_order (#5759)
    + docs: Properly document the cc_ubuntu_autoinstall module (#5757)
    + docs: fix WSL tutorial (#5752) (GH: 5746)
    + test: make verify_clean_boot respect return code by environment (#5754)
    + feat(integration_test): add CLOUD_INIT_PKG setting (#5739)
    + fix(ci): fix packaging check merge operation (#5750)
    + doc: do not document user.meta-data key (#5745)
    + test: avoid undocumented lxd key (#5748)
    + test: Refactor test_cc_set_hostname.py and test_cc_ntp.py (#5727)
    + chore: update docs URLs to cloud-init.io (#5741)
    + test: fix timer logging change expected logs (#5734)
    + fix: type annotations for several modules (#5733)
    + chore: add timer to io and string manipulation code
    + feat: add log package and performance module
    + remove newline injected for cloud-init status --wait (#5700)
    [Andrew Nelson] (GH: 5863)
    + test: webhook require_deprecation msg on 24.3 (#5731)
    + test: fix test_nocloud message typo introduced by 313390f8 (#5731)
    + test: Fix test_log_message_on_missing_version_file (#5730)
    + tests: assert info level warnings instead of require_deprecation
    + tests: fix test to ignore_warnings not require Used fallback ds
    + chore: clean up pytest warnings (#5721)
    + tests(pro): bump pycloudlib add noble release to pro tests (#5719)
    + fix(hotplugd.socket): remove basic.target as dependency (#5722)
    (LP: #2081124)
    + ci: fix integration test positional argument (#5718)
    + Create datasource for CloudCIX (#1351) [BrianKelleher]
    + ci: colorize output (#5716)
    + fix(schema): Allow for locale: false in schema add tests (#5647)
    + ci: fix packaging patch check (#5713)
    + chore: clean up old pickle workaround (#5714)
    + fix: force sftp cleanup when done with instance (#5698)
    + test(hotplug): reenable vpc test in focal (#5492)
    + chore: fix typing of userdata_raw (#5710)
    + fix(NetworkManager): Fix network activator (#5620)
    + fix: lxd do not check for thinpool kernel module (#5709)
    + docs: fix typo in docstring (#5708)
    + Scaleway: Force on-link: true for static networks (#5654)
    [Louis Bouchard] (LP: 5523, #2073869)
    + fix: Invalid "seedfrom" in NoCloud system configuration (#5701)
    + tests: pytestify test_nocloud.py (#5701)
    + test: make verify_clean_boot respect return code by series (#5695)
    + fix: use cross-distro netcat name (#5696)
    + ci: fix labeler (#5697)
    + chore(actions): add packaging label for any branches modifying debian/*
    + (#5693)
    + test: add verify_clean_boot() calls alongside verify_clean_log() (#5671)
    + test: add deprecation support to verify_clean_boot (#5671)
    + doc: remove misleading warning (#5681)
    + chore: Prefer other methods over $INSTANCE_ID (#5661)
    + ci: fix packaging test when no patches (#5680)
    + chore: fix tip-ruff and update to latest version (#5676)
    + chore: make ansible test serial (#5677)
    + feat(ec2): Bump url_max_timeout to 240s from 120s. (#5565)
    [Robert Nickel]
    + chore: fix typo in requirements.txt (#5637)
    + feat: make pyserial an optional dependency (#5637)
    + chore: bump ci dependency versions (#5660)
    + chore: drop broken optimization (#5666)
    24.3.1
    + test: add test coverage for iproute2 commands (#5651)
    + fix(netops): fix ip addr flush command (#5651) (GH: 5648)
    24.3
    + docs: Clarify v2 set-name behavior (#5639)
    + fix: properly handle blank lines in fstab (#5643)
    + fix: cc_user_groups incorrectly assumes "useradd" never locks password
    field (#5355) [dermotbradley]
    + tests: assert cloud-init user-data cert is the only root cert (#5641)
    + feat: add automation for ubuntu/* branches asserting quilt patches apply
    (#5622)
    + fix(sources/wsl): no error with empty .cloud-init dir (SC-1862) (#5633)
    + feat(azure): add PPS support for azure-proxy-agent (#5601)
    [Ksenija Stanojevic]
    + fix(tests): use instance.clean/restart instead of clean --reboot (#5636)
    + test: fix cmd/test_schema int test (#5629)
    + test: fix test_honor_cloud_dir int test (#5627)
    + docs: alphabetize dsname lookup table. update comment to create the csv
    (#5624)
    + docs: new datasources should update reference/ds_dsname_map (#5624)
    + test: fix ca_certs int test (#5626)
    + chore: update schema docs to use RST bold for config key names (#5562)
    + fix(doc): italics around deprecation prefix, description bolds key names
    (#5562)
    + feat(doc): add env vars to debug config module doc builds (#5562)
    + fix(doc): doc of nested objects under JSON schema items.oneOf (#5562)
    + fix(doc): object type check if patternProperties or properties (#5562)
    + doc(schema): schema descriptions should end with trailing stop (#5562)
    + fix(wsl): Properly assemble multipart data (#5538) [Carlos Nihelton]
    + feat: collect-logs improvements (#5619)
    + tests: fix test_ca_certs.py for gcp (#5621)
    + fix(nm): Ensure bond property name formatting matches schema definition
    (#5383) [Curt Moore]
    + Update behavior of base bond interface with NetworkManager (#5385)
    [Curt Moore]
    + ci: Drop Python 3.6 and 3.7 (#5607)
    + chore(black): Bump version (#5607)
    + chore(mypy): Fix failures on newer versions of mypy (#5607)
    + chore(tox.ini): Simplify configuration, fix minor bugs (#5607)
    + chore(mypy): Lint log module (#5607)
    + fix(systemd): Correct location of installed drop-in files(#5615)
    [Noah Meyerhans]
    + fix(btrfs): Version parsing (#5618)
    + docs: Remove unnecessary section, add feature flag page (#5617)
    + docs: Drop Python 3.6 and 3.7 support (#5617)
    + chore: explain other use of oauth (#5616)
    + chore(actions): add doc label for any doc related subdir file matches
    (#5602)
    + doc: Add misc links, improve wording (#5595)
    + doc(boot): Make first boot a dedicated page (#5595)
    + doc: Describe all stages in a single process (#5595)
    + chore: Deprecate old commands in help output (#5595)
    + chore: add comment explaining the NetworkManager may-fail setting
    (#5598) [Ani Sinha]
    + Revert "fix(vmware): Set IPv6 to dhcp when there is no IPv6 addr
    (#5471)" (#5596) [PengpengSun]
    + fix: read_optional_seed to set network-config when present (#5593)
    + feat(snap): avoid refresh on package_upgrade: true and refresh.hold
    (#5426)
    + fix: Fix tests which have outdated strings (#5585)
    + fix: Fix ftp failures (#5585)
    + doc: improve integration testing configuration instructions (#5556)
    [Alec Warren]
    + azure: check azure-proxy-agent status (#5138) [Ksenija Stanojevic]
    + refactor: refactor and fix mypy in DataSourceIBMCloud.py (#5509)
    [Alec Warren]
    + fix: Update default LXD meta-data with user meta-data (#5584)
    + chore: Fix log message in url_helper.py (#5583)
    + fix: nocloud no fail when network-config absent (#5580)
    + feat: Single process optimization (#5489)
    + chore: Add helper, refactor utilities into separate module (#5573)
    + refactor: update handle function of cc_mounts (#5498)
    + fix: Integration tests (#5576)
    + fix(NoCloudNet): Add network-config support (#5566)
    + feat: Eliminate redundant configuration reads (#5536)
    + fix(actions): correct typo in cloudinit/config/schemas/ match (#5570)
    + fix: add host template for AOSC (#5557) [Yuanhang Sun]
    + chore(debian): Remove vestigial postinst and preinst code (#5569)
    + fix(actions): doc labeler needs all clause instead of default any (#5568)
    + docs: Overhaul user data formats documentation (#5551)
    + chore: Deprecate ENI as an input configuration format (#5561)
    + doc: improve drop-in custom modules (#5548)
    + doc(NoCloud): Categorize the different configuration types (#5521)
    + doc(autoinstall): Remove incorrect statements, be more direct (#5545)
    + chore: remove unneeded doc-lint tox env config (#5547)
    + fix(doc-spelling): config spelling_word_list_filename (#5547)
    + doc(modules): add section to wrap modules' doc (#5550)
    + doc: Update docs on boothooks (#5546)
    + fix: doc auto label to consider schema json changes as doc PRs (#5543)
    + feat(schema): add chef_license schema enum (#5543)
    + doc: add diagram with boot stages (#5539)
    + docs: improve qemu command line (#5540) [Christian Ehrhardt]
    + fix: auto label doc PRs (#5542)
    + fix(wsl): Put back the "path" argument to wsl_path in ds-identify
    + (#5537) [Carlos Nihelton]
    + test: fix test_kernel_command_line_match (#5529)
    + test: fix no ds cache tests (#5529)
    + fix(azurelinux): Change default usr_lib_exec path (#5526) [Minghe Ren]
    + feat: Support URI sources in `write_files` module (#5505)
    [Lucas Ritzdorf]
    + add openeuler to distros in cc_spacewalk.py (#5530) [sxt1001]
    + feat(wsl): Special handling Landscape client config tags (#5460)
    [Carlos Nihelton]
    + chore: Deprecate partially supported system config (#5515)
    + chore: Improve detection logging for user clarity (#5515)
    + fix(ds-identify): Detect nocloud when seedfrom url exists (#5515)
    + refactor: logs.py add typing and small misc refactors (#5414)
    + refactor: logs.py pathlib changes (#5414)
    + refactor: replace verbosity with log levels in logs.py (#5414)
    + feat: Add trace-level logger (#5414)
    + chore(formatting): fix squashed commit test formatting (#5524)
    + fix: Clean cache if no datasource fallback (#5499)
    + Support setting mirrorlist in yum repository config (#5522) [Ani Sinha]
    + doc(OFV): Document how to configure cloud-init (#5519)
    + fix: Update DNS behavior for NetworkManager interfaces (#5496)
    [Curt Moore]
    + Fix configuration of DNS servers via OpenStack (#5384) [Curt Moore]
    + test: Unconditionally skip test_multi_nic_hotplug_vpc (#5503)
    + tests: revert expectation of exit 2 from cloud-init init --local (#5504)
    + fix(test): Fix ip printer for non-lxd (#5488)
    + feat(systemd): convert warning level message to deprecation (#5209)
    + test: allow verify_clean_boot to ignore all or specific tracebacks
    (#5209)
    + test: Don't fail tests which call cloud-init as a command (#5209)
    + feat(systemd): Warn user of unexpected run mode (#5209)
    + fix: add schema rules for 'baseurl' and 'metalink' in yum repo config
    (#5501) [Ani Sinha]
    + Set MTU for bond parent interface (#5495) [Curt Moore]
    + refactor: util.mounts to handle errors (#5490)
    + refactor: util.get_proc_env to work with strs (#5490)
    + typing: fix check_untyped_defs in cloudinit.util (#5490)
    + test: Add missing assert to test_status.py (#5494)
    + test: Ensure mkcert executable in ftp tests (#5493)
    + test: pytestify and cleanup test_cc_mounts.py (#5459)
    + fix(vmware): Set IPv6 to dhcp when there is no IPv6 addr (#5471)
    [PengpengSun]
    + fix(openbsd): fix mtu on newline in hostname files (#5412) [Tobias Urdin]
    + feat(aosc): Add 'AOSC OS' support (#5310) [Yuanhang Sun]
    24.2
    + test: Fix no default user in test_status.py (#5478)
    + fix: correct deprecated_version=22.2 for users.sudo
    + test: Add jsonschema guard in test_cc_ubuntu_pro.py (#5479)
    + fix(test): Fix pycloudlib types in integration tests (#5350)
    + fix(test): Fix ip printing for non-lxd instances (#5350)
    + chore(mypy): Drop unused missing import exclusions (#5350)
    + type: Add stub types for network v1/v2 config (#5350)
    + chore: Auto-format network jsonschema in ci (#5350)
    + fix(tox): Update tox.ini (#5350)
    + chore(typing): Remove type ignores and casts (#5350)
    + refactor(typing): Remove unused code paths (#5350)
    + fix(typing): Add / update type annotations (#5350)
    + fix(typing): Remove type annotation for unused variable (#5350)
    + fix(typing): Remove invalid type annotations (#5350)
    + ci(mypy): Set default follow_imports value (#5350)
    + test: Update integration tests to pass on focal (#5476)
    + tests: update ubuntu_pro test to account for info-level deprecations
    (#5475)
    + tests: update nocloud deprecation test for boundary version (#5474)
    + fix(rh_subscription): add string type to org (#5453)
    + tests: integration tests aware of features.DEPRECATION_INFO_BOUNDARY
    + tests: update keyserver PPA key fur curtin-dev (#5472)
    + test: Fix deprecation test failures (#5466)
    + chore: fix schema.py formatting (#5465)
    + fix: dont double-log deprecated INFOs (#5465)
    + fix(test): Mock version boundary (#5464)
    + fix(schema): Don't report changed keys as deprecated (#5464)
    + test: fix unit test openstack vlan mac_address (#5367)
    + fix: Ensure properties for bonded interfaces are properly translated
    (#5367) [Curt Moore]
    + fix(schema): permit deprecated hyphenated keys under users key (#5456)
    + fix: Do not add the vlan_mac_address field into the VLAN object (#5365)
    [Curt Moore]
    + doc(refactor): Convert module docs to new system (#5427) [Sally]
    + test: Add unit tests for features.DEPRECATION_INFO_BOUNDARY (#5411)
    + feat: Add deprecation boundary support to schema validator (#5411)
    + feat: Add deprecation boundary to logger (#5411)
    + fix: Gracefully handle missing files (#5397) [Curt Moore]
    + test(openstack): Test bond mac address (#5369)
    + fix(openstack): Fix bond mac_address (#5369) [Curt Moore]
    + test: Add ds-identify integration test coverage (#5394)
    + chore(cmdline): Update comments (#5458)
    + fix: Add get_connection_with_tls_context() for requests 2.32.2+ (#5435)
    [eaglegai]
    + fix(net): klibc ipconfig PROTO compatibility (#5437)
    [Alexsander de Souza] (LP: #2065787)
    + Support metalink in yum repository config (#5444) [Ani Sinha]
    + tests: hard-code curtin-dev ppa instead of canonical-kernel-team (#5450)
    + ci: PR update checklist GH- anchors to align w/ later template (#5449)
    + test: update validate error message in test_networking (#5436)
    + ci: Add PR checklist (#5446)
    + chore: fix W0105 in t/u/s/h/test_netlink.py (#5409)
    + chore(pyproject.toml): migrate to booleans (#5409)
    + typing: add check_untyped_defs (#5409)
    + fix(openstack): Append interface / scope_id for IPv6 link-local metadata
    address (#5419) [Christian Rohmann]
    + test: Update validation error in test_cli.py test (#5430)
    + test: Update schema validation error in integration test (#5429)
    + test: bump pycloudlib to get azure oracular images (#5428)
    + fix(azure): fix discrepancy for monotonic() vs time() (#5420)
    [Chris Patterson]
    + fix(pytest): Fix broken pytest gdb flag (#5415)
    + fix: Use monotonic time (#5423)
    + docs: Remove mention of resolv.conf (#5424)
    + perf(netplan): Improve network v1 -> network v2 performance (#5391)
    + perf(set_passwords): Run module in Network stage (#5395)
    + fix(test): Remove temporary directory side effect (#5416)
    + Improve schema validator warning messages (#5404) [Ani Sinha]
    + feat(sysconfig): Add DNS from interface config to resolv.conf (#5401)
    [Ani Sinha]
    + typing: add no_implicit_optional lint (#5408)
    + doc: update examples to reflect alternative ways to provide `sudo`
    option (#5418) [Ani Sinha]
    + fix(jsonschema): Add missing sudo definition (#5418)
    + chore(doc): migrate cc modules i through r to templates (#5313)
    + chore(doc): migrate grub_dpkg to tmpl add changed/deprecation (#5313)
    + chore(json): migrate cc_apt_configure and json schema indents (#5313)
    + chore(doc): migrate ca_certs/chef to template, flatten schema (#5313)
    + chore(doc): migrate cc_byobu to templates (#5313)
    + chore(doc): migrate cc_bootcmd to templates (#5313)
    + fix(apt): Enable calling apt update multiple times (#5230)
    + chore(VMware): Modify section of instance-id in the customization config
    (#5356) [PengpengSun]
    + fix(treewide): Remove dead code (#5332) [Shreenidhi Shedi]
    + doc: network-config v2 ethernets are of type object (#5381) [Malte Poll]
    + Release 24.1.7 (#5375)
    + fix(azure): url_helper: specify User-Agent when using headers_cb with
    readurl() (#5298) [Ksenija Stanojevic]
    + fix: Stop attempting to resize ZFS in cc_growpart on Linux (#5370)
    + doc: update docs adding YAML 1.1 spec and jinja template references
    + fix(final_message): do not warn on datasourcenone when single ds
    + fix(growpart): correct growpart log message to include value of mode
    + feat(hotplug): disable hotplugd.socket (#5058)
    + feat(hotlug): trigger hotplug after cloud-init.service (#5058)
    + test: add function to push and enable systemd units (#5058)
    + test(util): fix wait_until_cloud_init exit code 2 (#5058)
    + test(hotplug): fix race getting ipv6 (#5271)
    + docs: Adjust CSS to increase font weight across the docs (#5363) [Sally]
    + fix(ec2): Correctly identify netplan renderer (#5361)
    + tests: fix expect logging from growpart on devent with partition (#5360)
    + test: Add v2 test coverage to test_net.py (#5247)
    + refactor: Simplify collect_logs() in logs.py (#5268)
    + fix: Ensure no subp from logs.py import (#5268)
    + tests: fix integration tests for ubuntu pro 32.3 release (#5351)
    + tests: add oracular's hello package for pkg upgrade test (#5354)
    + growpart: Fix behaviour for ZFS datasets (#5169) [Mina Galić]
    + device_part_info: do not recurse if we did not match anything (#5169)
    [Mina Galić]
    + feat(alpine): add support for Busybox adduser/addgroup (#5176)
    [dermotbradley]
    + ci: Move lint tip and py3-dev jobs to daily (#5347)
    + fix(netplan): treat netplan warnings on stderr as debug for cloud-init
    (#5348)
    + feat(disk_setup): Add support for nvme devices (#5263)
    + fix(log): Do not warn when doing requested operation (#5263)
    + Support sudoers in the "/usr/usr merge" location (#5161)
    [Robert Schweikert]
    + doc(nocloud): Document network-config file (#5204)
    + fix(netplan): Fix predictable interface rename issue (#5339)
    + cleanup: Don't execute code on import (#5295)
    + fix(net): Make duplicate route add succeed. (#5343)
    + fix(freebsd): correct configuration of IPv6 routes (#5291) [Théo Bertin]
    + fix(azure): disable use-dns for secondary nics (#5314)
    + chore: fix lint failure (#5320)
    + Update pylint version to support python 3.12 (#5338) [Ani Sinha]
    + fix(tests): use regex to avoid focal whitespace in jinja debug test
    (#5335)
    + chore: Add docstrings and types to Version class (#5262)
    + ci(mypy): add type-jinja2 stubs (#5337)
    + tests(alpine): github trust lxc mounted source dir cloud-init-ro (#5329)
    + test: Add oracular release to integration tests (#5328)
    + Release 24.1.6 (#5326)
    + test: Fix failing test_ec2.py test (#5324)
    + fix: Check renderer for netplan-specific code (#5321)
    + docs: Removal of top-level --file breaking change (#5308)
    + fix: typo correction of delaycompress (#5317)
    + docs: Renderers/Activators have downstream overrides (#5322)
    + fix(ec2): Ensure metadata exists before configuring PBR (#5287)
    + fix(lxd): Properly handle unicode from LXD socket (#5309)
    + docs: Prefer "artifact" over "artefact" (#5311) [Arthur Le Maitre]
    + chore(doc): migrate cc_byobu to templates
    + chore(doc): migrate cc_bootcmd to templates
    + chore(doc): migrate apt_pipelining and apk_configure to templates
    + tests: in_place mount module-docs into lxd vm/container
    + feat(docs): generate rtd module schema from rtd/module-docs
    + feat: Set RH ssh key permissions when no 'ssh_keys' group (#5296)
    [Ani Sinha]
    + test: Avoid circular import in Azure tests (#5280)
    + test: Fix test_failing_userdata_modules_exit_codes (#5279)
    + chore: Remove CPY check from ruff (#5281)
    + chore: Clean up docstrings
    + chore(ruff): Bump to version 0.4.3
    + feat(systemd): Improve AlmaLinux OS and CloudLinux OS support (#5265)
    [Elkhan Mammadli]
    + feat(ca_certs): Add AlmaLinux OS and CloudLinux OS support (#5264)
    [Elkhan Mammadli]
    + docs: cc_apt_pipelining docstring typo fix (#5273) [Alex Ratner]
    + feat(azure): add request identifier to IMDS requests (#5218)
    [Ksenija Stanojevic]
    + test: Fix TestFTP integration test (#5237) [d1r3ct0r]
    + feat(ifconfig): prepare for CIDR output (#5272) [Mina Galić]
    + fix: stop manually dropping dhcp6 key in integration test (#5267)
    [Alec Warren]
    + test: Remove some CiTestCase tests (#5256)
    + fix: Warn when signal is handled (#5186)
    + fix(snapd): ubuntu do not snap refresh when snap absent (LP: #2064300)
    + feat(landscape-client): handle already registered client (#4784)
    [Fabian Lichtenegger-Lukas]
    + doc: Show how to debug external services blocking cloud-init (#5255)
    + fix(pdb): Enable running cloud-init under pdb (#5217)
    + chore: Update systemd description (#5250)
    + fix(time): Harden cloud-init to system clock changes
    + fix: Update analyze timestamp uptime
    + fix(schema): no network validation on netplan systems without API
    + fix(mount): Don't run cloud-init.service if cloud-init disabled (#5226)
    + fix(ntp): Fix AlmaLinux OS and CloudLinux OS support (#5235)
    [Elkhan Mammadli]
    + tests: force version of cloud-init from PPA regardless of version (#5251)
    + ci: Print isort diff (#5242)
    + test: Fix integration test dependencies (#5248)
    + fix(ec2): Fix broken uuid match with other-endianness (#5236)
    + fix(schema): allow networkv2 schema without top-level key (#5239)
    [Cat Red]
    + fix(cmd): Do not hardcode reboot command (#5208)
    + test: Run Alpine tests without network (#5220)
    + docs: Add base config reference from explanation (#5241)
    + docs: Remove preview from WSL tutorial (#5225)
    + chore: Remove broken maas code (#5219)
    + feat(WSL): Add support for Ubuntu Pro configs (#5116) [Ash]
    + chore: sync ChangeLog and version.py from 24.1.x (#5228)
    + bug(package_update): avoid snap refresh in images without snap command
    (LP: #2064132)
    + ci: Skip package build on tox runs (#5210)
    + chore: Fix test skip message
    + test(ec2): adopt pycloudlib public ip creation while launching instances
    + test(ec2): add ipv6 testing for multi-nic instances
    + test(ec2): adopt pycloudlib enable_ipv6 while launching instances
    + feat: tool to print diff between netplan and networkv2 schema (#5200)
    [Cat Red]
    + test: mock internet access in test_upgrade (#5212)
    + ci: Add timezone for alpine unit tests (#5216)
    + fix: Ensure dump timestamps parsed as UTC (#5214)
    + docs: Add WSL tutorial (#5206)
    + feature(schema): add networkv2 schema (#4892) [Cat Red]
    + Add alpine unittests to ci (#5121)
    + test: Fix invalid openstack datasource name (#4905)
    + test: Fix MAAS test and mark xfail (#4905)
    + chore(ds-identify): Update shellcheck ignores (#4905)
    + fix(ds-identify): Prevent various false positives and false negatives
    (#4905)
    + Use grep for faster parsing of cloud config in ds-identify (#4905)
    [Scott Moser] (LP: #2030729)
    + tests: validate netplan API YAML instead of strict content (#5195)
    + chore(templates): update ubuntu universe wording (#5199)
    + Deprecate the users ssh-authorized-keys property (#5162)
    [Anders Björklund]
    + doc(nocloud): Describe ftp and ftp over tls implementation (#5193)
    + feat(net): provide network config to netplan.State for render (#4981)
    + docs: Add breaking datasource identification changes (#5171)
    + fix(openbsd): Update build-on-openbsd python dependencies (#5172)
    [Hyacinthe Cartiaux]
    + fix: Add subnet ipv4/ipv6  to network schema (#5191)
    + docs: Add deprecated system_info to schema (#5168)
    + docs: Add DataSourceNone documentation (#5165)
    + test: Skip test if console log is None (#5188)
    + fix(dhcp): Enable interactively running cloud-init init --local (#5166)
    + test: Update message for netplan apply dbus issue
    + test: install software-properties-common if absent during PPA setup
    + test: bump pycloudlib to use latest version
    + test: Update version of hello package installed on noble
    + test: universally ignore netplan apply dbus issue (#5178)
    + chore: Remove obsolete nose workaround
    + feat: Add support for FTP and FTP over TLS (#4834)
    + feat(opennebula): Add support for posix shell
    + test: Make analyze tests not depend on GNU date
    + test: Eliminate bash dependency from subp tests
    + docs: Add breaking changes section to reference docs (#5147) [Cat Red]
    + util: add log_level kwarg for logexc() (#5125) [Chris Patterson]
    + refactor: Make device info part of distro definition (#5067)
    + refactor: Distro-specific growpart code (#5067)
    + test(ec2): fix mocking with responses==0.9.0 (focal) (#5163)
    + chore(safeyaml): Remove unicode helper for Python2 (#5142)
    + Revert "test: fix upgrade dhcp6 on ec2 (#5131)" (#5148)
    + refactor(net): Reuse netops code
    + refactor(iproute2): Make expressions multi-line for legibility
    + feat(freebsd): support freebsd find part by gptid and ufsid (#5122)
    [jinkangkang]
    + feat: Determining route metric based on NIC name (#5070) [qidong.ld]
    + test: Enable profiling in integration tests (#5130)
    + dhcp: support configuring static routes for dhclient's unknown-121
    option (#5146) [Chris Patterson]
    + feat(azure): parse ProvisionGuestProxyAgent as bool (#5126)
    [Ksenija Stanojevic]
    + fix(url_helper): fix TCP connection leak on readurl() retries (#5144)
    [Chris Patterson]
    + test: pytest-ify t/u/sources/test_ec2.py
    + Revert "ec2: Do not enable dhcp6 on EC2 (#5104)" (#5145) [Major Hayden]
    + fix: Logging sensitive data
    + test: Mock ds-identify systemd path (#5119)
    + fix(dhcpcd): Make lease parsing more robust (#5129)
    + test: fix upgrade dhcp6 on ec2 (#5131)
    + net/dhcp: raise InvalidDHCPLeaseFileError on error parsing dhcpcd lease
    (#5128) [Chris Patterson]
    + fix: Fix runtime file locations for cloud-init (#4820)
    + ci: fix linkcheck.yml invalid yaml (#5123)
    + net/dhcp: bump dhcpcd timeout to 300s (#5127) [Chris Patterson]
    + ec2: Do not enable dhcp6 on EC2 (#5104) [Major Hayden]
    + fix: Fall back to cached local ds if no valid ds found (#4997)
    [PengpengSun]
    + ci: Make linkcheck a scheduled job (#5118)
    + net: Warn when interface rename fails
    + ephemeral(dhcpcd): Set dhcpcd interface down
    + Release 24.1.3
    + chore: Handle all level 1 TiCS security violations (#5103)
    + fix: Always use single datasource if specified (#5098)
    + fix(tests): Leaked mocks (#5097)
    + fix(rhel)!: Fix network boot order in upstream cloud-init
    + fix(rhel): Fix network ordering in sysconfig
    + feat: Use NetworkManager renderer by default in RHEL family
    + fix: Allow caret at the end of apt package (#5099)
    + test: Add missing mocks to prevent bleed through (#5082)
    [Robert Schweikert]
    + fix: Ensure network config in DataSourceOracle can be unpickled (#5073)
    + docs: set the home directory using homedir, not home (#5101)
    [Olivier Gayot] (LP: #2047796)
    + fix(cacerts): Correct configuration customizations for Photon (#5077)
    [Christopher McCann]
    + fix(test): Mock systemd fs path for non-systemd distros
    + fix(tests): Leaked subp.which mock
    + fix(networkd): add GatewayOnLink flag when necessary (#4996) [王煎饼]
    + Release 24.1.2
    + test: fix `disable_sysfs_net` mock (#5065)
    + refactor: don't import subp function directly (#5065)
    + test: Remove side effects from tests (#5074)
    + refactor: Import log module rather than functions (#5074)
    + fix: Fix breaking changes in package install (#5069)
    + fix: Undeprecate 'network' in schema route definition (#5072)
    + refactor(ec2): simplify convert_ec2_metadata_network_config
    + fix(ec2): fix ipv6 policy routing
    + fix: document and add 'accept-ra' to network schema (#5060)
    + bug(maas): register the correct DatasourceMAASLocal in init-local
    (#5068) (LP: #2057763)
    + ds-identify: Improve ds-identify testing flexibility (#5047)
    + fix(ansible): Add verify_commit and inventory to ansible.pull schema
    (#5032) [Fionn Fitzmaurice]
    + doc: Explain breaking change in status code (#5049)
    + gpg: Handle temp directory containing files (#5063)
    + distro(freebsd): add_user: respect homedir (#5061) [Mina Galić]
    + doc: Install required dependencies (#5054)
    + networkd: Always respect accept-ra if set (#4928) [Phil Sphicas]
    + chore: ignore all cloud-init_*.tar.gz in .gitignore (#5059)
    + test: Don't assume ordering of ThreadPoolExecutor submissions (#5052)
    + feat: Add new distro 'azurelinux' for Microsoft Azure Linux. (#4931)
    [Dan Streetman]
    + fix(gpg): Make gpg resilient to host configuration changes (#5026)
    + Sync 24.1.1 changelog and version
    + DS VMware: Fix ipv6 addr converter from netinfo to netifaces (#5029)
    [PengpengSun]
    + packages/debian: remove dependency on isc-dhcp-client (#5041)
    [Chris Patterson]
    + test: Allow fake_filesystem to work with TemporaryDirectory (#5035)
    + tests: Don't wait for GCE instance teardown (#5037)
    + fix: Include DataSourceCloudStack attribute in unpickle test (#5039)
    + bug(vmware): initialize new DataSourceVMware attributes at unpickle
    (#5021) (LP: #2056439)
    + fix(apt): Don't warn on apt 822 source format (#5028)
    + fix(atomic_helper.py): ensure presence of parent directories (#4938)
    [Shreenidhi Shedi]
    + fix: Add "broadcast" to network v1 schema (#5034) (LP: #2056460)
    + pro: honor but warn on custom ubuntu_advantage in /etc/cloud/cloud.cfg
    (#5030)
    + net/dhcp: handle timeouts for dhcpcd (#5022) [Chris Patterson]
    + fix: Make wait_for_url respect explicit arguments
    + test: Fix scaleway retry assumptions
    + fix: Make DataSourceOracle more resilient to early network issues
    (#5025) (LP: #2056194)
    + chore(cmd-modules): fix exit code when --mode init (#5017)
    + feat: pylint: enable W0201 - attribute-defined-outside-init
    + refactor: Ensure no attributes defined outside __init__
    + chore: disable attribute-defined-outside-init check in tests
    + refactor: Use _unpickle rather than hasattr() in sources
    + chore: remove unused vendordata "_pure" variables
    + chore(cmd-modules): deprecate --mode init (#5005)
    + tests: drop CiTestCase and convert to pytest
    + bug(tests): mock reads of host's /sys/class/net via get_sys_class_path
    + fix: log correct disabled path in ds-identify (#5016)
    + tests: ec2 dont spend > 1 second retrying 19 times when 3 times will do
    + tests: openstack mock expected ipv6 IMDS
    + bug(wait_for_url): when exceptions occur url is unset, use url_exc
    (LP: #2055077)
    + feat(run-container): Run from arbitrary commitish (#5015)
    + tests: Fix wsl test (#5008)
    + feat(ds-identify): Don't run unnecessary systemd-detect-virt (#4633)
    + chore(ephemeral): add debug log when bringing up ephemeral network
    (#5010) [Alec Warren]
    + release: sync changelog and version (#5011)
    + Cleanup test_net.py (#4840)
    + refactor: remove dependency on netifaces (#4634) [Cat Red]
    + feat: make lxc binary configurable (#5000)
    + docs: update 404 page for new doc site and bug link
    + test(aws): local network connectivity on multi-nics (#4982)
    + test: Make integration test output more useful (#4984)
    From 24.1.7
    + fix(ec2): Correctly identify netplan renderer (#5361)
    From 24.1.6
    + fix(ec2): Ensure metadata exists before configuring PBR (#5287)
    + fix: Check renderer for netplan-specific code (#5321)
    + test: Fix failing test_ec2.py test (#5324)
    From 24.1.5
    + fix(package_update): avoid snap refresh in images without snap command
    (LP: #2064132)
    From 24.1.4
    + fix(dhcpcd): Make lease parsing more robust (#5129)
    + net/dhcp: raise InvalidDHCPLeaseFileError on error parsing dhcpcd lease
    + (#5128) [Chris Patterson]
    + fix: Fix runtime file locations for cloud-init (#4820)
    + net/dhcp: bump dhcpcd timeout to 300s (#5127) [Chris Patterson]
    + net: Warn when interface rename fails
    + ephemeral(dhcpcd): Set dhcpcd interface down
    + test: Remove side effects from tests (#5074)
    + refactor: Import log module rather than functions (#5074)
    From 24.1.3
    + fix: Always use single datasource if specified (#5098)
    + fix: Allow caret at the end of apt package (#5099)
    From 24.1.2
    + test: Don't assume ordering of ThreadPoolExecutor submissions (#5052)
    + refactor(ec2): simplify convert_ec2_metadata_network_config
    + tests: drop CiTestCase and convert to pytest
    + bug(tests): mock reads of host's /sys/class/net via get_sys_class_path
    + fix: Fix breaking changes in package install (#5069)
    + fix: Undeprecate 'network' in schema route definition (#5072)
    + fix(ec2): fix ipv6 policy routing
    + fix: document and add 'accept-ra' to network schema (#5060)
    + bug(maas): register the correct DatasourceMAASLocal in init-local
    (#5068) (LP: #2057763)
    From 24.1.1
    + fix: Include DataSourceCloudStack attribute in unpickle test (#5039)
    + bug(vmware): initialize new DataSourceVMware attributes at unpickle (#5021)
    + fix(apt): Don't warn on apt 822 source format (#5028)
    + fix: Add "broadcast" to network v1 schema (#5034)
    + pro: honor but warn on custom ubuntu_advantage in /etc/cloud/cloud.cfg
    (#5030)
    + net/dhcp: handle timeouts for dhcpcd (#5022)
    + fix: Make wait_for_url respect explicit arguments
    + bug(wait_for_url): when exceptions occur url is unset, use url_exc
    + test: Fix scaleway retry assumptions
    + fix: Make DataSourceOracle more resilient to early network issues (#5025)
    + tests: Fix wsl test (#5008)
    From 24.1
    + fix: Don't warn on vendor directory (#4986)
    + apt: kill spawned keyboxd after gpg cmd interaction
    + tests: upgrade tests should only validate current boot log
    + net/dhcp: fix maybe_perform_dhcp_discovery check for interface=None
    [Chris Patterson]
    + doc(network-v2): fix section nesting levels
    + fix(tests): don't check for clean log on minimal image (#4965) [Cat Red]
    + fix(cc_resize): Don't warn if zpool command not found (#4969)
    (LP: #2055219)
    + feat(subp): Make invalid command warning more user-friendly (#4972)
    + docs: Remove statement about device path matching (#4966)
    + test: Fix xfail to check the dhcp client name (#4971)
    + tests: avoid console prompts when removing gpg on Noble
    + test: fix test_get_status_systemd_failure
    + fix: Remove hardcoded /var/lib/cloud hotplug path (#4940)
    + refactor: Refactor status.py (#4864)
    + test: Use correct lxd network-config keys (#4950)
    + test: limit temp dhcp6 changes to < NOBLE (#4942)
    + test: allow downgrades when install debs (#4941)
    + tests: on noble, expect default /etc/apt/sources.list
    + tests: lxd_vm early boot status test ordered After=systemd-remount-fs
    (#4936)
    + tests: pro integration tests supply ubuntu_advantage until pro v32
    (#4935)
    + feat(hotplug): add cmd to enable hotplug (#4821)
    + test: fix test_combined_cloud_config_json (#4925)
    + test: xfail udhcpc on azure (#4924)
    + feat: Implement the WSL datasource (#4786) [Carlos Nihelton]
    + refactor(openrc):  Improve the OpenRC files (#4916) [dermotbradley]
    + tests: use apt install instead of dpkg -i to install pkg deps
    + tests: inactive module rename ubuntu_advantage to ubuntu_pro
    + test: fix tmpdir in test_cc_apk_configure (#4914)
    + test: fix jsonschema version checking in pro test (#4915)
    + feat(dhcp): Make dhcpcd the default dhcp client (#4912)
    + feat(Alpine) cc_growpart.py: fix handling of /dev/mapper devices (#4876)
    [dermotbradley]
    + test: Retry longer in test_status.py integration test (#4910)
    + test: fix kernel override test (#4913)
    + chore: Rename sysvinit/gentoo directory to sysvinit/openrc (#4906)
    [dermotbradley]
    + doc: update ubuntu_advantage references to pro
    + chore: rename cc_ubuntu_advantage to cc_ubuntu_pro (SC-1555)
    + feat(ubuntu pro): deprecate ubuntu_pro key in favor of ubuntu_advantage
    + feat(schema): support ubuntu_pro key and deprecate ubuntu_advantage
    + test: fix verify_clean_log (#4903)
    + test: limit test_no_hotplug_triggered_by_docker to stable releases
    + tests: generalize warning Open vSwitch warning from netplan apply (#4894)
    + fix(hotplug): remove literal quotes in args
    + feat(apt): skip known /etc/apt/sources.list content
    + feat(apt): use APT deb822 source format by default
    + test(ubuntu-pro): change livepatch to esm-infra
    + doc(ec2): fix metadata urls (#4880)
    + fix: unpin jsonschema and update tests (#4882)
    + distro: add eject FreeBSD code path (#4838) [Mina Galić]
    + feat(ec2): add hotplug as a default network update event (#4799)
    + feat(ec2): support instances with repeated device-number (#4799)
    + feat(cc_install_hotplug): trigger hook on known ec2 drivers (#4799)
    + feat(ec2): support multi NIC/IP setups (#4799)
    + feat(hotplug): hook-hotplug is now POSIX shell add OpenRC init script
    [dermotbradley]
    + test: harden test_dhcp.py::test_noble_and_newer_force_client
    + test: fix test_combined_cloud_config_json (#4868)
    + feat(apport): Disable hook when disabled (#4874)
    + chore: Add pyright ignore comments (#4874)
    + bug(apport): Fix invalid typing (#4874)
    + refactor: Move general apport hook to main branch (#4874)
    + feat(bootspeed)!: cloud-config.service drop After=snapd.seeded
    + chore: update CI package build to oldest supported Ubuntu release focal
    (#4871)
    + test: fix test_cli.test_valid_userdata
    + feat: handle error when log file is empty (#4859) [Hasan]
    + test: fix test_ec2_ipv6
    + fix: Address TIOBE abstract interpretation issues (#4866)
    + feat(dhcp): Make udhcpc use same client id (#4830)
    + feat(dhcp): Support InfiniBand with dhcpcd (#4830)
    + feat(azure): Add ProvisionGuestProxyAgent OVF setting (#4860)
    [Ksenija Stanojevic]
    + test: Bring back dhcp6 integration test changes (#4855)
    + tests: add status --wait blocking test from early boot
    + tests: fix retry decorator to return the func value
    + docs: add create_hostname_file to all hostname user-data examples
    (#4727) [Cat Red]
    + fix: Fix typos (#4850) [Viktor Szépe]
    + feat(dhcpcd): Read dhcp option 245 for azure wireserver (#4835)
    + tests(dhcp): Add udhcpc client to test matrix (#4839)
    + fix: Add types to network v1 schema (#4841)
    + docs(vmware): fixed indentation on example userdata yaml (#4854)
    [Alec Warren]
    + tests: Remove invalid keyword from method call
    + fix: Handle systemctl when dbus not ready (#4842) (LP: #2046483)
    + fix(schema cli): avoid netplan validation on net-config version 1
    + tests: reduce expected reports due to dropped rightscale module
    + tests(net-config): add awareness of netplan on stable Ubuntu
    [Gilbert Gilb's]
    + feat: fall back to cdrom_id eject if eject is not available (#4769)
    [Cat Red]
    + fix(packages/bddeb): restrict debhelper-compat to 12 in focal (#4831)
    + tests: Add kernel commandline test (#4833)
    + fix: Ensure NetworkManager renderer works without gateway (#4829)
    + test: Correct log parsing in schema test (#4832)
    + refactor: Remove cc_rightscale_userdata (#4813)
    + refactor: Replace load_file with load_binary_file to simplify typing
    (#4823)
    + refactor: Add load_text_file function to simplify typing (#4823)
    + refactor: Change variable name for consistent typing (#4823)
    + feat(dhcp): Add support for dhcpcd (#4746)
    + refactor: Remove unused networking code (#4810)
    + test: Add more DNS net tests
    + BREAKING CHANGE: Stop adding network v2 DNS to global DNS
    + doc: update DataSource.default_update_events doc (#4815)
    + chore: do not modify instance attribute (#4815)
    + test: fix mocking leaks (#4815)
    + Revert "ci: Pin pytest<8.0.0. (#4816)" (#4815)
    + test: Update tests for passlib (#4818)
    + fix(net-schema): no warn when skipping schema check on non-netplan
    + feat(SUSE): reboot marker file is written as /run/reboot-needed (#4788)
    [Robert Schweikert]
    + test: Cleanup unwanted logger setup calls (#4817)
    + refactor(cloudinit.util): Modernize error handling, add better warnings
    (#4812)
    + ci: Pin pytest<8.0.0. (#4816)
    + fix(tests): fixing KeyError on integrations tests (#4811) [Cat Red]
    + tests: integration for network schema on netplan systems (#4767)
    + feat(schema): use netplan API to validate network-config (#4767)
    + chore: define CLOUDINIT_NETPLAN_FILE static var (#4767)
    + fix: cli schema config-file option report network-config type (#4767)
    + refactor(azure): replace BrokenAzureDataSource with reportable errors
    (#4807) [Chris Patterson]
    + Fix Alpine and Mariner /etc/hosts templates (#4780) [dermotbradley]
    + tests: revert #4792 as noble images no longer return 2 (#4809) [Cat Red]
    + tests: use client fixture instead of class_client in cleantest (#4806)
    + tests: enable ds-idenitfy xfail test LXD-kvm-not-MAAS-1 (#4808)
    + fix(tests): failing integration tests due to missing ua token (#4802)
    [Cat Red]
    + Revert "Use grep for faster parsing of cloud config in ds-identify
    (#4327)"
    + tests: Demonstrate ds-identify yaml parsing broken
    + tests: add exit 2 on noble from cloud-init status (#4792)
    + fix: linkcheck for ci to ignore scaleway anchor URL (#4793)
    + feat: Update cacerts to support VMware Photon (#4763)
    [Christopher McCann]
    + fix: netplan rendering integrations tests (#4795) [Cat Red]
    + azure: remove cloud-init.log reporting via KVP (#4715) [Chris Patterson]
    + feat(Alpine): Modify ds-identify for Alpine support and add OpenRC
    init.d script (#4785) [dermotbradley]
    + doc: Add DatasourceScaleway documentation (#4773) [Louis Bouchard]
    + fix: packaged logrotate file lacks suffix on ubuntu (#4790)
    + feat(logrotate): config flexibility more backups (#4790)
    + fix(clean): stop warning when running clean command (#4761) [d1r3ct0r]
    + feat: network schema v1 strict on nic name length 15 (#4774)
    + logrotate config (#4721) [Fabian Lichtenegger-Lukas]
    + test: Enable coverage in integration tests (#4682)
    + test: Move unit test helpers to global test helpers (#4682)
    + test: Remove snapshot option from install_new_cloud_init (#4682)
    + docs: fix cloud-init single param docs (#4682)
    + Alpine: fix location of dhclient leases file (#4782) [dermotbradley]
    + test(jsonschema): Pin jsonschema version (#4781)
    + refactor(IscDhclient): discover DHCP leases at distro-provided location
    (#4683) [Phsm Qwerty]
    + feat: datasource check for WSL (#4730) [Carlos Nihelton]
    + test: Update hostname integration tests (#4744)
    + test: Add mantic and noble releases to integration tests (#4744)
    + refactor: Ensure internal DNS state same for v1 and v2 (#4756)
    + feat: Add v2 route mtu rendering to NetworkManager (#4748)
    + tests: stable ubuntu releases will not exit 2 on warnings (#4757)
    + doc(ds-identify): Describe ds-identify irrespective of distro (#4742)
    + fix: relax NetworkManager renderer rules (#4745)
    + fix: fix growpart race (#4618)
    + feat: apply global DNS to interfaces in network-manager  (#4723)
    [Florian Apolloner]
    + feat(apt): remove /etc/apt/sources.list when deb22 preferred (#4740)
    + chore: refactor schema data as enums and namedtuples (#4585)
    + feat(schema): improve CLI message on unprocessed data files (#4585)
    + fix(config): relocate /run to /var/run on BSD (canonical#4677)
    [Mina Galić]
    + fix(ds-identify): relocate /run on *BSD (#4677) [Mina Galić]
    + fix(sysvinit): make code a bit more consistent (#4677) [Mina Galić]
    + doc: Document how cloud-init is, not how it was (#4737)
    + tests: add expected exit 2 on noble from cloud-init status (#4738)
    + test(linkcheck): ignore github md and rst link headers (#4734)
    + test: Update webhook test due to removed cc_migrator module (#4726)
    + fix(ds-identify): Return code 2 is a valid result, use cached value
    + fix(cloudstack): Use parsed lease file for virtual router in cloudstack
    + fix(dhcp): Guard against FileNotFoundError and NameError exceptions
    + fix(apt_configure): disable sources.list if rendering deb822 (#4699)
    (LP: #2045086)
    + docs: Add link to contributing to docs (#4725) [Cat Red]
    + chore: remove commented code (#4722)
    + chore: Add log message when create_hostname_file key is false (#4724)
    [Cat Red]
    + fix: Correct v2 NetworkManager route rendering (#4637)
    + azure/imds: log http failures as warnings instead of info (#4714)
    [Chris Patterson]
    + fix(setup): Relocate libexec on OpenBSD (#4708) [Mina Galić]
    + feat(jinja): better jinja feedback and error catching (#4629)
    [Alec Warren]
    + test: Fix silent swallowing of unexpected subp error (#4702)
    + fix: Move cloud-final.service after time-sync.target (#4610)
    [Dave Jones] (LP: #1951639)
    + feat(log): Make logger name more useful for __init__.py
    + chore: Remove cc_migrator module (#4690)
    + fix(tests): make cmd/devel/tests work on non-GNU [Mina Galić]
    + chore: Remove cmdline from spelling list (#4670)
    + doc: Document boot status meaning (#4670)
    + doc: Set expectations for new datasources (#4670)
    + ci: Show linkcheck broken links in job output (#4670)
    + dmi: Add support for OpenBSD (#4654) [Mina Galić]
    + ds-identify: fake dmidecode support on OpenBSD (#4654) [Mina Galić]
    + ds-identify: add OpenBSD support in uname (#4654) [Mina Galić]
    + refactor: Ensure '_cfg' in Init class is dict (#4674)
    + refactor: Make event scope required in stages.py (#4674)
    + refactor: Remove unused argument (#4674)
    + chore: Move from lintian to a sphinx spelling plugin (#3639)
    + fix(doc): Fix spelling errors found by sphinxcontrib-spelling (#3639)
    + ci: Add Python 3.13 (#4567)
    + Add AlexSv04047 to CLA signers file (#4671) [AlexSv04047]
    + fix(openbsd): services & build tool (#4660) [CodeBleu]
    + tests/unittests: add a new unit test for network manager net activator
    (#4672) [Ani Sinha]
    + Implement DataSourceCloudStack.get_hostname() (#4433) [Phsm Qwerty]
    + net/nm: check for presence of ifcfg files when nm connection files
    are absent (#4645) [Ani Sinha]
    + doc: Overhaul debugging documentation (#4578)
    + doc: Move dangerous commands to dev docs (#4578)
    + doc: Relocate file location docs (#4578)
    + doc: Remove the debugging page (#4578)
    + fix(util): Fix boottime to work on OpenBSD (#4667) [Mina Galić]
    + net: allow dhcp6 configuration from generate_fallback_configuration()
    [Ani Sinha]
    + net/network_manager: do not set "may-fail" to False for both ipv4 and
    ipv6 dhcp [Ani Sinha]
    + feat(subp): Measure subprocess command time (#4606)
    + fix(python3.13): Fix import error for passlib on Python 3.13 (#4669)
    + style(brpm/bddeb): add black and ruff for packages build scripts (#4666)
    + copr: remove TODO.rst from spec file
    + fix(packages/brpm): correct syntax error and typo
    + style(ruff): fix tip target
    + config: Module documentation updates (#4599)
    + refactor(subp): Remove redundant parameter 'env' (#4555)
    + refactor(subp): Remove unused parameter 'target' (#4555)
    + refactor: Remove 'target' boilerplate from cc_apt_configure (#4555)
    + refactor(subp): Re-add return type to subp() (#4555)
    + refactor(subp): Add type information to args (#4555)
    + refactor(subp): Use subprocess.DEVNULL (#4555)
    + refactor(subp): Remove parameter 'combine_capture' (#4555)
    + refactor(subp): Remove unused parameter 'status_cb' (#4555)
    + fix(cli): fix parsing of argparse subcommands (#4559)
    [Calvin Mwadime] (LP: #2040325)
    + chore!: drop support for dsa ssh hostkeys in docs and schema (#4456)
    + chore!: do not generate ssh dsa host keys (#4456) [shixuantong]
    From 23.4.4
    + fix(nocloud): smbios datasource definition
    + tests: Check that smbios seed works
    + fix(source): fix argument boundaries when parsing cmdline (#4825)
    From 23.4.3
    + fix: Handle systemctl when dbus not ready (#4842)
    (LP: #2046483)
    From 23.4.2
    + fix: Handle invalid user configuration gracefully (#4797)
    (LP: #2051147)
    From 23.4.1
    + fix: Handle systemctl commands when dbus not ready (#4681)
    From 23.4
    + tests: datasourcenone use client.restart to block until done (#4635)
    + tests: increase number of retries across reboot to 90 (#4651)
    + fix: Add schema for merge types (#4648)
    + feat: Allow aliyun ds to fetch data in init-local (#4590) [qidong.ld]
    + azure: report failure to eject as error instead of debug (#4643)
    [Chris Patterson]
    + bug(schema): write network-config if instance dir present (#4635)
    + test: fix schema fuzzing test (#4639)
    + Update build-on-openbsd dependencies (#4644) [CodeBleu]
    + fix(test): Fix expected log for ipv6-only ephemeral network (#4641)
    + refactor: Remove metaclass from network_state.py (#4638)
    + schema: non-root fallback to default paths on perm errors (# 4631)
    + fix: Don't loosen the permissions of the log file (#4628)
    + Revert "logging: keep current file mode of log file if its stricter
    than the new mode (#4250)"
    + ephemeral: Handle link up failure for both ipv4 and ipv6  (#4547)
    + fix(main): Don't call logging too early (#4595)
    + fix: Remove Ubuntu-specific kernel naming convention assertion (#4617)
    + fix(log): Do not implement handleError with a self parameter (#4617)
    + fix(log): Don't try to reuse stderr logger (#4617)
    + feat: Standardize logging output to stderr (#4617)
    + chore: Sever unmaintained TODO.rst (#4625)
    + test: Skip failing tests
    + distros: Add suse
    + test: Add default hello package version (#4614)
    + fix(net): Improve DHCPv4 SUSE code, add test
    + net: Fix DHCPv4 not enabled on SUSE in some cases [bin456789]
    + fix(schema): Warn if missing dependency (#4616)
    + fix(cli): main source cloud_config for schema validation (#4562)
    + feat(schema): annotation path for invalid top-level keys (#4562)
    + feat(schema): top-level additionalProperties: false (#4562)
    + test: ensure top-level properties tests will pass (#4562)
    + fix(schema): Add missing schema definitions (#4562)
    + test: Fix snap tests (#4562)
    + azure: Check for stale pps data from IMDS (#4596) [Ksenija Stanojevic]
    + test: Undo dhcp6 integration test changes (#4612)
    + azure: update diagnostic from warning level to debug [Chris Patterson]
    + azure/imds: remove limit for connection errors if route present (#4604)
    + [Chris Patterson]
    + [enhancement]: Add shellcheck to CI (#4488) [Aviral Singh]
    + chore: add conventional commits template (#4593)
    + Revert "net: allow dhcp6 configuration from
    generate_fallback_configuration()" (#4607)
    + azure: workaround to disable reporting IMDS failures on Azure Stack
    [Chris Patterson]
    + cc_apt_pipelining: Update docs, deprecate options (#4571)
    + test: add gh workflows on push to main, update status badges (#4597)
    + util: Remove function abs_join() (#4587)
    + url_helper: Remove unused function retry_on_url_exc() (#4587)
    + cc_resizefs: Add bcachefs resize support (#4594)
    + integration_tests: Support non-Ubuntu distros (#4586)
    + fix(cmdline): fix cmdline parsing with MAC containing cc:
    + azure/errors: include http code in reason for IMDS failure
    [Chris Patterson]
    + tests: cloud-init schema --system does not return exit code 2
    + github: allow pull request to specify desired rebase and merge
    + tests: fix integration test expectations of exit 2 on schema warning
    + tests: fix schema test expected cli output Valid schema <type>
    + fix(schema cli): check raw userdata when processed cloud-config empty
    + azure: report failure to host if ephemeral DHCP secondary NIC (#4558)
    [Chris Patterson]
    + man: Document cloud-init error codes (#4500)
    + Add support for cloud-init "degraded" state (#4500)
    + status.json: Don't override detail key with error condition (#4500)
    + status: Remove duplicated data (#4500)
    + refactor: Rename exported_errors in status.json (#4500)
    + test: Remove stale status.json value (#4500)
    + tools/render-template: Make yaml loading opt-in, fix setup.py (#4564)
    + Add summit digest/trip report to docs (#4561) [Sally]
    + doc: Fix incorrect statement about `cloud-init analyze`
    + azure/imds: ensure new errors are logged immediately when retrying
    (#4468) [Chris Patterson]
    + Clarify boothook docs (#4543)
    + boothook: allow stdout/stderr to emit to cloud-init-output.log
    + summit-notes: add 2023 notes for reference in mailinglist/discourse
    + fix: added mock to stop leaking journalctl that slows down unit test
    (#4556) [Alec Warren]
    + tests: maas test for DataSourceMAASLocal get_data
    + maas tests: avoid using CiTest case and prefer pytest.tmpdir fixture
    + MAAS: Add datasource to init-local timeframe
    + Ensure all tests passed and/or are skipped
    + Support QEMU in integration tests
    + fix(read-dependencies): handle version specifiers containing [~!]
    + test: unpin pytest
    + schema: network-config optional network key. route uses oneOf (#4482)
    + schema: add cloud_init_deepest_matches for best error message (#4482)
    + network: warn invalid cfg add /run/cloud-init/network-config  (#4482)
    + schema: add network-config support to schema subcommand (#4482)
    + Update version number and merge ChangeLog from 23.3.3 into main (#4553)
    + azure: check for primary interface when performing DHCP (#4465)
    [Chris Patterson]
    + Fix hypothesis failure
    + subp: add a log when skipping a file for execution for lack of exe
    permission (#4506) [Ani Sinha]
    + azure/imds: refactor max_connection_errors definition (#4467)
    [Chris Patterson]
    + chore: fix PR template rendering (#4526)
    + fix(cc_apt_configure): avoid unneeded call to apt-install (#4519)
    + comment difference between sysconfig and NetworkManager renderer (#4517)
    [Ani Sinha]
    + Set Debian's default locale to be c.UTF-8 (#4503) (LP: #2038945)
    + Convert test_debian.py to pytest (#4503)
    + doc: fix cloudstack link
    + doc: fix development/contributing.html references
    + doc: hide duplicated links
    + Revert "ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen
    (#4281)" (#4511) (LP: #2039453)
    + Fix the missing mcopy argument [Vladimir Pouzanov]
    + tests: Add logging fix (#4499)
    + Update upgrade test to account for dhcp6
    + Remove logging of PPID path (#4502)
    + Make Python 3.12 CI test non-experimental (#4498)
    + ds-identify: exit 2 on disabled state from marker or cmdline (#4399)
    + cloud-init-generator: Various performance optimizations (#4399)
    + systemd: Standardize cloud-init systemd enablement (#4399)
    + benchmark: benchmark cloud-init-generator independent of ds-identify
    (#4399)
    + tests/integration_tests: add cloud-init disablement coverage (#4399)
    + doc: Describe disabling cloud-init using an environment variable (#4399)
    + fix: cloud-init status --wait broken with KERNEL_CMDLINE (#4399)
    + azure/imds: retry on 429 errors for reprovisiondata (#4470)
    [Chris Patterson]
    + cmd: Don't write json status files for non-boot stages (#4478)
    + ds-identify: Allow disable service and override environment (#4485)
    [Mina Galić]
    + Update DataSourceNWCS.py (#4496) [shell-skrimp]
    + Add r00ta to CLA signers file
    + Fix override of systemd_locale_conf in rhel [Jacopo Rota]
    + ci(linkcheck): minor fixes (#4495)
    + integration test fix for deb822 URI format (#4492)
    + test: use a mantic-compatible tz in t/i/m/test_combined.py (#4494)
    + ua: shift CLI command from ua to pro for all interactions
    + pro: avoid double-dash when enabling inviddual services on CLI
    + net: allow dhcp6 configuration from generate_fallback_configuration()
    (#4474) [Ani Sinha]
    + tests: apt re.search to match alternative ordering of installed pkgs
    + apt: doc apt_pkg performance improvement over subp apt-config dump
    + Tidy up contributing docs (#4469) [Sally]
    + [enhancement]: Automatically linkcheck in CI (#4479) [Aviral Singh]
    + Revert allowing pro service warnings (#4483)
    + Export warning logs to status.json (#4455)
    + Fix regression in package installation (#4466)
    + schema: cloud-init schema in early boot or in dev environ (#4448)
    + schema: annotation of nested dicts lists in schema marks (#4448)
    + feat(apport): collect ubuntu-pro logs if ubuntu-advantage.log present
    (#4443)
    + apt_configure: add deb822 support for default sources file (#4437)
    + net: remove the word "on instance boot" from cloud-init generated config
    (#4457) [Ani Sinha]
    + style: Make cloudinit.log functions use snake case (#4449)
    + Don't recommend using cloud-init as a library (#4459)
    + vmware: Fall back to vmtoolsd if vmware-rpctool errs (#4444)
    [Andrew Kutz]
    + azure: add option to enable/disable secondary ip config (#4432)
    + [Ksenija Stanojevic]
    + Allow installing snaps via package_update_upgrade_install module (#4202)
    + docs: Add cloud-init overview/introduction (#4440) [Sally]
    + apt: install software-properties-common when absent but needed (#4441)
    + sources/Azure: Ignore system volume information folder while scanning
    for files in the ntfs resource disk (#4446) [Anh Vo]
    + refactor: Remove unnecessary __main__.py file
    + style: Drop vi format comments
    + cloudinit.log: Use more appropriate exception (#4435)
    + cloudinit.log: Don't configure NullHandler (#4435)
    + commit 6bbbfbbb030831c72b5aa2bba9cb8492f19d56f4
    + cloudinit.log: Remove unnecessary module function and variables (#4435)
    + cloudinit.log: Remove unused getLogger wrapper (#4435)
    + cloudinit.log: Standardize use of cloudinit's logging module (#4435)
    + Remove unnecessary logging wrapper in Cloud class (#4435)
    + integration test: allow pro service warnings (#4447)
    + integration tests: fix mount indentation (#4445)
    + sources/Azure: fix for conflicting reports to platform (#4434)
    [Chris Patterson]
    + docs: link the cloud-config validation service (#4442)
    + Fix pip-managed ansible on pip < 23.0.1 (#4403)
    + Install gnupg if gpg not found (#4431)
    + Add "phsm" as contributor (#4429) [Phsm Qwerty]
    + cc_ubuntu_advantage: do not rely on uaclient.messages module (#4397)
    [Grant Orndorff]
    + tools/ds-identify: match Azure datasource's ds_detect() behavior (#4430)
    [Chris Patterson]
    + Refactor test_apt_source_v1.py to use pytest (#4427)
    + sources: do not override datasource detection if None is in list (#4426)
    [Chris Patterson]
    + feat: check for create_hostname_file key before writing /etc/hostname
    (SC-1588) (#4330) [Cat Red]
    + Pytestify apt config test modules (#4424)
    + upstream gentoo patch (#4422)
    + Work around no instance ip (#4419)
    + Fix typing issues in subp module (#4401)
    + net: fix ipv6_dhcpv6_stateful/stateless/slaac configuration for rhel
    (#4395) [Ani Sinha]
    + Release 23.3.1
    + apt: kill dirmngr/gpg-agent without gpgconf dependency (LP: #2034273)
    + integration tests: fix mount indentation (#4405)
    + Use grep for faster parsing of cloud config in ds-identify (#4327)
    [Scott Moser] (LP: #2030729)
    + doc: fix instructions on how to disable cloud-init from kernel command
    line (#4406) [Ani Sinha]
    + doc/vmware: Update contents relevant to disable_vmware_customization
    [PengpengSun]
    + Bring back flake8 for python 3.6 (#4394)
    + integration tests: Fix cgroup parsing (#4402)
    + summary: Update template parameter descriptions in docs [MJ Moshiri]
    + Log PPID for better debugging (#4398)
    + integration tests: don't clean when KEEP_* flags true (#4400)
    + clean: add a new option to clean generated config files [Ani Sinha]
    + pep-594: drop deprecated pipes module import
    From 23.3.3
    + Fix pip-managed ansible on pip < 23.0.1 (#4403)
    From 23.3.2
    + Revert "ds-identify/CloudStack: $DS_MAYBE if vm running on vmware/xen"
    (#4281) (#4511) (LP: #2039453)
    From 23.3.1
    + apt: kill dirmngr/gpg-agent without gpgconf dependency (LP: #2034273)
    + integration tests: Fix cgroup parsing (#4402)

++++ python-kiwi:

  - Bump version: 10.2.21 → 10.2.22
  - Apply security context on writable root only
    Make sure to perform setfiles only on a writable target. In case
    of a read-only root it is expected that the security context set
    by kiwi in an earlier stage is complete. As there is no way to
    modify data when root is read-only, there is also no way to change
    the security context of any file such that we skip setfiles
    in this case. Should there be a read-only system that has writable
    partitions such as /boot and their content changes while the rest
    of the root system is read-only it is in the responsibility of
    the author of the image description to call setfiles only on
    the affected and still writable files via a custom disk.sh
    script. Along with the fix the respective integration test was
    modified to enable selinux such that this change is actually
    integration tested. This Fixes #2805
  - Docs: fix typo in users.rst

++++ python-kiwi:

  - Bump version: 10.2.21 → 10.2.22
  - Apply security context on writable root only
    Make sure to perform setfiles only on a writable target. In case
    of a read-only root it is expected that the security context set
    by kiwi in an earlier stage is complete. As there is no way to
    modify data when root is read-only, there is also no way to change
    the security context of any file such that we skip setfiles
    in this case. Should there be a read-only system that has writable
    partitions such as /boot and their content changes while the rest
    of the root system is read-only it is in the responsibility of
    the author of the image description to call setfiles only on
    the affected and still writable files via a custom disk.sh
    script. Along with the fix the respective integration test was
    modified to enable selinux such that this change is actually
    integration tested. This Fixes #2805
  - Docs: fix typo in users.rst

++++ openssl-3:

  - Security fix: [bsc#1240366, CVE-2025-27587]
    * Minerva side channel vulnerability in P-384 on PPC arch
    * Add openssl-3-p384-minerva-ppc.patch
    * Add openssl-3-p384-minerva-ppc-p9.patch

------------------------------------------------------------------
------------------  2025-5-14  -  May 14 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Docs: minor punctuation and grammar fixes
  - Give test-image-overlayroot enough space
  - Allow ext2/ext3 as valid build target
    stat reports the value 'ext2/ext3' which is a valid target
  - Added check_target_dir_on_unsupported_filesystem
    Add runtime check to make sure the selected target directory
    for the image and/or the image rootfs lives on a filesystem
    that provides all required features like extended permissions,
    ACLs or xattrs.

++++ python-kiwi:

  - Docs: minor punctuation and grammar fixes
  - Give test-image-overlayroot enough space
  - Allow ext2/ext3 as valid build target
    stat reports the value 'ext2/ext3' which is a valid target
  - Added check_target_dir_on_unsupported_filesystem
    Add runtime check to make sure the selected target directory
    for the image and/or the image rootfs lives on a filesystem
    that provides all required features like extended permissions,
    ACLs or xattrs.

++++ mozilla-nss:

  - update to NSS 3.110
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
    * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
    * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
    * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
    * bmo#1930807 - NSS policy updates
    * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
    * bmo#1951394 - Fix race in sdb_GetMetaData
    * bmo#1951800 - Fix member access within null pointer
    * bmo#1950077 - Increase smime fuzzer memory limit
    * bmo#1949677 - Enable resumption when using custom extensions
    * bmo#1952568 - change CN of server12 test certificate
    * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
    * bmo#1949118 - Part 1: Fix smime UBSan errors
    * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
    * bmo#1951491 - Don't build libpkix in static builds
    * bmo#1951395 - handle `-p all` in try syntax
    * bmo#1951346 - fix opt-make builds to actually be opt
    * bmo#1951346 - fix opt-static builds to actually be opt
    * bmo#1916439 - Remove extraneous assert
  - Removed upstreamed nss-fips-stricter-dh.patch
  - Removed upstreamed nss-reproducible-chksums.patch
  - Added bmo1962556.patch to fix test failures
  - Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch
  - update to NSS 3.109
    * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
    * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
    * bmo#1945883 - SMIME fuzz target
    * bmo#1914256 - ASN1 decoder fuzz target
    * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
    * bmo#1915155 - Add fuzz/README.md
    * bmo#1936001 - Part 4: Fix tstclnt arguments script
    * bmo#1944545 - Extend pkcs7 fuzz target
    * bmo#1912320 - Extend certDN fuzz target
    * bmo#1944300 - revert changes to HACL* files from bug 1866841
    * bmo#1936001 - Part 3: Package frida corpus script
  - update to NSS 3.108
    * bmo#1923285 - libclang-16 -> libclang-19
    * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
    * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
    * bmo#1915902 - Remove SwissSign Silver CA – G2
    * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
    * bmo#1942301 - fix fips test failure on windows
    * bmo#1935925 - change default sensitivity of KEM keys
    * bmo#1936001 - Part 1: Introduce frida hooks and script
    * bmo#1942350 - add missing arm_neon.h include to gcm.c
    * bmo#1831552 - ci: update windows workers to win2022
    * bmo#1831552 - strip trailing carriage returns in tools tests
    * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
    * bmo#1831552 - ci: let the windows setup script work without $m
    * bmo#1880255 - detect msys
    * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
    * bmo#1930807 - NSS policy updates
    * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
    * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
    * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
    * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
    * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
    * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
    * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
    * bmo#1915898 - Fix actual underlying ODR violations issue
    * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
    * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
    * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
    * bmo#1934529 - Set -O2 for ASan builds in CI
    * bmo#1934543 - Change branch of tlsfuzzer dependency
    * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
    * bmo#1934241 - Fix coverage failure in CI
    * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
    * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
    * bmo#1913677 - Part 3: Restructure fuzz/
    * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
    * bmo#1923037 - Force Cryptofuzz to use NSS in CI
    * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
    * bmo#1933154 - Update Cryptofuzz repository link
    * bmo#1926256 - fix build error from 9505f79d
    * bmo#1926256 - simplify error handling in get_token_objects_for_cache
    * bmo#1931973 - nss doc: fix a warning
    * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
  - remove obsolete patches
    * nss-fips-safe-memset.patch
    * nss-bmo1930797.patch
  - update to NSS 3.107
    * bmo#1923038 - Remove MPI fuzz targets.
    * bmo#1925512 - Remove globals `lockStatus` and `locksEverDisabled`.
    * bmo#1919015 - Enable PKCS8 fuzz target.
    * bmo#1923037 - Integrate Cryptofuzz in CI.
    * bmo#1913677 - Part 2: Set tls server target socket options in config class
    * bmo#1913677 - Part 1: Set tls client target socket options in config class
    * bmo#1913680 - Support building with thread sanitizer.
    * bmo#1922392 - set nssckbi version number to 2.72.
    * bmo#1919913 - remove Websites Trust Bit from Entrust Root
    Certification Authority - G4.
    * bmo#1920641 - remove Security Communication RootCA3 root cert.
    * bmo#1918559 - remove SecureSign RootCA11 root cert.
    * bmo#1922387 - Add distrust-after for TLS to Entrust Roots.
    * bmo#1927096 - update expected error code in pk12util pbmac1 tests.
    * bmo#1929041 - Use random tstclnt args with handshake collection script
    * bmo#1920466 - Remove extraneous assert in ssl3gthr.c.
    * bmo#1928402 - Adding missing release notes for NSS_3_105.
    * bmo#1874451 - Enable the disabled mlkem tests for dtls.
    * bmo#1874451 - NSS gtests filter cleans up the constucted buffer
    before the use.
    * bmo#1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe.
    * bmo#1925503 - Remove short circuit test from ssl_Init.
  - fix build on loongarch64 (setting it as 64bit arch)
  - Remove upstreamed bmo-1400603.patch
  - Added nss-bmo1930797.patch to fix failing tests in testsuite
  - update to NSS 3.106
    * bmo#1925975 - NSS 3.106 should be distributed with NSPR 4.36.
    * bmo#1923767 - pk12util: improve error handling in p12U_ReadPKCS12File.
    * bmo#1899402 - Correctly destroy bulkkey in error scenario.
    * bmo#1919997 - PKCS7 fuzz target, r=djackson,nss-reviewers.
    * bmo#1923002 - Extract certificates with handshake collection script.
    * bmo#1923006 - Specify len_control for fuzz targets.
    * bmo#1923280 - Fix memory leak in dumpCertificatePEM.
    * bmo#1102981 - Fix UBSan errors for SECU_PrintCertificate and
    SECU_PrintCertificateBasicInfo.
    * bmo#1921528 - add new error codes to mozilla::pkix for Firefox to use.
    * bmo#1921768 - allow null phKey in NSC_DeriveKey.
    * bmo#1921801 - Only create seed corpus zip from existing corpus.
    * bmo#1826035 - Use explicit allowlist for for KDF PRFS.
    * bmo#1920138 - Increase optimization level for fuzz builds.
    * bmo#1920470 - Remove incorrect assert.
    * bmo#1914870 - Use libFuzzer options from fuzz/options/\*.options in CI.
    * bmo#1920945 - Polish corpus collection for automation.
    * bmo#1917572 - Detect new and unfuzzed SSL options.
    * bmo#1804646 - PKCS12 fuzzing target.
  - requires NSPR 4.36
  - update to NSS 3.105
    * bmo#1915792 - Allow importing PKCS#8 private EC keys missing public key
    * bmo#1909768 - UBSAN fix: applying zero offset to null pointer in sslsnce.c
    * bmo#1919577 - set KRML_MUSTINLINE=inline in makefile builds
    * bmo#1918965 - Don't set CKA_SIGN for CKK_EC_MONTGOMERY private keys
    * bmo#1918767 - override default definition of KRML_MUSTINLINE
    * bmo#1916525 - libssl support for mlkem768x25519
    * bmo#1916524 - support for ML-KEM-768 in softoken and pk11wrap
    * bmo#1866841 - Add Libcrux implementation of ML-KEM 768 to FreeBL
    * bmo#1911912 - Avoid misuse of ctype(3) functions
    * bmo#1917311 - part 2: run clang-format
    * bmo#1917311 - part 1: upgrade to clang-format 13
    * bmo#1916953 - clang-format fuzz
    * bmo#1910370 - DTLS client message buffer may not empty be on retransmit
    * bmo#1916413 - Optionally print config for TLS client and server
    fuzz target
    * bmo#1916059 - Fix some simple documentation issues in NSS.
    * bmo#1915439 - improve performance of NSC_FindObjectsInit when
    template has CKA_TOKEN attr
    * bmo#1912828 - define CKM_NSS_ECDHE_NO_PAIRWISE_CHECK_KEY_PAIR_GEN
  - Fix build error under Leap by rebasing nss-fips-safe-memset.patch.
  - update to NSS 3.104
    * bmo#1910071 - Copy original corpus to heap-allocated buffer
    * bmo#1910079 - Fix min ssl version for DTLS client fuzzer
    * bmo#1908990 - Remove OS2 support just like we did on NSPR
    * bmo#1910605 - clang-format NSS improvements
    * bmo#1902078 - Adding basicutil.h to use HexString2SECItem function
    * bmo#1908990 - removing dirent.c from build
    * bmo#1902078 - Allow handing in keymaterial to shlibsign to make
    the output reproducible
    * bmo#1908990 - remove nec4.3, sunos4, riscos and SNI references
    * bmo#1908990 - remove other old OS (BSDI, old HP UX, NCR,
    openunix, sco, unixware or reliantUnix
    * bmo#1908990 - remove mentions of WIN95
    * bmo#1908990 - remove mentions of WIN16
    * bmo#1913750 - More explicit directory naming
    * bmo#1913755 - Add more options to TLS server fuzz target
    * bmo#1913675 - Add more options to TLS client fuzz target
    * bmo#1835240 - Use OSS-Fuzz corpus in NSS CI
    * bmo#1908012 - set nssckbi version number to 2.70.
    * bmo#1914499 - Remove Email Trust bit from ACCVRAIZ1 root cert.
    * bmo#1908009 - Remove Email Trust bit from certSIGN ROOT CA.
    * bmo#1908006 - Add Cybertrust Japan Roots to NSS.
    * bmo#1908004 - Add Taiwan CA Roots to NSS.
    * bmo#1911354 - remove search by decoded serial in
    nssToken_FindCertificateByIssuerAndSerialNumber
    * bmo#1913132 - Fix tstclnt CI build failure
    * bmo#1913047 - vfyserv: ensure peer cert chain is in db for
    CERT_VerifyCertificateNow
    * bmo#1912427 - Enable all supported protocol versions for UDP
    * bmo#1910361 - Actually use random PSK hash type
    * bmo#1911576 - Initialize NSS DB once
    * bmo#1910361 - Additional ECH cipher suites and PSK hash types
    * bmo#1903604 - Automate corpus file generation for TLS client Fuzzer
    * bmo#1910364 - Fix crash with UNSAFE_FUZZER_MODE
    * bmo#1910605 - clang-format shlibsign.c
  - remove obsolete nss-reproducible-builds.patch
  - update to NSS 3.103
    * bmo#1908623 - move list size check after lock acquisition in sftk_PutObjectToList.
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_POST_HANDSHAKE_AUTH,
    * bmo#1909638 - Follow-up to fix test for presence of file nspr.patch.
    * bmo#1903783 - Adjust libFuzzer size limits
    * bmo#1899542 - Add fuzzing support for SSL_SetCertificateCompressionAlgorithm,
    SSL_SetClientEchConfigs, SSL_VersionRangeSet and SSL_AddExternalPsk
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_GREASE and
    SSL_ENABLE_CH_EXTENSION_PERMUTATION
  - Add nss-reproducible-builds.patch to make the rpms reproducible,
    by using a hardcoded, static key to generate the checksums (*.chk-files)
  - Updated nss-fips-approved-crypto-non-ec.patch to enforce
    approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).
  - update to NSS 3.102.1
    * bmo#1905691 - ChaChaXor to return after the function
  - update to NSS 3.102
    * bmo#1880351 - Add Valgrind annotations to freebl Chacha20-Poly1305.
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1615298 - improve certutil keyUsage, extKeyUsage, and nsCertType keyword handling.
    * bmo#1660676 - correct length of raw SPKI data before printing in pp utility.

++++ mozilla-nss:

  - update to NSS 3.110
    * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
    * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
    * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
    * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
    * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
    * bmo#1930807 - NSS policy updates
    * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
    * bmo#1951394 - Fix race in sdb_GetMetaData
    * bmo#1951800 - Fix member access within null pointer
    * bmo#1950077 - Increase smime fuzzer memory limit
    * bmo#1949677 - Enable resumption when using custom extensions
    * bmo#1952568 - change CN of server12 test certificate
    * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
    * bmo#1949118 - Part 1: Fix smime UBSan errors
    * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
    * bmo#1951491 - Don't build libpkix in static builds
    * bmo#1951395 - handle `-p all` in try syntax
    * bmo#1951346 - fix opt-make builds to actually be opt
    * bmo#1951346 - fix opt-static builds to actually be opt
    * bmo#1916439 - Remove extraneous assert
  - Removed upstreamed nss-fips-stricter-dh.patch
  - Removed upstreamed nss-reproducible-chksums.patch
  - Added bmo1962556.patch to fix test failures
  - Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch
  - update to NSS 3.109
    * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
    * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
    * bmo#1945883 - SMIME fuzz target
    * bmo#1914256 - ASN1 decoder fuzz target
    * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
    * bmo#1915155 - Add fuzz/README.md
    * bmo#1936001 - Part 4: Fix tstclnt arguments script
    * bmo#1944545 - Extend pkcs7 fuzz target
    * bmo#1912320 - Extend certDN fuzz target
    * bmo#1944300 - revert changes to HACL* files from bug 1866841
    * bmo#1936001 - Part 3: Package frida corpus script
  - update to NSS 3.108
    * bmo#1923285 - libclang-16 -> libclang-19
    * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
    * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
    * bmo#1915902 - Remove SwissSign Silver CA – G2
    * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
    * bmo#1942301 - fix fips test failure on windows
    * bmo#1935925 - change default sensitivity of KEM keys
    * bmo#1936001 - Part 1: Introduce frida hooks and script
    * bmo#1942350 - add missing arm_neon.h include to gcm.c
    * bmo#1831552 - ci: update windows workers to win2022
    * bmo#1831552 - strip trailing carriage returns in tools tests
    * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
    * bmo#1831552 - ci: let the windows setup script work without $m
    * bmo#1880255 - detect msys
    * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
    * bmo#1930807 - NSS policy updates
    * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
    * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
    * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
    * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
    * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
    * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
    * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
    * bmo#1915898 - Fix actual underlying ODR violations issue
    * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
    * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
    * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
    * bmo#1934529 - Set -O2 for ASan builds in CI
    * bmo#1934543 - Change branch of tlsfuzzer dependency
    * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
    * bmo#1934241 - Fix coverage failure in CI
    * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
    * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
    * bmo#1913677 - Part 3: Restructure fuzz/
    * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
    * bmo#1923037 - Force Cryptofuzz to use NSS in CI
    * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
    * bmo#1933154 - Update Cryptofuzz repository link
    * bmo#1926256 - fix build error from 9505f79d
    * bmo#1926256 - simplify error handling in get_token_objects_for_cache
    * bmo#1931973 - nss doc: fix a warning
    * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
  - remove obsolete patches
    * nss-fips-safe-memset.patch
    * nss-bmo1930797.patch
  - update to NSS 3.107
    * bmo#1923038 - Remove MPI fuzz targets.
    * bmo#1925512 - Remove globals `lockStatus` and `locksEverDisabled`.
    * bmo#1919015 - Enable PKCS8 fuzz target.
    * bmo#1923037 - Integrate Cryptofuzz in CI.
    * bmo#1913677 - Part 2: Set tls server target socket options in config class
    * bmo#1913677 - Part 1: Set tls client target socket options in config class
    * bmo#1913680 - Support building with thread sanitizer.
    * bmo#1922392 - set nssckbi version number to 2.72.
    * bmo#1919913 - remove Websites Trust Bit from Entrust Root
    Certification Authority - G4.
    * bmo#1920641 - remove Security Communication RootCA3 root cert.
    * bmo#1918559 - remove SecureSign RootCA11 root cert.
    * bmo#1922387 - Add distrust-after for TLS to Entrust Roots.
    * bmo#1927096 - update expected error code in pk12util pbmac1 tests.
    * bmo#1929041 - Use random tstclnt args with handshake collection script
    * bmo#1920466 - Remove extraneous assert in ssl3gthr.c.
    * bmo#1928402 - Adding missing release notes for NSS_3_105.
    * bmo#1874451 - Enable the disabled mlkem tests for dtls.
    * bmo#1874451 - NSS gtests filter cleans up the constucted buffer
    before the use.
    * bmo#1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe.
    * bmo#1925503 - Remove short circuit test from ssl_Init.
  - fix build on loongarch64 (setting it as 64bit arch)
  - Remove upstreamed bmo-1400603.patch
  - Added nss-bmo1930797.patch to fix failing tests in testsuite
  - update to NSS 3.106
    * bmo#1925975 - NSS 3.106 should be distributed with NSPR 4.36.
    * bmo#1923767 - pk12util: improve error handling in p12U_ReadPKCS12File.
    * bmo#1899402 - Correctly destroy bulkkey in error scenario.
    * bmo#1919997 - PKCS7 fuzz target, r=djackson,nss-reviewers.
    * bmo#1923002 - Extract certificates with handshake collection script.
    * bmo#1923006 - Specify len_control for fuzz targets.
    * bmo#1923280 - Fix memory leak in dumpCertificatePEM.
    * bmo#1102981 - Fix UBSan errors for SECU_PrintCertificate and
    SECU_PrintCertificateBasicInfo.
    * bmo#1921528 - add new error codes to mozilla::pkix for Firefox to use.
    * bmo#1921768 - allow null phKey in NSC_DeriveKey.
    * bmo#1921801 - Only create seed corpus zip from existing corpus.
    * bmo#1826035 - Use explicit allowlist for for KDF PRFS.
    * bmo#1920138 - Increase optimization level for fuzz builds.
    * bmo#1920470 - Remove incorrect assert.
    * bmo#1914870 - Use libFuzzer options from fuzz/options/\*.options in CI.
    * bmo#1920945 - Polish corpus collection for automation.
    * bmo#1917572 - Detect new and unfuzzed SSL options.
    * bmo#1804646 - PKCS12 fuzzing target.
  - requires NSPR 4.36
  - update to NSS 3.105
    * bmo#1915792 - Allow importing PKCS#8 private EC keys missing public key
    * bmo#1909768 - UBSAN fix: applying zero offset to null pointer in sslsnce.c
    * bmo#1919577 - set KRML_MUSTINLINE=inline in makefile builds
    * bmo#1918965 - Don't set CKA_SIGN for CKK_EC_MONTGOMERY private keys
    * bmo#1918767 - override default definition of KRML_MUSTINLINE
    * bmo#1916525 - libssl support for mlkem768x25519
    * bmo#1916524 - support for ML-KEM-768 in softoken and pk11wrap
    * bmo#1866841 - Add Libcrux implementation of ML-KEM 768 to FreeBL
    * bmo#1911912 - Avoid misuse of ctype(3) functions
    * bmo#1917311 - part 2: run clang-format
    * bmo#1917311 - part 1: upgrade to clang-format 13
    * bmo#1916953 - clang-format fuzz
    * bmo#1910370 - DTLS client message buffer may not empty be on retransmit
    * bmo#1916413 - Optionally print config for TLS client and server
    fuzz target
    * bmo#1916059 - Fix some simple documentation issues in NSS.
    * bmo#1915439 - improve performance of NSC_FindObjectsInit when
    template has CKA_TOKEN attr
    * bmo#1912828 - define CKM_NSS_ECDHE_NO_PAIRWISE_CHECK_KEY_PAIR_GEN
  - Fix build error under Leap by rebasing nss-fips-safe-memset.patch.
  - update to NSS 3.104
    * bmo#1910071 - Copy original corpus to heap-allocated buffer
    * bmo#1910079 - Fix min ssl version for DTLS client fuzzer
    * bmo#1908990 - Remove OS2 support just like we did on NSPR
    * bmo#1910605 - clang-format NSS improvements
    * bmo#1902078 - Adding basicutil.h to use HexString2SECItem function
    * bmo#1908990 - removing dirent.c from build
    * bmo#1902078 - Allow handing in keymaterial to shlibsign to make
    the output reproducible
    * bmo#1908990 - remove nec4.3, sunos4, riscos and SNI references
    * bmo#1908990 - remove other old OS (BSDI, old HP UX, NCR,
    openunix, sco, unixware or reliantUnix
    * bmo#1908990 - remove mentions of WIN95
    * bmo#1908990 - remove mentions of WIN16
    * bmo#1913750 - More explicit directory naming
    * bmo#1913755 - Add more options to TLS server fuzz target
    * bmo#1913675 - Add more options to TLS client fuzz target
    * bmo#1835240 - Use OSS-Fuzz corpus in NSS CI
    * bmo#1908012 - set nssckbi version number to 2.70.
    * bmo#1914499 - Remove Email Trust bit from ACCVRAIZ1 root cert.
    * bmo#1908009 - Remove Email Trust bit from certSIGN ROOT CA.
    * bmo#1908006 - Add Cybertrust Japan Roots to NSS.
    * bmo#1908004 - Add Taiwan CA Roots to NSS.
    * bmo#1911354 - remove search by decoded serial in
    nssToken_FindCertificateByIssuerAndSerialNumber
    * bmo#1913132 - Fix tstclnt CI build failure
    * bmo#1913047 - vfyserv: ensure peer cert chain is in db for
    CERT_VerifyCertificateNow
    * bmo#1912427 - Enable all supported protocol versions for UDP
    * bmo#1910361 - Actually use random PSK hash type
    * bmo#1911576 - Initialize NSS DB once
    * bmo#1910361 - Additional ECH cipher suites and PSK hash types
    * bmo#1903604 - Automate corpus file generation for TLS client Fuzzer
    * bmo#1910364 - Fix crash with UNSAFE_FUZZER_MODE
    * bmo#1910605 - clang-format shlibsign.c
  - remove obsolete nss-reproducible-builds.patch
  - update to NSS 3.103
    * bmo#1908623 - move list size check after lock acquisition in sftk_PutObjectToList.
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_POST_HANDSHAKE_AUTH,
    * bmo#1909638 - Follow-up to fix test for presence of file nspr.patch.
    * bmo#1903783 - Adjust libFuzzer size limits
    * bmo#1899542 - Add fuzzing support for SSL_SetCertificateCompressionAlgorithm,
    SSL_SetClientEchConfigs, SSL_VersionRangeSet and SSL_AddExternalPsk
    * bmo#1899542 - Add fuzzing support for SSL_ENABLE_GREASE and
    SSL_ENABLE_CH_EXTENSION_PERMUTATION
  - Add nss-reproducible-builds.patch to make the rpms reproducible,
    by using a hardcoded, static key to generate the checksums (*.chk-files)
  - Updated nss-fips-approved-crypto-non-ec.patch to enforce
    approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).
  - update to NSS 3.102.1
    * bmo#1905691 - ChaChaXor to return after the function
  - update to NSS 3.102
    * bmo#1880351 - Add Valgrind annotations to freebl Chacha20-Poly1305.
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1615298 - improve certutil keyUsage, extKeyUsage, and nsCertType keyword handling.
    * bmo#1660676 - correct length of raw SPKI data before printing in pp utility.

++++ python-cryptography:

  - Update vendor tarball to fix CVE-2025-3416 (bsc#1242631)

++++ python-cryptography:

  - Update vendor tarball to fix CVE-2025-3416 (bsc#1242631)

++++ python-cryptography:

  - Update vendor tarball to fix CVE-2025-3416 (bsc#1242631)

------------------------------------------------------------------
------------------  2025-5-13  -  May 13 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix rd.kiwi.oem.luks.reencrypt_randompass workflow
    When requesting a new random key prior reencryption, make
    sure that this new key is referenced in the current in
    memory initrd crypttab such that all subsequent
    tasks e.g. luks resize have permissions to complete while
    inside of this initrd instance

++++ python-kiwi:

  - Fix rd.kiwi.oem.luks.reencrypt_randompass workflow
    When requesting a new random key prior reencryption, make
    sure that this new key is referenced in the current in
    memory initrd crypttab such that all subsequent
    tasks e.g. luks resize have permissions to complete while
    inside of this initrd instance

++++ iputils:

  - Security fix [bsc#1242300, CVE-2025-47268]
    * integer overflow in RTT calculation can lead to undefined behavior
    * Add iputils-CVE-2025-47268.patch

++++ iputils:

  - Security fix [bsc#1242300, CVE-2025-47268]
    * integer overflow in RTT calculation can lead to undefined behavior
    * Add iputils-CVE-2025-47268.patch

------------------------------------------------------------------
------------------  2025-5-12  -  May 12 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add support for new tarball-based WSL format
    With the new image="wsl" type one can build a WSL container
    image that uses the new tarball format. This Fixes #2678
  - Update SL-Micro build test
    For details see: https://build.opensuse.org/request/show/1272418
  - Required read-only-root-fs for SL-Micro test build
    Changes from the SL-Micro team requires adaptions to the
    integration test description
  - Delete fstab.script from SL-Micro test build
    This was only needed when /var was an extra partition, but
    it's a volume with copy-on-write disabled for some time
  - Add systemd-resolved to TW integration tests
    For some reason it's not longer part of the systemd standard
    installation

++++ python-kiwi:

  - Add support for new tarball-based WSL format
    With the new image="wsl" type one can build a WSL container
    image that uses the new tarball format. This Fixes #2678
  - Update SL-Micro build test
    For details see: https://build.opensuse.org/request/show/1272418
  - Required read-only-root-fs for SL-Micro test build
    Changes from the SL-Micro team requires adaptions to the
    integration test description
  - Delete fstab.script from SL-Micro test build
    This was only needed when /var was an extra partition, but
    it's a volume with copy-on-write disabled for some time
  - Add systemd-resolved to TW integration tests
    For some reason it's not longer part of the systemd standard
    installation

++++ pcr-oracle:

  - Add fix-bsc1241957-try-alternative-database.patch to predict
    the EFI_VARIABLE_AUTHORITY event with the alternative database
    (bsc#1241957)

++++ pcr-oracle:

  - Add fix-bsc1241957-try-alternative-database.patch to predict
    the EFI_VARIABLE_AUTHORITY event with the alternative database
    (bsc#1241957)

++++ pcr-oracle:

  - Add fix-bsc1241957-try-alternative-database.patch to predict
    the EFI_VARIABLE_AUTHORITY event with the alternative database
    (bsc#1241957)

++++ pcr-oracle:

  - Add fix-bsc1241957-try-alternative-database.patch to predict
    the EFI_VARIABLE_AUTHORITY event with the alternative database
    (bsc#1241957)

------------------------------------------------------------------
------------------  2025-5-10  -  May 10 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311-core:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

++++ python311:

  - Remove python-3.3.0b1-test-posix_fadvise.patch (not needed
    since kernel 3.6-rc1)

------------------------------------------------------------------
------------------  2025-5-9  -  May 9 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.20 → 10.2.21

++++ python-kiwi:

  - Bump version: 10.2.20 → 10.2.21

++++ systemd:

  - Import commit ebdfa3e44e0c85febfa3b35fc8843f8db6f3fb10
    ebdfa3e44e man/pstore.conf: pstore.conf template is not always installed in /etc
    304ed20aab man: coredump.conf template is not always installed in /etc (bsc#1237496)
  - Add 1003-journal-again-create-user-journals-for-users-with-hi.patch (bsc#1242938)
    Don't write messages sent from users with UID falling into the container UID
    range to the system journal. Daemons in the container don't talk to the
    outside journald as they talk to the inner one directly, which does its
    journal splitting based on shifted uids.

++++ systemd:

  - Import commit ebdfa3e44e0c85febfa3b35fc8843f8db6f3fb10
    ebdfa3e44e man/pstore.conf: pstore.conf template is not always installed in /etc
    304ed20aab man: coredump.conf template is not always installed in /etc (bsc#1237496)
  - Add 1003-journal-again-create-user-journals-for-users-with-hi.patch (bsc#1242938)
    Don't write messages sent from users with UID falling into the container UID
    range to the system journal. Daemons in the container don't talk to the
    outside journald as they talk to the inner one directly, which does its
    journal splitting based on shifted uids.

++++ systemd:

  - Import commit ebdfa3e44e0c85febfa3b35fc8843f8db6f3fb10
    ebdfa3e44e man/pstore.conf: pstore.conf template is not always installed in /etc
    304ed20aab man: coredump.conf template is not always installed in /etc (bsc#1237496)
  - Add 1003-journal-again-create-user-journals-for-users-with-hi.patch (bsc#1242938)
    Don't write messages sent from users with UID falling into the container UID
    range to the system journal. Daemons in the container don't talk to the
    outside journald as they talk to the inner one directly, which does its
    journal splitting based on shifted uids.

++++ systemd:

  - Import commit ebdfa3e44e0c85febfa3b35fc8843f8db6f3fb10
    ebdfa3e44e man/pstore.conf: pstore.conf template is not always installed in /etc
    304ed20aab man: coredump.conf template is not always installed in /etc (bsc#1237496)
  - Add 1003-journal-again-create-user-journals-for-users-with-hi.patch (bsc#1242938)
    Don't write messages sent from users with UID falling into the container UID
    range to the system journal. Daemons in the container don't talk to the
    outside journald as they talk to the inner one directly, which does its
    journal splitting based on shifted uids.

------------------------------------------------------------------
------------------  2025-5-8  -  May 8 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add dkms to test-image-embedded integration test
  - Fixed access issue to etc/kernel for sdboot
    In case of an overlayroot setup we have to make sure
    that etc/kernel is writable. This is done by a bind
    mount of the ESP
  - Update test-image-overlayroot
    Add another build using grub instead of systemd-boot and use
    btrfs as write partition instead of xfs. Please note this test
    requires a boot partition because grub cannot read from erofs
    and unlike systemd-boot grub does not read all boot data from
    the ESP.
  - Fixed get_volume_management
    If a volume capable filesystem like btrfs is requested, there
    must also be a volume definition available to report that
    the volume management is actively used. Just the request of
    the filesystem can also mean it's being used without volumes
    like it could be the case for an overlayroot setup that
    requests btrfs as write partition.
  - Update test-image-overlayroot
    Move to systemd-boot as bootloader, activate secure boot
    and drop the extra boot partition. Use XFS for the write
    space
  - Allow initrd updates on read-only devices
    Move initrd to ESP for boot loaders that reads data
    from there
  - Fix ordering issue for device assignment
    wrong assignment of a boot partition in overlayroot setup
    without boot partition

++++ python-kiwi:

  - Add dkms to test-image-embedded integration test
  - Fixed access issue to etc/kernel for sdboot
    In case of an overlayroot setup we have to make sure
    that etc/kernel is writable. This is done by a bind
    mount of the ESP
  - Update test-image-overlayroot
    Add another build using grub instead of systemd-boot and use
    btrfs as write partition instead of xfs. Please note this test
    requires a boot partition because grub cannot read from erofs
    and unlike systemd-boot grub does not read all boot data from
    the ESP.
  - Fixed get_volume_management
    If a volume capable filesystem like btrfs is requested, there
    must also be a volume definition available to report that
    the volume management is actively used. Just the request of
    the filesystem can also mean it's being used without volumes
    like it could be the case for an overlayroot setup that
    requests btrfs as write partition.
  - Update test-image-overlayroot
    Move to systemd-boot as bootloader, activate secure boot
    and drop the extra boot partition. Use XFS for the write
    space
  - Allow initrd updates on read-only devices
    Move initrd to ESP for boot loaders that reads data
    from there
  - Fix ordering issue for device assignment
    wrong assignment of a boot partition in overlayroot setup
    without boot partition

------------------------------------------------------------------
------------------  2025-5-7  -  May 7 2025  -------------------
------------------------------------------------------------------

++++ afterburn:

  - Use autosetup for patches, refresh them and rename
    * fix-authorized-keys-location.patch to 0001-Fix-authorized-keys-location-for-OpenSUSE.patch
    * set-default-user.patch to 0002-Set-the-default-user-to-suse.patch
    * no-network-args.patch to 0003-On-OpenSUSE-do-not-add-to-kernel-command-line.patch
  - Update to version 5.7.0.git103.bae893c:
    * Sync repo templates ⚙
    * build(deps): bump crossbeam-channel from 0.5.13 to 0.5.15
    * build(deps): bump tokio from 1.40.0 to 1.44.2
    * build(deps): bump openssl from 0.10.71 to 0.10.72
    fixes RUSTSEC-2025-0022 AKA CVE-2025-3416
    * build(deps): bump zbus from 4.4.0 to 5.5.0
    * mod.rs: Fix clippy lint errors
    * release-notes.md: add release notes for rust version update
    * Cargo.toml: bump MSRV to 1.84.1
    * Fix clippy lint issues
    * Sync repo templates ⚙
    * build(deps): bump mockito from 1.6.1 to 1.7.0
    * build(deps): bump serde_json from 1.0.139 to 1.0.140
    * build(deps): bump tempfile from 3.17.1 to 3.19.1
    * build(deps): bump clap from 4.5.31 to 4.5.35
    * build(deps): bump reqwest from 0.12.12 to 0.12.15
    * Update release notes.
    * proxmoxve: Add more context to log messages.
    * proxmoxve: Remove unneeded fields
    * proxmoxve: Add tests for static network configuration from cloud-init.
    * proxmoxve: Add support for static network configuration from cloud-init.
    * build(deps): bump mailparse from 0.15.0 to 0.16.1
    * Sync repo templates ⚙
    * build(deps): bump ring from 0.17.8 to 0.17.13
    * build(deps): bump anyhow from 1.0.95 to 1.0.96
    * release notes: add notes for tempfile bump from 3.16.0 to 3.17.1
    * build(deps): bump serde from 1.0.217 to 1.0.218
    * build(deps): bump openssl from 0.10.70 to 0.10.71
    * build(deps): bump tempfile from 3.16.0 to 3.17.1
    * build(deps): bump serde_json from 1.0.138 to 1.0.139
    * build(deps): bump clap from 4.5.27 to 4.5.31
    * add makefile targets for fmt,lint and test
    * providers/openstack: ignore ec2 metadata if not present
    * build(deps): bump openssl from 0.10.66 to 0.10.70
    * build(deps): bump serde_json from 1.0.137 to 1.0.138
    * build(deps): bump tempfile from 3.14.0 to 3.16.0
    * build(deps): bump openssl from 0.10.66 to 0.10.69
    * build(deps): bump ipnetwork from 0.20.0 to 0.21.1
    * build(deps): bump serde from 1.0.215 to 1.0.217
    * build(deps): bump serde_json from 1.0.133 to 1.0.137
    * build(deps): bump anyhow from 1.0.93 to 1.0.95
    * build(deps): bump clap from 4.5.21 to 4.5.27
    * build(deps): bump reqwest from 0.12.7 to 0.12.12
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * build(deps): bump mockito from 1.5.0 to 1.6.1
    * build(deps): bump serde_json from 1.0.128 to 1.0.133
    * Sync repo templates ⚙
    * build(deps): bump clap from 4.5.17 to 4.5.21
    * build(deps): bump tempfile from 3.12.0 to 3.14.0
    * build(deps): bump anyhow from 1.0.89 to 1.0.93
    * build(deps): bump serde from 1.0.210 to 1.0.215
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * docs: add changelog entry
    * proxmox: use noop provider if no configdrive
    * add noop provider
    * release-notes: remove "upcoming"
  - Update to version 5.7.0:
    * cargo: Afterburn release 5.7.0
    * docs/release-notes: update for release 5.7.0
    * cargo: update dependencies
    * dhcp: replace dbus_proxy with proxy, and zbus traits
    * build(deps): bump zbus from 3.15.2 to 4.4.0
    * build(deps): bump tempfile from 3.10.1 to 3.12.0
    * build(deps): bump serde from 1.0.205 to 1.0.210
    * build(deps): bump serde_json from 1.0.121 to 1.0.127
    * build(deps): bump reqwest from 0.12.5 to 0.12.7
    * build(deps): bump uzers from 0.12.0 to 0.12.1
    * build(deps): bump clap from 4.5.13 to 4.5.16
    * build(deps): bump serde from 1.0.203 to 1.0.205
    * build(deps): bump serde_json from 1.0.119 to 1.0.121
    * build(deps): bump mockito from 1.4.0 to 1.5.0
    * build(deps): bump openssh-keys from 0.6.3 to 0.6.4
    * build(deps): bump clap from 4.5.8 to 4.5.13
    * build(deps): bump openssl from 0.10.64 to 0.10.66
    * providers/hetzner: private ipv4 addresses in attributes
    * openstack: Document the two platforms
    * build(deps): bump zerovec-derive from 0.10.2 to 0.10.3
    * build(deps): bump zerovec from 0.10.2 to 0.10.4
    * build(deps): bump nix from 0.27.1 to 0.29.0
    * build(deps): bump clap from 4.5.7 to 4.5.8
    * build(deps): bump serde_json from 1.0.117 to 1.0.119
    * microsoft/azure: allow empty certificate chain in PKCS12 file
    * proxmoxve: implement proxmoxve provider
    * providers/hetzner: fix duplicate attribute prefix
    * build(deps): bump pnet_base from 0.34.0 to 0.35.0
    * cargo: Afterburn release 5.6.0
    * docs/release-notes: update for release 5.6.0
    * cargo: update dependencies
    * build(deps): bump libflate from 1.4.0 to 2.1.0
    * build(deps): bump base64 from 0.21.7 to 0.22.1
    * build(deps): bump uzers from 0.11.3 to 0.12.0
    * build(deps): bump pnet_datalink from 0.34.0 to 0.35.0
    * build(deps): bump nix from 0.28.0 to 0.29.0
    * lint: silence deadcode warnings
    * lint: address latest lint's from msrv update
    * workflows/rust: directly update toolchain to 1.75.0
    * cargo: update msrv to 1.75
    * Sync repo templates ⚙
    * build(deps): bump reqwest from 0.12.2 to 0.12.4
    * build(deps): bump serde from 1.0.197 to 1.0.200
    * build(deps): bump anyhow from 1.0.81 to 1.0.82
    * build(deps): bump mailparse from 0.14.1 to 0.15.0
    * build(deps): bump serde_json from 1.0.115 to 1.0.116
    * Sync repo templates ⚙
    * providers: Add "akamai" provider
    * build(deps): bump h2 from 0.3.24 to 0.3.26
    * build(deps): bump anyhow from 1.0.79 to 1.0.81
    * build(deps): bump serde_json from 1.0.113 to 1.0.115
    * build(deps): bump reqwest from 0.11.24 to 0.12.2
    * build(deps): bump serde_yaml from 0.9.32 to 0.9.34+deprecated
    * build(deps): bump mio from 0.8.10 to 0.8.11
    * build(deps): bump mailparse from 0.14.0 to 0.14.1
    * build(deps): bump openssl from 0.10.62 to 0.10.64
    * build(deps): bump nix from 0.27.1 to 0.28.0
    * build(deps): bump mockito from 1.2.0 to 1.4.0
    * build(deps): bump tempfile from 3.9.0 to 3.10.1
    * build(deps): bump serde_yaml from 0.9.31 to 0.9.32
    * build(deps): bump serde from 1.0.195 to 1.0.197
    * build(deps): bump h2 from 0.3.23 to 0.3.24
    * build(deps): bump slog-term from 2.9.0 to 2.9.1
    * build(deps): bump serde_yaml from 0.9.30 to 0.9.31
    * build(deps): bump serde_json from 1.0.111 to 1.0.113
    * build(deps): bump clap from 4.4.16 to 4.4.18
    * build(deps): bump reqwest from 0.11.23 to 0.11.24
    * Sync repo templates ⚙
    * cargo: Afterburn release 5.5.1
    * docs/release-notes: update for release 5.5.1
    * cargo: update dependencies
    * build(deps): bump anyhow from 1.0.75 to 1.0.78
    * build(deps): bump serde_yaml from 0.9.27 to 0.9.29
    * build(deps): bump reqwest from 0.11.22 to 0.11.23
    * build(deps): bump serde_json from 1.0.108 to 1.0.109
    * build(deps): bump openssl from 0.10.60 to 0.10.62
    * build(deps): bump tempfile from 3.8.1 to 3.9.0
    * build(deps): bump clap from 4.4.10 to 4.4.12
    * build(deps): bump unsafe-libyaml from 0.2.9 to 0.2.10
    * providers/vmware: add missing public functions for non-amd64
    * build(deps): bump clap from 4.4.8 to 4.4.10
    * cargo: Afterburn release 5.5.0
    * build(deps): bump openssl from 0.10.59 to 0.10.60
    * Sync repo templates ⚙
    * docs/release-notes: update for release 5.5.0
    * cargo: update dependencies
    * ci: cancel previous build on PR update
    * build(deps): allow building with libsystemd 0.7.0
    * providers/vmware: Process guestinfo.metadata netplan configuration
    * kubevirt: Run afterburn-hostname service
    * build(deps): bump reqwest from 0.11.20 to 0.11.22
    * build(deps): bump tempfile from 3.8.0 to 3.8.1
    * build(deps): bump clap from 4.4.6 to 4.4.7
    * build(deps): bump serde_json from 1.0.107 to 1.0.108
    * build(deps): bump serde_yaml from 0.9.25 to 0.9.27
    * build(deps): bump rustix from 0.37.19 to 0.37.25
    * build(deps): bump clap from 4.4.2 to 4.4.6
    * build(deps): bump serde_json from 1.0.105 to 1.0.107
    * build(deps): bump mockito from 1.1.0 to 1.2.0
    * providers: add support for scaleway
    * Move away from deprecated `users` to `uzers`
    * Sync repo templates ⚙
    * providers/hetzner: add support for Hetzner Cloud
    * build(deps): bump clap from 4.4.1 to 4.4.2
    * cargo: update MSRV to 1.71
    * build(deps): bump clap from 4.3.19 to 4.4.1
    * chore: Get rid of Clippy warnings
    * cargo: specify required features for nix dependency
    * build(deps): bump nix from 0.26.2 to 0.27.1
    * build(deps): bump slog-async from 2.7.0 to 2.8.0
    * build(deps): bump openssl from 0.10.56 to 0.10.57
    * build(deps): bump reqwest from 0.11.18 to 0.11.20
    * build(deps): bump serde from 1.0.185 to 1.0.188
    * Sync repo templates ⚙
    * build(deps): bump tempfile from 3.7.1 to 3.8.0
    * build(deps): bump serde from 1.0.183 to 1.0.185
    * build(deps): bump anyhow from 1.0.72 to 1.0.75
    * build(deps): bump serde_json from 1.0.104 to 1.0.105
    * build(deps): bump openssl from 0.10.55 to 0.10.56
    * build(deps): bump tempfile from 3.7.0 to 3.7.1
    * build(deps): bump serde from 1.0.180 to 1.0.183
    * Sync repo templates ⚙
    * build(deps): bump serde from 1.0.179 to 1.0.180
    * build(deps): bump serde_json from 1.0.103 to 1.0.104
    * build(deps): bump serde from 1.0.175 to 1.0.179
    * build(deps): bump pnet_datalink from 0.33.0 to 0.34.0
    * build(deps): bump serde from 1.0.171 to 1.0.175
    * build(deps): bump clap from 4.3.14 to 4.3.19
    * build(deps): bump pnet_base from 0.33.0 to 0.34.0
    * build(deps): bump serde_yaml from 0.9.23 to 0.9.25
    * build(deps): bump tempfile from 3.6.0 to 3.7.0
    * build(deps): bump clap from 4.3.11 to 4.3.14
    * build(deps): bump serde_yaml from 0.9.22 to 0.9.23
    * build(deps): bump anyhow from 1.0.71 to 1.0.72
    * build(deps): bump serde_json from 1.0.100 to 1.0.103
    * Sync repo templates ⚙
    * build(deps): bump clap from 4.3.10 to 4.3.11
    * build(deps): bump serde_json from 1.0.99 to 1.0.100
    * build(deps): bump openssh-keys from 0.6.1 to 0.6.2
    * build(deps): bump zbus from 3.13.1 to 3.14.1
    * build(deps): bump clap from 4.3.8 to 4.3.10
    * build(deps): bump serde from 1.0.164 to 1.0.165
    * build(deps): bump serde_json from 1.0.96 to 1.0.99
    * build(deps): bump clap from 4.3.3 to 4.3.8
    * build(deps): bump serde_yaml from 0.9.21 to 0.9.22
    * build(deps): bump openssl from 0.10.54 to 0.10.55
    * build(deps): bump mockito from 1.0.2 to 1.1.0
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * openstack: Add attribute OPENSTACK_INSTANCE_UUID
    * build(deps): bump serde from 1.0.163 to 1.0.164
    * build(deps): bump clap from 4.3.2 to 4.3.3
    * build(deps): bump tempfile from 3.5.0 to 3.6.0
    * cargo: Afterburn release 5.4.3
    * docs/release-notes: update for release 5.4.3
    * cargo: update dependencies
    * cargo: allow openssl 0.10.46
    * build(deps): bump openssl from 0.10.52 to 0.10.54
    * build(deps): bump openssh-keys from 0.6.0 to 0.6.1
    * build(deps): bump vmw_backdoor from 0.2.3 to 0.2.4
    * ci: strip debug symbols
    * Sync repo templates ⚙
    * build-sys: Use new tier = 2 for cargo-vendor-filterer
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * build(deps): bump reqwest from 0.11.17 to 0.11.18
    * cargo: Afterburn release 5.4.2
    * docs/release-notes: update for release
    * docs/release-notes: note Azure SSH regression fix with new openssl
    * cargo: fix minimum version of openssl crate
    * build(deps): bump serde from 1.0.162 to 1.0.163
    * build(deps): bump zbus from 3.12.0 to 3.13.1
    * build(deps): bump serde from 1.0.160 to 1.0.162
    * build(deps): bump anyhow from 1.0.70 to 1.0.71
    * build(deps): bump openssl from 0.10.51 to 0.10.52
    * build(deps): bump reqwest from 0.11.16 to 0.11.17
    * build(deps): bump openssl from 0.10.50 to 0.10.51
    * build(deps): bump enumflags2 from 0.7.5 to 0.7.7
    * build(deps): bump openssl from 0.10.48 to 0.10.50
    * build(deps): bump zbus from 3.11.1 to 3.12.0
    * build(deps): bump serde_json from 1.0.95 to 1.0.96
    * build(deps): bump h2 from 0.3.15 to 0.3.17
    * build(deps): bump openssl from 0.10.47 to 0.10.48
    * microsoft/crypto/mod: replace deprecated function `parse` with `parse2`
    * build(deps): bump serde from 1.0.159 to 1.0.160
    * build(deps): bump serde_yaml from 0.9.19 to 0.9.21
    * build(deps): bump tempfile from 3.4.0 to 3.5.0
    * build(deps): bump serde from 1.0.158 to 1.0.159
    * build(deps): bump mockito from 1.0.1 to 1.0.2
    * Update mockito to 1.0.1
    * build(deps): bump reqwest from 0.11.15 to 0.11.16
    * build(deps): bump serde_json from 1.0.94 to 1.0.95
    * cli: switch to clap derive
    * cli: add descriptive value names for option arguments in --help
    * build(deps): bump zbus from 3.11.0 to 3.11.1
    * build(deps): bump openssl from 0.10.45 to 0.10.47
    * build(deps): bump reqwest from 0.11.14 to 0.11.15
    * build(deps): bump serde from 1.0.155 to 1.0.158
    * build(deps): bump anyhow from 1.0.69 to 1.0.70
    * cli: have clap require exactly one of --cmdline/--provider
    * providers/*: move endpoint mocking into retry::Client
    * retry/client: move URL parsing into helper function
    * providers/microsoft: import crate::retry
    * providers/microsoft: use stored client for all fetches
    * providers/packet: use stored client for boot checkin
    * build(deps): bump zbus from 3.10.0 to 3.11.0
    * build(deps): bump serde from 1.0.152 to 1.0.155
    * Sync repo templates ⚙
    * docs: Use upstream theme & update to 0.4.1
    * build(deps): bump serde_json from 1.0.93 to 1.0.94
    * build(deps): bump serde_yaml from 0.9.17 to 0.9.19
    * build(deps): bump mockito from 0.32.3 to 0.32.4
    * build(deps): bump tempfile from 3.3.0 to 3.4.0
    * initrd: remember to write trailing newline to network kargs file
    * util: drop obsolete "OEM" terminology
    * Update to clap 4
    * build(deps): bump mockito from 0.31.1 to 0.32.3
    * workflows: update clippy to 1.67
    * Fix clippy lints
    * Inline variables into format strings
    * build(deps): bump zbus from 3.9.0 to 3.10.0
    * build(deps): bump serde_json from 1.0.92 to 1.0.93

++++ afterburn:

  - Use autosetup for patches, refresh them and rename
    * fix-authorized-keys-location.patch to 0001-Fix-authorized-keys-location-for-OpenSUSE.patch
    * set-default-user.patch to 0002-Set-the-default-user-to-suse.patch
    * no-network-args.patch to 0003-On-OpenSUSE-do-not-add-to-kernel-command-line.patch
  - Update to version 5.7.0.git103.bae893c:
    * Sync repo templates ⚙
    * build(deps): bump crossbeam-channel from 0.5.13 to 0.5.15
    * build(deps): bump tokio from 1.40.0 to 1.44.2
    * build(deps): bump openssl from 0.10.71 to 0.10.72
    fixes RUSTSEC-2025-0022 AKA CVE-2025-3416
    * build(deps): bump zbus from 4.4.0 to 5.5.0
    * mod.rs: Fix clippy lint errors
    * release-notes.md: add release notes for rust version update
    * Cargo.toml: bump MSRV to 1.84.1
    * Fix clippy lint issues
    * Sync repo templates ⚙
    * build(deps): bump mockito from 1.6.1 to 1.7.0
    * build(deps): bump serde_json from 1.0.139 to 1.0.140
    * build(deps): bump tempfile from 3.17.1 to 3.19.1
    * build(deps): bump clap from 4.5.31 to 4.5.35
    * build(deps): bump reqwest from 0.12.12 to 0.12.15
    * Update release notes.
    * proxmoxve: Add more context to log messages.
    * proxmoxve: Remove unneeded fields
    * proxmoxve: Add tests for static network configuration from cloud-init.
    * proxmoxve: Add support for static network configuration from cloud-init.
    * build(deps): bump mailparse from 0.15.0 to 0.16.1
    * Sync repo templates ⚙
    * build(deps): bump ring from 0.17.8 to 0.17.13
    * build(deps): bump anyhow from 1.0.95 to 1.0.96
    * release notes: add notes for tempfile bump from 3.16.0 to 3.17.1
    * build(deps): bump serde from 1.0.217 to 1.0.218
    * build(deps): bump openssl from 0.10.70 to 0.10.71
    * build(deps): bump tempfile from 3.16.0 to 3.17.1
    * build(deps): bump serde_json from 1.0.138 to 1.0.139
    * build(deps): bump clap from 4.5.27 to 4.5.31
    * add makefile targets for fmt,lint and test
    * providers/openstack: ignore ec2 metadata if not present
    * build(deps): bump openssl from 0.10.66 to 0.10.70
    * build(deps): bump serde_json from 1.0.137 to 1.0.138
    * build(deps): bump tempfile from 3.14.0 to 3.16.0
    * build(deps): bump openssl from 0.10.66 to 0.10.69
    * build(deps): bump ipnetwork from 0.20.0 to 0.21.1
    * build(deps): bump serde from 1.0.215 to 1.0.217
    * build(deps): bump serde_json from 1.0.133 to 1.0.137
    * build(deps): bump anyhow from 1.0.93 to 1.0.95
    * build(deps): bump clap from 4.5.21 to 4.5.27
    * build(deps): bump reqwest from 0.12.7 to 0.12.12
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * build(deps): bump mockito from 1.5.0 to 1.6.1
    * build(deps): bump serde_json from 1.0.128 to 1.0.133
    * Sync repo templates ⚙
    * build(deps): bump clap from 4.5.17 to 4.5.21
    * build(deps): bump tempfile from 3.12.0 to 3.14.0
    * build(deps): bump anyhow from 1.0.89 to 1.0.93
    * build(deps): bump serde from 1.0.210 to 1.0.215
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * docs: add changelog entry
    * proxmox: use noop provider if no configdrive
    * add noop provider
    * release-notes: remove "upcoming"
  - Update to version 5.7.0:
    * cargo: Afterburn release 5.7.0
    * docs/release-notes: update for release 5.7.0
    * cargo: update dependencies
    * dhcp: replace dbus_proxy with proxy, and zbus traits
    * build(deps): bump zbus from 3.15.2 to 4.4.0
    * build(deps): bump tempfile from 3.10.1 to 3.12.0
    * build(deps): bump serde from 1.0.205 to 1.0.210
    * build(deps): bump serde_json from 1.0.121 to 1.0.127
    * build(deps): bump reqwest from 0.12.5 to 0.12.7
    * build(deps): bump uzers from 0.12.0 to 0.12.1
    * build(deps): bump clap from 4.5.13 to 4.5.16
    * build(deps): bump serde from 1.0.203 to 1.0.205
    * build(deps): bump serde_json from 1.0.119 to 1.0.121
    * build(deps): bump mockito from 1.4.0 to 1.5.0
    * build(deps): bump openssh-keys from 0.6.3 to 0.6.4
    * build(deps): bump clap from 4.5.8 to 4.5.13
    * build(deps): bump openssl from 0.10.64 to 0.10.66
    * providers/hetzner: private ipv4 addresses in attributes
    * openstack: Document the two platforms
    * build(deps): bump zerovec-derive from 0.10.2 to 0.10.3
    * build(deps): bump zerovec from 0.10.2 to 0.10.4
    * build(deps): bump nix from 0.27.1 to 0.29.0
    * build(deps): bump clap from 4.5.7 to 4.5.8
    * build(deps): bump serde_json from 1.0.117 to 1.0.119
    * microsoft/azure: allow empty certificate chain in PKCS12 file
    * proxmoxve: implement proxmoxve provider
    * providers/hetzner: fix duplicate attribute prefix
    * build(deps): bump pnet_base from 0.34.0 to 0.35.0
    * cargo: Afterburn release 5.6.0
    * docs/release-notes: update for release 5.6.0
    * cargo: update dependencies
    * build(deps): bump libflate from 1.4.0 to 2.1.0
    * build(deps): bump base64 from 0.21.7 to 0.22.1
    * build(deps): bump uzers from 0.11.3 to 0.12.0
    * build(deps): bump pnet_datalink from 0.34.0 to 0.35.0
    * build(deps): bump nix from 0.28.0 to 0.29.0
    * lint: silence deadcode warnings
    * lint: address latest lint's from msrv update
    * workflows/rust: directly update toolchain to 1.75.0
    * cargo: update msrv to 1.75
    * Sync repo templates ⚙
    * build(deps): bump reqwest from 0.12.2 to 0.12.4
    * build(deps): bump serde from 1.0.197 to 1.0.200
    * build(deps): bump anyhow from 1.0.81 to 1.0.82
    * build(deps): bump mailparse from 0.14.1 to 0.15.0
    * build(deps): bump serde_json from 1.0.115 to 1.0.116
    * Sync repo templates ⚙
    * providers: Add "akamai" provider
    * build(deps): bump h2 from 0.3.24 to 0.3.26
    * build(deps): bump anyhow from 1.0.79 to 1.0.81
    * build(deps): bump serde_json from 1.0.113 to 1.0.115
    * build(deps): bump reqwest from 0.11.24 to 0.12.2
    * build(deps): bump serde_yaml from 0.9.32 to 0.9.34+deprecated
    * build(deps): bump mio from 0.8.10 to 0.8.11
    * build(deps): bump mailparse from 0.14.0 to 0.14.1
    * build(deps): bump openssl from 0.10.62 to 0.10.64
    * build(deps): bump nix from 0.27.1 to 0.28.0
    * build(deps): bump mockito from 1.2.0 to 1.4.0
    * build(deps): bump tempfile from 3.9.0 to 3.10.1
    * build(deps): bump serde_yaml from 0.9.31 to 0.9.32
    * build(deps): bump serde from 1.0.195 to 1.0.197
    * build(deps): bump h2 from 0.3.23 to 0.3.24
    * build(deps): bump slog-term from 2.9.0 to 2.9.1
    * build(deps): bump serde_yaml from 0.9.30 to 0.9.31
    * build(deps): bump serde_json from 1.0.111 to 1.0.113
    * build(deps): bump clap from 4.4.16 to 4.4.18
    * build(deps): bump reqwest from 0.11.23 to 0.11.24
    * Sync repo templates ⚙
    * cargo: Afterburn release 5.5.1
    * docs/release-notes: update for release 5.5.1
    * cargo: update dependencies
    * build(deps): bump anyhow from 1.0.75 to 1.0.78
    * build(deps): bump serde_yaml from 0.9.27 to 0.9.29
    * build(deps): bump reqwest from 0.11.22 to 0.11.23
    * build(deps): bump serde_json from 1.0.108 to 1.0.109
    * build(deps): bump openssl from 0.10.60 to 0.10.62
    * build(deps): bump tempfile from 3.8.1 to 3.9.0
    * build(deps): bump clap from 4.4.10 to 4.4.12
    * build(deps): bump unsafe-libyaml from 0.2.9 to 0.2.10
    * providers/vmware: add missing public functions for non-amd64
    * build(deps): bump clap from 4.4.8 to 4.4.10
    * cargo: Afterburn release 5.5.0
    * build(deps): bump openssl from 0.10.59 to 0.10.60
    * Sync repo templates ⚙
    * docs/release-notes: update for release 5.5.0
    * cargo: update dependencies
    * ci: cancel previous build on PR update
    * build(deps): allow building with libsystemd 0.7.0
    * providers/vmware: Process guestinfo.metadata netplan configuration
    * kubevirt: Run afterburn-hostname service
    * build(deps): bump reqwest from 0.11.20 to 0.11.22
    * build(deps): bump tempfile from 3.8.0 to 3.8.1
    * build(deps): bump clap from 4.4.6 to 4.4.7
    * build(deps): bump serde_json from 1.0.107 to 1.0.108
    * build(deps): bump serde_yaml from 0.9.25 to 0.9.27
    * build(deps): bump rustix from 0.37.19 to 0.37.25
    * build(deps): bump clap from 4.4.2 to 4.4.6
    * build(deps): bump serde_json from 1.0.105 to 1.0.107
    * build(deps): bump mockito from 1.1.0 to 1.2.0
    * providers: add support for scaleway
    * Move away from deprecated `users` to `uzers`
    though not vulnerable as unused but lib had CVE-2025-5791
    * Sync repo templates ⚙
    * providers/hetzner: add support for Hetzner Cloud
    * build(deps): bump clap from 4.4.1 to 4.4.2
    * cargo: update MSRV to 1.71
    * build(deps): bump clap from 4.3.19 to 4.4.1
    * chore: Get rid of Clippy warnings
    * cargo: specify required features for nix dependency
    * build(deps): bump nix from 0.26.2 to 0.27.1
    * build(deps): bump slog-async from 2.7.0 to 2.8.0
    * build(deps): bump openssl from 0.10.56 to 0.10.57
    * build(deps): bump reqwest from 0.11.18 to 0.11.20
    * build(deps): bump serde from 1.0.185 to 1.0.188
    * Sync repo templates ⚙
    * build(deps): bump tempfile from 3.7.1 to 3.8.0
    * build(deps): bump serde from 1.0.183 to 1.0.185
    * build(deps): bump anyhow from 1.0.72 to 1.0.75
    * build(deps): bump serde_json from 1.0.104 to 1.0.105
    * build(deps): bump openssl from 0.10.55 to 0.10.56
    * build(deps): bump tempfile from 3.7.0 to 3.7.1
    * build(deps): bump serde from 1.0.180 to 1.0.183
    * Sync repo templates ⚙
    * build(deps): bump serde from 1.0.179 to 1.0.180
    * build(deps): bump serde_json from 1.0.103 to 1.0.104
    * build(deps): bump serde from 1.0.175 to 1.0.179
    * build(deps): bump pnet_datalink from 0.33.0 to 0.34.0
    * build(deps): bump serde from 1.0.171 to 1.0.175
    * build(deps): bump clap from 4.3.14 to 4.3.19
    * build(deps): bump pnet_base from 0.33.0 to 0.34.0
    * build(deps): bump serde_yaml from 0.9.23 to 0.9.25
    * build(deps): bump tempfile from 3.6.0 to 3.7.0
    * build(deps): bump clap from 4.3.11 to 4.3.14
    * build(deps): bump serde_yaml from 0.9.22 to 0.9.23
    * build(deps): bump anyhow from 1.0.71 to 1.0.72
    * build(deps): bump serde_json from 1.0.100 to 1.0.103
    * Sync repo templates ⚙
    * build(deps): bump clap from 4.3.10 to 4.3.11
    * build(deps): bump serde_json from 1.0.99 to 1.0.100
    * build(deps): bump openssh-keys from 0.6.1 to 0.6.2
    * build(deps): bump zbus from 3.13.1 to 3.14.1
    * build(deps): bump clap from 4.3.8 to 4.3.10
    * build(deps): bump serde from 1.0.164 to 1.0.165
    * build(deps): bump serde_json from 1.0.96 to 1.0.99
    * build(deps): bump clap from 4.3.3 to 4.3.8
    * build(deps): bump serde_yaml from 0.9.21 to 0.9.22
    * build(deps): bump openssl from 0.10.54 to 0.10.55
    * build(deps): bump mockito from 1.0.2 to 1.1.0
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * openstack: Add attribute OPENSTACK_INSTANCE_UUID
    * build(deps): bump serde from 1.0.163 to 1.0.164
    * build(deps): bump clap from 4.3.2 to 4.3.3
    * build(deps): bump tempfile from 3.5.0 to 3.6.0
    * cargo: Afterburn release 5.4.3
    * docs/release-notes: update for release 5.4.3
    * cargo: update dependencies
    * cargo: allow openssl 0.10.46
    * build(deps): bump openssl from 0.10.52 to 0.10.54
    * build(deps): bump openssh-keys from 0.6.0 to 0.6.1
    * build(deps): bump vmw_backdoor from 0.2.3 to 0.2.4
    * ci: strip debug symbols
    * Sync repo templates ⚙
    * build-sys: Use new tier = 2 for cargo-vendor-filterer
    * Sync repo templates ⚙
    * Sync repo templates ⚙
    * build(deps): bump reqwest from 0.11.17 to 0.11.18
    * cargo: Afterburn release 5.4.2
    * docs/release-notes: update for release
    * docs/release-notes: note Azure SSH regression fix with new openssl
    * cargo: fix minimum version of openssl crate
    * build(deps): bump serde from 1.0.162 to 1.0.163
    * build(deps): bump zbus from 3.12.0 to 3.13.1
    * build(deps): bump serde from 1.0.160 to 1.0.162
    * build(deps): bump anyhow from 1.0.70 to 1.0.71
    * build(deps): bump openssl from 0.10.51 to 0.10.52
    * build(deps): bump reqwest from 0.11.16 to 0.11.17
    * build(deps): bump openssl from 0.10.50 to 0.10.51
    * build(deps): bump enumflags2 from 0.7.5 to 0.7.7
    * build(deps): bump openssl from 0.10.48 to 0.10.50
    * build(deps): bump zbus from 3.11.1 to 3.12.0
    * build(deps): bump serde_json from 1.0.95 to 1.0.96
    * build(deps): bump h2 from 0.3.15 to 0.3.17
    * build(deps): bump openssl from 0.10.47 to 0.10.48
    * microsoft/crypto/mod: replace deprecated function `parse` with `parse2`
    * build(deps): bump serde from 1.0.159 to 1.0.160
    * build(deps): bump serde_yaml from 0.9.19 to 0.9.21
    * build(deps): bump tempfile from 3.4.0 to 3.5.0
    * build(deps): bump serde from 1.0.158 to 1.0.159
    * build(deps): bump mockito from 1.0.1 to 1.0.2
    * Update mockito to 1.0.1
    * build(deps): bump reqwest from 0.11.15 to 0.11.16
    * build(deps): bump serde_json from 1.0.94 to 1.0.95
    * cli: switch to clap derive
    * cli: add descriptive value names for option arguments in --help
    * build(deps): bump zbus from 3.11.0 to 3.11.1
    * build(deps): bump openssl from 0.10.45 to 0.10.47
    * build(deps): bump reqwest from 0.11.14 to 0.11.15
    * build(deps): bump serde from 1.0.155 to 1.0.158
    * build(deps): bump anyhow from 1.0.69 to 1.0.70
    * cli: have clap require exactly one of --cmdline/--provider
    * providers/*: move endpoint mocking into retry::Client
    * retry/client: move URL parsing into helper function
    * providers/microsoft: import crate::retry
    * providers/microsoft: use stored client for all fetches
    * providers/packet: use stored client for boot checkin
    * build(deps): bump zbus from 3.10.0 to 3.11.0
    * build(deps): bump serde from 1.0.152 to 1.0.155
    * Sync repo templates ⚙
    * docs: Use upstream theme & update to 0.4.1
    * build(deps): bump serde_json from 1.0.93 to 1.0.94
    * build(deps): bump serde_yaml from 0.9.17 to 0.9.19
    * build(deps): bump mockito from 0.32.3 to 0.32.4
    * build(deps): bump tempfile from 3.3.0 to 3.4.0
    * initrd: remember to write trailing newline to network kargs file
    * util: drop obsolete "OEM" terminology
    * Update to clap 4
    * build(deps): bump mockito from 0.31.1 to 0.32.3
    * workflows: update clippy to 1.67
    * Fix clippy lints
    * Inline variables into format strings
    * build(deps): bump zbus from 3.9.0 to 3.10.0
    * build(deps): bump serde_json from 1.0.92 to 1.0.93

++++ python-kiwi:

  - Add kiwi-settings package for TW
    de-blacklist erofs to allow building integration tests
    with this filesystem
  - Switch to dracut-kiwi-verity
    So far no luck with the systemd verity generator. This
    commit adds the parsing of /etc/veritytab in the existing
    kiwi-verity dracut module and uses it in the overlayroot
    integration test.
  - Update test-image-overlayroot integration test
    Switch to erofs for overlay testing. Additionally split the build
    into two profiles. The first one just builds a simple overlayroot
    oem disk based on erofs. The second one adds a veritysetup layer
    and configures the systemd-veritysetup-generator for use in dracut.
    This Fixes #2799
  - Add documentation for new attribute
    Add details how to use the new overlayroot_readonly_filesystem attribute
  - Add support for selecting the overlay read-only fs
    Add new overlayroot_readonly_filesystem attribute which allows
    to select for either squashfs or erofs as the read-only filesystem
    in an OEM overlay disk setup.
  - Fixed root setup for verity overlay disk
    When building an image with overlayroot set to true and
    activated verity data, the root= parameter must be
    set to root=overlay:MAPPER=verityroot instead of the standard
    overlay:PARTUUID mapping.
  - Make sure the verity record has a superblock
  - Drop distro specific runtime check
    The check_efi_mode_for_disk_overlay_correctly_setup exists because
    shim-install does not work on read-only devices. However, shim-install
    is a SUSE only tool that runs a SUSE specific secure boot setup.
    For other secure boot processes this runtime check is not useful.
    As runtime checks aims to be generally useful, this one gets
    dropped.

++++ python-kiwi:

  - Add kiwi-settings package for TW
    de-blacklist erofs to allow building integration tests
    with this filesystem
  - Switch to dracut-kiwi-verity
    So far no luck with the systemd verity generator. This
    commit adds the parsing of /etc/veritytab in the existing
    kiwi-verity dracut module and uses it in the overlayroot
    integration test.
  - Update test-image-overlayroot integration test
    Switch to erofs for overlay testing. Additionally split the build
    into two profiles. The first one just builds a simple overlayroot
    oem disk based on erofs. The second one adds a veritysetup layer
    and configures the systemd-veritysetup-generator for use in dracut.
    This Fixes #2799
  - Add documentation for new attribute
    Add details how to use the new overlayroot_readonly_filesystem attribute
  - Add support for selecting the overlay read-only fs
    Add new overlayroot_readonly_filesystem attribute which allows
    to select for either squashfs or erofs as the read-only filesystem
    in an OEM overlay disk setup.
  - Fixed root setup for verity overlay disk
    When building an image with overlayroot set to true and
    activated verity data, the root= parameter must be
    set to root=overlay:MAPPER=verityroot instead of the standard
    overlay:PARTUUID mapping.
  - Make sure the verity record has a superblock
  - Drop distro specific runtime check
    The check_efi_mode_for_disk_overlay_correctly_setup exists because
    shim-install does not work on read-only devices. However, shim-install
    is a SUSE only tool that runs a SUSE specific secure boot setup.
    For other secure boot processes this runtime check is not useful.
    As runtime checks aims to be generally useful, this one gets
    dropped.

++++ sqlite3:

  - Update to release 3.49.2:
    * Fix a bug in the NOT NULL optimization of version 3.40.0 that
    can lead to a memory error if abused.
    * Fix the count-of-view optimization so that it does not give an
    incorrect answer for a DISTINCT query.
    * Fix a possible incorrect answer that can result if a UNIQUE
    constraint of a table contains the PRIMARY KEY column and that
    UNIQUE constraint is used by an IN operator.
    * Fix obscure problems with the generate_series() extension
    function.
    * Incremental improvements to the configure/make.

++++ sqlite3:

  - Update to release 3.49.2:
    * Fix a bug in the NOT NULL optimization of version 3.40.0 that
    can lead to a memory error if abused.
    * Fix the count-of-view optimization so that it does not give an
    incorrect answer for a DISTINCT query.
    * Fix a possible incorrect answer that can result if a UNIQUE
    constraint of a table contains the PRIMARY KEY column and that
    UNIQUE constraint is used by an IN operator.
    * Fix obscure problems with the generate_series() extension
    function.
    * Incremental improvements to the configure/make.

++++ sqlite3:

  - Update to release 3.49.2:
    * Fix a bug in the NOT NULL optimization of version 3.40.0 that
    can lead to a memory error if abused.
    * Fix the count-of-view optimization so that it does not give an
    incorrect answer for a DISTINCT query.
    * Fix a possible incorrect answer that can result if a UNIQUE
    constraint of a table contains the PRIMARY KEY column and that
    UNIQUE constraint is used by an IN operator.
    * Fix obscure problems with the generate_series() extension
    function.
    * Incremental improvements to the configure/make.

++++ regionServiceClientConfigGCE:

  - Update conditional to handle name change of metadata package
    in SLE 16 (bsc#1242063)

++++ regionServiceClientConfigGCE:

  - Update conditional to handle name change of metadata package
    in SLE 16 (bsc#1242063)

------------------------------------------------------------------
------------------  2025-5-6  -  May 6 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix root clone size setup
    If the root_clone attribute is specified without providing a
    fixed size for the system, kiwi estimates the size needed for
    the root part and assigns the rest to the clone. This leads to
    different partition sizes for the root clones. As per definition
    of a clone the expectation is that the size is the same, this
    commit changes the behavior such that the calculated size for
    the system is applied to the origin root and all its clones.
    As a consequence this can leave unpartitioned space free in
    the image. This Fixes #2463

++++ python-kiwi:

  - Fix root clone size setup
    If the root_clone attribute is specified without providing a
    fixed size for the system, kiwi estimates the size needed for
    the root part and assigns the rest to the clone. This leads to
    different partition sizes for the root clones. As per definition
    of a clone the expectation is that the size is the same, this
    commit changes the behavior such that the calculated size for
    the system is applied to the origin root and all its clones.
    As a consequence this can leave unpartitioned space free in
    the image. This Fixes #2463

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

++++ libsoup:

  - Add more CVE fixes:
    + libsoup-CVE-2025-32050.patch (boo#1240752 CVE-2025-32050)
    + libsoup-CVE-2025-32051.patch (boo#1240754 CVE-2025-32051)
    + libsoup-CVE-2025-32052.patch (boo#1240756 CVE-2025-32052)
    + libsoup-CVE-2025-32053.patch (boo#1240757 CVE-2025-32053)
    + libsoup-CVE-2025-46420.patch (boo#1241686 CVE-2025-46420)
    + libsoup-CVE-2025-32913.patch (boo#1241162 boo#1241238
    CVE-2025-32913 CVE-2025-32911)
    + libsoup-CVE-2025-32910.patch (boo#1241252 CVE-2025-32910)
    + libsoup-CVE-2025-32909.patch (boo#1241226 CVE-2025-32909)
    + libsoup-CVE-2025-2784.patch (boo#1240750 CVE-2025-2784)
    + libsoup-CVE-2025-46421.patch (boo#1241688 CVE-2025-46421)
    + libsoup-CVE-2025-32912.patch (boo#1241214 CVE-2025-32912)
    + libsoup-CVE-2025-32906.patch (boo#1241163 CVE-2025-32906)
    + libsoup-CVE-2025-32914.patch (boo#1241164 CVE-2025-32914)
    + libsoup-CVE-2025-32908.patch (boo#1241223 CVE-2025-32908)
    + libsoup-CVE-2025-32907.patch (boo#1241222 CVE-2025-32907)

------------------------------------------------------------------
------------------  2025-5-5  -  May 5 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.19 → 10.2.20

++++ python-kiwi:

  - Bump version: 10.2.19 → 10.2.20

++++ grub2:

  - Fix CVE-2025-4382: TPM auto-decryption data exposure (bsc#1242971)
    * 0001-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch
    * 0002-commands-search-Introduce-the-cryptodisk-only-argume.patch
    * 0003-disk-diskfilter-Introduce-the-cryptocheck-command.patch
    * 0004-commands-search-Add-the-diskfilter-support.patch
    * 0005-docs-Document-available-crypto-disks-checks.patch
    * 0006-disk-cryptodisk-Add-the-erase-secrets-function.patch
    * 0007-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch
    * 0008-cryptocheck-Add-quiet-option.patch
  - patch rebased
    * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch
    * 0004-Key-revocation-on-out-of-bound-file-access.patch
  - patch refrehed
    * 0002-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch

++++ grub2:

  - Fix CVE-2025-4382: TPM auto-decryption data exposure (bsc#1242971)
    * 0001-kern-rescue_reader-Block-the-rescue-mode-until-the-C.patch
    * 0002-commands-search-Introduce-the-cryptodisk-only-argume.patch
    * 0003-disk-diskfilter-Introduce-the-cryptocheck-command.patch
    * 0004-commands-search-Add-the-diskfilter-support.patch
    * 0005-docs-Document-available-crypto-disks-checks.patch
    * 0006-disk-cryptodisk-Add-the-erase-secrets-function.patch
    * 0007-disk-cryptodisk-Wipe-the-passphrase-from-memory.patch
    * 0008-cryptocheck-Add-quiet-option.patch
  - patch rebased
    * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch
    * 0004-Key-revocation-on-out-of-bound-file-access.patch
  - patch refrehed
    * 0002-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch

------------------------------------------------------------------
------------------  2025-5-2  -  May 2 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix reencryption master key passphrase
    Make sure to use the correct passphrase for the master
    key such that it can be decrypted with the same credentials
    as before. The credentials reset is a subsequent task
    after reencryption.

++++ python-kiwi:

  - Fix reencryption master key passphrase
    Make sure to use the correct passphrase for the master
    key such that it can be decrypted with the same credentials
    as before. The credentials reset is a subsequent task
    after reencryption.

------------------------------------------------------------------
------------------  2025-5-1  -  May 1 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 28.1.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
    Includes upstream fixes:
  - CVE-2025-22872 bsc#1241830
  - Remove long-outdated build handling for deprecated and unsupported
    devicemapper and AUFS storage drivers. AUFS was removed in v24, and
    devicemapper was removed in v25.
    <https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Remove upstreamed patches:
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 28.1.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
    Includes upstream fixes:
  - CVE-2025-22872 bsc#1241830
  - Remove long-outdated build handling for deprecated and unsupported
    devicemapper and AUFS storage drivers. AUFS was removed in v24, and
    devicemapper was removed in v25.
    <https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Remove upstreamed patches:
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 28.1.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
    Includes upstream fixes:
  - CVE-2025-22872 bsc#1241830
  - Remove long-outdated build handling for deprecated and unsupported
    devicemapper and AUFS storage drivers. AUFS was removed in v24, and
    devicemapper was removed in v25.
    <https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Remove upstreamed patches:
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 28.1.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
    Includes upstream fixes:
  - CVE-2025-22872 bsc#1241830
  - Remove long-outdated build handling for deprecated and unsupported
    devicemapper and AUFS storage drivers. AUFS was removed in v24, and
    devicemapper was removed in v25.
    <https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Remove upstreamed patches:
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 28.1.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
    Includes upstream fixes:
  - CVE-2025-22872 bsc#1241830
  - Remove long-outdated build handling for deprecated and unsupported
    devicemapper and AUFS storage drivers. AUFS was removed in v24, and
    devicemapper was removed in v25.
    <https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Remove upstreamed patches:
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - cli-0001-docs-include-required-tools-in-source-tree.patch

++++ python-kiwi:

  - Bump version: 10.2.18 → 10.2.19

++++ python-kiwi:

  - Bump version: 10.2.18 → 10.2.19

------------------------------------------------------------------
------------------  2025-4-30  -  Apr 30 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed targettype setup in zipl.conf
    The special targettype set to GPT still indicates SCSI for
    the zipl.conf but tells kiwi to create a GPT disk layout
  - Fixed s390 integration test
    targettype attribute in wrong section
  - Add support for GPT targettype on s390
    Allow to build s390 images using GPT instead of the old DOS
    partition table. zipl has added support to read from GPT.
    This Fixes #2694
  - Add --no-compress option to bundler
    Allow to skip the compression for bundle files marked
    to become compressed. This Fixes #2736
  - Rawhide (F43) has removed basesystem package
    The basesystem package was retired with rawhide (F43).
    https://src.fedoraproject.org/rpms/filesystem/pull-request/20
  - rawhide install shadow-utils for usermod
    Using `kiwi-ng` version 10.2.18 (EL9)
    Currently with:
    ```
    sudo kiwi-ng system build \
  - -description kiwi/build-tests/x86/fedora/test-image-docker
  - -set-repo http://ftp.fau.de/fedora/linux/development/rawhide/Everything/x86_64/os/ \
  - -target-dir /tmp/myimage1
    ```
    This fails with:
    ```
    [ INFO    ]: 09:46:38 | Setting up user root
    [ INFO    ]: 09:46:38 | --> Modifying user: root
    [ INFO    ]: 09:46:38 | --> Primary group for user root: root
    [ ERROR   ]: 09:46:38 | KiwiCommandError: chroot: stderr: /sbin/chroot: failed to run command ‘usermod’: No such file or directory
    ```
    Install the package `shadow-utils` to provide `usermod`.
  - Fixed default bls value setup
    Fixed get_build_type_bootloader_bls behavior in case the bls
    attribute is not set. In this case get_bls() returns a None value
    which was returned. However in this case the attribute value
    should not be taken into account and the method defined default
    value for bls should be returned. This Fixes #2542

++++ python-kiwi:

  - Fixed targettype setup in zipl.conf
    The special targettype set to GPT still indicates SCSI for
    the zipl.conf but tells kiwi to create a GPT disk layout
  - Fixed s390 integration test
    targettype attribute in wrong section
  - Add support for GPT targettype on s390
    Allow to build s390 images using GPT instead of the old DOS
    partition table. zipl has added support to read from GPT.
    This Fixes #2694
  - Add --no-compress option to bundler
    Allow to skip the compression for bundle files marked
    to become compressed. This Fixes #2736
  - Rawhide (F43) has removed basesystem package
    The basesystem package was retired with rawhide (F43).
    https://src.fedoraproject.org/rpms/filesystem/pull-request/20
  - rawhide install shadow-utils for usermod
    Using `kiwi-ng` version 10.2.18 (EL9)
    Currently with:
    ```
    sudo kiwi-ng system build \
  - -description kiwi/build-tests/x86/fedora/test-image-docker
  - -set-repo http://ftp.fau.de/fedora/linux/development/rawhide/Everything/x86_64/os/ \
  - -target-dir /tmp/myimage1
    ```
    This fails with:
    ```
    [ INFO    ]: 09:46:38 | Setting up user root
    [ INFO    ]: 09:46:38 | --> Modifying user: root
    [ INFO    ]: 09:46:38 | --> Primary group for user root: root
    [ ERROR   ]: 09:46:38 | KiwiCommandError: chroot: stderr: /sbin/chroot: failed to run command ‘usermod’: No such file or directory
    ```
    Install the package `shadow-utils` to provide `usermod`.
  - Fixed default bls value setup
    Fixed get_build_type_bootloader_bls behavior in case the bls
    attribute is not set. In this case get_bls() returns a None value
    which was returned. However in this case the attribute value
    should not be taken into account and the method defined default
    value for bls should be returned. This Fixes #2542

++++ libzypp:

  - fixed build with boost 1.88.
  - XmlReader: Fix detection of bad input streams (fixes #635)
    libxml2 2.14 potentially reads the complete stream, so it may
    have the 'eof' bit set. Which is not 'good' but also not 'bad'.
  - rpm: Fix detection of %triggerscript starts (bsc#1222044)
  - RepoindexFileReader: add more <repo> related attributes a
    service may set.
    Add optional attributes gpgcheck, repo_gpgcheck, pkg_gpgcheck,
    keeppackages, gpgkey, mirrorlist, and metalink with the same
    semantic as in a .repo file.
  - version 17.36.7 (35)

++++ libzypp:

  - fixed build with boost 1.88.
  - XmlReader: Fix detection of bad input streams (fixes #635)
    libxml2 2.14 potentially reads the complete stream, so it may
    have the 'eof' bit set. Which is not 'good' but also not 'bad'.
  - rpm: Fix detection of %triggerscript starts (bsc#1222044)
  - RepoindexFileReader: add more <repo> related attributes a
    service may set.
    Add optional attributes gpgcheck, repo_gpgcheck, pkg_gpgcheck,
    keeppackages, gpgkey, mirrorlist, and metalink with the same
    semantic as in a .repo file.
  - version 17.36.7 (35)

++++ libzypp:

  - fixed build with boost 1.88.
  - XmlReader: Fix detection of bad input streams (fixes #635)
    libxml2 2.14 potentially reads the complete stream, so it may
    have the 'eof' bit set. Which is not 'good' but also not 'bad'.
  - rpm: Fix detection of %triggerscript starts (bsc#1222044)
  - RepoindexFileReader: add more <repo> related attributes a
    service may set.
    Add optional attributes gpgcheck, repo_gpgcheck, pkg_gpgcheck,
    keeppackages, gpgkey, mirrorlist, and metalink with the same
    semantic as in a .repo file.
  - version 17.36.7 (35)

++++ python-httpcore:

  - Remove upper limit for python-h11, CVE-2025-43859, bsc#1241872

++++ zypper:

  - Updated translations (bsc#1230267)
  - version 1.14.89

++++ zypper:

  - Updated translations (bsc#1230267)
  - version 1.14.89

------------------------------------------------------------------
------------------  2025-4-29  -  Apr 29 2025  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update version to 10.4.0
    + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
    + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
    + Support flexible licenses in GCE (jsc#PCT-531)
    + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
    + Handle cache inconsistencies (bsc#1218345)
    + Properly handle the zypper root target argument (bsc#1240997)

++++ cloud-regionsrv-client:

  - Update version to 10.4.0
    + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
    + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
    + Support flexible licenses in GCE (jsc#PCT-531)
    + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
    + Handle cache inconsistencies (bsc#1218345)
    + Properly handle the zypper root target argument (bsc#1240997)

++++ cloud-regionsrv-client:

  - Update version to 10.4.0
    + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
    + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
    + Support flexible licenses in GCE (jsc#PCT-531)
    + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
    + Handle cache inconsistencies (bsc#1218345)
    + Properly handle the zypper root target argument (bsc#1240997)

++++ cloud-regionsrv-client:

  - Update version to 10.4.0
    + Remove repositories when the package is being removed
    We do not want to leave repositories behind refering to the plugin that
    is being removed when the package gets removed (bsc#1240310, bsc#1240311)
    + Turn docker into an optional setup (jsc#PCT-560)
    Change the Requires into a Recommends and adapt the code accordingly
    + Support flexible licenses in GCE (jsc#PCT-531)
    + Drop the azure-addon package it is geting replaced by the
    license-watcher package which has a generic implementation of the
    same functionality.
    + Handle cache inconsistencies (bsc#1218345)
    + Properly handle the zypper root target argument (bsc#1240997)

++++ runc:

  - Update to runc v1.3.0. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

++++ runc:

  - Update to runc v1.3.0. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

++++ runc:

  - Update to runc v1.3.0. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

------------------------------------------------------------------
------------------  2025-4-28  -  Apr 28 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to docker-buildx v0.23.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.23.0>

++++ docker:

  - Update to docker-buildx v0.23.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.23.0>

++++ docker:

  - Update to docker-buildx v0.23.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.23.0>

++++ docker:

  - Update to docker-buildx v0.23.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.23.0>

++++ docker:

  - Update to docker-buildx v0.23.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.23.0>

++++ python-kiwi:

  - Bump version: 10.2.17 → 10.2.18
  - Fix setup of use_disk_password for random secret
    When using luks="random" in combination with use_disk_password="true"
    the resulting cryptomount call in grub is wrong. This commit fixes it

++++ python-kiwi:

  - Bump version: 10.2.17 → 10.2.18
  - Fix setup of use_disk_password for random secret
    When using luks="random" in combination with use_disk_password="true"
    the resulting cryptomount call in grub is wrong. This commit fixes it

------------------------------------------------------------------
------------------  2025-4-27  -  Apr 27 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Drop copying GRUB2 modules to /boot with Secure Boot UEFI images
    Copying the modules creates a situation where future updates
    applied to a running system can cause GRUB to crash due to mixed
    modules and GRUB EFI binaries.
    It is not needed anyway since GRUB EFI binaries for Secure Boot have
    all modules compiled into the binaries.
    Fixes: https://github.com/OSInside/kiwi/issues/2790
  - Make sure editbootinstall runs offline
    editbootinstall expects the system to be umounted
  - Make sure post sync actions are in scope
  - Follow up fix for overlayroot builds for EFI path
    Only perform the boot overlay if there is an extra boot partition
  - Only remove entries from exclude list if present
  - Fix overlayroot builds for EFI path
    make sure to keep boot/efi mountpoint directories
    in the read-only area as they can't be created later
  - doc: overview: Add list of supported Linux distributions
    These are the Linux distributions that are developed and actively
    tested for with the latest kiwi releases.
    This should offer greater clarity about what we're able to support
    as an upstream project.
  - Fixed mount of image system for volume managers
    The ImageSystem.mount() method implemented its own handling
    for mounting the volumes of a volume manager based system.
    First and foremost this duplicates code that already exists
    in the respective VolumeManager implementation and second
    the code behaved wrong in case of btrfs when there is no
    default subvolume configured
  - Handle grub fix functions less strict
    If called on full read-only systems, log the information
    that the files can't be modified but do not fail. On
    such systems the expectation is that no fix code must
    be applied and as such the fix function can be considered
    an optional step.

++++ python-kiwi:

  - Drop copying GRUB2 modules to /boot with Secure Boot UEFI images
    Copying the modules creates a situation where future updates
    applied to a running system can cause GRUB to crash due to mixed
    modules and GRUB EFI binaries.
    It is not needed anyway since GRUB EFI binaries for Secure Boot have
    all modules compiled into the binaries.
    Fixes: https://github.com/OSInside/kiwi/issues/2790
  - Make sure editbootinstall runs offline
    editbootinstall expects the system to be umounted
  - Make sure post sync actions are in scope
  - Follow up fix for overlayroot builds for EFI path
    Only perform the boot overlay if there is an extra boot partition
  - Only remove entries from exclude list if present
  - Fix overlayroot builds for EFI path
    make sure to keep boot/efi mountpoint directories
    in the read-only area as they can't be created later
  - doc: overview: Add list of supported Linux distributions
    These are the Linux distributions that are developed and actively
    tested for with the latest kiwi releases.
    This should offer greater clarity about what we're able to support
    as an upstream project.
  - Fixed mount of image system for volume managers
    The ImageSystem.mount() method implemented its own handling
    for mounting the volumes of a volume manager based system.
    First and foremost this duplicates code that already exists
    in the respective VolumeManager implementation and second
    the code behaved wrong in case of btrfs when there is no
    default subvolume configured
  - Handle grub fix functions less strict
    If called on full read-only systems, log the information
    that the files can't be modified but do not fail. On
    such systems the expectation is that no fix code must
    be applied and as such the fix function can be considered
    an optional step.

------------------------------------------------------------------
------------------  2025-4-25  -  Apr 25 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed root setup for encrypted overlay disk
    When building an image with overlayroot set to true and
    activated luks encryption, the root= parameter must be
    set to root=overlay:MAPPER=luks instead of the standard
    overlay:PARTUUID mapping. This Fixes #2776
  - Change suffix for package manager config files
    Use .config instead of .conf for the temporary package
    manager config files. Reason for this change is a bug in
    dracut which reads and executes all /*.conf files from
    the system. This Fixes #2780
  - Set security context after root sync
    On selinux enabled image builds we call setfiles initially
    after the root tree is complete and after each script invocation
    that might change the system. However the security context
    also applies to mount points e.g volumes which only exists
    at the time when the root tree gets synced to the actual image
    binary. Thus this commit also calls setfiles on the mounted
    root tree after data sync. This Fixes rh#2333743
  - Fix broken doc link
    Rephrase chapter pointing to a documentation side at VMware.
    They are constantly changing their documentation URLs that
    I'm tired of fixing this. This Fixes #2782

++++ python-kiwi:

  - Fixed root setup for encrypted overlay disk
    When building an image with overlayroot set to true and
    activated luks encryption, the root= parameter must be
    set to root=overlay:MAPPER=luks instead of the standard
    overlay:PARTUUID mapping. This Fixes #2776
  - Change suffix for package manager config files
    Use .config instead of .conf for the temporary package
    manager config files. Reason for this change is a bug in
    dracut which reads and executes all /*.conf files from
    the system. This Fixes #2780
  - Set security context after root sync
    On selinux enabled image builds we call setfiles initially
    after the root tree is complete and after each script invocation
    that might change the system. However the security context
    also applies to mount points e.g volumes which only exists
    at the time when the root tree gets synced to the actual image
    binary. Thus this commit also calls setfiles on the mounted
    root tree after data sync. This Fixes rh#2333743
  - Fix broken doc link
    Rephrase chapter pointing to a documentation side at VMware.
    They are constantly changing their documentation URLs that
    I'm tired of fixing this. This Fixes #2782

++++ systemd:

  - Add 1002-udev-persistent-net-rule-generator-support.patch (bsc#1241190)
    This re-adds back the support for the persistent net name rules as well as
    their generator since predictable naming scheme is still disabled by default
    on Micro (via the `net.ifnames=0` boot option).

++++ systemd:

  - Add 1002-udev-persistent-net-rule-generator-support.patch (bsc#1241190)
    This re-adds back the support for the persistent net name rules as well as
    their generator since predictable naming scheme is still disabled by default
    on Micro (via the `net.ifnames=0` boot option).

++++ systemd:

  - Add 1002-udev-persistent-net-rule-generator-support.patch (bsc#1241190)
    This re-adds back the support for the persistent net name rules as well as
    their generator since predictable naming scheme is still disabled by default
    on Micro (via the `net.ifnames=0` boot option).

++++ systemd:

  - Add 1002-udev-persistent-net-rule-generator-support.patch (bsc#1241190)
    This re-adds back the support for the persistent net name rules as well as
    their generator since predictable naming scheme is still disabled by default
    on Micro (via the `net.ifnames=0` boot option).

++++ python-h11:

  - Update 0.16.0:
    * Security fix (CVE-2025-43859, bsc#1241872)
    Reject certain malformed Transfer-Encoding: chunked bodies that
    were previously accepted. These could have enabled
    request-smuggling attacks when an h11-based HTTP server was placed
    behind a load balancer with a matching bug in its chunked
    handling.
    Advisory with more details:
    https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj
  - 0.15.0:
    * Reject Content-Lengths >= 1 zettabyte (1 billion terabytes) early,
    without attempting to parse the integer (#181)

------------------------------------------------------------------
------------------  2025-4-23  -  Apr 23 2025  -------------------
------------------------------------------------------------------

++++ augeas:

  - Add patch, fix for bsc#1239909 / CVE-2025-2588:
    * CVE-2025-2588.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API
    + libxml2-CVE-2025-32414.patch
    CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read
    + libxml2-CVE-2025-32415.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API
    + libxml2-CVE-2025-32414.patch
    CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read
    + libxml2-CVE-2025-32415.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API
    + libxml2-CVE-2025-32414.patch
    CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read
    + libxml2-CVE-2025-32415.patch

++++ libxml2:

  - security update
  - added patches
    CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API
    + libxml2-CVE-2025-32414.patch
    CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read
    + libxml2-CVE-2025-32415.patch

++++ libxml2-python:

  - security update
  - added patches
    CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API
    + libxml2-CVE-2025-32414.patch
    CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read
    + libxml2-CVE-2025-32415.patch

------------------------------------------------------------------
------------------  2025-4-22  -  Apr 22 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.16 → 10.2.17
  - Fix key slot selection for luks reencrypt
    Depending on the type setup for a luks encrypted image, there
    might be one or two key slots available. When kiwi is requested
    to perform the reencryption process at least one key-slot and
    the proper keyfile/passphrase must be provided. This commit
    stores the information about the key-slot number for which
    a decryption information exists in the initrd. In addition to
    the code change also the corresponding integration test image
    was updated.
  - Fixed test-image-gce integration test
    python3-gcemetadata was renamed to python-gcemetadata

++++ python-kiwi:

  - Bump version: 10.2.16 → 10.2.17
  - Fix key slot selection for luks reencrypt
    Depending on the type setup for a luks encrypted image, there
    might be one or two key slots available. When kiwi is requested
    to perform the reencryption process at least one key-slot and
    the proper keyfile/passphrase must be provided. This commit
    stores the information about the key-slot number for which
    a decryption information exists in the initrd. In addition to
    the code change also the corresponding integration test image
    was updated.
  - Fixed test-image-gce integration test
    python3-gcemetadata was renamed to python-gcemetadata

------------------------------------------------------------------
------------------  2025-4-21  -  Apr 21 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed integration test builds for TW
    Request dracut explicitly when needed

++++ python-kiwi:

  - Fixed integration test builds for TW
    Request dracut explicitly when needed

------------------------------------------------------------------
------------------  2025-4-18  -  Apr 18 2025  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311-core:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

++++ python311:

  - Update to 3.11.12:
  - gh-131809: Update bundled libexpat to 2.7.1
  - gh-131261: Upgrade to libexpat 2.7.0
  - gh-105704: When using urllib.parse.urlsplit() and
    urllib.parse.urlparse() host parsing would not reject domain
    names containing square brackets ([ and ]). Square brackets
    are only valid for IPv6 and IPvFuture hosts according to RFC
    3986 Section 3.2.2 (bsc#1236705, CVE-2025-0938,
    gh#python/cpython#105704).
  - gh-121284: Fix bug in the folding of rfc2047 encoded-words
    when flattening an email message using a modern email
    policy. Previously when an encoded-word was too long for
    a line, it would be decoded, split across lines, and
    re-encoded. But commas and other special characters in the
    original text could be left unencoded and unquoted. This
    could theoretically be used to spoof header lines using a
    carefully constructed encoded-word if the resulting rendered
    email was transmitted or re-parsed.
  - gh-80222: Fix bug in the folding of quoted strings
    when flattening an email message using a modern email
    policy. Previously when a quoted string was folded so that
    it spanned more than one line, the surrounding quotes and
    internal escapes would be omitted. This could theoretically
    be used to spoof header lines using a carefully constructed
    quoted string if the resulting rendered email was transmitted
    or re-parsed.
  - gh-119511: Fix a potential denial of service in the imaplib
    module. When connecting to a malicious server, it could
    cause an arbitrary amount of memory to be allocated. On many
    systems this is harmless as unused virtual memory is only
    a mapping, but if this hit a virtual address size limit
    it could lead to a MemoryError or other process crash. On
    unusual systems or builds where all allocated memory is
    touched and backed by actual ram or storage it could’ve
    consumed resources doing so until similarly crashing.
  - gh-127257: In ssl, system call failures that OpenSSL reports
    using ERR_LIB_SYS are now raised as OSError.
  - gh-121277: Writers of CPython’s documentation can now use
    next as the version for the versionchanged, versionadded,
    deprecated directives.
  - gh-106883: Disable GC during the _PyThread_CurrentFrames()
    and _PyThread_CurrentExceptions() calls to avoid the
    interpreter to deadlock.
  - Remove upstreamed patch:
  - CVE-2025-0938-sq-brackets-domain-names.patch
  - Add gh-126572-test_ssl-no-stop-ThreadedEchoServer-OSError.patch
    which makes test_ssl not to stop ThreadedEchoServer on OSError,
    which makes test_ssl pass with OpenSSL 3.5 (bsc#1241067,
    gh#python/cpython!126572)

------------------------------------------------------------------
------------------  2025-4-17  -  Apr 17 2025  -------------------
------------------------------------------------------------------

++++ sqlite3:

  - Add subpackage for the lemon parser generator.
  - Add patches:
    * sqlite-3.49.0-fix-lemon-missing-cflags.patch
    * sqlite-3.6.23-lemon-system-template.patch

++++ sqlite3:

  - Add subpackage for the lemon parser generator.
  - Add patches:
    * sqlite-3.49.0-fix-lemon-missing-cflags.patch
    * sqlite-3.6.23-lemon-system-template.patch

++++ sqlite3:

  - Add subpackage for the lemon parser generator.
  - Add patches:
    * sqlite-3.49.0-fix-lemon-missing-cflags.patch
    * sqlite-3.6.23-lemon-system-template.patch

------------------------------------------------------------------
------------------  2025-4-16  -  Apr 16 2025  -------------------
------------------------------------------------------------------

++++ dracut:

  - Update to version 059+suse.597.gb05a38d8:
    * fix(dmsquash-live): do not check ISO md5 if image filesystem (bsc#1240919)
    * fix(nfs): set correct ownership of rpc.statd state directories (bsc#1217885)
    * perf(nfs): remove references to old rpcbind state dir
    * fix(nfs): libnfsidmap plugins not added in some distributions

++++ dracut:

  - Update to version 059+suse.597.gb05a38d8:
    * fix(dmsquash-live): do not check ISO md5 if image filesystem (bsc#1240919)
    * fix(nfs): set correct ownership of rpc.statd state directories (bsc#1217885)
    * perf(nfs): remove references to old rpcbind state dir
    * fix(nfs): libnfsidmap plugins not added in some distributions

++++ dracut:

  - Update to version 059+suse.597.gb05a38d8:
    * fix(dmsquash-live): do not check ISO md5 if image filesystem (bsc#1240919)
    * fix(nfs): set correct ownership of rpc.statd state directories (bsc#1217885)
    * perf(nfs): remove references to old rpcbind state dir
    * fix(nfs): libnfsidmap plugins not added in some distributions

++++ python-kiwi:

  - Add support for filtering out files from the ESP image for GRUB
    Prior to this change, KIWI blindly synced the ESP directory into the
    embedded ESP image. Depending on the distribution and packages included
    for the created image, this can have undesirable side-effects.
    For image builds that need some more fine-grained control over the
    creation of the embedded ESP image (particularly for ISO images),
    this change introduces the ability to inject an exclusion list
    similar to what is used to filter out files for the root filesystem.
    Fixes: https://github.com/OSInside/kiwi/issues/2008
    Fixes: https://github.com/OSInside/kiwi/issues/2777

++++ python-kiwi:

  - Add support for filtering out files from the ESP image for GRUB
    Prior to this change, KIWI blindly synced the ESP directory into the
    embedded ESP image. Depending on the distribution and packages included
    for the created image, this can have undesirable side-effects.
    For image builds that need some more fine-grained control over the
    creation of the embedded ESP image (particularly for ISO images),
    this change introduces the ability to inject an exclusion list
    similar to what is used to filter out files for the root filesystem.
    Fixes: https://github.com/OSInside/kiwi/issues/2008
    Fixes: https://github.com/OSInside/kiwi/issues/2777

------------------------------------------------------------------
------------------  2025-4-13  -  Apr 13 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix bundle extension for container types
    When building result files that use container types like oci or docker,
    kiwi creates them as archive tarballs with an extension prefix to
    indicate the special nature of the archive. However, the bundler
    code does not retain the prefix, which results in the wrong file
    extension for these archives.
    This change adds exceptions for these types and refactors the
    exception handling to unify it with the Vagrant image filename
    handling, which operates similarly.
    Fixes: https://github.com/OSInside/kiwi/issues/2628

++++ python-kiwi:

  - Fix bundle extension for container types
    When building result files that use container types like oci or docker,
    kiwi creates them as archive tarballs with an extension prefix to
    indicate the special nature of the archive. However, the bundler
    code does not retain the prefix, which results in the wrong file
    extension for these archives.
    This change adds exceptions for these types and refactors the
    exception handling to unify it with the Vagrant image filename
    handling, which operates similarly.
    Fixes: https://github.com/OSInside/kiwi/issues/2628

------------------------------------------------------------------
------------------  2025-4-11  -  Apr 11 2025  -------------------
------------------------------------------------------------------

++++ ca-certificates-mozilla:

  - reenable the distrusted certs again. the distrust is only for certs
    issued after the distrust date, not for all certs of a CA.
    remove: remove-distrusted.patch

++++ ca-certificates-mozilla:

  - reenable the distrusted certs again. the distrust is only for certs
    issued after the distrust date, not for all certs of a CA.
    remove: remove-distrusted.patch

++++ curl:

  - fix Leap build add curl-8.13.0-CloseSocket.patch

++++ curl:

  - fix Leap build add curl-8.13.0-CloseSocket.patch

++++ curl:

  - fix Leap build add curl-8.13.0-CloseSocket.patch

++++ curl:

  - fix Leap build add curl-8.13.0-CloseSocket.patch

++++ curl:

  - fix Leap build add curl-8.13.0-CloseSocket.patch

++++ curl:

  - fix Leap build add curl-8.13.0-CloseSocket.patch

++++ python-kiwi:

  - Update LOADER_TYPE setup for grub
    If the bootloader attribute: bls is set to true, make sure
    the LOADER_TYPE changes to grub2-bls. This is related to
    Issue #2773

++++ python-kiwi:

  - Update LOADER_TYPE setup for grub
    If the bootloader attribute: bls is set to true, make sure
    the LOADER_TYPE changes to grub2-bls. This is related to
    Issue #2773

++++ perl:

  - fix heap buffer overflow with tr// [bsc#1241083] [CVE-2024-56406]
    new patch: perl-pmtrans.diff

++++ perl:

  - fix heap buffer overflow with tr// [bsc#1241083] [CVE-2024-56406]
    new patch: perl-pmtrans.diff

------------------------------------------------------------------
------------------  2025-4-10  -  Apr 10 2025  -------------------
------------------------------------------------------------------

++++ cups:

  - Version upgrade to 2.4.12:
    See https://github.com/openprinting/cups/releases
    The last planned release of CUPS 2.4.x series
    (the next will be 2.5.x series) contains several enhancements
    among set of bug fixes, such following cryptographic policies
    when using GnuTLS crypto provider and possibility to opt-out
    from this behavior, logging job debugging history if print
    queue backends fails, or raising alerts for certificate issues
    in IPPS backend.
    Detailed list (from CHANGES.md):
    * GnuTLS follows system crypto policies now (Issue #1105)
    * Added `NoSystem` SSLOptions value (Issue #1130)
    * Now we raise alert for certificate issues (Issue #1194)
    * Added Kyocera USB quirk (Issue #1198)
    * The scheduler now logs a job's debugging history
    if the backend fails (Issue #1205)
    * Fixed a potential timing issue with `cupsEnumDests`
    (Issue #1084)
    * Fixed a potential "lost PPD" condition in the scheduler
    (Issue #1109)
    * Fixed a compressed file error handling bug (Issue #1070)
    * Fixed a bug in the make-and-model whitespace trimming
    code (Issue #1096)
    * Fixed a removal of IPP Everywhere permanent queue
    if installation failed (Issue #1102)
    * Fixed `ServerToken None` in scheduler (Issue #1111)
    * Fixed invalid IPP keyword values created from PPD
    option names (Issue #1118)
    * Fixed handling of "media" and "PageSize" in the same
    print request (Issue #1125)
    * Fixed client raster printing from macOS (Issue #1143)
    * Fixed the default User-Agent string.
    * Fixed a recursion issue in `ippReadIO`.
    * Fixed handling incorrect radix in `scan_ps()` (Issue #1188)
    * Fixed validation of dateTime values with time zones
    more than UTC+11 (Issue #1201)
    * Fixed attributes returned by the Create-Xxx-Subscriptions
    requests (Issue #1204)
    * Fixed `ippDateToTime` when using a non GMT/UTC timezone
    (Issue #1208)
    * Fixed `job-completed` event notifications for jobs that are
    cancelled before started (Issue #1209)
    * Fixed DNS-SD discovery with `ippfind` (Issue #1211)
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.12

++++ docker:

  - Update to docker-buildx v0.22.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.22.0>
    * Includes fixes for CVE-2025-0495. bsc#1239765
  - Disable transparent SUSEConnect support for SLE-16. PED-12534
    When this patchset was first added in 2013 (and rewritten over the years),
    there was no upstream way to easily provide SLE customers with a way to build
    container images based on SLE using the host subscription. However, with
    docker-buildx you can now define secrets for builds (this is not entirely
    transparent, but we can easily document this new requirement for SLE-16).
    Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
  - Now that the only blocker for docker-buildx support was removed for SLE-16,
    enable docker-buildx for SLE-16 as well. PED-8905

++++ docker:

  - Update to docker-buildx v0.22.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.22.0>
    * Includes fixes for CVE-2025-0495. bsc#1239765
  - Disable transparent SUSEConnect support for SLE-16. PED-12534
    When this patchset was first added in 2013 (and rewritten over the years),
    there was no upstream way to easily provide SLE customers with a way to build
    container images based on SLE using the host subscription. However, with
    docker-buildx you can now define secrets for builds (this is not entirely
    transparent, but we can easily document this new requirement for SLE-16).
    Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
  - Now that the only blocker for docker-buildx support was removed for SLE-16,
    enable docker-buildx for SLE-16 as well. PED-8905

++++ docker:

  - Update to docker-buildx v0.22.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.22.0>
    * Includes fixes for CVE-2025-0495. bsc#1239765
  - Disable transparent SUSEConnect support for SLE-16. PED-12534
    When this patchset was first added in 2013 (and rewritten over the years),
    there was no upstream way to easily provide SLE customers with a way to build
    container images based on SLE using the host subscription. However, with
    docker-buildx you can now define secrets for builds (this is not entirely
    transparent, but we can easily document this new requirement for SLE-16).
    Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
  - Now that the only blocker for docker-buildx support was removed for SLE-16,
    enable docker-buildx for SLE-16 as well. PED-8905

++++ docker:

  - Update to docker-buildx v0.22.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.22.0>
    * Includes fixes for CVE-2025-0495. bsc#1239765
  - Disable transparent SUSEConnect support for SLE-16. PED-12534
    When this patchset was first added in 2013 (and rewritten over the years),
    there was no upstream way to easily provide SLE customers with a way to build
    container images based on SLE using the host subscription. However, with
    docker-buildx you can now define secrets for builds (this is not entirely
    transparent, but we can easily document this new requirement for SLE-16).
    Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
  - Now that the only blocker for docker-buildx support was removed for SLE-16,
    enable docker-buildx for SLE-16 as well. PED-8905

++++ docker:

  - Update to docker-buildx v0.22.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.22.0>
    * Includes fixes for CVE-2025-0495. bsc#1239765
  - Disable transparent SUSEConnect support for SLE-16. PED-12534
    When this patchset was first added in 2013 (and rewritten over the years),
    there was no upstream way to easily provide SLE customers with a way to build
    container images based on SLE using the host subscription. However, with
    docker-buildx you can now define secrets for builds (this is not entirely
    transparent, but we can easily document this new requirement for SLE-16).
    Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
  - Now that the only blocker for docker-buildx support was removed for SLE-16,
    enable docker-buildx for SLE-16 as well. PED-8905

++++ docker:

  - Update to docker-buildx v0.22.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.22.0>
    * Includes fixes for CVE-2025-0495. bsc#1239765
  - Disable transparent SUSEConnect support for SLE-16. PED-12534
    When this patchset was first added in 2013 (and rewritten over the years),
    there was no upstream way to easily provide SLE customers with a way to build
    container images based on SLE using the host subscription. However, with
    docker-buildx you can now define secrets for builds (this is not entirely
    transparent, but we can easily document this new requirement for SLE-16).
    Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
  - Now that the only blocker for docker-buildx support was removed for SLE-16,
    enable docker-buildx for SLE-16 as well. PED-8905

++++ docker:

  - Update to docker-buildx v0.22.0. Upstream changelog:
    <https://github.com/docker/buildx/releases/tag/v0.22.0>
    * Includes fixes for CVE-2025-0495. bsc#1239765
  - Disable transparent SUSEConnect support for SLE-16. PED-12534
    When this patchset was first added in 2013 (and rewritten over the years),
    there was no upstream way to easily provide SLE customers with a way to build
    container images based on SLE using the host subscription. However, with
    docker-buildx you can now define secrets for builds (this is not entirely
    transparent, but we can easily document this new requirement for SLE-16).
    Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
    in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
    when doing their builds.
  - Now that the only blocker for docker-buildx support was removed for SLE-16,
    enable docker-buildx for SLE-16 as well. PED-8905

++++ python-kiwi:

  - Fix Agama PXE build
    A bootloader setup is needed to create config.bootoptions
    Even though a ramdisk deployment does not require a bootloader
    setup we need it because part of the setup is the root device
    reference which is still needed to pivot root into the
    system
  - Fix firmware setting for Agama PXE image
  - Added obs BUILD_FLAVOR for agama
    Required for multibuild (multiple profiles) build
  - Update Agama integration test
    Split the build into two profiles ISO and PXE to differentiate
    the build results into a small Agama for remote installations
    and a standard Agama for iso based installations

++++ python-kiwi:

  - Fix Agama PXE build
    A bootloader setup is needed to create config.bootoptions
    Even though a ramdisk deployment does not require a bootloader
    setup we need it because part of the setup is the root device
    reference which is still needed to pivot root into the
    system
  - Fix firmware setting for Agama PXE image
  - Added obs BUILD_FLAVOR for agama
    Required for multibuild (multiple profiles) build
  - Update Agama integration test
    Split the build into two profiles ISO and PXE to differentiate
    the build results into a small Agama for remote installations
    and a standard Agama for iso based installations

++++ runc:

  - Update to runc v1.2.6. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.6>.

++++ runc:

  - Update to runc v1.2.6. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.6>.

++++ runc:

  - Update to runc v1.2.6. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.6>.

++++ runc:

  - Update to runc v1.2.6. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.6>.

------------------------------------------------------------------
------------------  2025-4-9  -  Apr 9 2025  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.27. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.27>
    bsc#1239749 CVE-2024-40635
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.27. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.27>
    bsc#1239749 CVE-2024-40635
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.27. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.27>
    bsc#1239749 CVE-2024-40635
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ curl:

  - Update to 8.13.0:
    * Changes:
  - curl: add write-out variable 'tls_earlydata'
  - curl: make --url support a file with URLs
  - gnutls: set priority via --ciphers
  - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
  - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
  - OpenSSL/quictls: add support for TLSv1.3 early data
  - rustls: add support for CERTINFO
  - rustls: add support for SSLKEYLOGFILE
  - rustls: support ECH w/ DoH lookup for config
  - rustls: support native platform verifier
  - var: add a '64dec' function that can base64 decode a string
    * Bugfixes:
  - conn: fix connection reuse when SSL is optional
  - hash: use single linked list for entries
  - http2: detect session being closed on ingress handling
  - http2: reset stream on response header error
  - http: remove a HTTP method size restriction
  - http: version negotiation
  - httpsrr: fix port detection
  - libssh: fix freeing of resources in disconnect
  - libssh: fix scp large file upload for 32-bit size_t systems
  - openssl-quic: do not iterate over multi handles
  - openssl: check return value of X509_get0_pubkey
  - openssl: drop support for old OpenSSL/LibreSSL versions
  - openssl: fix crash on missing cert password
  - openssl: fix pkcs11 URI checking for key files.
  - openssl: remove bad `goto`s into other scope
  - setopt: illegal CURLOPT_SOCKS5_AUTH should return error
  - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine
  - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version
  - sshserver: fix excluding obsolete client config lines
  - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR
  - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
  - tool_operate: fail SSH transfers without server auth
  - url: call protocol handler's disconnect in Curl_conn_free
  - urlapi: remove percent encoded dot sequences from the URL path
  - urldata: remove 'hostname' from struct Curl_async
    * Rebase patches:
  - libcurl-ocloexec.patch
  - curl-secure-getenv.patch

++++ curl:

  - Update to 8.13.0:
    * Changes:
  - curl: add write-out variable 'tls_earlydata'
  - curl: make --url support a file with URLs
  - gnutls: set priority via --ciphers
  - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
  - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
  - OpenSSL/quictls: add support for TLSv1.3 early data
  - rustls: add support for CERTINFO
  - rustls: add support for SSLKEYLOGFILE
  - rustls: support ECH w/ DoH lookup for config
  - rustls: support native platform verifier
  - var: add a '64dec' function that can base64 decode a string
    * Bugfixes:
  - conn: fix connection reuse when SSL is optional
  - hash: use single linked list for entries
  - http2: detect session being closed on ingress handling
  - http2: reset stream on response header error
  - http: remove a HTTP method size restriction
  - http: version negotiation
  - httpsrr: fix port detection
  - libssh: fix freeing of resources in disconnect
  - libssh: fix scp large file upload for 32-bit size_t systems
  - openssl-quic: do not iterate over multi handles
  - openssl: check return value of X509_get0_pubkey
  - openssl: drop support for old OpenSSL/LibreSSL versions
  - openssl: fix crash on missing cert password
  - openssl: fix pkcs11 URI checking for key files.
  - openssl: remove bad `goto`s into other scope
  - setopt: illegal CURLOPT_SOCKS5_AUTH should return error
  - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine
  - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version
  - sshserver: fix excluding obsolete client config lines
  - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR
  - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
  - tool_operate: fail SSH transfers without server auth
  - url: call protocol handler's disconnect in Curl_conn_free
  - urlapi: remove percent encoded dot sequences from the URL path
  - urldata: remove 'hostname' from struct Curl_async
    * Rebase patches:
  - libcurl-ocloexec.patch
  - curl-secure-getenv.patch

++++ curl:

  - Update to 8.13.0:
    * Changes:
  - curl: add write-out variable 'tls_earlydata'
  - curl: make --url support a file with URLs
  - gnutls: set priority via --ciphers
  - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
  - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
  - OpenSSL/quictls: add support for TLSv1.3 early data
  - rustls: add support for CERTINFO
  - rustls: add support for SSLKEYLOGFILE
  - rustls: support ECH w/ DoH lookup for config
  - rustls: support native platform verifier
  - var: add a '64dec' function that can base64 decode a string
    * Bugfixes:
  - conn: fix connection reuse when SSL is optional
  - hash: use single linked list for entries
  - http2: detect session being closed on ingress handling
  - http2: reset stream on response header error
  - http: remove a HTTP method size restriction
  - http: version negotiation
  - httpsrr: fix port detection
  - libssh: fix freeing of resources in disconnect
  - libssh: fix scp large file upload for 32-bit size_t systems
  - openssl-quic: do not iterate over multi handles
  - openssl: check return value of X509_get0_pubkey
  - openssl: drop support for old OpenSSL/LibreSSL versions
  - openssl: fix crash on missing cert password
  - openssl: fix pkcs11 URI checking for key files.
  - openssl: remove bad `goto`s into other scope
  - setopt: illegal CURLOPT_SOCKS5_AUTH should return error
  - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine
  - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version
  - sshserver: fix excluding obsolete client config lines
  - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR
  - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
  - tool_operate: fail SSH transfers without server auth
  - url: call protocol handler's disconnect in Curl_conn_free
  - urlapi: remove percent encoded dot sequences from the URL path
  - urldata: remove 'hostname' from struct Curl_async
    * Rebase patches:
  - libcurl-ocloexec.patch
  - curl-secure-getenv.patch

++++ curl:

  - Update to 8.13.0:
    * Changes:
  - curl: add write-out variable 'tls_earlydata'
  - curl: make --url support a file with URLs
  - gnutls: set priority via --ciphers
  - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
  - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
  - OpenSSL/quictls: add support for TLSv1.3 early data
  - rustls: add support for CERTINFO
  - rustls: add support for SSLKEYLOGFILE
  - rustls: support ECH w/ DoH lookup for config
  - rustls: support native platform verifier
  - var: add a '64dec' function that can base64 decode a string
    * Bugfixes:
  - conn: fix connection reuse when SSL is optional
  - hash: use single linked list for entries
  - http2: detect session being closed on ingress handling
  - http2: reset stream on response header error
  - http: remove a HTTP method size restriction
  - http: version negotiation
  - httpsrr: fix port detection
  - libssh: fix freeing of resources in disconnect
  - libssh: fix scp large file upload for 32-bit size_t systems
  - openssl-quic: do not iterate over multi handles
  - openssl: check return value of X509_get0_pubkey
  - openssl: drop support for old OpenSSL/LibreSSL versions
  - openssl: fix crash on missing cert password
  - openssl: fix pkcs11 URI checking for key files.
  - openssl: remove bad `goto`s into other scope
  - setopt: illegal CURLOPT_SOCKS5_AUTH should return error
  - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine
  - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version
  - sshserver: fix excluding obsolete client config lines
  - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR
  - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
  - tool_operate: fail SSH transfers without server auth
  - url: call protocol handler's disconnect in Curl_conn_free
  - urlapi: remove percent encoded dot sequences from the URL path
  - urldata: remove 'hostname' from struct Curl_async
    * Rebase patches:
  - libcurl-ocloexec.patch
  - curl-secure-getenv.patch

++++ curl:

  - Update to 8.13.0:
    * Changes:
  - curl: add write-out variable 'tls_earlydata'
  - curl: make --url support a file with URLs
  - gnutls: set priority via --ciphers
  - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
  - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
  - OpenSSL/quictls: add support for TLSv1.3 early data
  - rustls: add support for CERTINFO
  - rustls: add support for SSLKEYLOGFILE
  - rustls: support ECH w/ DoH lookup for config
  - rustls: support native platform verifier
  - var: add a '64dec' function that can base64 decode a string
    * Bugfixes:
  - conn: fix connection reuse when SSL is optional
  - hash: use single linked list for entries
  - http2: detect session being closed on ingress handling
  - http2: reset stream on response header error
  - http: remove a HTTP method size restriction
  - http: version negotiation
  - httpsrr: fix port detection
  - libssh: fix freeing of resources in disconnect
  - libssh: fix scp large file upload for 32-bit size_t systems
  - openssl-quic: do not iterate over multi handles
  - openssl: check return value of X509_get0_pubkey
  - openssl: drop support for old OpenSSL/LibreSSL versions
  - openssl: fix crash on missing cert password
  - openssl: fix pkcs11 URI checking for key files.
  - openssl: remove bad `goto`s into other scope
  - setopt: illegal CURLOPT_SOCKS5_AUTH should return error
  - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine
  - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version
  - sshserver: fix excluding obsolete client config lines
  - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR
  - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
  - tool_operate: fail SSH transfers without server auth
  - url: call protocol handler's disconnect in Curl_conn_free
  - urlapi: remove percent encoded dot sequences from the URL path
  - urldata: remove 'hostname' from struct Curl_async
    * Rebase patches:
  - libcurl-ocloexec.patch
  - curl-secure-getenv.patch

++++ curl:

  - Update to 8.13.0:
    * Changes:
  - curl: add write-out variable 'tls_earlydata'
  - curl: make --url support a file with URLs
  - gnutls: set priority via --ciphers
  - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
  - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
  - OpenSSL/quictls: add support for TLSv1.3 early data
  - rustls: add support for CERTINFO
  - rustls: add support for SSLKEYLOGFILE
  - rustls: support ECH w/ DoH lookup for config
  - rustls: support native platform verifier
  - var: add a '64dec' function that can base64 decode a string
    * Bugfixes:
  - conn: fix connection reuse when SSL is optional
  - hash: use single linked list for entries
  - http2: detect session being closed on ingress handling
  - http2: reset stream on response header error
  - http: remove a HTTP method size restriction
  - http: version negotiation
  - httpsrr: fix port detection
  - libssh: fix freeing of resources in disconnect
  - libssh: fix scp large file upload for 32-bit size_t systems
  - openssl-quic: do not iterate over multi handles
  - openssl: check return value of X509_get0_pubkey
  - openssl: drop support for old OpenSSL/LibreSSL versions
  - openssl: fix crash on missing cert password
  - openssl: fix pkcs11 URI checking for key files.
  - openssl: remove bad `goto`s into other scope
  - setopt: illegal CURLOPT_SOCKS5_AUTH should return error
  - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine
  - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version
  - sshserver: fix excluding obsolete client config lines
  - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR
  - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`
  - tool_operate: fail SSH transfers without server auth
  - url: call protocol handler's disconnect in Curl_conn_free
  - urlapi: remove percent encoded dot sequences from the URL path
  - urldata: remove 'hostname' from struct Curl_async
    * Rebase patches:
  - libcurl-ocloexec.patch
  - curl-secure-getenv.patch

++++ python-kiwi:

  - Prevent loading unused data in oem deployment
    In case rd.kiwi.ramdisk is used as part of a remote deployment
    setup, it's not needed to load the system kernel and initrd
    because it's not used as kexec is not called with the system
    deployed into memory. For ramdisk deployments the system is
    booted using the currently active kernel and initrd and as
    such we can avoid loading an extra kernel and initrd for
    booting the system via kexec.
  - Update Agama integration test
    Make use of <oem-ramdisk-size> in the Agama integration test
  - Added <oem-ramdisk-size> element
    So far it was only possible to specify the size of the ramdisk
    via the kernel commandline option: ramdisk_size. In a remote
    deployment it was therefore required to carry this size as a
    mandatory information to the deployment server. With this commit
    we allow to specify the size for the ramdisk to be configured as
    part of the image configuration which makes this information
    also available inside of the initrd. If provided the ramdisk_size
    kernel commandline option still takes precedence over the
    <oem-ramdisk-size> setting to avoid any behavior change and to
    still allow dynamic overrides of the ramdisk size.

++++ python-kiwi:

  - Prevent loading unused data in oem deployment
    In case rd.kiwi.ramdisk is used as part of a remote deployment
    setup, it's not needed to load the system kernel and initrd
    because it's not used as kexec is not called with the system
    deployed into memory. For ramdisk deployments the system is
    booted using the currently active kernel and initrd and as
    such we can avoid loading an extra kernel and initrd for
    booting the system via kexec.
  - Update Agama integration test
    Make use of <oem-ramdisk-size> in the Agama integration test
  - Added <oem-ramdisk-size> element
    So far it was only possible to specify the size of the ramdisk
    via the kernel commandline option: ramdisk_size. In a remote
    deployment it was therefore required to carry this size as a
    mandatory information to the deployment server. With this commit
    we allow to specify the size for the ramdisk to be configured as
    part of the image configuration which makes this information
    also available inside of the initrd. If provided the ramdisk_size
    kernel commandline option still takes precedence over the
    <oem-ramdisk-size> setting to avoid any behavior change and to
    still allow dynamic overrides of the ramdisk size.

------------------------------------------------------------------
------------------  2025-4-8  -  Apr 8 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - reinstall bootstrap packs in image phase for apt
    Due to the special bootstrap process, the packages unpacked
    during bootstrap are not properly listed in the apt index.
    Therefore the bootstrap packages are added to the install
    phase which causes an install of this packages again to
    fix the apt index and provide a consistent system from
    an apt perspective. This Fixes #2768

++++ python-kiwi:

  - reinstall bootstrap packs in image phase for apt
    Due to the special bootstrap process, the packages unpacked
    during bootstrap are not properly listed in the apt index.
    Therefore the bootstrap packages are added to the install
    phase which causes an install of this packages again to
    fix the apt index and provide a consistent system from
    an apt perspective. This Fixes #2768

++++ glib2:

  - Add glib2-CVE-2025-3360.patch:
    Backport 8d60d7dc from upstream, Fix integer overflow when
    parsing very long ISO8601 inputs. This will only happen with
    invalid (or maliciously invalid) potential ISO8601 strings,
    but `g_date_time_new_from_iso8601()` needs to be robust against
    that.
    (CVE-2025-3360, bsc#1240897)

++++ glib2:

  - Add glib2-CVE-2025-3360.patch:
    Backport 8d60d7dc from upstream, Fix integer overflow when
    parsing very long ISO8601 inputs. This will only happen with
    invalid (or maliciously invalid) potential ISO8601 strings,
    but `g_date_time_new_from_iso8601()` needs to be robust against
    that.
    (CVE-2025-3360, bsc#1240897)

++++ glib2:

  - Add glib2-CVE-2025-3360.patch:
    Backport 8d60d7dc from upstream, Fix integer overflow when
    parsing very long ISO8601 inputs. This will only happen with
    invalid (or maliciously invalid) potential ISO8601 strings,
    but `g_date_time_new_from_iso8601()` needs to be robust against
    that.
    (CVE-2025-3360, bsc#1240897)

++++ glib2:

  - Add glib2-CVE-2025-3360.patch:
    Backport 8d60d7dc from upstream, Fix integer overflow when
    parsing very long ISO8601 inputs. This will only happen with
    invalid (or maliciously invalid) potential ISO8601 strings,
    but `g_date_time_new_from_iso8601()` needs to be robust against
    that.
    (CVE-2025-3360, bsc#1240897)

++++ glib2:

  - Add glib2-CVE-2025-3360.patch:
    Backport 8d60d7dc from upstream, Fix integer overflow when
    parsing very long ISO8601 inputs. This will only happen with
    invalid (or maliciously invalid) potential ISO8601 strings,
    but `g_date_time_new_from_iso8601()` needs to be robust against
    that.
    (CVE-2025-3360, bsc#1240897)

------------------------------------------------------------------
------------------  2025-4-7  -  Apr 7 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed restore of keyfile after reencryption
    When kiwi runs the reencryption it also restores an eventual
    existing keyfile. However if the option rd.kiwi.oem.luks.reencrypt_randompass
    is specified no former keyfile should be restored. The purpose
    of reencrypt_randompass is to make sure only this in memory
    passphrase can access the luks pool such that tooling at boot
    time gets the opportunity to work with the luks pool for e.g.
    setting up a TPM key or set a passphrase only known to the user.

++++ python-kiwi:

  - Fixed restore of keyfile after reencryption
    When kiwi runs the reencryption it also restores an eventual
    existing keyfile. However if the option rd.kiwi.oem.luks.reencrypt_randompass
    is specified no former keyfile should be restored. The purpose
    of reencrypt_randompass is to make sure only this in memory
    passphrase can access the luks pool such that tooling at boot
    time gets the opportunity to work with the luks pool for e.g.
    setting up a TPM key or set a passphrase only known to the user.

------------------------------------------------------------------
------------------  2025-4-4  -  Apr 4 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update dracut kiwi-lib module setup
    Make sure all tools used in code are requested for inclusion
  - keep /usr/bin/sha256sum
    dropping md5sum was okay, but now we need
    the current tool to verify the checksum

++++ python-kiwi:

  - Update dracut kiwi-lib module setup
    Make sure all tools used in code are requested for inclusion
  - keep /usr/bin/sha256sum
    dropping md5sum was okay, but now we need
    the current tool to verify the checksum

------------------------------------------------------------------
------------------  2025-4-3  -  Apr 3 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Restrict keyfile permissions
    For reencrypt in combination with rd.kiwi.oem.luks.reencrypt_randompass
    make sure that the temporary random pass keyfile has 0400 root
    owned access permissions set

++++ python-kiwi:

  - Restrict keyfile permissions
    For reencrypt in combination with rd.kiwi.oem.luks.reencrypt_randompass
    make sure that the temporary random pass keyfile has 0400 root
    owned access permissions set

++++ glibc:

  - pthread-wakeup.patch: pthreads NPTL: lost wakeup fix 2 (bsc#1234128, BZ
    [#25847])

++++ glibc:

  - pthread-wakeup.patch: pthreads NPTL: lost wakeup fix 2 (bsc#1234128, BZ
    [#25847])

++++ glibc:

  - pthread-wakeup.patch: pthreads NPTL: lost wakeup fix 2 (bsc#1234128, BZ
    [#25847])

++++ libsolv:

  - build both static and dynamic libraries on new suse distros
  - support the apk package and repository format (both v2 and v3)
  - new dataiterator_final_{repo,solvable} functions
  - bump version to 0.7.32

++++ libsolv:

  - build both static and dynamic libraries on new suse distros
  - support the apk package and repository format (both v2 and v3)
  - new dataiterator_final_{repo,solvable} functions
  - bump version to 0.7.32

++++ libsolv:

  - build both static and dynamic libraries on new suse distros
  - support the apk package and repository format (both v2 and v3)
  - new dataiterator_final_{repo,solvable} functions
  - bump version to 0.7.32

++++ libzypp:

  - Drop workaround for broken rpm-4.18 in Code16 (bsc#1237172)
  - BuildRequires:  %{libsolv_devel_package} >= 0.7.32.
    Code16 moved static libs to libsolv-devel-static.
  - Drop usage of SHA1 hash algorithm because it will become
    unavailable in FIPS mode (bsc#1240529)
  - Fix zypp.conf dupAllowVendorChange to reflect the correct
    default (false).
    The default was true in Code12 (libzypp-16.x) and changed to
    false with Code15 (libzypp-17.x). Unfortunately this was done by
    shipping a modified zypp.conf file rather than fixing the code.
  - zypp.conf: Add `lock_timeout` ($ZYPP_LOCK_TIMEOUT) (bsc#1239809)
  - version 17.36.6 (35)

++++ libzypp:

  - Drop workaround for broken rpm-4.18 in Code16 (bsc#1237172)
  - BuildRequires:  %{libsolv_devel_package} >= 0.7.32.
    Code16 moved static libs to libsolv-devel-static.
  - Drop usage of SHA1 hash algorithm because it will become
    unavailable in FIPS mode (bsc#1240529)
  - Fix zypp.conf dupAllowVendorChange to reflect the correct
    default (false).
    The default was true in Code12 (libzypp-16.x) and changed to
    false with Code15 (libzypp-17.x). Unfortunately this was done by
    shipping a modified zypp.conf file rather than fixing the code.
  - zypp.conf: Add `lock_timeout` ($ZYPP_LOCK_TIMEOUT) (bsc#1239809)
  - version 17.36.6 (35)

++++ libzypp:

  - Drop workaround for broken rpm-4.18 in Code16 (bsc#1237172)
  - BuildRequires:  %{libsolv_devel_package} >= 0.7.32.
    Code16 moved static libs to libsolv-devel-static.
  - Drop usage of SHA1 hash algorithm because it will become
    unavailable in FIPS mode (bsc#1240529)
  - Fix zypp.conf dupAllowVendorChange to reflect the correct
    default (false).
    The default was true in Code12 (libzypp-16.x) and changed to
    false with Code15 (libzypp-17.x). Unfortunately this was done by
    shipping a modified zypp.conf file rather than fixing the code.
  - zypp.conf: Add `lock_timeout` ($ZYPP_LOCK_TIMEOUT) (bsc#1239809)
  - version 17.36.6 (35)

++++ timezone:

  - Update to 2025b:
    * New zone for Aysén Region in Chile (America/Coyhaique) which
    moves from -04/-03 to -03
  - Refresh patches
    * revert-philippines-historical-data.patch
    * tzdata-china.diff

------------------------------------------------------------------
------------------  2025-4-2  -  Apr 2 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - package: Add kiwi-image:oci Provides to -systemdeps-containers
    This allows the Open Build Service to correctly resolve dependencies
    when building OCI images.
  - Better logging which kiwi file is read
    Improve the log message that tells about reading the
    kiwi config file to actually show the file path that
    is read in. This is especially an issue if more than
    one kiwi file is read in during the build process.
  - also keep the ts binary, might be needed to provide timestamped logfiles

++++ python-kiwi:

  - package: Add kiwi-image:oci Provides to -systemdeps-containers
    This allows the Open Build Service to correctly resolve dependencies
    when building OCI images.
  - Better logging which kiwi file is read
    Improve the log message that tells about reading the
    kiwi config file to actually show the file path that
    is read in. This is especially an issue if more than
    one kiwi file is read in during the build process.
  - also keep the ts binary, might be needed to provide timestamped logfiles

++++ grub2:

  - Filter out the non-subvolume btrfs mount points when creating the
    relative path (bsc#1239674)
    * grub2-btrfs-filter-non-subvol-mount.patch

++++ grub2:

  - Filter out the non-subvolume btrfs mount points when creating the
    relative path (bsc#1239674)
    * grub2-btrfs-filter-non-subvol-mount.patch

------------------------------------------------------------------
------------------  2025-4-1  -  Apr 1 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update documentation
    Add information about new apk (Alpine) support

++++ python-kiwi:

  - Update documentation
    Add information about new apk (Alpine) support

------------------------------------------------------------------
------------------  2025-3-31  -  Mar 31 2025  -------------------
------------------------------------------------------------------

++++ ca-certificates-mozilla:

  - explit remove distruted certs, as the distrust does not get exported
    correctly and the SSL certs are still trusted. (bsc#1240343)
  - Entrust.net Premium 2048 Secure Server CA
  - Entrust Root Certification Authority
  - AffirmTrust Commercial
  - AffirmTrust Networking
  - AffirmTrust Premium
  - AffirmTrust Premium ECC
  - Entrust Root Certification Authority - G2
  - Entrust Root Certification Authority - EC1
  - GlobalSign Root E46
  - GLOBALTRUST 2020
  - remove-distrusted.patch: apply to certdata.txt

++++ ca-certificates-mozilla:

  - explit remove distruted certs, as the distrust does not get exported
    correctly and the SSL certs are still trusted. (bsc#1240343)
  - Entrust.net Premium 2048 Secure Server CA
  - Entrust Root Certification Authority
  - AffirmTrust Commercial
  - AffirmTrust Networking
  - AffirmTrust Premium
  - AffirmTrust Premium ECC
  - Entrust Root Certification Authority - G2
  - Entrust Root Certification Authority - EC1
  - GlobalSign Root E46
  - GLOBALTRUST 2020
  - remove-distrusted.patch: apply to certdata.txt

++++ container-selinux:

  - Update to version 2.236.0:
    * Allow super privileged containers to use RealtimeKit for scheduling
    * Add container_ro_file_t to the podman artifact store

++++ python-kiwi:

  - Add support for Alpine
    Add apk repository and package manager support and provide
    an integration test build for the Alpine distribution
  - Fix F824 flake check for global assignments
  - Use metalink repos for local test builds

++++ python-kiwi:

  - Add support for Alpine
    Add apk repository and package manager support and provide
    an integration test build for the Alpine distribution
  - Fix F824 flake check for global assignments
  - Use metalink repos for local test builds

------------------------------------------------------------------
------------------  2025-3-29  -  Mar 29 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - schema: Allow C as a valid locale
    It should be permitted to set the "C.UTF-8" locale for minimal images
    that are not preloaded with locales. The "C.UTF-8" locale has been
    supported in Linux distributions for many years.

++++ python-kiwi:

  - schema: Allow C as a valid locale
    It should be permitted to set the "C.UTF-8" locale for minimal images
    that are not preloaded with locales. The "C.UTF-8" locale has been
    supported in Linux distributions for many years.

------------------------------------------------------------------
------------------  2025-3-28  -  Mar 28 2025  -------------------
------------------------------------------------------------------

++++ expat:

  - version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives

++++ expat:

  - version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives

++++ expat:

  - version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives

++++ expat:

  - version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives

------------------------------------------------------------------
------------------  2025-3-27  -  Mar 27 2025  -------------------
------------------------------------------------------------------

++++ expat:

  - version update to 2.7.0 for SLFO-1.1
  - deleted patches
  - expat-CVE-2024-45490.patch (upstreamed)
  - expat-CVE-2024-45491.patch (upstreamed)
  - expat-CVE-2024-45492.patch (upstreamed)
  - expat-CVE-2024-28757.patch (upstreamed)
  - expat-CVE-2024-50602.patch (upstreamed)
  - expat-fix-minicheck.patch (upstreamed)

++++ expat:

  - version update to 2.7.0 for SLFO-1.1
  - deleted patches
  - expat-CVE-2024-45490.patch (upstreamed)
  - expat-CVE-2024-45491.patch (upstreamed)
  - expat-CVE-2024-45492.patch (upstreamed)
  - expat-CVE-2024-28757.patch (upstreamed)
  - expat-CVE-2024-50602.patch (upstreamed)
  - expat-fix-minicheck.patch (upstreamed)

++++ expat:

  - version update to 2.7.0 for SLFO-1.1
  - deleted patches
  - expat-CVE-2024-45490.patch (upstreamed)
  - expat-CVE-2024-45491.patch (upstreamed)
  - expat-CVE-2024-45492.patch (upstreamed)
  - expat-CVE-2024-28757.patch (upstreamed)
  - expat-CVE-2024-50602.patch (upstreamed)
  - expat-fix-minicheck.patch (upstreamed)

++++ expat:

  - version update to 2.7.0 for SLFO-1.1
  - deleted patches
  - expat-CVE-2024-45490.patch (upstreamed)
  - expat-CVE-2024-45491.patch (upstreamed)
  - expat-CVE-2024-45492.patch (upstreamed)
  - expat-CVE-2024-28757.patch (upstreamed)
  - expat-CVE-2024-50602.patch (upstreamed)
  - expat-fix-minicheck.patch (upstreamed)

------------------------------------------------------------------
------------------  2025-3-26  -  Mar 26 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Don't use the new container-selinux conditional requires on SLE-12, as the
    RPM version there doesn't support it. Arguably the change itself is a bit
    suspect but we can fix that later. bsc#1237367

++++ docker:

  - Don't use the new container-selinux conditional requires on SLE-12, as the
    RPM version there doesn't support it. Arguably the change itself is a bit
    suspect but we can fix that later. bsc#1237367

++++ docker:

  - Don't use the new container-selinux conditional requires on SLE-12, as the
    RPM version there doesn't support it. Arguably the change itself is a bit
    suspect but we can fix that later. bsc#1237367

++++ docker:

  - Don't use the new container-selinux conditional requires on SLE-12, as the
    RPM version there doesn't support it. Arguably the change itself is a bit
    suspect but we can fix that later. bsc#1237367

++++ docker:

  - Don't use the new container-selinux conditional requires on SLE-12, as the
    RPM version there doesn't support it. Arguably the change itself is a bit
    suspect but we can fix that later. bsc#1237367

++++ docker:

  - Don't use the new container-selinux conditional requires on SLE-12, as the
    RPM version there doesn't support it. Arguably the change itself is a bit
    suspect but we can fix that later. bsc#1237367

++++ docker:

  - Don't use the new container-selinux conditional requires on SLE-12, as the
    RPM version there doesn't support it. Arguably the change itself is a bit
    suspect but we can fix that later. bsc#1237367

------------------------------------------------------------------
------------------  2025-3-25  -  Mar 25 2025  -------------------
------------------------------------------------------------------

++++ ca-certificates-mozilla:

  - Fix awk to compare (missing a =) and give the following output:
    [#] NSS_BUILTINS_LIBRARY_VERSION "2.74"
  - pass file argument to awk (bsc#1240009)

++++ ca-certificates-mozilla:

  - Fix awk to compare (missing a =) and give the following output:
    [#] NSS_BUILTINS_LIBRARY_VERSION "2.74"
  - pass file argument to awk (bsc#1240009)

++++ docker:

  - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185
    + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322
    + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - Refresh patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185
    + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322
    + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - Refresh patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185
    + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322
    + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - Refresh patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185
    + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322
    + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - Refresh patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185
    + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322
    + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - Refresh patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185
    + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322
    + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - Refresh patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ docker:

  - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185
    + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322
    + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - Refresh patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

++++ python-kiwi:

  - Bump version: 10.2.15 → 10.2.16
  - Support sourcetype setting on the commandline
    Allow to specifiy the sourcetype(metalink|baseurl|mirrorlist)
    also on the commandline via --set-repo/--add-repo options. So
    far this was only possible as part of the kiwi description file
  - Bump version: 10.2.14 → 10.2.15
  - Fix gh-pages deployment
    poetry install was not called, thus sphinx was not present
  - Bump version: 10.2.13 → 10.2.14

++++ python-kiwi:

  - Bump version: 10.2.15 → 10.2.16
  - Support sourcetype setting on the commandline
    Allow to specifiy the sourcetype(metalink|baseurl|mirrorlist)
    also on the commandline via --set-repo/--add-repo options. So
    far this was only possible as part of the kiwi description file
  - Bump version: 10.2.14 → 10.2.15
  - Fix gh-pages deployment
    poetry install was not called, thus sphinx was not present
  - Bump version: 10.2.13 → 10.2.14

------------------------------------------------------------------
------------------  2025-3-24  -  Mar 24 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Drop use of travis-sphinx
    According to the documentation of peaceiris/actions-gh-pages
    the sphinx-build output can be directly consumed to publish
    to github pages
  - Allow stderr data in CommandProcess
    Enhance poll_show_progress() method to allow polling on
    stderr data too. The new parameter with_stderr is used
    together with the dnf5 package manager. dnf5 has changed
    in a way that a lot of useful information during the
    install of packages is printed to stderr. From my perspective
    a clear regression to former behavior but we can fix this
    in kiwi to poll on both channels. This Fixes #2748
  - Support arch attribute for <users> section
    Allow to setup users per arch. This Fixes #2737
  - Add Debian_12_update repo for testing with typer
    Even though we will add support for the typer Cli with kiwi-11
    I want our integration test images to be able to build with the
    open PR #2751. Debian 12 is the only target in the support matrix
    which uses a too old veryion of typer. Therefore to be able to
    test this target I built a newer version of typer in an update
    repo for Debian 12 and added it to the integration test
    description

++++ python-kiwi:

  - Drop use of travis-sphinx
    According to the documentation of peaceiris/actions-gh-pages
    the sphinx-build output can be directly consumed to publish
    to github pages
  - Allow stderr data in CommandProcess
    Enhance poll_show_progress() method to allow polling on
    stderr data too. The new parameter with_stderr is used
    together with the dnf5 package manager. dnf5 has changed
    in a way that a lot of useful information during the
    install of packages is printed to stderr. From my perspective
    a clear regression to former behavior but we can fix this
    in kiwi to poll on both channels. This Fixes #2748
  - Support arch attribute for <users> section
    Allow to setup users per arch. This Fixes #2737
  - Add Debian_12_update repo for testing with typer
    Even though we will add support for the typer Cli with kiwi-11
    I want our integration test images to be able to build with the
    open PR #2751. Debian 12 is the only target in the support matrix
    which uses a too old veryion of typer. Therefore to be able to
    test this target I built a newer version of typer in an update
    repo for Debian 12 and added it to the integration test
    description

++++ git:

  - Add support of SHA256 git repo for gitk (bsc#1239989):
    0001-gitk-Add-a-basic-support-of-SHA256-repositories-into.patch
    0002-gitk-Add-auto-select-length-preference-for-SHA256.patch

++++ glibc:

  - Mark functions in libc_nonshared.a as hidden (bsc#1239883)

++++ glibc:

  - Mark functions in libc_nonshared.a as hidden (bsc#1239883)

++++ glibc:

  - Mark functions in libc_nonshared.a as hidden (bsc#1239883)

++++ podman:

  - Add patch for CVE-2025-22869 (bsc#1239330):
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch

++++ podman:

  - Add patch for CVE-2025-22869 (bsc#1239330):
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch

++++ podman:

  - Add patch for CVE-2025-22869 (bsc#1239330):
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch

++++ podman:

  - Add patch for CVE-2025-22869 (bsc#1239330):
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch

++++ podman:

  - Add patch for CVE-2025-22869 (bsc#1239330):
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch

++++ podman:

  - Add patch for CVE-2025-22869 (bsc#1239330):
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch

++++ podman:

  - Add patch for CVE-2025-22869 (bsc#1239330):
    * 0006-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch

++++ qemu:

  - Fixes for bsc#1237603, bsc#1236709, bsc#1236709:
    * linux-user: Do not define struct sched_attr if libc headers do (bsc#1237603)
    * elfload: Fix alignment when unmapping excess reservation (bsc#1236709)
    * linux-user: Honor elf alignment when placing images (bsc#1236709)

++++ qemu:

  - Fixes for bsc#1237603, bsc#1236709, bsc#1236709:
    * linux-user: Do not define struct sched_attr if libc headers do (bsc#1237603)
    * elfload: Fix alignment when unmapping excess reservation (bsc#1236709)
    * linux-user: Honor elf alignment when placing images (bsc#1236709)

++++ qemu:

  - Fixes for bsc#1237603, bsc#1236709, bsc#1236709:
    * linux-user: Do not define struct sched_attr if libc headers do (bsc#1237603)
    * elfload: Fix alignment when unmapping excess reservation (bsc#1236709)
    * linux-user: Honor elf alignment when placing images (bsc#1236709)

++++ skopeo:

  - Add patch for CVE-2025-22870 - bsc#1238685
    Add patch:
    * 0004-CVE-2025-22870-vendor-proxy-http-httpproxy-do-not-mi.patch
    (CVE-2025-22870 - bsc#1238685)
    Rebase patches:
    * 0001-http2-close-connections-when-receiving-too-many-head.patch
    * 0002-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0003-Don-t-allow-unbounded-amounts-of-splits-https-github.patch

++++ skopeo:

  - Add patch for CVE-2025-22870 - bsc#1238685
    Add patch:
    * 0004-CVE-2025-22870-vendor-proxy-http-httpproxy-do-not-mi.patch
    (CVE-2025-22870 - bsc#1238685)
    Rebase patches:
    * 0001-http2-close-connections-when-receiving-too-many-head.patch
    * 0002-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0003-Don-t-allow-unbounded-amounts-of-splits-https-github.patch

------------------------------------------------------------------
------------------  2025-3-23  -  Mar 23 2025  -------------------
------------------------------------------------------------------

++++ pam_pkcs11:

  - Security update fix [bsc#1237062, CVE-2025-24032], [bsc#1237058, CVE-2025-24031]
    * Fix CVE-2025-24032: vulnerable to authentication bypass with default value for `cert_policy` (`none`)
    * Fix CVE-2025-24031: vulnerable to segmentation fault on ctrl-c/ctrl-d when asked for PIN
    * Add pam_pkcs11-CVE-2025-24032.patch
    * Add pam_pkcs11-CVE-2025-24031.patch

++++ pam_pkcs11:

  - Security update fix [bsc#1237062, CVE-2025-24032], [bsc#1237058, CVE-2025-24031]
    * Fix CVE-2025-24032: vulnerable to authentication bypass with default value for `cert_policy` (`none`)
    * Fix CVE-2025-24031: vulnerable to segmentation fault on ctrl-c/ctrl-d when asked for PIN
    * Add pam_pkcs11-CVE-2025-24032.patch
    * Add pam_pkcs11-CVE-2025-24031.patch

------------------------------------------------------------------
------------------  2025-3-22  -  Mar 22 2025  -------------------
------------------------------------------------------------------

++++ tiff:

  - Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
  - Add %check section
  - Remove Group: declarations, no longer used

------------------------------------------------------------------
------------------  2025-3-21  -  Mar 21 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed python3_sitelib for debbuild in OBS
  - Fixed test-image-agama
    Service setup-systemd-proxy-env.path no longer exists

++++ python-kiwi:

  - Fixed python3_sitelib for debbuild in OBS
  - Fixed test-image-agama
    Service setup-systemd-proxy-env.path no longer exists

------------------------------------------------------------------
------------------  2025-3-20  -  Mar 20 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Make container-selinux requirement conditional on selinux-policy
    (bsc#1237367)

++++ docker:

  - Make container-selinux requirement conditional on selinux-policy
    (bsc#1237367)

++++ docker:

  - Make container-selinux requirement conditional on selinux-policy
    (bsc#1237367)

++++ docker:

  - Make container-selinux requirement conditional on selinux-policy
    (bsc#1237367)

++++ docker:

  - Make container-selinux requirement conditional on selinux-policy
    (bsc#1237367)

++++ docker:

  - Make container-selinux requirement conditional on selinux-policy
    (bsc#1237367)

++++ docker:

  - Make container-selinux requirement conditional on selinux-policy
    (bsc#1237367)

++++ supportutils:

  - Changes to version 3.2.10
    + network.txt collect all firewalld zones (pr#233)
    + Collects gfs2 info (PED-11853, pr#235, pr#236)
    + Ignore tasks/threads to prevent collecting duplicate fd data in open_files (bsc#1230371, pr#237)
    + Added openldap2_5 support for SLES (pr#238)
    + Collects additional hawk details (pr#239)
    + Optimized filtering D/Z processes (pr#241)
    + Collect firewalld permanent configuration (pr#243)
    + ldap_info: support for multiple DBs and sanitize olcRootPW (bsc#1231838, pr#247)
    + Added dbus_info for dbus.txt (bsc#1222650, pr#248)

++++ supportutils:

  - Changes to version 3.2.10
    + network.txt collect all firewalld zones (pr#233)
    + Collects gfs2 info (PED-11853, pr#235, pr#236)
    + Ignore tasks/threads to prevent collecting duplicate fd data in open_files (bsc#1230371, pr#237)
    + Added openldap2_5 support for SLES (pr#238)
    + Collects additional hawk details (pr#239)
    + Optimized filtering D/Z processes (pr#241)
    + Collect firewalld permanent configuration (pr#243)
    + ldap_info: support for multiple DBs and sanitize olcRootPW (bsc#1231838, pr#247)
    + Added dbus_info for dbus.txt (bsc#1222650, pr#248)

------------------------------------------------------------------
------------------  2025-3-19  -  Mar 19 2025  -------------------
------------------------------------------------------------------

++++ libxslt:

  - Security fixes:
    * Fix use-after-free of XPath context node [bsc#1239625, CVE-2025-24855]
    * Fix UAF related to excluded namespaces [bsc#1239637, CVE-2024-55549]
    * Make generate-id() deterministic [bsc#1238591, CVE-2023-40403]
    Just adding the reference here as this CVE was already fixed
    in 0009-Make-generate-id-deterministic.patch
    * Add patches:
  - libxslt-CVE-2024-55549.patch
  - libxslt-CVE-2025-24855.patch

++++ libxslt:

  - Security fixes:
    * Fix use-after-free of XPath context node [bsc#1239625, CVE-2025-24855]
    * Fix UAF related to excluded namespaces [bsc#1239637, CVE-2024-55549]
    * Make generate-id() deterministic [bsc#1238591, CVE-2023-40403]
    Just adding the reference here as this CVE was already fixed
    in 0009-Make-generate-id-deterministic.patch
    * Add patches:
  - libxslt-CVE-2024-55549.patch
  - libxslt-CVE-2025-24855.patch

++++ libxslt:

  - Security fixes:
    * Fix use-after-free of XPath context node [bsc#1239625, CVE-2025-24855]
    * Fix UAF related to excluded namespaces [bsc#1239637, CVE-2024-55549]
    * Make generate-id() deterministic [bsc#1238591, CVE-2023-40403]
    Just adding the reference here as this CVE was already fixed
    in 0009-Make-generate-id-deterministic.patch
    * Add patches:
  - libxslt-CVE-2024-55549.patch
  - libxslt-CVE-2025-24855.patch

++++ libxslt:

  - Security fixes:
    * Fix use-after-free of XPath context node [bsc#1239625, CVE-2025-24855]
    * Fix UAF related to excluded namespaces [bsc#1239637, CVE-2024-55549]
    * Make generate-id() deterministic [bsc#1238591, CVE-2023-40403]
    Just adding the reference here as this CVE was already fixed
    in 0009-Make-generate-id-deterministic.patch
    * Add patches:
  - libxslt-CVE-2024-55549.patch
  - libxslt-CVE-2025-24855.patch

++++ systemd:

  - Maintain the network device naming scheme used on SLE15 (jsc#PED-12317)
    This shouldn't cause problems as predictable naming schemes are disabled on
    SLMicro-6.1 (net.ifnames=0 is set on the kernel command line by default).
    Add 1001-man-describe-the-net-naming-schemes-specific-to-SLE.patch for the
    description of these schemes in the relevant man page.
  - Import commit 09b7477895b79c7a3604a7e1aa71eeb3d401e65c
    09b7477895 udev: allow/denylist for reading sysfs attributes when composing a NIC name (bsc#1234015)
  - Drop 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch
    The path has been merged into the SUSE/v254 branch.
  - Import commit 0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991 (merge of v254.24)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/b4693652f317dbae80e31b978f51e695a23fa3d0...0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991
  - Import commit b4693652f317dbae80e31b978f51e695a23fa3d0
    b4693652f3 journald: close runtime journals before their parent directory removed
    044d051f0c journald: reset runtime seqnum data when flushing to system journal (bsc#1236886)

++++ systemd:

  - Maintain the network device naming scheme used on SLE15 (jsc#PED-12317)
    This shouldn't cause problems as predictable naming schemes are disabled on
    SLMicro-6.1 (net.ifnames=0 is set on the kernel command line by default).
    Add 1001-man-describe-the-net-naming-schemes-specific-to-SLE.patch for the
    description of these schemes in the relevant man page.
  - Import commit 09b7477895b79c7a3604a7e1aa71eeb3d401e65c
    09b7477895 udev: allow/denylist for reading sysfs attributes when composing a NIC name (bsc#1234015)
  - Drop 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch
    The path has been merged into the SUSE/v254 branch.
  - Import commit 0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991 (merge of v254.24)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/b4693652f317dbae80e31b978f51e695a23fa3d0...0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991
  - Import commit b4693652f317dbae80e31b978f51e695a23fa3d0
    b4693652f3 journald: close runtime journals before their parent directory removed
    044d051f0c journald: reset runtime seqnum data when flushing to system journal (bsc#1236886)

++++ systemd:

  - Maintain the network device naming scheme used on SLE15 (jsc#PED-12317)
    This shouldn't cause problems as predictable naming schemes are disabled on
    SLMicro-6.1 (net.ifnames=0 is set on the kernel command line by default).
    Add 1001-man-describe-the-net-naming-schemes-specific-to-SLE.patch for the
    description of these schemes in the relevant man page.
  - Import commit 09b7477895b79c7a3604a7e1aa71eeb3d401e65c
    09b7477895 udev: allow/denylist for reading sysfs attributes when composing a NIC name (bsc#1234015)
  - Drop 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch
    The path has been merged into the SUSE/v254 branch.
  - Import commit 0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991 (merge of v254.24)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/b4693652f317dbae80e31b978f51e695a23fa3d0...0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991
  - Import commit b4693652f317dbae80e31b978f51e695a23fa3d0
    b4693652f3 journald: close runtime journals before their parent directory removed
    044d051f0c journald: reset runtime seqnum data when flushing to system journal (bsc#1236886)

++++ systemd:

  - Maintain the network device naming scheme used on SLE15 (jsc#PED-12317)
    This shouldn't cause problems as predictable naming schemes are disabled on
    SLMicro-6.1 (net.ifnames=0 is set on the kernel command line by default).
    Add 1001-man-describe-the-net-naming-schemes-specific-to-SLE.patch for the
    description of these schemes in the relevant man page.
  - Import commit 09b7477895b79c7a3604a7e1aa71eeb3d401e65c
    09b7477895 udev: allow/denylist for reading sysfs attributes when composing a NIC name (bsc#1234015)
  - Drop 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch
    The path has been merged into the SUSE/v254 branch.
  - Import commit 0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991 (merge of v254.24)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/b4693652f317dbae80e31b978f51e695a23fa3d0...0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991
  - Import commit b4693652f317dbae80e31b978f51e695a23fa3d0
    b4693652f3 journald: close runtime journals before their parent directory removed
    044d051f0c journald: reset runtime seqnum data when flushing to system journal (bsc#1236886)

++++ systemd:

  - Maintain the network device naming scheme used on SLE15 (jsc#PED-12317)
    This shouldn't cause problems as predictable naming schemes are disabled on
    SLMicro-6.1 (net.ifnames=0 is set on the kernel command line by default).
    Add 1001-man-describe-the-net-naming-schemes-specific-to-SLE.patch for the
    description of these schemes in the relevant man page.
  - Import commit 09b7477895b79c7a3604a7e1aa71eeb3d401e65c
    09b7477895 udev: allow/denylist for reading sysfs attributes when composing a NIC name (bsc#1234015)
  - Drop 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch
    The path has been merged into the SUSE/v254 branch.
  - Import commit 0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991 (merge of v254.24)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/b4693652f317dbae80e31b978f51e695a23fa3d0...0d0f2dbfc4c901dca09fdd3d5b744b5339e0e991
  - Import commit b4693652f317dbae80e31b978f51e695a23fa3d0
    b4693652f3 journald: close runtime journals before their parent directory removed
    044d051f0c journald: reset runtime seqnum data when flushing to system journal (bsc#1236886)

------------------------------------------------------------------
------------------  2025-3-18  -  Mar 18 2025  -------------------
------------------------------------------------------------------

++++ gpg2:

  - Security update, fix [bsc#1239119]
    * Fix a verification DoS due to a malicious subkey in the keyring.
    * Add gnupg-fix-dos-subkey.patch

++++ gpg2:

  - Security update, fix [bsc#1239119]
    * Fix a verification DoS due to a malicious subkey in the keyring.
    * Add gnupg-fix-dos-subkey.patch

++++ gpg2:

  - Security update, fix [bsc#1239119]
    * Fix a verification DoS due to a malicious subkey in the keyring.
    * Add gnupg-fix-dos-subkey.patch

++++ gpg2:

  - Security update, fix [bsc#1239119]
    * Fix a verification DoS due to a malicious subkey in the keyring.
    * Add gnupg-fix-dos-subkey.patch

++++ gpg2:

  - Security update, fix [bsc#1239119]
    * Fix a verification DoS due to a malicious subkey in the keyring.
    * Add gnupg-fix-dos-subkey.patch

++++ gpg2:

  - Security update, fix [bsc#1239119]
    * Fix a verification DoS due to a malicious subkey in the keyring.
    * Add gnupg-fix-dos-subkey.patch

------------------------------------------------------------------
------------------  2025-3-17  -  Mar 17 2025  -------------------
------------------------------------------------------------------

++++ libzypp:

  - Fix computation of RepStatus if Repo URLs change.
  - Fix lost double slash when appending to an absolute FTP url
    (bsc#1238315)
    Ftp actually differs between absolute and relative URL paths.
    Absolute path names begin with a double slash encoded as '/%2F'.
    This must be preserved when manipulating the path.
  - version 17.36.5 (35)

++++ libzypp:

  - Fix computation of RepStatus if Repo URLs change.
  - Fix lost double slash when appending to an absolute FTP url
    (bsc#1238315)
    Ftp actually differs between absolute and relative URL paths.
    Absolute path names begin with a double slash encoded as '/%2F'.
    This must be preserved when manipulating the path.
  - version 17.36.5 (35)

++++ libzypp:

  - Fix computation of RepStatus if Repo URLs change.
  - Fix lost double slash when appending to an absolute FTP url
    (bsc#1238315)
    Ftp actually differs between absolute and relative URL paths.
    Absolute path names begin with a double slash encoded as '/%2F'.
    This must be preserved when manipulating the path.
  - version 17.36.5 (35)

------------------------------------------------------------------
------------------  2025-3-14  -  Mar 14 2025  -------------------
------------------------------------------------------------------

++++ git:

  - update to 2.49.0
    https://about.gitlab.com/blog/2025/03/14/whats-new-in-git-2-49-0/
    https://raw.githubusercontent.com/git/git/refs/tags/v2.49.0/Documentation/RelNotes/2.49.0.adoc
  - switch to zlib-ng for code 16
  - docs switched to asciidoc

++++ expat:

  - version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
    * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("<e>&g1;</e>")
  - general entities in attribute values ("<e k1='&g1;'/>")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
    * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
    [#945] #962 #966  CMake: Drop support for CMake <3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do

++++ expat:

  - version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
    * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("<e>&g1;</e>")
  - general entities in attribute values ("<e k1='&g1;'/>")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
    * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
    [#945] #962 #966  CMake: Drop support for CMake <3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do

++++ expat:

  - version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
    * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("<e>&g1;</e>")
  - general entities in attribute values ("<e k1='&g1;'/>")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
    * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
    [#945] #962 #966  CMake: Drop support for CMake <3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do

++++ expat:

  - version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
    * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("<e>&g1;</e>")
  - general entities in attribute values ("<e k1='&g1;'/>")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
    * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
    [#945] #962 #966  CMake: Drop support for CMake <3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do

++++ salt:

  - Fix aptpkg 'NoneType object has no attribute split' error
  - Detect openEuler as RedHat family OS
  - Ensure the correct crypt module is loaded
  - Implement multiple inventory for ansible.targets
  - Make x509 module compatible with M2Crypto 0.44.0
  - Remove deprecated code from x509.certificate_managed test mode
  - Move logrotate config to /usr/etc/logrotate.d where possible
  - Add DEB822 apt repository format support
  - Make Salt-SSH work with all SSH passwords (bsc#1215484)
  - Fix issue of using update-alternatives with alts (#105)
  - Fix virt_query outputter and add support for block devices
  - Make _auth calls visible with master stats
  - Repair mount.fstab_present always returning pending changes
  - Set virtual grain in Podman systemd container
  - Fix crash due wrong client reference on `SaltMakoTemplateLookup`
  - Enhace batch async and fix some detected issues
  - Enhacement of Salt packaging
    * Use update-alternatives for all salt scripts
    * Use flexible dependencies for the subpackages
    * Make salt-minion to require flavored zypp-plugin
    * Make zyppnotify to use update-alternatives
    * Drop unused yumnotify plugin
    * Add dependency to python3-dnf-plugins-core for RHEL based
  - Fix tests failures after "repo.saltproject.io" deprecation
  - Fix error to stat '/root/.gitconfig' on gitfs
    (bsc#1230944) (bsc#1234881) (bsc#1220905)
  - Adapt to removal of hex attribute in pygit2 v1.15.0 (bsc#1230642)
  - Enhance smart JSON parsing when garbage is present (bsc#1231605)
  - Fix virtual grains for VMs running on Nutanix AHV (bsc#1234022)
  - Fix issues running on Python 3.12 and 3.13
  - Added:
    * fix-deb822-nonetype-object-has-no-attribute-split-71.patch
    * detect-openeuler-as-redhat-family-os.patch
    * ensure-the-correct-crypt-module-is-loaded.patch
    * implement-multiple-inventory-for-ansible.targets.patch
    * make-x509-module-compatible-with-m2crypto-0.44.0.patch
    * remove-deprecated-code-from-x509.certificate_managed.patch
    * add-deb822-apt-source-format-support-692.patch
    * remove-password-from-shell-after-functional-text-mat.patch
    * repair-virt_query-outputter-655.patch
    * make-_auth-calls-visible-with-master-stats-696.patch
    * repair-fstab_present-test-mode-702.patch
    * set-virtual-grain-in-podman-systemd-container-703.patch
    * fixed-file-client-private-attribute-reference-on-sal.patch
    * backport-batch-async-fixes-and-improvements-701.patch
    * fix-tests-failures-after-repo.saltproject.io-depreca.patch
    * fix-failed-to-stat-root-.gitconfig-issue-on-gitfs-bs.patch
    * update-for-deprecation-of-hex-in-pygit2-1.15.0-and-a.patch
    * enhance-find_json-garbage-filtering-bsc-1231605-688.patch
    * fix-virtual-grains-for-vms-running-on-nutanix-ahv-bs.patch
    * fix-issues-that-break-salt-in-python-3.12-and-3.13-6.patch

++++ salt:

  - Fix aptpkg 'NoneType object has no attribute split' error
  - Detect openEuler as RedHat family OS
  - Ensure the correct crypt module is loaded
  - Implement multiple inventory for ansible.targets
  - Make x509 module compatible with M2Crypto 0.44.0
  - Remove deprecated code from x509.certificate_managed test mode
  - Move logrotate config to /usr/etc/logrotate.d where possible
  - Add DEB822 apt repository format support
  - Make Salt-SSH work with all SSH passwords (bsc#1215484)
  - Fix issue of using update-alternatives with alts (#105)
  - Fix virt_query outputter and add support for block devices
  - Make _auth calls visible with master stats
  - Repair mount.fstab_present always returning pending changes
  - Set virtual grain in Podman systemd container
  - Fix crash due wrong client reference on `SaltMakoTemplateLookup`
  - Enhace batch async and fix some detected issues
  - Enhacement of Salt packaging
    * Use update-alternatives for all salt scripts
    * Use flexible dependencies for the subpackages
    * Make salt-minion to require flavored zypp-plugin
    * Make zyppnotify to use update-alternatives
    * Drop unused yumnotify plugin
    * Add dependency to python3-dnf-plugins-core for RHEL based
  - Fix tests failures after "repo.saltproject.io" deprecation
  - Fix error to stat '/root/.gitconfig' on gitfs
    (bsc#1230944) (bsc#1234881) (bsc#1220905)
  - Adapt to removal of hex attribute in pygit2 v1.15.0 (bsc#1230642)
  - Enhance smart JSON parsing when garbage is present (bsc#1231605)
  - Fix virtual grains for VMs running on Nutanix AHV (bsc#1234022)
  - Fix issues running on Python 3.12 and 3.13
  - Added:
    * fix-deb822-nonetype-object-has-no-attribute-split-71.patch
    * detect-openeuler-as-redhat-family-os.patch
    * ensure-the-correct-crypt-module-is-loaded.patch
    * implement-multiple-inventory-for-ansible.targets.patch
    * make-x509-module-compatible-with-m2crypto-0.44.0.patch
    * remove-deprecated-code-from-x509.certificate_managed.patch
    * add-deb822-apt-source-format-support-692.patch
    * remove-password-from-shell-after-functional-text-mat.patch
    * repair-virt_query-outputter-655.patch
    * make-_auth-calls-visible-with-master-stats-696.patch
    * repair-fstab_present-test-mode-702.patch
    * set-virtual-grain-in-podman-systemd-container-703.patch
    * fixed-file-client-private-attribute-reference-on-sal.patch
    * backport-batch-async-fixes-and-improvements-701.patch
    * fix-tests-failures-after-repo.saltproject.io-depreca.patch
    * fix-failed-to-stat-root-.gitconfig-issue-on-gitfs-bs.patch
    * update-for-deprecation-of-hex-in-pygit2-1.15.0-and-a.patch
    * enhance-find_json-garbage-filtering-bsc-1231605-688.patch
    * fix-virtual-grains-for-vms-running-on-nutanix-ahv-bs.patch
    * fix-issues-that-break-salt-in-python-3.12-and-3.13-6.patch

++++ salt:

  - Fix aptpkg 'NoneType object has no attribute split' error
  - Detect openEuler as RedHat family OS
  - Ensure the correct crypt module is loaded
  - Implement multiple inventory for ansible.targets
  - Make x509 module compatible with M2Crypto 0.44.0
  - Remove deprecated code from x509.certificate_managed test mode
  - Move logrotate config to /usr/etc/logrotate.d where possible
  - Add DEB822 apt repository format support
  - Make Salt-SSH work with all SSH passwords (bsc#1215484)
  - Fix issue of using update-alternatives with alts (#105)
  - Fix virt_query outputter and add support for block devices
  - Make _auth calls visible with master stats
  - Repair mount.fstab_present always returning pending changes
  - Set virtual grain in Podman systemd container
  - Fix crash due wrong client reference on `SaltMakoTemplateLookup`
  - Enhace batch async and fix some detected issues
  - Enhacement of Salt packaging
    * Use update-alternatives for all salt scripts
    * Use flexible dependencies for the subpackages
    * Make salt-minion to require flavored zypp-plugin
    * Make zyppnotify to use update-alternatives
    * Drop unused yumnotify plugin
    * Add dependency to python3-dnf-plugins-core for RHEL based
  - Fix tests failures after "repo.saltproject.io" deprecation
  - Fix error to stat '/root/.gitconfig' on gitfs
    (bsc#1230944) (bsc#1234881) (bsc#1220905)
  - Adapt to removal of hex attribute in pygit2 v1.15.0 (bsc#1230642)
  - Enhance smart JSON parsing when garbage is present (bsc#1231605)
  - Fix virtual grains for VMs running on Nutanix AHV (bsc#1234022)
  - Fix issues running on Python 3.12 and 3.13
  - Added:
    * fix-deb822-nonetype-object-has-no-attribute-split-71.patch
    * detect-openeuler-as-redhat-family-os.patch
    * ensure-the-correct-crypt-module-is-loaded.patch
    * implement-multiple-inventory-for-ansible.targets.patch
    * make-x509-module-compatible-with-m2crypto-0.44.0.patch
    * remove-deprecated-code-from-x509.certificate_managed.patch
    * add-deb822-apt-source-format-support-692.patch
    * remove-password-from-shell-after-functional-text-mat.patch
    * repair-virt_query-outputter-655.patch
    * make-_auth-calls-visible-with-master-stats-696.patch
    * repair-fstab_present-test-mode-702.patch
    * set-virtual-grain-in-podman-systemd-container-703.patch
    * fixed-file-client-private-attribute-reference-on-sal.patch
    * backport-batch-async-fixes-and-improvements-701.patch
    * fix-tests-failures-after-repo.saltproject.io-depreca.patch
    * fix-failed-to-stat-root-.gitconfig-issue-on-gitfs-bs.patch
    * update-for-deprecation-of-hex-in-pygit2-1.15.0-and-a.patch
    * enhance-find_json-garbage-filtering-bsc-1231605-688.patch
    * fix-virtual-grains-for-vms-running-on-nutanix-ahv-bs.patch
    * fix-issues-that-break-salt-in-python-3.12-and-3.13-6.patch

++++ salt:

  - Fix aptpkg 'NoneType object has no attribute split' error
  - Detect openEuler as RedHat family OS
  - Ensure the correct crypt module is loaded
  - Implement multiple inventory for ansible.targets
  - Make x509 module compatible with M2Crypto 0.44.0
  - Remove deprecated code from x509.certificate_managed test mode
  - Move logrotate config to /usr/etc/logrotate.d where possible
  - Add DEB822 apt repository format support
  - Make Salt-SSH work with all SSH passwords (bsc#1215484)
  - Fix issue of using update-alternatives with alts (#105)
  - Fix virt_query outputter and add support for block devices
  - Make _auth calls visible with master stats
  - Repair mount.fstab_present always returning pending changes
  - Set virtual grain in Podman systemd container
  - Fix crash due wrong client reference on `SaltMakoTemplateLookup`
  - Enhace batch async and fix some detected issues
  - Enhacement of Salt packaging
    * Use update-alternatives for all salt scripts
    * Use flexible dependencies for the subpackages
    * Make salt-minion to require flavored zypp-plugin
    * Make zyppnotify to use update-alternatives
    * Drop unused yumnotify plugin
    * Add dependency to python3-dnf-plugins-core for RHEL based
  - Fix tests failures after "repo.saltproject.io" deprecation
  - Fix error to stat '/root/.gitconfig' on gitfs
    (bsc#1230944) (bsc#1234881) (bsc#1220905)
  - Adapt to removal of hex attribute in pygit2 v1.15.0 (bsc#1230642)
  - Enhance smart JSON parsing when garbage is present (bsc#1231605)
  - Fix virtual grains for VMs running on Nutanix AHV (bsc#1234022)
  - Fix issues running on Python 3.12 and 3.13
  - Added:
    * fix-deb822-nonetype-object-has-no-attribute-split-71.patch
    * detect-openeuler-as-redhat-family-os.patch
    * ensure-the-correct-crypt-module-is-loaded.patch
    * implement-multiple-inventory-for-ansible.targets.patch
    * make-x509-module-compatible-with-m2crypto-0.44.0.patch
    * remove-deprecated-code-from-x509.certificate_managed.patch
    * add-deb822-apt-source-format-support-692.patch
    * remove-password-from-shell-after-functional-text-mat.patch
    * repair-virt_query-outputter-655.patch
    * make-_auth-calls-visible-with-master-stats-696.patch
    * repair-fstab_present-test-mode-702.patch
    * set-virtual-grain-in-podman-systemd-container-703.patch
    * fixed-file-client-private-attribute-reference-on-sal.patch
    * backport-batch-async-fixes-and-improvements-701.patch
    * fix-tests-failures-after-repo.saltproject.io-depreca.patch
    * fix-failed-to-stat-root-.gitconfig-issue-on-gitfs-bs.patch
    * update-for-deprecation-of-hex-in-pygit2-1.15.0-and-a.patch
    * enhance-find_json-garbage-filtering-bsc-1231605-688.patch
    * fix-virtual-grains-for-vms-running-on-nutanix-ahv-bs.patch
    * fix-issues-that-break-salt-in-python-3.12-and-3.13-6.patch

------------------------------------------------------------------
------------------  2025-3-13  -  Mar 13 2025  -------------------
------------------------------------------------------------------

++++ zypper:

  - Do not double encode URL strings passed on the commandline
    (bsc#1237587)
    URLs passed on the commandline must have their special chars
    encoded already. We just want to check and encode forgotten
    unsafe chars like a blank. A '%' however must not be encoded
    again.
  - version 1.14.88

++++ zypper:

  - Do not double encode URL strings passed on the commandline
    (bsc#1237587)
    URLs passed on the commandline must have their special chars
    encoded already. We just want to check and encode forgotten
    unsafe chars like a blank. A '%' however must not be encoded
    again.
  - version 1.14.88

------------------------------------------------------------------
------------------  2025-3-12  -  Mar 12 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Explicitly request shadow-utils
    Make sure shadow-utils gets installed for rawhide
    integration tests
  - Drop test-image-suse-on-dnf test
    This was just a "can this work" test but has no real
    relevance for users since nobody would use dnf to build
    a suse image, there is also no help when it does not
    work. So let's drop this test build

++++ python-kiwi:

  - Explicitly request shadow-utils
    Make sure shadow-utils gets installed for rawhide
    integration tests
  - Drop test-image-suse-on-dnf test
    This was just a "can this work" test but has no real
    relevance for users since nobody would use dnf to build
    a suse image, there is also no help when it does not
    work. So let's drop this test build

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311-core:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python311:

  - Allow to disable PGO

++++ python-Jinja2:

  - Add security patch CVE-2025-27516.patch (bsc#1238879)

------------------------------------------------------------------
------------------  2025-3-11  -  Mar 11 2025  -------------------
------------------------------------------------------------------

++++ sqlite3:

  - Mark build recipe as POSIX-sh-incompatible
  - Run mkdir/rm with verbose mode for the build log

++++ sqlite3:

  - Mark build recipe as POSIX-sh-incompatible
  - Run mkdir/rm with verbose mode for the build log

++++ sqlite3:

  - Mark build recipe as POSIX-sh-incompatible
  - Run mkdir/rm with verbose mode for the build log

++++ sqlite3:

  - Mark build recipe as POSIX-sh-incompatible
  - Run mkdir/rm with verbose mode for the build log

------------------------------------------------------------------
------------------  2025-3-10  -  Mar 10 2025  -------------------
------------------------------------------------------------------

++++ mozilla-nss:

  - Add nss-reproducible-chksums.patch to make NSS-build reproducible
    Use key from openssl (bsc#1081723)

++++ mozilla-nss:

  - Add nss-reproducible-chksums.patch to make NSS-build reproducible
    Use key from openssl (bsc#1081723)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311-core:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt-sb-off.patch to fix the
    prediction of SbatLevelRT when Secure Boot is disabled
    (bsc#1230316)
  - Add fix-bsc1230316-make-pcr4-hard-requirement.patch to make PCR4
    a hard requirement for SbatLevelRT prediction (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt-sb-off.patch to fix the
    prediction of SbatLevelRT when Secure Boot is disabled
    (bsc#1230316)
  - Add fix-bsc1230316-make-pcr4-hard-requirement.patch to make PCR4
    a hard requirement for SbatLevelRT prediction (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt-sb-off.patch to fix the
    prediction of SbatLevelRT when Secure Boot is disabled
    (bsc#1230316)
  - Add fix-bsc1230316-make-pcr4-hard-requirement.patch to make PCR4
    a hard requirement for SbatLevelRT prediction (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt-sb-off.patch to fix the
    prediction of SbatLevelRT when Secure Boot is disabled
    (bsc#1230316)
  - Add fix-bsc1230316-make-pcr4-hard-requirement.patch to make PCR4
    a hard requirement for SbatLevelRT prediction (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt-sb-off.patch to fix the
    prediction of SbatLevelRT when Secure Boot is disabled
    (bsc#1230316)
  - Add fix-bsc1230316-make-pcr4-hard-requirement.patch to make PCR4
    a hard requirement for SbatLevelRT prediction (bsc#1230316)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

++++ python311:

  - Skip PGO with %want_reproducible_builds (bsc#1239210)

------------------------------------------------------------------
------------------  2025-3-9  -  Mar 9 2025  -------------------
------------------------------------------------------------------

++++ vim:

  - Introduce patch to fix bsc#1235751 (regression).
    * vim-9.1.1134-revert-putty-terminal-colors.patch
  - Update to 9.1.1176. Changes:
    * 9.1.1176: wrong indent when expanding multiple lines
    * 9.1.1175: inconsistent behaviour with exclusive selection and motion commands
    * 9.1.1174: tests: Test_complete_cmdline() may fail
    * 9.1.1173: filetype: ABNF files are not detected
    * 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
    * 9.1.1171: tests: wrong arguments passed to assert_equal()
    * 9.1.1170: wildmenu highlighting in popup can be improved
    * 9.1.1169: using global variable for get_insert()/get_lambda_name()
    * 9.1.1168: wrong flags passed down to nextwild()
    * 9.1.1167: mark '] wrong after copying text object
    * 9.1.1166: command-line auto-completion hard with wildmenu
    * 9.1.1165: diff: regression with multi-file diff blocks
    * 9.1.1164: [security]: code execution with tar.vim and special crafted tar files
    * 9.1.1163: $MYVIMDIR is set too late
    * 9.1.1162: completion popup not cleared in cmdline
    * 9.1.1161: preinsert requires bot "menu" and "menuone" to be set
    * 9.1.1160: Ctrl-Y does not work well with "preinsert" when completing items
    * 9.1.1159: $MYVIMDIR may not always be set
    * 9.1.1158: :verbose set has wrong file name with :compiler!
    * 9.1.1157: command completion wrong for input()
    * 9.1.1156: tests: No test for what patch 9.1.1152 fixes
    * 9.1.1155: Mode message not cleared after :silent message
    * 9.1.1154: Vim9: not able to use autoload class accross scripts
    * 9.1.1153: build error on Haiku
    * 9.1.1152: Patch v9.1.1151 causes problems
    * 9.1.1151: too many strlen() calls in getchar.c
    * 9.1.1150: :hi completion may complete to wrong value
    * 9.1.1149: Unix Makefile does not support Brazilian lang for the installer
    * 9.1.1148: Vim9: finding imported scripts can be further improved
    * 9.1.1147: preview-window does not scroll correctly
    * 9.1.1146: Vim9: wrong context being used when evaluating class member
    * 9.1.1145: multi-line completion has wrong indentation for last line
    * 9.1.1144: no way to create raw strings from a blob
    * 9.1.1143: illegal memory access when putting a register
    * 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined
    * 9.1.1141: Misplaced comment in readfile()
    * 9.1.1140: filetype: m17ndb files are not detected
    * 9.1.1139: [fifo] is not displayed when editing a fifo
    * 9.1.1138: cmdline completion for :hi is too simplistic
    * 9.1.1137: ins_str() is inefficient by calling STRLEN()
    * 9.1.1136: Match highlighting marks a buffer region as changed
    * 9.1.1135: 'suffixesadd' doesn't work with multiple items
    * 9.1.1134: filetype: Guile init file not recognized
    * 9.1.1133: filetype: xkb files not recognized everywhere
    * 9.1.1132: Mark positions wrong after triggering multiline completion
    * 9.1.1131: potential out-of-memory issue in search.c
    * 9.1.1130: 'listchars' "precedes" is not drawn on Tabs.
    * 9.1.1129: missing out-of-memory test in buf_write()
    * 9.1.1128: patch 9.1.1119 caused a regression with imports
    * 9.1.1127: preinsert text is not cleaned up correctly
    * 9.1.1126: patch 9.1.1121 used a wrong way to handle enter
    * 9.1.1125: cannot loop through pum menu with multiline items
    * 9.1.1124: No test for 'listchars' "precedes" with double-width char
    * 9.1.1123: popup hi groups not falling back to defaults
    * 9.1.1122: too many strlen() calls in findfile.c
    * 9.1.1121: Enter does not insert newline with "noselect"
    * 9.1.1120: tests: Test_registers fails
    * 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script
    * 9.1.1118: tests: test_termcodes fails
    * 9.1.1117: there are a few minor style issues
    * 9.1.1116: Vim9: super not supported in lambda expressions
    * 9.1.1115: [security]: use-after-free in str_to_reg()
    * 9.1.1114: enabling termguicolors automatically confuses users
    * 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds
    * 9.1.1112: Inconsistencies in get_next_or_prev_match()
    * 9.1.1111: Vim9: variable not found in transitive import
    * 9.1.1110: Vim tests are slow and flaky
    * 9.1.1109: cmdexpand.c hard to read
    * 9.1.1108: 'smoothscroll' gets stuck with 'listchars' "eol"
    * 9.1.1107: cannot loop through completion menu with fuzzy
    * 9.1.1106: tests: Test_log_nonexistent() causes asan failure
    * 9.1.1105: Vim9: no support for protected new() method
    * 9.1.1104: CI: using Ubuntu 22.04 Github runners
    * 9.1.1103: if_perl: still some compile errors with Perl 5.38
    * 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename

++++ vim:

  - Introduce patch to fix bsc#1235751 (regression).
    * vim-9.1.1134-revert-putty-terminal-colors.patch
  - Update to 9.1.1176. Changes:
    * 9.1.1176: wrong indent when expanding multiple lines
    * 9.1.1175: inconsistent behaviour with exclusive selection and motion commands
    * 9.1.1174: tests: Test_complete_cmdline() may fail
    * 9.1.1173: filetype: ABNF files are not detected
    * 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
    * 9.1.1171: tests: wrong arguments passed to assert_equal()
    * 9.1.1170: wildmenu highlighting in popup can be improved
    * 9.1.1169: using global variable for get_insert()/get_lambda_name()
    * 9.1.1168: wrong flags passed down to nextwild()
    * 9.1.1167: mark '] wrong after copying text object
    * 9.1.1166: command-line auto-completion hard with wildmenu
    * 9.1.1165: diff: regression with multi-file diff blocks
    * 9.1.1164: [security]: code execution with tar.vim and special crafted tar files
    * 9.1.1163: $MYVIMDIR is set too late
    * 9.1.1162: completion popup not cleared in cmdline
    * 9.1.1161: preinsert requires bot "menu" and "menuone" to be set
    * 9.1.1160: Ctrl-Y does not work well with "preinsert" when completing items
    * 9.1.1159: $MYVIMDIR may not always be set
    * 9.1.1158: :verbose set has wrong file name with :compiler!
    * 9.1.1157: command completion wrong for input()
    * 9.1.1156: tests: No test for what patch 9.1.1152 fixes
    * 9.1.1155: Mode message not cleared after :silent message
    * 9.1.1154: Vim9: not able to use autoload class accross scripts
    * 9.1.1153: build error on Haiku
    * 9.1.1152: Patch v9.1.1151 causes problems
    * 9.1.1151: too many strlen() calls in getchar.c
    * 9.1.1150: :hi completion may complete to wrong value
    * 9.1.1149: Unix Makefile does not support Brazilian lang for the installer
    * 9.1.1148: Vim9: finding imported scripts can be further improved
    * 9.1.1147: preview-window does not scroll correctly
    * 9.1.1146: Vim9: wrong context being used when evaluating class member
    * 9.1.1145: multi-line completion has wrong indentation for last line
    * 9.1.1144: no way to create raw strings from a blob
    * 9.1.1143: illegal memory access when putting a register
    * 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined
    * 9.1.1141: Misplaced comment in readfile()
    * 9.1.1140: filetype: m17ndb files are not detected
    * 9.1.1139: [fifo] is not displayed when editing a fifo
    * 9.1.1138: cmdline completion for :hi is too simplistic
    * 9.1.1137: ins_str() is inefficient by calling STRLEN()
    * 9.1.1136: Match highlighting marks a buffer region as changed
    * 9.1.1135: 'suffixesadd' doesn't work with multiple items
    * 9.1.1134: filetype: Guile init file not recognized
    * 9.1.1133: filetype: xkb files not recognized everywhere
    * 9.1.1132: Mark positions wrong after triggering multiline completion
    * 9.1.1131: potential out-of-memory issue in search.c
    * 9.1.1130: 'listchars' "precedes" is not drawn on Tabs.
    * 9.1.1129: missing out-of-memory test in buf_write()
    * 9.1.1128: patch 9.1.1119 caused a regression with imports
    * 9.1.1127: preinsert text is not cleaned up correctly
    * 9.1.1126: patch 9.1.1121 used a wrong way to handle enter
    * 9.1.1125: cannot loop through pum menu with multiline items
    * 9.1.1124: No test for 'listchars' "precedes" with double-width char
    * 9.1.1123: popup hi groups not falling back to defaults
    * 9.1.1122: too many strlen() calls in findfile.c
    * 9.1.1121: Enter does not insert newline with "noselect"
    * 9.1.1120: tests: Test_registers fails
    * 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script
    * 9.1.1118: tests: test_termcodes fails
    * 9.1.1117: there are a few minor style issues
    * 9.1.1116: Vim9: super not supported in lambda expressions
    * 9.1.1115: [security]: use-after-free in str_to_reg()
    * 9.1.1114: enabling termguicolors automatically confuses users
    * 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds
    * 9.1.1112: Inconsistencies in get_next_or_prev_match()
    * 9.1.1111: Vim9: variable not found in transitive import
    * 9.1.1110: Vim tests are slow and flaky
    * 9.1.1109: cmdexpand.c hard to read
    * 9.1.1108: 'smoothscroll' gets stuck with 'listchars' "eol"
    * 9.1.1107: cannot loop through completion menu with fuzzy
    * 9.1.1106: tests: Test_log_nonexistent() causes asan failure
    * 9.1.1105: Vim9: no support for protected new() method
    * 9.1.1104: CI: using Ubuntu 22.04 Github runners
    * 9.1.1103: if_perl: still some compile errors with Perl 5.38
    * 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename

++++ vim:

  - Introduce patch to fix bsc#1235751 (regression).
    * vim-9.1.1134-revert-putty-terminal-colors.patch
  - Update to 9.1.1176. Changes:
    * 9.1.1176: wrong indent when expanding multiple lines
    * 9.1.1175: inconsistent behaviour with exclusive selection and motion commands
    * 9.1.1174: tests: Test_complete_cmdline() may fail
    * 9.1.1173: filetype: ABNF files are not detected
    * 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
    * 9.1.1171: tests: wrong arguments passed to assert_equal()
    * 9.1.1170: wildmenu highlighting in popup can be improved
    * 9.1.1169: using global variable for get_insert()/get_lambda_name()
    * 9.1.1168: wrong flags passed down to nextwild()
    * 9.1.1167: mark '] wrong after copying text object
    * 9.1.1166: command-line auto-completion hard with wildmenu
    * 9.1.1165: diff: regression with multi-file diff blocks
    * 9.1.1164: [security]: code execution with tar.vim and special crafted tar files
    * 9.1.1163: $MYVIMDIR is set too late
    * 9.1.1162: completion popup not cleared in cmdline
    * 9.1.1161: preinsert requires bot "menu" and "menuone" to be set
    * 9.1.1160: Ctrl-Y does not work well with "preinsert" when completing items
    * 9.1.1159: $MYVIMDIR may not always be set
    * 9.1.1158: :verbose set has wrong file name with :compiler!
    * 9.1.1157: command completion wrong for input()
    * 9.1.1156: tests: No test for what patch 9.1.1152 fixes
    * 9.1.1155: Mode message not cleared after :silent message
    * 9.1.1154: Vim9: not able to use autoload class accross scripts
    * 9.1.1153: build error on Haiku
    * 9.1.1152: Patch v9.1.1151 causes problems
    * 9.1.1151: too many strlen() calls in getchar.c
    * 9.1.1150: :hi completion may complete to wrong value
    * 9.1.1149: Unix Makefile does not support Brazilian lang for the installer
    * 9.1.1148: Vim9: finding imported scripts can be further improved
    * 9.1.1147: preview-window does not scroll correctly
    * 9.1.1146: Vim9: wrong context being used when evaluating class member
    * 9.1.1145: multi-line completion has wrong indentation for last line
    * 9.1.1144: no way to create raw strings from a blob
    * 9.1.1143: illegal memory access when putting a register
    * 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined
    * 9.1.1141: Misplaced comment in readfile()
    * 9.1.1140: filetype: m17ndb files are not detected
    * 9.1.1139: [fifo] is not displayed when editing a fifo
    * 9.1.1138: cmdline completion for :hi is too simplistic
    * 9.1.1137: ins_str() is inefficient by calling STRLEN()
    * 9.1.1136: Match highlighting marks a buffer region as changed
    * 9.1.1135: 'suffixesadd' doesn't work with multiple items
    * 9.1.1134: filetype: Guile init file not recognized
    * 9.1.1133: filetype: xkb files not recognized everywhere
    * 9.1.1132: Mark positions wrong after triggering multiline completion
    * 9.1.1131: potential out-of-memory issue in search.c
    * 9.1.1130: 'listchars' "precedes" is not drawn on Tabs.
    * 9.1.1129: missing out-of-memory test in buf_write()
    * 9.1.1128: patch 9.1.1119 caused a regression with imports
    * 9.1.1127: preinsert text is not cleaned up correctly
    * 9.1.1126: patch 9.1.1121 used a wrong way to handle enter
    * 9.1.1125: cannot loop through pum menu with multiline items
    * 9.1.1124: No test for 'listchars' "precedes" with double-width char
    * 9.1.1123: popup hi groups not falling back to defaults
    * 9.1.1122: too many strlen() calls in findfile.c
    * 9.1.1121: Enter does not insert newline with "noselect"
    * 9.1.1120: tests: Test_registers fails
    * 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script
    * 9.1.1118: tests: test_termcodes fails
    * 9.1.1117: there are a few minor style issues
    * 9.1.1116: Vim9: super not supported in lambda expressions
    * 9.1.1115: [security]: use-after-free in str_to_reg()
    * 9.1.1114: enabling termguicolors automatically confuses users
    * 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds
    * 9.1.1112: Inconsistencies in get_next_or_prev_match()
    * 9.1.1111: Vim9: variable not found in transitive import
    * 9.1.1110: Vim tests are slow and flaky
    * 9.1.1109: cmdexpand.c hard to read
    * 9.1.1108: 'smoothscroll' gets stuck with 'listchars' "eol"
    * 9.1.1107: cannot loop through completion menu with fuzzy
    * 9.1.1106: tests: Test_log_nonexistent() causes asan failure
    * 9.1.1105: Vim9: no support for protected new() method
    * 9.1.1104: CI: using Ubuntu 22.04 Github runners
    * 9.1.1103: if_perl: still some compile errors with Perl 5.38
    * 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename

++++ vim:

  - Introduce patch to fix bsc#1235751 (regression).
    * vim-9.1.1134-revert-putty-terminal-colors.patch
  - Update to 9.1.1176. Changes:
    * 9.1.1176: wrong indent when expanding multiple lines
    * 9.1.1175: inconsistent behaviour with exclusive selection and motion commands
    * 9.1.1174: tests: Test_complete_cmdline() may fail
    * 9.1.1173: filetype: ABNF files are not detected
    * 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
    * 9.1.1171: tests: wrong arguments passed to assert_equal()
    * 9.1.1170: wildmenu highlighting in popup can be improved
    * 9.1.1169: using global variable for get_insert()/get_lambda_name()
    * 9.1.1168: wrong flags passed down to nextwild()
    * 9.1.1167: mark '] wrong after copying text object
    * 9.1.1166: command-line auto-completion hard with wildmenu
    * 9.1.1165: diff: regression with multi-file diff blocks
    * 9.1.1164: [security]: code execution with tar.vim and special crafted tar files
    * 9.1.1163: $MYVIMDIR is set too late
    * 9.1.1162: completion popup not cleared in cmdline
    * 9.1.1161: preinsert requires bot "menu" and "menuone" to be set
    * 9.1.1160: Ctrl-Y does not work well with "preinsert" when completing items
    * 9.1.1159: $MYVIMDIR may not always be set
    * 9.1.1158: :verbose set has wrong file name with :compiler!
    * 9.1.1157: command completion wrong for input()
    * 9.1.1156: tests: No test for what patch 9.1.1152 fixes
    * 9.1.1155: Mode message not cleared after :silent message
    * 9.1.1154: Vim9: not able to use autoload class accross scripts
    * 9.1.1153: build error on Haiku
    * 9.1.1152: Patch v9.1.1151 causes problems
    * 9.1.1151: too many strlen() calls in getchar.c
    * 9.1.1150: :hi completion may complete to wrong value
    * 9.1.1149: Unix Makefile does not support Brazilian lang for the installer
    * 9.1.1148: Vim9: finding imported scripts can be further improved
    * 9.1.1147: preview-window does not scroll correctly
    * 9.1.1146: Vim9: wrong context being used when evaluating class member
    * 9.1.1145: multi-line completion has wrong indentation for last line
    * 9.1.1144: no way to create raw strings from a blob
    * 9.1.1143: illegal memory access when putting a register
    * 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined
    * 9.1.1141: Misplaced comment in readfile()
    * 9.1.1140: filetype: m17ndb files are not detected
    * 9.1.1139: [fifo] is not displayed when editing a fifo
    * 9.1.1138: cmdline completion for :hi is too simplistic
    * 9.1.1137: ins_str() is inefficient by calling STRLEN()
    * 9.1.1136: Match highlighting marks a buffer region as changed
    * 9.1.1135: 'suffixesadd' doesn't work with multiple items
    * 9.1.1134: filetype: Guile init file not recognized
    * 9.1.1133: filetype: xkb files not recognized everywhere
    * 9.1.1132: Mark positions wrong after triggering multiline completion
    * 9.1.1131: potential out-of-memory issue in search.c
    * 9.1.1130: 'listchars' "precedes" is not drawn on Tabs.
    * 9.1.1129: missing out-of-memory test in buf_write()
    * 9.1.1128: patch 9.1.1119 caused a regression with imports
    * 9.1.1127: preinsert text is not cleaned up correctly
    * 9.1.1126: patch 9.1.1121 used a wrong way to handle enter
    * 9.1.1125: cannot loop through pum menu with multiline items
    * 9.1.1124: No test for 'listchars' "precedes" with double-width char
    * 9.1.1123: popup hi groups not falling back to defaults
    * 9.1.1122: too many strlen() calls in findfile.c
    * 9.1.1121: Enter does not insert newline with "noselect"
    * 9.1.1120: tests: Test_registers fails
    * 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script
    * 9.1.1118: tests: test_termcodes fails
    * 9.1.1117: there are a few minor style issues
    * 9.1.1116: Vim9: super not supported in lambda expressions
    * 9.1.1115: [security]: use-after-free in str_to_reg()
    * 9.1.1114: enabling termguicolors automatically confuses users
    * 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds
    * 9.1.1112: Inconsistencies in get_next_or_prev_match()
    * 9.1.1111: Vim9: variable not found in transitive import
    * 9.1.1110: Vim tests are slow and flaky
    * 9.1.1109: cmdexpand.c hard to read
    * 9.1.1108: 'smoothscroll' gets stuck with 'listchars' "eol"
    * 9.1.1107: cannot loop through completion menu with fuzzy
    * 9.1.1106: tests: Test_log_nonexistent() causes asan failure
    * 9.1.1105: Vim9: no support for protected new() method
    * 9.1.1104: CI: using Ubuntu 22.04 Github runners
    * 9.1.1103: if_perl: still some compile errors with Perl 5.38
    * 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename

++++ vim:

  - Introduce patch to fix bsc#1235751 (regression).
    * vim-9.1.1134-revert-putty-terminal-colors.patch
  - Update to 9.1.1176. Changes:
    * 9.1.1176: wrong indent when expanding multiple lines
    * 9.1.1175: inconsistent behaviour with exclusive selection and motion commands
    * 9.1.1174: tests: Test_complete_cmdline() may fail
    * 9.1.1173: filetype: ABNF files are not detected
    * 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
    * 9.1.1171: tests: wrong arguments passed to assert_equal()
    * 9.1.1170: wildmenu highlighting in popup can be improved
    * 9.1.1169: using global variable for get_insert()/get_lambda_name()
    * 9.1.1168: wrong flags passed down to nextwild()
    * 9.1.1167: mark '] wrong after copying text object
    * 9.1.1166: command-line auto-completion hard with wildmenu
    * 9.1.1165: diff: regression with multi-file diff blocks
    * 9.1.1164: [security]: code execution with tar.vim and special crafted tar files
    * 9.1.1163: $MYVIMDIR is set too late
    * 9.1.1162: completion popup not cleared in cmdline
    * 9.1.1161: preinsert requires bot "menu" and "menuone" to be set
    * 9.1.1160: Ctrl-Y does not work well with "preinsert" when completing items
    * 9.1.1159: $MYVIMDIR may not always be set
    * 9.1.1158: :verbose set has wrong file name with :compiler!
    * 9.1.1157: command completion wrong for input()
    * 9.1.1156: tests: No test for what patch 9.1.1152 fixes
    * 9.1.1155: Mode message not cleared after :silent message
    * 9.1.1154: Vim9: not able to use autoload class accross scripts
    * 9.1.1153: build error on Haiku
    * 9.1.1152: Patch v9.1.1151 causes problems
    * 9.1.1151: too many strlen() calls in getchar.c
    * 9.1.1150: :hi completion may complete to wrong value
    * 9.1.1149: Unix Makefile does not support Brazilian lang for the installer
    * 9.1.1148: Vim9: finding imported scripts can be further improved
    * 9.1.1147: preview-window does not scroll correctly
    * 9.1.1146: Vim9: wrong context being used when evaluating class member
    * 9.1.1145: multi-line completion has wrong indentation for last line
    * 9.1.1144: no way to create raw strings from a blob
    * 9.1.1143: illegal memory access when putting a register
    * 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined
    * 9.1.1141: Misplaced comment in readfile()
    * 9.1.1140: filetype: m17ndb files are not detected
    * 9.1.1139: [fifo] is not displayed when editing a fifo
    * 9.1.1138: cmdline completion for :hi is too simplistic
    * 9.1.1137: ins_str() is inefficient by calling STRLEN()
    * 9.1.1136: Match highlighting marks a buffer region as changed
    * 9.1.1135: 'suffixesadd' doesn't work with multiple items
    * 9.1.1134: filetype: Guile init file not recognized
    * 9.1.1133: filetype: xkb files not recognized everywhere
    * 9.1.1132: Mark positions wrong after triggering multiline completion
    * 9.1.1131: potential out-of-memory issue in search.c
    * 9.1.1130: 'listchars' "precedes" is not drawn on Tabs.
    * 9.1.1129: missing out-of-memory test in buf_write()
    * 9.1.1128: patch 9.1.1119 caused a regression with imports
    * 9.1.1127: preinsert text is not cleaned up correctly
    * 9.1.1126: patch 9.1.1121 used a wrong way to handle enter
    * 9.1.1125: cannot loop through pum menu with multiline items
    * 9.1.1124: No test for 'listchars' "precedes" with double-width char
    * 9.1.1123: popup hi groups not falling back to defaults
    * 9.1.1122: too many strlen() calls in findfile.c
    * 9.1.1121: Enter does not insert newline with "noselect"
    * 9.1.1120: tests: Test_registers fails
    * 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script
    * 9.1.1118: tests: test_termcodes fails
    * 9.1.1117: there are a few minor style issues
    * 9.1.1116: Vim9: super not supported in lambda expressions
    * 9.1.1115: [security]: use-after-free in str_to_reg()
    * 9.1.1114: enabling termguicolors automatically confuses users
    * 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds
    * 9.1.1112: Inconsistencies in get_next_or_prev_match()
    * 9.1.1111: Vim9: variable not found in transitive import
    * 9.1.1110: Vim tests are slow and flaky
    * 9.1.1109: cmdexpand.c hard to read
    * 9.1.1108: 'smoothscroll' gets stuck with 'listchars' "eol"
    * 9.1.1107: cannot loop through completion menu with fuzzy
    * 9.1.1106: tests: Test_log_nonexistent() causes asan failure
    * 9.1.1105: Vim9: no support for protected new() method
    * 9.1.1104: CI: using Ubuntu 22.04 Github runners
    * 9.1.1103: if_perl: still some compile errors with Perl 5.38
    * 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename

++++ vim:

  - Introduce patch to fix bsc#1235751 (regression).
    * vim-9.1.1134-revert-putty-terminal-colors.patch
  - Update to 9.1.1176. Changes:
    * 9.1.1176: wrong indent when expanding multiple lines
    * 9.1.1175: inconsistent behaviour with exclusive selection and motion commands
    * 9.1.1174: tests: Test_complete_cmdline() may fail
    * 9.1.1173: filetype: ABNF files are not detected
    * 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
    * 9.1.1171: tests: wrong arguments passed to assert_equal()
    * 9.1.1170: wildmenu highlighting in popup can be improved
    * 9.1.1169: using global variable for get_insert()/get_lambda_name()
    * 9.1.1168: wrong flags passed down to nextwild()
    * 9.1.1167: mark '] wrong after copying text object
    * 9.1.1166: command-line auto-completion hard with wildmenu
    * 9.1.1165: diff: regression with multi-file diff blocks
    * 9.1.1164: [security]: code execution with tar.vim and special crafted tar files
    * 9.1.1163: $MYVIMDIR is set too late
    * 9.1.1162: completion popup not cleared in cmdline
    * 9.1.1161: preinsert requires bot "menu" and "menuone" to be set
    * 9.1.1160: Ctrl-Y does not work well with "preinsert" when completing items
    * 9.1.1159: $MYVIMDIR may not always be set
    * 9.1.1158: :verbose set has wrong file name with :compiler!
    * 9.1.1157: command completion wrong for input()
    * 9.1.1156: tests: No test for what patch 9.1.1152 fixes
    * 9.1.1155: Mode message not cleared after :silent message
    * 9.1.1154: Vim9: not able to use autoload class accross scripts
    * 9.1.1153: build error on Haiku
    * 9.1.1152: Patch v9.1.1151 causes problems
    * 9.1.1151: too many strlen() calls in getchar.c
    * 9.1.1150: :hi completion may complete to wrong value
    * 9.1.1149: Unix Makefile does not support Brazilian lang for the installer
    * 9.1.1148: Vim9: finding imported scripts can be further improved
    * 9.1.1147: preview-window does not scroll correctly
    * 9.1.1146: Vim9: wrong context being used when evaluating class member
    * 9.1.1145: multi-line completion has wrong indentation for last line
    * 9.1.1144: no way to create raw strings from a blob
    * 9.1.1143: illegal memory access when putting a register
    * 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined
    * 9.1.1141: Misplaced comment in readfile()
    * 9.1.1140: filetype: m17ndb files are not detected
    * 9.1.1139: [fifo] is not displayed when editing a fifo
    * 9.1.1138: cmdline completion for :hi is too simplistic
    * 9.1.1137: ins_str() is inefficient by calling STRLEN()
    * 9.1.1136: Match highlighting marks a buffer region as changed
    * 9.1.1135: 'suffixesadd' doesn't work with multiple items
    * 9.1.1134: filetype: Guile init file not recognized
    * 9.1.1133: filetype: xkb files not recognized everywhere
    * 9.1.1132: Mark positions wrong after triggering multiline completion
    * 9.1.1131: potential out-of-memory issue in search.c
    * 9.1.1130: 'listchars' "precedes" is not drawn on Tabs.
    * 9.1.1129: missing out-of-memory test in buf_write()
    * 9.1.1128: patch 9.1.1119 caused a regression with imports
    * 9.1.1127: preinsert text is not cleaned up correctly
    * 9.1.1126: patch 9.1.1121 used a wrong way to handle enter
    * 9.1.1125: cannot loop through pum menu with multiline items
    * 9.1.1124: No test for 'listchars' "precedes" with double-width char
    * 9.1.1123: popup hi groups not falling back to defaults
    * 9.1.1122: too many strlen() calls in findfile.c
    * 9.1.1121: Enter does not insert newline with "noselect"
    * 9.1.1120: tests: Test_registers fails
    * 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script
    * 9.1.1118: tests: test_termcodes fails
    * 9.1.1117: there are a few minor style issues
    * 9.1.1116: Vim9: super not supported in lambda expressions
    * 9.1.1115: [security]: use-after-free in str_to_reg()
    * 9.1.1114: enabling termguicolors automatically confuses users
    * 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds
    * 9.1.1112: Inconsistencies in get_next_or_prev_match()
    * 9.1.1111: Vim9: variable not found in transitive import
    * 9.1.1110: Vim tests are slow and flaky
    * 9.1.1109: cmdexpand.c hard to read
    * 9.1.1108: 'smoothscroll' gets stuck with 'listchars' "eol"
    * 9.1.1107: cannot loop through completion menu with fuzzy
    * 9.1.1106: tests: Test_log_nonexistent() causes asan failure
    * 9.1.1105: Vim9: no support for protected new() method
    * 9.1.1104: CI: using Ubuntu 22.04 Github runners
    * 9.1.1103: if_perl: still some compile errors with Perl 5.38
    * 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename

------------------------------------------------------------------
------------------  2025-3-7  -  Mar 7 2025  -------------------
------------------------------------------------------------------

++++ dracut:

  - Update to version 059+suse.591.ge2ab3f62:
    * fix(iscsi): make sure services are shut down when switching root (bsc#1237695)
    * fix(iscsi): don't require network setup for qedi
    * fix(network-legacy): do not require pgrep when using wicked (bsc#1236982)

++++ dracut:

  - Update to version 059+suse.591.ge2ab3f62:
    * fix(iscsi): make sure services are shut down when switching root (bsc#1237695)
    * fix(iscsi): don't require network setup for qedi
    * fix(network-legacy): do not require pgrep when using wicked (bsc#1236982)

++++ dracut:

  - Update to version 059+suse.591.ge2ab3f62:
    * fix(iscsi): make sure services are shut down when switching root (bsc#1237695)
    * fix(iscsi): don't require network setup for qedi
    * fix(network-legacy): do not require pgrep when using wicked (bsc#1236982)

++++ dracut:

  - Update to version 059+suse.591.ge2ab3f62:
    * fix(iscsi): make sure services are shut down when switching root (bsc#1237695)
    * fix(iscsi): don't require network setup for qedi
    * fix(network-legacy): do not require pgrep when using wicked (bsc#1236982)

------------------------------------------------------------------
------------------  2025-3-6  -  Mar 6 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - distutils sysconfig is deprecated
    Move to sysconfig module

++++ python-kiwi:

  - distutils sysconfig is deprecated
    Move to sysconfig module

------------------------------------------------------------------
------------------  2025-3-5  -  Mar 5 2025  -------------------
------------------------------------------------------------------

++++ container-selinux:

  - Update to version 2.235.0:
    * Bump to v2.235.0
    * OWNERS: add wrabcak and zpytela
    * OWNERS: initial commit
    * container_log{reader,writer}_t: allow watch file
    * RPM: Update gating config
    * Enable aarch64 testing
    * TMT: simplify podman tests
    * feat: support /var/lib/crio

------------------------------------------------------------------
------------------  2025-3-4  -  Mar 4 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Make integration tests to build outside of OBS
    Update and extend all integration tests such that they also
    build outside of the Open Build Service. Along with the changes
    on the descriptions a simple build-tests.sh script was added
    to drive the build process. The build is based on the kiwi
    boxbuild plugin in container mode to build the tests
    from a given build-tests directory. A new chapter to document
    how to Build the Build Tests is also provided and referenced
    on the github main page.

++++ python-kiwi:

  - Make integration tests to build outside of OBS
    Update and extend all integration tests such that they also
    build outside of the Open Build Service. Along with the changes
    on the descriptions a simple build-tests.sh script was added
    to drive the build process. The build is based on the kiwi
    boxbuild plugin in container mode to build the tests
    from a given build-tests directory. A new chapter to document
    how to Build the Build Tests is also provided and referenced
    on the github main page.

------------------------------------------------------------------
------------------  2025-3-3  -  Mar 3 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add rd.kiwi.oem.luks.reencrypt_randompass
    For OEM LUKS2 encrypted disk images in combination
    with rd.kiwi.oem.luks.reencrypt. Reset insecure built time
    passphrase with a random onetime passphrase
  - Bump version: 10.2.12 → 10.2.13

++++ python-kiwi:

  - Add rd.kiwi.oem.luks.reencrypt_randompass
    For OEM LUKS2 encrypted disk images in combination
    with rd.kiwi.oem.luks.reencrypt. Reset insecure built time
    passphrase with a random onetime passphrase
  - Bump version: 10.2.12 → 10.2.13

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

++++ podman:

  - Add patch for CVE-2025-27144 (bsc#1237641):
    * 0005-CVE-2025-27144-vendor-don-t-allow-unbounded-amounts-.patch
  - Rebase patches:
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
    * 0002-Backport-fix-for-CVE-2024-6104.patch
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
    * 0004-http2-close-connections-when-receiving-too-many-head.patch

------------------------------------------------------------------
------------------  2025-3-1  -  Mar 1 2025  -------------------
------------------------------------------------------------------

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to exclude the
    SHA-1 hash from SLI approval.

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to exclude the
    SHA-1 hash from SLI approval.

------------------------------------------------------------------
------------------  2025-2-28  -  Feb 28 2025  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.26. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.26>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.26. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.26>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.26. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.26>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ python-kiwi:

  - Lookup CHRP loader instead of using a static name
    On ppc the CHRP loader name can vary between distributions.
    This commit adds a search method to lookup different ELF
    loader names. In addition an integration test image for
    Fedora was added. This Fixes #2741

++++ python-kiwi:

  - Lookup CHRP loader instead of using a static name
    On ppc the CHRP loader name can vary between distributions.
    This commit adds a search method to lookup different ELF
    loader names. In addition an integration test image for
    Fedora was added. This Fixes #2741

++++ libzypp:

  - Add a transaction package preloader (fixes openSUSE/zypper#104)
    This patch adds a preloader that concurrently downloads files
    during a transaction commit. It's not yet enabled per default.
    To enable the preview set ZYPP_CURL2=1 and ZYPP_PCK_PRELOAD=1
    in the environment.
  - RpmPkgSigCheck_test: Exchange the test package signingkey
    (fixes #622)
  - Exclude MediaCurl tests if DISABLE_MEDIABACKEND_TESTS (fixes #626)
  - Strip a mediahandler tag from baseUrl querystrings.
  - version 17.36.4 (35)

++++ libzypp:

  - Add a transaction package preloader (fixes openSUSE/zypper#104)
    This patch adds a preloader that concurrently downloads files
    during a transaction commit. It's not yet enabled per default.
    To enable the preview set ZYPP_CURL2=1 and ZYPP_PCK_PRELOAD=1
    in the environment.
  - RpmPkgSigCheck_test: Exchange the test package signingkey
    (fixes #622)
  - Exclude MediaCurl tests if DISABLE_MEDIABACKEND_TESTS (fixes #626)
  - Strip a mediahandler tag from baseUrl querystrings.
  - version 17.36.4 (35)

++++ libzypp:

  - Add a transaction package preloader (fixes openSUSE/zypper#104)
    This patch adds a preloader that concurrently downloads files
    during a transaction commit. It's not yet enabled per default.
    To enable the preview set ZYPP_CURL2=1 and ZYPP_PCK_PRELOAD=1
    in the environment.
  - RpmPkgSigCheck_test: Exchange the test package signingkey
    (fixes #622)
  - Exclude MediaCurl tests if DISABLE_MEDIABACKEND_TESTS (fixes #626)
  - Strip a mediahandler tag from baseUrl querystrings.
  - version 17.36.4 (35)

++++ skopeo:

  - Add patch for CVE-2025-27144 (bsc#1237613)
    Add patch:
    * 0003-Don-t-allow-unbounded-amounts-of-splits-https-github.patch
    Rebase patches:
    * 0001-http2-close-connections-when-receiving-too-many-head.patch
    * 0002-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch

++++ skopeo:

  - Add patch for CVE-2025-27144 (bsc#1237613)
    Add patch:
    * 0003-Don-t-allow-unbounded-amounts-of-splits-https-github.patch
    Rebase patches:
    * 0001-http2-close-connections-when-receiving-too-many-head.patch
    * 0002-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch

++++ zypper:

  - Package preloader that concurrently downloads files. It's not yet
    enabled per default. To enable the preview set ZYPP_CURL2=1 and
    ZYPP_PCK_PRELOAD=1 in the environment. (#104)
  - BuildRequires:  libzypp-devel >= 17.36.4.
  - version 1.14.87
  - refresh: add --include-all-archs (fixes #598)
    Future multi-arch repos may allow to download only those metadata
    which refer to packages actually compatible with the systems
    architecture. Some tools however want zypp to provide the full
    metadata of a repository without filtering incompatible
    architectures.
  - info,search: add option to search and list Enhances
    (bsc#1237949)
  - version 1.14.86

++++ zypper:

  - Package preloader that concurrently downloads files. It's not yet
    enabled per default. To enable the preview set ZYPP_CURL2=1 and
    ZYPP_PCK_PRELOAD=1 in the environment. (#104)
  - BuildRequires:  libzypp-devel >= 17.36.4.
  - version 1.14.87

------------------------------------------------------------------
------------------  2025-2-27  -  Feb 27 2025  -------------------
------------------------------------------------------------------

++++ libzypp:

  - Disable zypp.conf:download.use_deltarpm by default (fixes #620)
    Measurements show that you don't benefit from using deltarpms
    unless your network connection is very slow. That's why most
    distributions even stop offering deltarpms. The default remains
    unchanged on SUSE-15.6 and older.
  - Make sure repo variables are evaluated in the right context
    (bsc#1237044)
  - Introducing MediaCurl2 a alternative HTTP backend.
    This patch adds MediaCurl2 as a testbed for experimenting with a
    more simple way to download files. Set ZYPP_CURL2=1 in the
    environment to use it.
  - version 17.36.3 (35)

++++ libzypp:

  - Disable zypp.conf:download.use_deltarpm by default (fixes #620)
    Measurements show that you don't benefit from using deltarpms
    unless your network connection is very slow. That's why most
    distributions even stop offering deltarpms. The default remains
    unchanged on SUSE-15.6 and older.
  - Make sure repo variables are evaluated in the right context
    (bsc#1237044)
  - Introducing MediaCurl2 a alternative HTTP backend.
    This patch adds MediaCurl2 as a testbed for experimenting with a
    more simple way to download files. Set ZYPP_CURL2=1 in the
    environment to use it.
  - version 17.36.3 (35)

++++ libzypp:

  - Disable zypp.conf:download.use_deltarpm by default (fixes #620)
    Measurements show that you don't benefit from using deltarpms
    unless your network connection is very slow. That's why most
    distributions even stop offering deltarpms. The default remains
    unchanged on SUSE-15.6 and older.
  - Make sure repo variables are evaluated in the right context
    (bsc#1237044)
  - Introducing MediaCurl2 a alternative HTTP backend.
    This patch adds MediaCurl2 as a testbed for experimenting with a
    more simple way to download files. Set ZYPP_CURL2=1 in the
    environment to use it.
  - version 17.36.3 (35)

++++ zypper:

  - Annonunce --root in commands not launching a Target
    (bsc#1237044)
  - BuildRequires:  libzypp-devel >= 17.36.3.
  - version 1.14.85

++++ zypper:

  - refresh: add --include-all-archs (fixes #598)
    Future multi-arch repos may allow to download only those metadata
    which refer to packages actually compatible with the systems
    architecture. Some tools however want zypp to provide the full
    metadata of a repository without filtering incompatible
    architectures.
  - info,search: add option to search and list Enhances
    (bsc#1237949)
  - version 1.14.86
  - Annonunce --root in commands not launching a Target
    (bsc#1237044)
  - BuildRequires:  libzypp-devel >= 17.36.3.
  - version 1.14.85

------------------------------------------------------------------
------------------  2025-2-26  -  Feb 26 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.11 → 10.2.12
  - Fix profile env variable name regression
    In the effort of adapting to the latest snapper in Issue #2697
    we overlooked the after effect of a different variable name
    in the profile environment with regards to $kiwi_btrfs_root_is_snapshot
    and $kiwi_btrfs_root_is_snapper_snapshot. Image builds that
    references the former variable name would be broken by the change.
    This commit makes sure no regression is introduced by providing
    both variants. This Fixes bsc#1237772

++++ python-kiwi:

  - Bump version: 10.2.11 → 10.2.12
  - Fix profile env variable name regression
    In the effort of adapting to the latest snapper in Issue #2697
    we overlooked the after effect of a different variable name
    in the profile environment with regards to $kiwi_btrfs_root_is_snapshot
    and $kiwi_btrfs_root_is_snapper_snapshot. Image builds that
    references the former variable name would be broken by the change.
    This commit makes sure no regression is introduced by providing
    both variants. This Fixes bsc#1237772

++++ python-kiwi:

  - Bump version: 10.2.11 → 10.2.12
  - Fix profile env variable name regression
    In the effort of adapting to the latest snapper in Issue #2697
    we overlooked the after effect of a different variable name
    in the profile environment with regards to $kiwi_btrfs_root_is_snapshot
    and $kiwi_btrfs_root_is_snapper_snapshot. Image builds that
    references the former variable name would be broken by the change.
    This commit makes sure no regression is introduced by providing
    both variants. This Fixes bsc#1237772

++++ gettext-runtime:

  - Fix crash while handling po files with malformed header and
    process them properly
    (0003-Fix-malformed-header-processing.patch, boo#1227316).

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt.patch to predict
    SbatLevelRT for the next boot (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt.patch to predict
    SbatLevelRT for the next boot (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt.patch to predict
    SbatLevelRT for the next boot (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt.patch to predict
    SbatLevelRT for the next boot (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt.patch to predict
    SbatLevelRT for the next boot (bsc#1230316)

++++ pcr-oracle:

  - Add fix-bsc1230316-predict-sbatlevelrt.patch to predict
    SbatLevelRT for the next boot (bsc#1230316)

++++ u-boot-rpiarm64:

  - Fix CVE-2024-57256 (bsc#1237284)
    * Patches added:
    0019-ext4-Fix-integer-overflow-in-ext4f-.patch

------------------------------------------------------------------
------------------  2025-2-25  -  Feb 25 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix grub mkimage call for the ppc platform
    The list of modules used to create a grub platform image for
    ppc was the same list as used for the x86 bios platform.
    This commit fixes this and also cleans up the inconsistency
    and misleading names used for creating platform specific
    output. This Fixes #2738

++++ python-kiwi:

  - Fix grub mkimage call for the ppc platform
    The list of modules used to create a grub platform image for
    ppc was the same list as used for the x86 bios platform.
    This commit fixes this and also cleans up the inconsistency
    and misleading names used for creating platform specific
    output. This Fixes #2738

++++ python-kiwi:

  - Fix grub mkimage call for the ppc platform
    The list of modules used to create a grub platform image for
    ppc was the same list as used for the x86 bios platform.
    This commit fixes this and also cleans up the inconsistency
    and misleading names used for creating platform specific
    output. This Fixes #2738

++++ freetype2:

  - update to 2.13.2:
    * Some  fields in the `FT_Outline` structure have been changed
    from signed to unsigned type, which better reflects the actual
    usage. It is also an additional means to protect against
    malformed input.
    * Rare double-free crashes in the cache subsystem have been fixed.
    * Excessive stack allocation in the autohinter has been fixed.
    * The B/W  rasterizer has received a major upkeep that results in
    large performance improvements.  The rendering speed has
    increased and even doubled for very complex glyphs.

++++ freetype2:

  - update to 2.13.3:
    * Some  fields in the `FT_Outline` structure have been changed
    from signed to unsigned type, which better reflects the actual
    usage. It is also an additional means to protect against
    malformed input.
    * Rare double-free crashes in the cache subsystem have been fixed.
    * Excessive stack allocation in the autohinter has been fixed.
    * The B/W  rasterizer has received a major upkeep that results in
    large performance improvements.  The rendering speed has
    increased and even doubled for very complex glyphs.

++++ u-boot-rpiarm64:

  - Fix CVE-2024-57258 (bsc#1237287)
    * Patches added:
    0017-dlmalloc-Fix-integer-overflow-in-s-.patch
    0018-dlmalloc-Fix-integer-overflow-in-r-.patch

------------------------------------------------------------------
------------------  2025-2-24  -  Feb 24 2025  -------------------
------------------------------------------------------------------

++++ tiff:

  - Use python3-Sphinx instead of  %{primary_python}-Sphinx
    based on recommendation from python maintainers.
    * Fixes build issue of man flavor on 15.6

++++ timezone:

  - Update to 2025a:
    * Paraguay adopts permanent -03 starting spring 2024
    * Improve pre-1991 data for the Philippines
    * Etc/Unknown is now reserved
  - Update to 2024b:
    * Improve historical data for Mexico, Mongolia, and Portugal.
    * System V names are now obsolescent.
    * The main data form now uses %z.
    * The code now conforms to RFC 8536 for early timestamps.
    * Support POSIX.1-2024, which removes asctime_r and ctime_r.
    * Assume POSIX.2-1992 or later for shell scripts.
    * SUPPORT_C89 now defaults to 1.
  - Add revert-philippines-historical-data.patch, revert-systemv-deprecation.patch
    * Fixes testsuite failures for other packages

------------------------------------------------------------------
------------------  2025-2-22  -  Feb 22 2025  -------------------
------------------------------------------------------------------

++++ libX11:

  - U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch
    * Buffer overflow in XkbChangeTypesOfKey()
    (CVE-2025-26597, bsc#1237431)

------------------------------------------------------------------
------------------  2025-2-21  -  Feb 21 2025  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.33.1:
    * Improvements
  - Add support for gw_priority, enable_ipv4 (requires docker
    v28.0) by @thaJeztah in #12570
    * Fixes
  - Run watch standalone if menu fails to start by @ndeloof in
    [#12536]
  - Report error using non-file secret|config with read-only
    service by @ndeloof in #12531
  - Don't display bake suggestion when using --progress with
    quiet or json option by @glours in #12561
  - Fix pull --parallel and --no-parallel deprecation warnings
    missing by @maxproske in #12555
  - Fix error message when detach is implied by wait by @ndeloof
    in #12566
    * Dependencies
  - build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1
    by @dependabot in #12556
  - build(deps): bump google.golang.org/grpc from 1.68.1 to
    1.70.0 by @dependabot in #12494
  - go.mod: update to docker v28.0.0 by @thaJeztah in #12545

++++ docker-compose:

  - Update to version 2.33.1:
    * Improvements
  - Add support for gw_priority, enable_ipv4 (requires docker
    v28.0) by @thaJeztah in #12570
    * Fixes
  - Run watch standalone if menu fails to start by @ndeloof in
    [#12536]
  - Report error using non-file secret|config with read-only
    service by @ndeloof in #12531
  - Don't display bake suggestion when using --progress with
    quiet or json option by @glours in #12561
  - Fix pull --parallel and --no-parallel deprecation warnings
    missing by @maxproske in #12555
  - Fix error message when detach is implied by wait by @ndeloof
    in #12566
    * Dependencies
  - build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1
    by @dependabot in #12556
  - build(deps): bump google.golang.org/grpc from 1.68.1 to
    1.70.0 by @dependabot in #12494
  - go.mod: update to docker v28.0.0 by @thaJeztah in #12545

++++ docker-compose:

  - Update to version 2.33.1:
    * Improvements
  - Add support for gw_priority, enable_ipv4 (requires docker
    v28.0) by @thaJeztah in #12570
    * Fixes
  - Run watch standalone if menu fails to start by @ndeloof in
    [#12536]
  - Report error using non-file secret|config with read-only
    service by @ndeloof in #12531
  - Don't display bake suggestion when using --progress with
    quiet or json option by @glours in #12561
  - Fix pull --parallel and --no-parallel deprecation warnings
    missing by @maxproske in #12555
  - Fix error message when detach is implied by wait by @ndeloof
    in #12566
    * Dependencies
  - build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1
    by @dependabot in #12556
  - build(deps): bump google.golang.org/grpc from 1.68.1 to
    1.70.0 by @dependabot in #12494
  - go.mod: update to docker v28.0.0 by @thaJeztah in #12545

++++ dracut:

  - Update to version 059+suse.585.gc1e69422:
    Fixes for booting from iSCSI offload with bnx2i (bsc#1228086):
    * fix(iscsi): attempt iSCSI login before all interfaces are up
    * fix(iscsi): don't require network setup for bnx2i
    Other:
    * fix(dracut): rework timeout for devices added via --mount and --add-device (bsc#1231792)

++++ dracut:

  - Update to version 059+suse.585.gc1e69422:
    Fixes for booting from iSCSI offload with bnx2i (bsc#1228086):
    * fix(iscsi): attempt iSCSI login before all interfaces are up
    * fix(iscsi): don't require network setup for bnx2i
    Other:
    * fix(dracut): rework timeout for devices added via --mount and --add-device (bsc#1231792)

++++ dracut:

  - Update to version 059+suse.585.gc1e69422:
    Fixes for booting from iSCSI offload with bnx2i (bsc#1228086):
    * fix(iscsi): attempt iSCSI login before all interfaces are up
    * fix(iscsi): don't require network setup for bnx2i
    Other:
    * fix(dracut): rework timeout for devices added via --mount and --add-device (bsc#1231792)

++++ dracut:

  - Update to version 059+suse.585.gc1e69422:
    Fixes for booting from iSCSI offload with bnx2i (bsc#1228086):
    * fix(iscsi): attempt iSCSI login before all interfaces are up
    * fix(iscsi): don't require network setup for bnx2i
    Other:
    * fix(dracut): rework timeout for devices added via --mount and --add-device (bsc#1231792)

++++ procps:

  - Add patch CVE-2023-4016-part2.patch
    * Fix the ps command segfaults when pid argument has a leading space (bsc#1236842)

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
    + libxml2-CVE-2024-56171.patch
    fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c
    + libxml2-CVE-2025-24928.patch
    fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch
    + libxml2-CVE-2025-27113.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
    + libxml2-CVE-2024-56171.patch
    fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c
    + libxml2-CVE-2025-24928.patch
    fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch
    + libxml2-CVE-2025-27113.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
    + libxml2-CVE-2024-56171.patch
    fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c
    + libxml2-CVE-2025-24928.patch
    fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch
    + libxml2-CVE-2025-27113.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
    + libxml2-CVE-2024-56171.patch
    fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c
    + libxml2-CVE-2025-24928.patch
    fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch
    + libxml2-CVE-2025-27113.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
    + libxml2-CVE-2024-56171.patch
    fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c
    + libxml2-CVE-2025-24928.patch
    fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch
    + libxml2-CVE-2025-27113.patch

++++ libzypp:

  - Filesystem usrmerge must not be done in singletrans mode
    (bsc#1236481, bsc#1189788)
    Commit will amend the backend in case the transaction would
    perform a filesystem usrmerge.
  - Workaround bsc#1216091 on Code16.
  - version 17.36.2 (35)

++++ libzypp:

  - Filesystem usrmerge must not be done in singletrans mode
    (bsc#1236481, bsc#1189788)
    Commit will amend the backend in case the transaction would
    perform a filesystem usrmerge.
  - Workaround bsc#1216091 on Code16.
  - version 17.36.2 (35)

++++ libzypp:

  - Filesystem usrmerge must not be done in singletrans mode
    (bsc#1236481, bsc#1189788)
    Commit will amend the backend in case the transaction would
    perform a filesystem usrmerge.
  - Workaround bsc#1216091 on Code16.
  - version 17.36.2 (35)

++++ libxml2-python:

  - security update
  - added patches
    fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
    + libxml2-CVE-2024-56171.patch
    fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c
    + libxml2-CVE-2025-24928.patch
    fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch
    + libxml2-CVE-2025-27113.patch

------------------------------------------------------------------
------------------  2025-2-19  -  Feb 19 2025  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 27.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741> bsc#1237335
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Update to docker-buildx 0.20.1. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.20.1>

++++ docker:

  - Update to Docker 27.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741> bsc#1237335
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Update to docker-buildx 0.20.1. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.20.1>

++++ docker:

  - Update to Docker 27.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741> bsc#1237335
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Update to docker-buildx 0.20.1. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.20.1>

++++ docker:

  - Update to Docker 27.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741> bsc#1237335
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Update to docker-buildx 0.20.1. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.20.1>

++++ docker:

  - Update to Docker 27.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741> bsc#1237335
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Update to docker-buildx 0.20.1. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.20.1>

++++ docker:

  - Update to Docker 27.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741> bsc#1237335
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Update to docker-buildx 0.20.1. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.20.1>

++++ docker:

  - Update to Docker 27.5.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741> bsc#1237335
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Update to docker-buildx 0.20.1. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.20.1>

++++ python-M2Crypto:

  - Change macro to %{?sle15allpythons} so we build both Python 3.6
    and Python 3.11 on SLE-15.

++++ vim:

  - 9.1.1101 is a fix for:
    bsc#1229685 (CVE-2024-43790)
    bsc#1229822 (CVE-2024-43802)
    bsc#1230078 (CVE-2024-45306)
    bsc#1235695 (CVE-2025-22134)
    bsc#1236151 (CVE-2025-24014)
    bsc#1237137 (CVE-2025-1215)
  - Remove obsoleted patch:
    * vim-7.3-mktemp_tutor.patch
  - update to 9.1.1101
    * insexpand.c hard to read
    * tests: Test_log_nonexistent only works on Linux
    * Update base-syntax, improve variable matching
    * Vim9: import with extends may crash
    * leaking memory with completing multi lines
    * --log with non-existent path causes a crash
    * if_perl: Perl 5.38 adds new symbols causing link failure
    * tests: matchparen plugin test wrongly named
    * Vim9: problem finding implemented method in type hierarchy
    * runtime(qf): Update syntax file, match second delimiter
    * tests: output of test ...win32_ctrl_z depends on python version
    * tests: fix expected return code for python 3.13 on Windows
    * tests: timeout might be a bit too small
    * tests: test_terminwscroll_topline2 unreliable
    * tests: No check when tests are run under Github actions
    * tests: plugin tests are named inconsistently
    * Vim9: import with extends may crash
    * completion doesn't work with multi lines
    * filetype: cmmt files are not recognized
    * Unable to persistently ignore events in a window and its buffers
    * improve syntax highlighting
    * setreg() doesn't correctly handle mbyte chars in blockwise mode
    * unexpected DCS responses may cause out of bounds reads
    * has('bsd') is true for GNU/Hurd
    * filetype: Mill files are not recognized
    * GUI late startup leads to uninitialized scrollbars
    * Add support for lz4 to tar & gzip plugin
    * Terminal ansi colors off by one after tgc reset
    * included syntax items do not understand contains=TOP
    * vim_strnchr() is strange and unnecessary
    * Vim9: len variable not used in compile_load()
    * runtime(vim): Update base-syntax, match :debuggreedy count prefix
    * Strange error when heredoc marker starts with "trim"
    * tests: test_compiler fails on Windows without Maven
    * 'diffopt' "linematch" cannot be used with {n} less than 10
    * args missing after failing to redefine a function
    * Cannot control cursor positioning of getchar()
    * preinsert text completions not deleted with <C-W>/<C-U>
    * getchar() can't distinguish between C-I and Tab
    * tests: Test_termwinscroll_topline2 fails on MacOS
    * heap-use-after-free and stack-use-after-scope with :14verbose
    * no digraph for "Approaches the limit"
    * not possible to use plural forms with gettext()
    * too many strlen() calls in userfunc.c
    * terminal: E315 when dragging the terminal with the mouse
    * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
    * runtime(doc): Tweak documentation style a bit
    * tests: test_glvs fails when unarchiver not available
    * Vim always enables 'termguicolors' in a terminal
    * completion: input text deleted with preinsert when adding leader
    * translation(sr): Missing Serbian translation for the tutor
    * Superfluous cleanup steps in test_ins_complete.vim
    * runtime(netrw): correct wrong version check
    * Vim doesn't highlight to be inserted text when completing
    * runtime(netrw): upstream snapshot of v176
    * runtime(dist/vim9): fix regressions in dist#vim9#Open
    * runtime(hyprlang): fix string recognition
    * make install fails because of a missing dependency
    * runtime(asm): add byte directives to syntax script
    * Vim doesn't work well with TERM=xterm-direct
    * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
    * runtime: decouple Open and Launch commands and gx mapping from netrw
    * "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
    * runtime(just): fix typo in syntax file
    * runtime(filetype): Improve Verilog detection by checking for modules definition
    * tests: off-by-one error in CheckCWD in test_debugger.vim
    * tests: no support for env variables when running Vim in terminal
    * too many strlen() calls in os_unix.c
    * insert-completed items are always sorted
    * crash after scrolling and pasting in silent Ex mode
    * Makefiles uses non-portable syntax
    * fuzzymatching doesn't prefer matching camelcase
    * filetype: N-Tripels and TriG files are not recognized
    * Vim9: Patch 9.1.1014 causes regressions
    * translation(sr): Update Serbian messages translation
  - updade to 9.1.1043
    * [security]: segfault in win_line()
    * update helptags
    * filetype: just files are not recognized
    * Update base-syntax, match ternary and falsy operators
    * Vim9: out-of-bound access when echoing an enum
    * Vim9: imported type cannot be used as func return type
    * runtime(kconfig): updated ftplugin and syntax script
    * runtime(doc): rename last t_BG reference to t_RB
    * Vim9: comments are outdated
    * tests: test_channel.py fails with IPv6
    * runtime(vim): Update base-syntax, fix is/isnot operator matching
    * Vim9: confusing error when using abstract method via super
    * make install fails when using shadowdir
    * Vim9: memory leak with blob2str()
    * runtime(tex): add texEmphStyle to texMatchGroup in syntax script
    * runtime(netrw): upstream snapshot of v175
    * Vim9: compiling abstract method fails without return
    * runtime(c): add new constexpr keyword to syntax file (C23)
    * tests: shaderslang was removed from test_filetype erroneously
    * link error when FEAT_SPELL not defined
    * Coverity complains about insecure data handling
    * runtime(sh): update syntax script
    * runtime(c): Add missing syntax test files
    * filetype: setting bash filetype is backwards incompatible
    * runtime(c): Update syntax and ftplugin files
    * the installer can be improved
    * too many strlen() calls in screen.c
    * no sanitize check when running linematch
    * filetype: swc configuration files are not recognized
    * runtime(netrw): change netrw maintainer
    * wrong return type of blob2str()
    * blob2str/str2blob() do not support list of strings
    * runtime(doc): fix typo in usr_02.txt
    * Coverity complains about dereferencing NULL pointer
    * linematch option value not completed
    * string might be used without a trailing NUL
    * no way to get current selected item in a async context
    * filetype: fd ignore files are not recognized
    * v9.1.0743 causes regression with diff mode
    * runtime(doc): fix base64 encode/decode examples
    * Vim9: Patch 9.1.1013 causes a few problems
    * Not possible to convert string2blob and blob2string
    * Coverity complains about dereferencing NULL value
    * Vim9: variable not found in transitive import
    * runtime(colors): Update colorschemes, include new unokai colorscheme
    * Vim9: Regression caused by patch v9.1.0646
    * runtime(lyrics): support milliseconds in syntax script
    * runtime(vim): Split Vim legacy and Vim9 script indent tests
    * Vim9: class interface inheritance not correctly working
    * popupmenu internal error with some abbr in completion item
    * filetype: VisualCode setting file not recognized
    * diff feature can be improved
    * tests: test for patch 9.1.1006 doesn't fail without the patch
    * filetype: various ignore are not recognized
    * tests: Load screendump files with "git vimdumps"
    * PmenuMatch completion highlight can be combined
    * completion text is highlighted even with no pattern found
    * tests: a few termdebug tests are flaky
    * [security]: heap-buffer-overflow with visual mode
    * runtime(doc): add package-<name> helptags for included packages
    * Vim9: unknown func error with interface declaring func var
    * runtime(filetype): don't detect string interpolation as angular
    * ComplMatchIns highlight hard to read on light background
    * runtime(vim): Update base-syntax, highlight literal string quote escape
    * runtime(editorconfig): set omnifunc to syntaxcomplete func
    * tests: ruby tests fail with Ruby 3.4
    * Vim9: leaking finished exception
    * runtime(tiasm):  use correct syntax name tiasm in syntax script
    * filetype: TI assembly files are not recognized
    * too many strlen() calls in drawscreen.c
    * runtime(xf86conf): add section name OutputClass to syntax script
    * ComplMatchIns may highlight wrong text
    * runtime(vim): Update base-syntax, improve ex-bang matching
    * runtime(doc): clarify buffer deletion on popup_close()
    * filetype: shaderslang files are not detected
    * Vim9: not able to use comment after opening curly brace
  - update to 9.1.0993
    * 9.1.0993: New 'cmdheight' behavior may be surprising
    * runtime(sh): fix typo in Last Change header
    * 9.1.0992: Vim9: double-free after v9.1.0988
    * 9.1.0991: v:stacktrace has wrong type in Vim9 script
    * runtime(sh): add PS0 to bashSpecialVariables in syntax script
    * runtime(vim): Remove trailing comma from match_words
    * runtime(zsh): sync syntax script with upstream repo
    * runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
    * 9.1.0990: Inconsistent behavior when changing cmdheight
    * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
    * runtime(java): Quietly opt out for unsupported markdown.vim versions
    * runtime(vim): fix failing vim syntax test
    * 9.1.0988: Vim9: no error when using uninitialized var in new()
    * runtime(doc): update index.txt
    * 9.1.0987: filetype: cake files are not recognized
    * 9.1.0986: filetype: 'jj' filetype is a bit imprecise
    * runtime(jj): Support diffs in jj syntax
    * runtime(vim): Update matchit pattern, no Vim9 short names
    * 9.1.0985: Vim9: some ex commands can be shortened
    * 9.1.0984: exception handling can be improved
    * runtime(doc): update doc for :horizontal
    * runtime(doc): update index.txt, windows.txt and version9.txt
    * runtime(doc): Tweak documentation about base64 function
    * runtime(chordpro): update syntax script
    * 9.1.0983: not able to get the displayed items in complete_info()
    * runtime(doc): use standard SGR format at :h xterm-true-color
    * 9.1.0982: TI linker files are not recognized
    * runtime(vim): update vim generator syntax script
    * 9.1.0981: tests: typo in test_filetype.vim
    * 9.1.0980: no support for base64 en-/decoding functions in Vim Script
    * syntax(sh): Improve the recognition of bracket expressions
    * runtime(doc): mention how NUL bytes are handled
    * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
    * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
    * 9.1.0977: filetype: msbuild filetypes are not recognized
    * 9.1.0976: Vim9: missing return statement with throw
    * 9.1.0975: Vim9: interpolated string expr not working in object methods
    * 9.1.0974: typo in change of commit v9.1.0873
    * 9.1.0973: too many strlen() calls in fileio.c
    * runtime(sh): set shellcheck as the compiler for supported shells
    * runtime(doc): Fix enum example syntax
    * 9.1.0972: filetype: TI linker map files are not recognized
    * runtime(vim): Improve syntax script generator for Vim Script
    * 9.1.0971: filetype: SLNX files are not recognized
    * 9.1.0970: VMS: build errors on VMS architecture
    * runtime(doc): Fix documentation typos
    * runtime(doc): update for new keyprotocol option value (after v9.1.0969)
    * 9.1.0969: ghostty not using kitty protocol by default
    * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
    * runtime(doc): update version9.txt for bash filetype
    * runtime(netrw): update last change header for #16265
    * runtime(doc): fix doc error in :r behaviour
    * 9.1.0967: SpotBugs compiler setup can be further improved
    * 9.1.0966: Vim9: :enum command can be shortened
    * runtime(compiler): include a basic bash syntax checker compiler
    * 9.1.0965: filetype: sh filetype set when detecting the use of bash
    * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
    * 9.1.0963: fuzzy-matching does not prefer full match
    * 9.1.0962: filetype: bun.lock file is not recognized
    * runtime(vim): update indentation plugin for Vim script
    * runtime(doc): tweak documentation style in helphelp.txt
    * runtime(vim): Update base-syntax, allow parens in default arguments
    * runtime(doc): mention auto-format using clang-format for sound.c/sign.c
    * runtime(help): fix typo s/additional/arbitrary/
    * runtime(help): Add better support for language annotation highlighting
    * 9.1.0961: filetype: TI gel files are not recognized
    * 9.1.0960: filetype: hy history files are not recognized
    * translation(fi): Fix typoes in Finish menu translation
    * 9.1.0959: Coverity complains about type conversion
    * runtime(vim): Use supported syntax in indent tests
    * 9.1.0958: filetype: supertux2 config files detected as lisp
    * 9.1.0956: completion may crash, completion highlight wrong with preview window
    * 9.1.0955: Vim9: vim9compile.c can be further improved
    * runtime(doc): move help tag E1182
    * runtime(graphql): contribute vim-graphql to Vim core
    * 9.1.0954: popupmenu.c can be improved
    * 9.1.0953: filetype: APKBUILD files not correctly detected
    * 9.1.0952: Vim9: missing type checking for any type assignment
    * 9.1.0951: filetype: jshell files are not recognized
    * runtime(dockerfile): do not set commentstring in syntax script
    * 9.1.0950: filetype: fennelrc files are not recognized
    * runtime(netrw): do not double escape Vim special characters
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): more reformating #16248
    * runtime(doc): Add a note about handling symbolic links in starting.txt
    * 9.1.0949: popups inconsistently shifted to the left
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): change indent size from 1 to 2
    * 9.1.0948: Missing cmdline completion for :pbuffer
    * runtime(tutor): Reformat tutor1
    * 9.1.0947: short-description
    * 9.1.0946: cross-compiling fails on osx-arm64
    * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
    * translation(sv): re-include the change from #16240
    * 9.1.0944: tests: test_registers fails when not run under X11
    * 9.1.0943: Vim9: vim9compile.c can be further improved
    * runtime(doc): Update README and mention make check to verify
    * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
    * runtime(vim): update base-syntax after v9.1.0936
    * 9.1.0942: a few typos were found
    * 9.1.0941: ComplMatchIns doesn't work after multibyte chars
    * runtime(doc): Fix style in fold.txt
    * translation(sv): Fix typo in Swedish translation
    * 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
    * runtime(doc): fix some small errors
    * 9.1.0939: make installtutor fails
    * 9.1.0938: exclusive selection not respected when re-selecting block mode
    * 9.1.0937: test_undolist() is flaky
    * 9.1.0936: cannot highlight completed text
    * 9.1.0935: SpotBugs compiler can be improved
    * 9.1.0934: hard to view an existing buffer in the preview window
    * runtime(doc): document how to minimize fold computation costs
    * 9.1.0933: Vim9: vim9compile.c can be further improved
    * 9.1.0932: new Italian tutor not installed
    * runtime(doc): fix a few minor errors from the last doc updates
    * translation(it): add Italian translation for the interactive tutor
    * runtime(doc): update the change.txt help file
    * runtime(help): Add Vim lang annotation support for codeblocks
    * 9.1.0931: ml_get error in terminal buffer
    * 9.1.0930: tests: test_terminal2 may hang in GUI mode
    * 9.1.0929: filetype: lalrpop files are not recognized
    * 9.1.0928: tests: test_popupwin fails because the filter command fails
    * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
    * 9.1.0927: style issues in insexpand.c
    * 9.1.0926: filetype: Pixi lock files are not recognized
    * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
    * runtime(doc): add a note about inclusive motions and exclusive selection
    * 9.1.0925: Vim9: expression compiled when not necessary
    * 9.1.0924: patch 9.1.0923 causes issues
    * 9.1.0923: too many strlen() calls in filepath.c
    * 9.1.0923: wrong MIN macro in popupmenu.c
    * 9.1.0921: popupmenu logic is a bit convoluted
    * 9.1.0920: Vim9: compile_assignment() too long
    * 9.1.0919: filetype: some assembler files are not recognized
    * runtime(netrw): do not pollute search history with symlinks
    * 9.1.0918: tiny Vim crashes with fuzzy buffer completion
    * 9.1.0917: various vartabstop and shiftround bugs when shifting lines
    * runtime(typst): add definition lists to formatlistpat, update maintainer
    * 9.1.0916: messages.c is exceeding 80 columns
    * runtime(proto): include filetype plugin for protobuf
    * 9.1.0915: GVim: default font size a bit too small
    * 9.1.0914: Vim9: compile_assignment() is too long
    * 9.1.0913: no error check for neg values for 'messagesopt'
    * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
    * 9.1.0912: xxd: integer overflow with sparse files and -autoskip
    * 9.1.0911: Variable name for 'messagesopt' doesn't match short name
    * 9.1.0910: 'messagesopt' does not check max wait time
    * runtime(doc): update wrong Vietnamese localization tag
    * 9.1.0909: Vim9: crash when calling instance method
  - update to 9.1.0908
    * refresh vim-7.3-mktemp_tutor.patch
    * 9.1.0908: not possible to configure :messages
    * 9.1.0907: printoptions:portrait does not change postscript Orientation
    * runtime(doc): Add vietnamese.txt to helps main TOC
    * 9.1.0906: filetype: Nvidia PTX files are not recognized
    * runtime(doc): updated version9.txt with changes from v9.1.0905
    * 9.1.0905: Missing information in CompleteDone event
    * 9.1.0904: Vim9: copy-paste error in class_defining_member()
    * 9.1.0903: potential overflow in spell_soundfold_wsal()
    * runtime(netrw): do not detach when launching external programs in gvim
    * runtime(doc): make tag alignment more consistent in filetype.txt
    * runtime(doc): fix wrong syntax and style of vietnamese.txt
    * translation(it): update Italian manpage for vimtutor
    * runtime(lua): add optional lua function folding
    * Filelist: include translations for Chapter 2 tutor
    * translation(vi): Update Vietnamese translation
    * runtime(doc): include vietnamese.txt
    * runtime(tutor): fix another typo in tutor2
    * runtime(doc): fix typo in vimtutor manpage
    * translation(it): update Italian manpage for vimtutor
    * translation(it): include Italian version of tutor chapter 2
    * runtime(tutor): regenerated some translated tutor1 files
    * runtime(tutor): fix typo in Chapter 2
    * 9.1.0902: filetype: Conda configuration files are not recognized
    * runtime(doc): Tweak documentation style a bit
    * runtime(tutor): update the tutor files and re-number the chapters
    * runtime(tutor): Update the makefiles for tutor1 and tutor2 files
    * 9.1.0901: MS-Windows: vimtutor batch script can be improved
    * runtime(doc): remove buffer-local completeopt todo item
    * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
    * runtime(typst): provide a formatlistpat in ftplugin
    * runtime(doc): Update documentation for "noselect" in 'completeopt'
    * 9.1.0899: default for 'backspace' can be set in C code
    * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
    * translation(ru): Updated messages translation
    * 9.1.0898: runtime(compiler): pytest compiler not included
    * 9.1.0897: filetype: pyrex files are not detected
    * runtime(compiler): update eslint compiler
    * 9.1.0896: completion list wrong after v9.1.0891
    * runtime(doc): document changed default value for 'history'
    * 9.1.0895: default history value is too small
    * 9.1.0894: No test for what the spotbug compiler parses
    * 9.1.0893: No test that undofile format does not regress
    * translation(de): update German manpages
    * runtime(compiler): include spotbugs Java linter
    * 9.1.0892: the max value of 'tabheight' is limited by other tabpages
    * runtime(po): remove poDiffOld/New, add po-format flags to syntax file
    * 9.1.0891: building the completion list array is inefficient
    * patch 9.1.0890: %! item not allowed for 'rulerformat'
    * runtime(gzip): load undofile if there exists one
    * 9.1.0889: Possible unnecessary redraw after adding/deleting lines
    * 9.1.0888: leftcol property not available in getwininfo()
    * 9.1.0887: Wrong expression in sign.c
    * 9.1.0886: filetype: debian control file not detected
    * runtime(c3): include c3 filetype plugin
    * 9.1.0885: style of sign.c can be improved
    * 9.1.0884: gcc warns about uninitialized variable
    * runtime(apache): Update syntax directives for apache server 2.4.62
    * translation(ru): updated vimtutor translation, update MAINTAINERS file
    * 9.1.0883: message history cleanup is missing some tests
    * runtime(doc): Expand docs on :! vs. :term
    * runtime(netrw): Fixing powershell execution issues on Windows
    * 9.1.0882: too many strlen() calls in insexpand.c
    * 9.1.0881: GUI: message dialog may not get focus
    * runtime(netrw): update netrw's decompress logic
    * runtime(apache): Update syntax keyword definition
    * runtime(misc): add Italian LICENSE and (top-level) README file
    * 9.1.0880: filetype: C3 files are not recognized
    * runtime(doc): add helptag for :HelpToc command
    * 9.1.0879: source is not consistently formatted
    * Add clang-format config file
    * runtime(compiler): fix escaping of arguments passed to :CompilerSet
    * 9.1.0878: termdebug: cannot enable DEBUG mode
    * 9.1.0877: tests: missing test for termdebug + decimal signs
    * 9.1.0876: filetype: openCL files are not recognized
    * 9.1.0875: filetype: hyprlang detection can be improved
    * 9.1.0874: filetype: karel files are not detected
    * 9.1.0873: filetype: Vivado files are not recognized
    * 9.1.0872: No test for W23 message
    * 9.1.0871: getcellpixels() can be further improved
    * 9.1.0870: too many strlen() calls in eval.c
    * 9.1.0869: Problem: curswant not set on gm in folded line
    * 9.1.0868: the warning about missing clipboard can be improved
    * runtime(doc): Makefile does not clean up all temporary files
    * 9.1.0867: ins_compl_add() has too many args
    * editorconfig: don't trim trailing whitespaces in runtime/doc
    * translation(am): Remove duplicate keys in desktop files
    * runtime(doc): update helptags
    * runtime(filetype): remove duplicated *.org file pattern
    * runtime(cfg): only consider leading // as starting a comment
    * 9.1.0866: filetype: LLVM IR files are not recognized
    * 9.1.0865: filetype: org files are not recognized
    * 9.1.0864: message history is fixed to 200
    * 9.1.0863: getcellpixels() can be further improved
    * runtime(sh): better function support for bash/zsh in indent script
    * runtime(netrw): small fixes to netrw#BrowseX
    * 9.1.0862: 'wildmenu' not enabled by default in nocp mode
    * runtime(doc): update how to report issues for mac Vim
    * runtime(doc): mention option-backslash at :h CompilerSet
    * runtime(compiler): include a Java Maven compiler plugin
    * runtime(racket): update Racket runtime files
    * runtime(doc): improve indentation in examples for netrw-handler
    * runtime(doc): improve examples for netrw-handler functions
    * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
    * runtime(doc): clarify the use of filters and external commands
    * 9.1.0861: Vim9: no runtime check for object member access of any var
    * runtime(compiler): update pylint linter
    * 9.1.0860: tests: mouse_shape tests use hard code sleep value
    * 9.1.0859: several problems with the GLVS plugin
    * 9.1.0858: Coverity complains about dead code
    * runtime(tar): Update tar.vim to support permissions
    * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
    * 9.1.0851: too many strlen() calls in getchar.c
    * 9.1.0850: Vim9: cannot access nested object inside objects
    * runtime(tex): extra Number highlighting causes issues
    * runtime(vim): Fix indent after :silent! function
    * 9.1.0849: there are a few typos in the source
    * runtime(netrw): directory symlink not resolved in tree view
    * runtime(doc): add a table of supported Operating Systems
    * runtime(tex): update Last Change header in syntax script
    * runtime(doc): fix typo in g:termdebug_config
    * runtime(vim): Update base-syntax, improve :normal highlighting
    * runtime(tex): add Number highlighting to syntax file
    * runtime(doc): Tweak documentation style a bit
    * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
    * runtime(dune): use :setl instead of :set in ftplugin
    * runtime(termdebug): allow to use decimal signs
    * translation(it): Updated Italian vimtutor
    * runtime(compiler): improve cppcheck
    * git: git-blame-ignore-revs shown as an error on Github
    * 9.1.0847: tests: test_popupwin fails because of updated help file
    * 9.1.0846: debug symbols for xxd are not cleaned in Makefile
    * runtime(structurizr): Update structurizr syntax
    * runtime(8th): updated 8th syntax
    * runtime(doc): Add pi_tutor.txt to help TOC
    * runtime(compiler): add mypy and ruff compiler; update pylint linter
    * runtime(netrw): fix several bugs in netrw tree listing
    * runtime(netrw): prevent polluting the search history
    * 9.1.0845: vimtutor shell script can be improved
    * 9.1.0844: if_python: no way to pass local vars to python
    * 9.1.0843: too many strlen() calls in undo.c
    * runtime(doc): update default value for fillchars option
    * runtime(compiler): fix typo in cppcheck compiler plugin
    * runtime(doc): simplify vimtutor manpage a bit more
    * runtime(matchparen): Add matchparen_disable_cursor_hl config option
    * 9.1.0842: not checking for the sync() systemcall
    * 9.1.0841: tests: still preferring python2 over python3
    * 9.1.0840: filetype: idris2 files are not recognized
    * 9.1.0839: filetype: leo files are not recognized
    * runtime(cook): include cook filetype plugin
    * runtime(debversions): Update Debian versions
    * patch 9.1.0838: vimtutor is bash-specific
    * runtime(doc): add help specific modeline to pi_tutor.txt
    * Filelist: vimtutor chapter 2 is missing in Filelist
    * 9.1.0837: cross-compiling has some issues
    * runtime(vimtutor): Add a second chapter

++++ vim:

  - 9.1.1101 is a fix for:
    bsc#1229685 (CVE-2024-43790)
    bsc#1229822 (CVE-2024-43802)
    bsc#1230078 (CVE-2024-45306)
    bsc#1235695 (CVE-2025-22134)
    bsc#1236151 (CVE-2025-24014)
    bsc#1237137 (CVE-2025-1215)
  - Remove obsoleted patch:
    * vim-7.3-mktemp_tutor.patch
  - update to 9.1.1101
    * insexpand.c hard to read
    * tests: Test_log_nonexistent only works on Linux
    * Update base-syntax, improve variable matching
    * Vim9: import with extends may crash
    * leaking memory with completing multi lines
    * --log with non-existent path causes a crash
    * if_perl: Perl 5.38 adds new symbols causing link failure
    * tests: matchparen plugin test wrongly named
    * Vim9: problem finding implemented method in type hierarchy
    * runtime(qf): Update syntax file, match second delimiter
    * tests: output of test ...win32_ctrl_z depends on python version
    * tests: fix expected return code for python 3.13 on Windows
    * tests: timeout might be a bit too small
    * tests: test_terminwscroll_topline2 unreliable
    * tests: No check when tests are run under Github actions
    * tests: plugin tests are named inconsistently
    * Vim9: import with extends may crash
    * completion doesn't work with multi lines
    * filetype: cmmt files are not recognized
    * Unable to persistently ignore events in a window and its buffers
    * improve syntax highlighting
    * setreg() doesn't correctly handle mbyte chars in blockwise mode
    * unexpected DCS responses may cause out of bounds reads
    * has('bsd') is true for GNU/Hurd
    * filetype: Mill files are not recognized
    * GUI late startup leads to uninitialized scrollbars
    * Add support for lz4 to tar & gzip plugin
    * Terminal ansi colors off by one after tgc reset
    * included syntax items do not understand contains=TOP
    * vim_strnchr() is strange and unnecessary
    * Vim9: len variable not used in compile_load()
    * runtime(vim): Update base-syntax, match :debuggreedy count prefix
    * Strange error when heredoc marker starts with "trim"
    * tests: test_compiler fails on Windows without Maven
    * 'diffopt' "linematch" cannot be used with {n} less than 10
    * args missing after failing to redefine a function
    * Cannot control cursor positioning of getchar()
    * preinsert text completions not deleted with <C-W>/<C-U>
    * getchar() can't distinguish between C-I and Tab
    * tests: Test_termwinscroll_topline2 fails on MacOS
    * heap-use-after-free and stack-use-after-scope with :14verbose
    * no digraph for "Approaches the limit"
    * not possible to use plural forms with gettext()
    * too many strlen() calls in userfunc.c
    * terminal: E315 when dragging the terminal with the mouse
    * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
    * runtime(doc): Tweak documentation style a bit
    * tests: test_glvs fails when unarchiver not available
    * Vim always enables 'termguicolors' in a terminal
    * completion: input text deleted with preinsert when adding leader
    * translation(sr): Missing Serbian translation for the tutor
    * Superfluous cleanup steps in test_ins_complete.vim
    * runtime(netrw): correct wrong version check
    * Vim doesn't highlight to be inserted text when completing
    * runtime(netrw): upstream snapshot of v176
    * runtime(dist/vim9): fix regressions in dist#vim9#Open
    * runtime(hyprlang): fix string recognition
    * make install fails because of a missing dependency
    * runtime(asm): add byte directives to syntax script
    * Vim doesn't work well with TERM=xterm-direct
    * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
    * runtime: decouple Open and Launch commands and gx mapping from netrw
    * "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
    * runtime(just): fix typo in syntax file
    * runtime(filetype): Improve Verilog detection by checking for modules definition
    * tests: off-by-one error in CheckCWD in test_debugger.vim
    * tests: no support for env variables when running Vim in terminal
    * too many strlen() calls in os_unix.c
    * insert-completed items are always sorted
    * crash after scrolling and pasting in silent Ex mode
    * Makefiles uses non-portable syntax
    * fuzzymatching doesn't prefer matching camelcase
    * filetype: N-Tripels and TriG files are not recognized
    * Vim9: Patch 9.1.1014 causes regressions
    * translation(sr): Update Serbian messages translation
  - updade to 9.1.1043
    * [security]: segfault in win_line()
    * update helptags
    * filetype: just files are not recognized
    * Update base-syntax, match ternary and falsy operators
    * Vim9: out-of-bound access when echoing an enum
    * Vim9: imported type cannot be used as func return type
    * runtime(kconfig): updated ftplugin and syntax script
    * runtime(doc): rename last t_BG reference to t_RB
    * Vim9: comments are outdated
    * tests: test_channel.py fails with IPv6
    * runtime(vim): Update base-syntax, fix is/isnot operator matching
    * Vim9: confusing error when using abstract method via super
    * make install fails when using shadowdir
    * Vim9: memory leak with blob2str()
    * runtime(tex): add texEmphStyle to texMatchGroup in syntax script
    * runtime(netrw): upstream snapshot of v175
    * Vim9: compiling abstract method fails without return
    * runtime(c): add new constexpr keyword to syntax file (C23)
    * tests: shaderslang was removed from test_filetype erroneously
    * link error when FEAT_SPELL not defined
    * Coverity complains about insecure data handling
    * runtime(sh): update syntax script
    * runtime(c): Add missing syntax test files
    * filetype: setting bash filetype is backwards incompatible
    * runtime(c): Update syntax and ftplugin files
    * the installer can be improved
    * too many strlen() calls in screen.c
    * no sanitize check when running linematch
    * filetype: swc configuration files are not recognized
    * runtime(netrw): change netrw maintainer
    * wrong return type of blob2str()
    * blob2str/str2blob() do not support list of strings
    * runtime(doc): fix typo in usr_02.txt
    * Coverity complains about dereferencing NULL pointer
    * linematch option value not completed
    * string might be used without a trailing NUL
    * no way to get current selected item in a async context
    * filetype: fd ignore files are not recognized
    * v9.1.0743 causes regression with diff mode
    * runtime(doc): fix base64 encode/decode examples
    * Vim9: Patch 9.1.1013 causes a few problems
    * Not possible to convert string2blob and blob2string
    * Coverity complains about dereferencing NULL value
    * Vim9: variable not found in transitive import
    * runtime(colors): Update colorschemes, include new unokai colorscheme
    * Vim9: Regression caused by patch v9.1.0646
    * runtime(lyrics): support milliseconds in syntax script
    * runtime(vim): Split Vim legacy and Vim9 script indent tests
    * Vim9: class interface inheritance not correctly working
    * popupmenu internal error with some abbr in completion item
    * filetype: VisualCode setting file not recognized
    * diff feature can be improved
    * tests: test for patch 9.1.1006 doesn't fail without the patch
    * filetype: various ignore are not recognized
    * tests: Load screendump files with "git vimdumps"
    * PmenuMatch completion highlight can be combined
    * completion text is highlighted even with no pattern found
    * tests: a few termdebug tests are flaky
    * [security]: heap-buffer-overflow with visual mode
    * runtime(doc): add package-<name> helptags for included packages
    * Vim9: unknown func error with interface declaring func var
    * runtime(filetype): don't detect string interpolation as angular
    * ComplMatchIns highlight hard to read on light background
    * runtime(vim): Update base-syntax, highlight literal string quote escape
    * runtime(editorconfig): set omnifunc to syntaxcomplete func
    * tests: ruby tests fail with Ruby 3.4
    * Vim9: leaking finished exception
    * runtime(tiasm):  use correct syntax name tiasm in syntax script
    * filetype: TI assembly files are not recognized
    * too many strlen() calls in drawscreen.c
    * runtime(xf86conf): add section name OutputClass to syntax script
    * ComplMatchIns may highlight wrong text
    * runtime(vim): Update base-syntax, improve ex-bang matching
    * runtime(doc): clarify buffer deletion on popup_close()
    * filetype: shaderslang files are not detected
    * Vim9: not able to use comment after opening curly brace
  - update to 9.1.0993
    * 9.1.0993: New 'cmdheight' behavior may be surprising
    * runtime(sh): fix typo in Last Change header
    * 9.1.0992: Vim9: double-free after v9.1.0988
    * 9.1.0991: v:stacktrace has wrong type in Vim9 script
    * runtime(sh): add PS0 to bashSpecialVariables in syntax script
    * runtime(vim): Remove trailing comma from match_words
    * runtime(zsh): sync syntax script with upstream repo
    * runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
    * 9.1.0990: Inconsistent behavior when changing cmdheight
    * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
    * runtime(java): Quietly opt out for unsupported markdown.vim versions
    * runtime(vim): fix failing vim syntax test
    * 9.1.0988: Vim9: no error when using uninitialized var in new()
    * runtime(doc): update index.txt
    * 9.1.0987: filetype: cake files are not recognized
    * 9.1.0986: filetype: 'jj' filetype is a bit imprecise
    * runtime(jj): Support diffs in jj syntax
    * runtime(vim): Update matchit pattern, no Vim9 short names
    * 9.1.0985: Vim9: some ex commands can be shortened
    * 9.1.0984: exception handling can be improved
    * runtime(doc): update doc for :horizontal
    * runtime(doc): update index.txt, windows.txt and version9.txt
    * runtime(doc): Tweak documentation about base64 function
    * runtime(chordpro): update syntax script
    * 9.1.0983: not able to get the displayed items in complete_info()
    * runtime(doc): use standard SGR format at :h xterm-true-color
    * 9.1.0982: TI linker files are not recognized
    * runtime(vim): update vim generator syntax script
    * 9.1.0981: tests: typo in test_filetype.vim
    * 9.1.0980: no support for base64 en-/decoding functions in Vim Script
    * syntax(sh): Improve the recognition of bracket expressions
    * runtime(doc): mention how NUL bytes are handled
    * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
    * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
    * 9.1.0977: filetype: msbuild filetypes are not recognized
    * 9.1.0976: Vim9: missing return statement with throw
    * 9.1.0975: Vim9: interpolated string expr not working in object methods
    * 9.1.0974: typo in change of commit v9.1.0873
    * 9.1.0973: too many strlen() calls in fileio.c
    * runtime(sh): set shellcheck as the compiler for supported shells
    * runtime(doc): Fix enum example syntax
    * 9.1.0972: filetype: TI linker map files are not recognized
    * runtime(vim): Improve syntax script generator for Vim Script
    * 9.1.0971: filetype: SLNX files are not recognized
    * 9.1.0970: VMS: build errors on VMS architecture
    * runtime(doc): Fix documentation typos
    * runtime(doc): update for new keyprotocol option value (after v9.1.0969)
    * 9.1.0969: ghostty not using kitty protocol by default
    * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
    * runtime(doc): update version9.txt for bash filetype
    * runtime(netrw): update last change header for #16265
    * runtime(doc): fix doc error in :r behaviour
    * 9.1.0967: SpotBugs compiler setup can be further improved
    * 9.1.0966: Vim9: :enum command can be shortened
    * runtime(compiler): include a basic bash syntax checker compiler
    * 9.1.0965: filetype: sh filetype set when detecting the use of bash
    * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
    * 9.1.0963: fuzzy-matching does not prefer full match
    * 9.1.0962: filetype: bun.lock file is not recognized
    * runtime(vim): update indentation plugin for Vim script
    * runtime(doc): tweak documentation style in helphelp.txt
    * runtime(vim): Update base-syntax, allow parens in default arguments
    * runtime(doc): mention auto-format using clang-format for sound.c/sign.c
    * runtime(help): fix typo s/additional/arbitrary/
    * runtime(help): Add better support for language annotation highlighting
    * 9.1.0961: filetype: TI gel files are not recognized
    * 9.1.0960: filetype: hy history files are not recognized
    * translation(fi): Fix typoes in Finish menu translation
    * 9.1.0959: Coverity complains about type conversion
    * runtime(vim): Use supported syntax in indent tests
    * 9.1.0958: filetype: supertux2 config files detected as lisp
    * 9.1.0956: completion may crash, completion highlight wrong with preview window
    * 9.1.0955: Vim9: vim9compile.c can be further improved
    * runtime(doc): move help tag E1182
    * runtime(graphql): contribute vim-graphql to Vim core
    * 9.1.0954: popupmenu.c can be improved
    * 9.1.0953: filetype: APKBUILD files not correctly detected
    * 9.1.0952: Vim9: missing type checking for any type assignment
    * 9.1.0951: filetype: jshell files are not recognized
    * runtime(dockerfile): do not set commentstring in syntax script
    * 9.1.0950: filetype: fennelrc files are not recognized
    * runtime(netrw): do not double escape Vim special characters
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): more reformating #16248
    * runtime(doc): Add a note about handling symbolic links in starting.txt
    * 9.1.0949: popups inconsistently shifted to the left
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): change indent size from 1 to 2
    * 9.1.0948: Missing cmdline completion for :pbuffer
    * runtime(tutor): Reformat tutor1
    * 9.1.0947: short-description
    * 9.1.0946: cross-compiling fails on osx-arm64
    * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
    * translation(sv): re-include the change from #16240
    * 9.1.0944: tests: test_registers fails when not run under X11
    * 9.1.0943: Vim9: vim9compile.c can be further improved
    * runtime(doc): Update README and mention make check to verify
    * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
    * runtime(vim): update base-syntax after v9.1.0936
    * 9.1.0942: a few typos were found
    * 9.1.0941: ComplMatchIns doesn't work after multibyte chars
    * runtime(doc): Fix style in fold.txt
    * translation(sv): Fix typo in Swedish translation
    * 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
    * runtime(doc): fix some small errors
    * 9.1.0939: make installtutor fails
    * 9.1.0938: exclusive selection not respected when re-selecting block mode
    * 9.1.0937: test_undolist() is flaky
    * 9.1.0936: cannot highlight completed text
    * 9.1.0935: SpotBugs compiler can be improved
    * 9.1.0934: hard to view an existing buffer in the preview window
    * runtime(doc): document how to minimize fold computation costs
    * 9.1.0933: Vim9: vim9compile.c can be further improved
    * 9.1.0932: new Italian tutor not installed
    * runtime(doc): fix a few minor errors from the last doc updates
    * translation(it): add Italian translation for the interactive tutor
    * runtime(doc): update the change.txt help file
    * runtime(help): Add Vim lang annotation support for codeblocks
    * 9.1.0931: ml_get error in terminal buffer
    * 9.1.0930: tests: test_terminal2 may hang in GUI mode
    * 9.1.0929: filetype: lalrpop files are not recognized
    * 9.1.0928: tests: test_popupwin fails because the filter command fails
    * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
    * 9.1.0927: style issues in insexpand.c
    * 9.1.0926: filetype: Pixi lock files are not recognized
    * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
    * runtime(doc): add a note about inclusive motions and exclusive selection
    * 9.1.0925: Vim9: expression compiled when not necessary
    * 9.1.0924: patch 9.1.0923 causes issues
    * 9.1.0923: too many strlen() calls in filepath.c
    * 9.1.0923: wrong MIN macro in popupmenu.c
    * 9.1.0921: popupmenu logic is a bit convoluted
    * 9.1.0920: Vim9: compile_assignment() too long
    * 9.1.0919: filetype: some assembler files are not recognized
    * runtime(netrw): do not pollute search history with symlinks
    * 9.1.0918: tiny Vim crashes with fuzzy buffer completion
    * 9.1.0917: various vartabstop and shiftround bugs when shifting lines
    * runtime(typst): add definition lists to formatlistpat, update maintainer
    * 9.1.0916: messages.c is exceeding 80 columns
    * runtime(proto): include filetype plugin for protobuf
    * 9.1.0915: GVim: default font size a bit too small
    * 9.1.0914: Vim9: compile_assignment() is too long
    * 9.1.0913: no error check for neg values for 'messagesopt'
    * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
    * 9.1.0912: xxd: integer overflow with sparse files and -autoskip
    * 9.1.0911: Variable name for 'messagesopt' doesn't match short name
    * 9.1.0910: 'messagesopt' does not check max wait time
    * runtime(doc): update wrong Vietnamese localization tag
    * 9.1.0909: Vim9: crash when calling instance method
  - update to 9.1.0908
    * refresh vim-7.3-mktemp_tutor.patch
    * 9.1.0908: not possible to configure :messages
    * 9.1.0907: printoptions:portrait does not change postscript Orientation
    * runtime(doc): Add vietnamese.txt to helps main TOC
    * 9.1.0906: filetype: Nvidia PTX files are not recognized
    * runtime(doc): updated version9.txt with changes from v9.1.0905
    * 9.1.0905: Missing information in CompleteDone event
    * 9.1.0904: Vim9: copy-paste error in class_defining_member()
    * 9.1.0903: potential overflow in spell_soundfold_wsal()
    * runtime(netrw): do not detach when launching external programs in gvim
    * runtime(doc): make tag alignment more consistent in filetype.txt
    * runtime(doc): fix wrong syntax and style of vietnamese.txt
    * translation(it): update Italian manpage for vimtutor
    * runtime(lua): add optional lua function folding
    * Filelist: include translations for Chapter 2 tutor
    * translation(vi): Update Vietnamese translation
    * runtime(doc): include vietnamese.txt
    * runtime(tutor): fix another typo in tutor2
    * runtime(doc): fix typo in vimtutor manpage
    * translation(it): update Italian manpage for vimtutor
    * translation(it): include Italian version of tutor chapter 2
    * runtime(tutor): regenerated some translated tutor1 files
    * runtime(tutor): fix typo in Chapter 2
    * 9.1.0902: filetype: Conda configuration files are not recognized
    * runtime(doc): Tweak documentation style a bit
    * runtime(tutor): update the tutor files and re-number the chapters
    * runtime(tutor): Update the makefiles for tutor1 and tutor2 files
    * 9.1.0901: MS-Windows: vimtutor batch script can be improved
    * runtime(doc): remove buffer-local completeopt todo item
    * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
    * runtime(typst): provide a formatlistpat in ftplugin
    * runtime(doc): Update documentation for "noselect" in 'completeopt'
    * 9.1.0899: default for 'backspace' can be set in C code
    * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
    * translation(ru): Updated messages translation
    * 9.1.0898: runtime(compiler): pytest compiler not included
    * 9.1.0897: filetype: pyrex files are not detected
    * runtime(compiler): update eslint compiler
    * 9.1.0896: completion list wrong after v9.1.0891
    * runtime(doc): document changed default value for 'history'
    * 9.1.0895: default history value is too small
    * 9.1.0894: No test for what the spotbug compiler parses
    * 9.1.0893: No test that undofile format does not regress
    * translation(de): update German manpages
    * runtime(compiler): include spotbugs Java linter
    * 9.1.0892: the max value of 'tabheight' is limited by other tabpages
    * runtime(po): remove poDiffOld/New, add po-format flags to syntax file
    * 9.1.0891: building the completion list array is inefficient
    * patch 9.1.0890: %! item not allowed for 'rulerformat'
    * runtime(gzip): load undofile if there exists one
    * 9.1.0889: Possible unnecessary redraw after adding/deleting lines
    * 9.1.0888: leftcol property not available in getwininfo()
    * 9.1.0887: Wrong expression in sign.c
    * 9.1.0886: filetype: debian control file not detected
    * runtime(c3): include c3 filetype plugin
    * 9.1.0885: style of sign.c can be improved
    * 9.1.0884: gcc warns about uninitialized variable
    * runtime(apache): Update syntax directives for apache server 2.4.62
    * translation(ru): updated vimtutor translation, update MAINTAINERS file
    * 9.1.0883: message history cleanup is missing some tests
    * runtime(doc): Expand docs on :! vs. :term
    * runtime(netrw): Fixing powershell execution issues on Windows
    * 9.1.0882: too many strlen() calls in insexpand.c
    * 9.1.0881: GUI: message dialog may not get focus
    * runtime(netrw): update netrw's decompress logic
    * runtime(apache): Update syntax keyword definition
    * runtime(misc): add Italian LICENSE and (top-level) README file
    * 9.1.0880: filetype: C3 files are not recognized
    * runtime(doc): add helptag for :HelpToc command
    * 9.1.0879: source is not consistently formatted
    * Add clang-format config file
    * runtime(compiler): fix escaping of arguments passed to :CompilerSet
    * 9.1.0878: termdebug: cannot enable DEBUG mode
    * 9.1.0877: tests: missing test for termdebug + decimal signs
    * 9.1.0876: filetype: openCL files are not recognized
    * 9.1.0875: filetype: hyprlang detection can be improved
    * 9.1.0874: filetype: karel files are not detected
    * 9.1.0873: filetype: Vivado files are not recognized
    * 9.1.0872: No test for W23 message
    * 9.1.0871: getcellpixels() can be further improved
    * 9.1.0870: too many strlen() calls in eval.c
    * 9.1.0869: Problem: curswant not set on gm in folded line
    * 9.1.0868: the warning about missing clipboard can be improved
    * runtime(doc): Makefile does not clean up all temporary files
    * 9.1.0867: ins_compl_add() has too many args
    * editorconfig: don't trim trailing whitespaces in runtime/doc
    * translation(am): Remove duplicate keys in desktop files
    * runtime(doc): update helptags
    * runtime(filetype): remove duplicated *.org file pattern
    * runtime(cfg): only consider leading // as starting a comment
    * 9.1.0866: filetype: LLVM IR files are not recognized
    * 9.1.0865: filetype: org files are not recognized
    * 9.1.0864: message history is fixed to 200
    * 9.1.0863: getcellpixels() can be further improved
    * runtime(sh): better function support for bash/zsh in indent script
    * runtime(netrw): small fixes to netrw#BrowseX
    * 9.1.0862: 'wildmenu' not enabled by default in nocp mode
    * runtime(doc): update how to report issues for mac Vim
    * runtime(doc): mention option-backslash at :h CompilerSet
    * runtime(compiler): include a Java Maven compiler plugin
    * runtime(racket): update Racket runtime files
    * runtime(doc): improve indentation in examples for netrw-handler
    * runtime(doc): improve examples for netrw-handler functions
    * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
    * runtime(doc): clarify the use of filters and external commands
    * 9.1.0861: Vim9: no runtime check for object member access of any var
    * runtime(compiler): update pylint linter
    * 9.1.0860: tests: mouse_shape tests use hard code sleep value
    * 9.1.0859: several problems with the GLVS plugin
    * 9.1.0858: Coverity complains about dead code
    * runtime(tar): Update tar.vim to support permissions
    * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
    * 9.1.0851: too many strlen() calls in getchar.c
    * 9.1.0850: Vim9: cannot access nested object inside objects
    * runtime(tex): extra Number highlighting causes issues
    * runtime(vim): Fix indent after :silent! function
    * 9.1.0849: there are a few typos in the source
    * runtime(netrw): directory symlink not resolved in tree view
    * runtime(doc): add a table of supported Operating Systems
    * runtime(tex): update Last Change header in syntax script
    * runtime(doc): fix typo in g:termdebug_config
    * runtime(vim): Update base-syntax, improve :normal highlighting
    * runtime(tex): add Number highlighting to syntax file
    * runtime(doc): Tweak documentation style a bit
    * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
    * runtime(dune): use :setl instead of :set in ftplugin
    * runtime(termdebug): allow to use decimal signs
    * translation(it): Updated Italian vimtutor
    * runtime(compiler): improve cppcheck
    * git: git-blame-ignore-revs shown as an error on Github
    * 9.1.0847: tests: test_popupwin fails because of updated help file
    * 9.1.0846: debug symbols for xxd are not cleaned in Makefile
    * runtime(structurizr): Update structurizr syntax
    * runtime(8th): updated 8th syntax
    * runtime(doc): Add pi_tutor.txt to help TOC
    * runtime(compiler): add mypy and ruff compiler; update pylint linter
    * runtime(netrw): fix several bugs in netrw tree listing
    * runtime(netrw): prevent polluting the search history
    * 9.1.0845: vimtutor shell script can be improved
    * 9.1.0844: if_python: no way to pass local vars to python
    * 9.1.0843: too many strlen() calls in undo.c
    * runtime(doc): update default value for fillchars option
    * runtime(compiler): fix typo in cppcheck compiler plugin
    * runtime(doc): simplify vimtutor manpage a bit more
    * runtime(matchparen): Add matchparen_disable_cursor_hl config option
    * 9.1.0842: not checking for the sync() systemcall
    * 9.1.0841: tests: still preferring python2 over python3
    * 9.1.0840: filetype: idris2 files are not recognized
    * 9.1.0839: filetype: leo files are not recognized
    * runtime(cook): include cook filetype plugin
    * runtime(debversions): Update Debian versions
    * patch 9.1.0838: vimtutor is bash-specific
    * runtime(doc): add help specific modeline to pi_tutor.txt
    * Filelist: vimtutor chapter 2 is missing in Filelist
    * 9.1.0837: cross-compiling has some issues
    * runtime(vimtutor): Add a second chapter

++++ vim:

  - 9.1.1101 is a fix for:
    bsc#1229685 (CVE-2024-43790)
    bsc#1229822 (CVE-2024-43802)
    bsc#1230078 (CVE-2024-45306)
    bsc#1235695 (CVE-2025-22134)
    bsc#1236151 (CVE-2025-24014)
    bsc#1237137 (CVE-2025-1215)
  - Remove obsoleted patch:
    * vim-7.3-mktemp_tutor.patch
  - update to 9.1.1101
    * insexpand.c hard to read
    * tests: Test_log_nonexistent only works on Linux
    * Update base-syntax, improve variable matching
    * Vim9: import with extends may crash
    * leaking memory with completing multi lines
    * --log with non-existent path causes a crash
    * if_perl: Perl 5.38 adds new symbols causing link failure
    * tests: matchparen plugin test wrongly named
    * Vim9: problem finding implemented method in type hierarchy
    * runtime(qf): Update syntax file, match second delimiter
    * tests: output of test ...win32_ctrl_z depends on python version
    * tests: fix expected return code for python 3.13 on Windows
    * tests: timeout might be a bit too small
    * tests: test_terminwscroll_topline2 unreliable
    * tests: No check when tests are run under Github actions
    * tests: plugin tests are named inconsistently
    * Vim9: import with extends may crash
    * completion doesn't work with multi lines
    * filetype: cmmt files are not recognized
    * Unable to persistently ignore events in a window and its buffers
    * improve syntax highlighting
    * setreg() doesn't correctly handle mbyte chars in blockwise mode
    * unexpected DCS responses may cause out of bounds reads
    * has('bsd') is true for GNU/Hurd
    * filetype: Mill files are not recognized
    * GUI late startup leads to uninitialized scrollbars
    * Add support for lz4 to tar & gzip plugin
    * Terminal ansi colors off by one after tgc reset
    * included syntax items do not understand contains=TOP
    * vim_strnchr() is strange and unnecessary
    * Vim9: len variable not used in compile_load()
    * runtime(vim): Update base-syntax, match :debuggreedy count prefix
    * Strange error when heredoc marker starts with "trim"
    * tests: test_compiler fails on Windows without Maven
    * 'diffopt' "linematch" cannot be used with {n} less than 10
    * args missing after failing to redefine a function
    * Cannot control cursor positioning of getchar()
    * preinsert text completions not deleted with <C-W>/<C-U>
    * getchar() can't distinguish between C-I and Tab
    * tests: Test_termwinscroll_topline2 fails on MacOS
    * heap-use-after-free and stack-use-after-scope with :14verbose
    * no digraph for "Approaches the limit"
    * not possible to use plural forms with gettext()
    * too many strlen() calls in userfunc.c
    * terminal: E315 when dragging the terminal with the mouse
    * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
    * runtime(doc): Tweak documentation style a bit
    * tests: test_glvs fails when unarchiver not available
    * Vim always enables 'termguicolors' in a terminal
    * completion: input text deleted with preinsert when adding leader
    * translation(sr): Missing Serbian translation for the tutor
    * Superfluous cleanup steps in test_ins_complete.vim
    * runtime(netrw): correct wrong version check
    * Vim doesn't highlight to be inserted text when completing
    * runtime(netrw): upstream snapshot of v176
    * runtime(dist/vim9): fix regressions in dist#vim9#Open
    * runtime(hyprlang): fix string recognition
    * make install fails because of a missing dependency
    * runtime(asm): add byte directives to syntax script
    * Vim doesn't work well with TERM=xterm-direct
    * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
    * runtime: decouple Open and Launch commands and gx mapping from netrw
    * "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
    * runtime(just): fix typo in syntax file
    * runtime(filetype): Improve Verilog detection by checking for modules definition
    * tests: off-by-one error in CheckCWD in test_debugger.vim
    * tests: no support for env variables when running Vim in terminal
    * too many strlen() calls in os_unix.c
    * insert-completed items are always sorted
    * crash after scrolling and pasting in silent Ex mode
    * Makefiles uses non-portable syntax
    * fuzzymatching doesn't prefer matching camelcase
    * filetype: N-Tripels and TriG files are not recognized
    * Vim9: Patch 9.1.1014 causes regressions
    * translation(sr): Update Serbian messages translation
  - updade to 9.1.1043
    * [security]: segfault in win_line()
    * update helptags
    * filetype: just files are not recognized
    * Update base-syntax, match ternary and falsy operators
    * Vim9: out-of-bound access when echoing an enum
    * Vim9: imported type cannot be used as func return type
    * runtime(kconfig): updated ftplugin and syntax script
    * runtime(doc): rename last t_BG reference to t_RB
    * Vim9: comments are outdated
    * tests: test_channel.py fails with IPv6
    * runtime(vim): Update base-syntax, fix is/isnot operator matching
    * Vim9: confusing error when using abstract method via super
    * make install fails when using shadowdir
    * Vim9: memory leak with blob2str()
    * runtime(tex): add texEmphStyle to texMatchGroup in syntax script
    * runtime(netrw): upstream snapshot of v175
    * Vim9: compiling abstract method fails without return
    * runtime(c): add new constexpr keyword to syntax file (C23)
    * tests: shaderslang was removed from test_filetype erroneously
    * link error when FEAT_SPELL not defined
    * Coverity complains about insecure data handling
    * runtime(sh): update syntax script
    * runtime(c): Add missing syntax test files
    * filetype: setting bash filetype is backwards incompatible
    * runtime(c): Update syntax and ftplugin files
    * the installer can be improved
    * too many strlen() calls in screen.c
    * no sanitize check when running linematch
    * filetype: swc configuration files are not recognized
    * runtime(netrw): change netrw maintainer
    * wrong return type of blob2str()
    * blob2str/str2blob() do not support list of strings
    * runtime(doc): fix typo in usr_02.txt
    * Coverity complains about dereferencing NULL pointer
    * linematch option value not completed
    * string might be used without a trailing NUL
    * no way to get current selected item in a async context
    * filetype: fd ignore files are not recognized
    * v9.1.0743 causes regression with diff mode
    * runtime(doc): fix base64 encode/decode examples
    * Vim9: Patch 9.1.1013 causes a few problems
    * Not possible to convert string2blob and blob2string
    * Coverity complains about dereferencing NULL value
    * Vim9: variable not found in transitive import
    * runtime(colors): Update colorschemes, include new unokai colorscheme
    * Vim9: Regression caused by patch v9.1.0646
    * runtime(lyrics): support milliseconds in syntax script
    * runtime(vim): Split Vim legacy and Vim9 script indent tests
    * Vim9: class interface inheritance not correctly working
    * popupmenu internal error with some abbr in completion item
    * filetype: VisualCode setting file not recognized
    * diff feature can be improved
    * tests: test for patch 9.1.1006 doesn't fail without the patch
    * filetype: various ignore are not recognized
    * tests: Load screendump files with "git vimdumps"
    * PmenuMatch completion highlight can be combined
    * completion text is highlighted even with no pattern found
    * tests: a few termdebug tests are flaky
    * [security]: heap-buffer-overflow with visual mode
    * runtime(doc): add package-<name> helptags for included packages
    * Vim9: unknown func error with interface declaring func var
    * runtime(filetype): don't detect string interpolation as angular
    * ComplMatchIns highlight hard to read on light background
    * runtime(vim): Update base-syntax, highlight literal string quote escape
    * runtime(editorconfig): set omnifunc to syntaxcomplete func
    * tests: ruby tests fail with Ruby 3.4
    * Vim9: leaking finished exception
    * runtime(tiasm):  use correct syntax name tiasm in syntax script
    * filetype: TI assembly files are not recognized
    * too many strlen() calls in drawscreen.c
    * runtime(xf86conf): add section name OutputClass to syntax script
    * ComplMatchIns may highlight wrong text
    * runtime(vim): Update base-syntax, improve ex-bang matching
    * runtime(doc): clarify buffer deletion on popup_close()
    * filetype: shaderslang files are not detected
    * Vim9: not able to use comment after opening curly brace
  - update to 9.1.0993
    * 9.1.0993: New 'cmdheight' behavior may be surprising
    * runtime(sh): fix typo in Last Change header
    * 9.1.0992: Vim9: double-free after v9.1.0988
    * 9.1.0991: v:stacktrace has wrong type in Vim9 script
    * runtime(sh): add PS0 to bashSpecialVariables in syntax script
    * runtime(vim): Remove trailing comma from match_words
    * runtime(zsh): sync syntax script with upstream repo
    * runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
    * 9.1.0990: Inconsistent behavior when changing cmdheight
    * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
    * runtime(java): Quietly opt out for unsupported markdown.vim versions
    * runtime(vim): fix failing vim syntax test
    * 9.1.0988: Vim9: no error when using uninitialized var in new()
    * runtime(doc): update index.txt
    * 9.1.0987: filetype: cake files are not recognized
    * 9.1.0986: filetype: 'jj' filetype is a bit imprecise
    * runtime(jj): Support diffs in jj syntax
    * runtime(vim): Update matchit pattern, no Vim9 short names
    * 9.1.0985: Vim9: some ex commands can be shortened
    * 9.1.0984: exception handling can be improved
    * runtime(doc): update doc for :horizontal
    * runtime(doc): update index.txt, windows.txt and version9.txt
    * runtime(doc): Tweak documentation about base64 function
    * runtime(chordpro): update syntax script
    * 9.1.0983: not able to get the displayed items in complete_info()
    * runtime(doc): use standard SGR format at :h xterm-true-color
    * 9.1.0982: TI linker files are not recognized
    * runtime(vim): update vim generator syntax script
    * 9.1.0981: tests: typo in test_filetype.vim
    * 9.1.0980: no support for base64 en-/decoding functions in Vim Script
    * syntax(sh): Improve the recognition of bracket expressions
    * runtime(doc): mention how NUL bytes are handled
    * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
    * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
    * 9.1.0977: filetype: msbuild filetypes are not recognized
    * 9.1.0976: Vim9: missing return statement with throw
    * 9.1.0975: Vim9: interpolated string expr not working in object methods
    * 9.1.0974: typo in change of commit v9.1.0873
    * 9.1.0973: too many strlen() calls in fileio.c
    * runtime(sh): set shellcheck as the compiler for supported shells
    * runtime(doc): Fix enum example syntax
    * 9.1.0972: filetype: TI linker map files are not recognized
    * runtime(vim): Improve syntax script generator for Vim Script
    * 9.1.0971: filetype: SLNX files are not recognized
    * 9.1.0970: VMS: build errors on VMS architecture
    * runtime(doc): Fix documentation typos
    * runtime(doc): update for new keyprotocol option value (after v9.1.0969)
    * 9.1.0969: ghostty not using kitty protocol by default
    * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
    * runtime(doc): update version9.txt for bash filetype
    * runtime(netrw): update last change header for #16265
    * runtime(doc): fix doc error in :r behaviour
    * 9.1.0967: SpotBugs compiler setup can be further improved
    * 9.1.0966: Vim9: :enum command can be shortened
    * runtime(compiler): include a basic bash syntax checker compiler
    * 9.1.0965: filetype: sh filetype set when detecting the use of bash
    * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
    * 9.1.0963: fuzzy-matching does not prefer full match
    * 9.1.0962: filetype: bun.lock file is not recognized
    * runtime(vim): update indentation plugin for Vim script
    * runtime(doc): tweak documentation style in helphelp.txt
    * runtime(vim): Update base-syntax, allow parens in default arguments
    * runtime(doc): mention auto-format using clang-format for sound.c/sign.c
    * runtime(help): fix typo s/additional/arbitrary/
    * runtime(help): Add better support for language annotation highlighting
    * 9.1.0961: filetype: TI gel files are not recognized
    * 9.1.0960: filetype: hy history files are not recognized
    * translation(fi): Fix typoes in Finish menu translation
    * 9.1.0959: Coverity complains about type conversion
    * runtime(vim): Use supported syntax in indent tests
    * 9.1.0958: filetype: supertux2 config files detected as lisp
    * 9.1.0956: completion may crash, completion highlight wrong with preview window
    * 9.1.0955: Vim9: vim9compile.c can be further improved
    * runtime(doc): move help tag E1182
    * runtime(graphql): contribute vim-graphql to Vim core
    * 9.1.0954: popupmenu.c can be improved
    * 9.1.0953: filetype: APKBUILD files not correctly detected
    * 9.1.0952: Vim9: missing type checking for any type assignment
    * 9.1.0951: filetype: jshell files are not recognized
    * runtime(dockerfile): do not set commentstring in syntax script
    * 9.1.0950: filetype: fennelrc files are not recognized
    * runtime(netrw): do not double escape Vim special characters
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): more reformating #16248
    * runtime(doc): Add a note about handling symbolic links in starting.txt
    * 9.1.0949: popups inconsistently shifted to the left
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): change indent size from 1 to 2
    * 9.1.0948: Missing cmdline completion for :pbuffer
    * runtime(tutor): Reformat tutor1
    * 9.1.0947: short-description
    * 9.1.0946: cross-compiling fails on osx-arm64
    * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
    * translation(sv): re-include the change from #16240
    * 9.1.0944: tests: test_registers fails when not run under X11
    * 9.1.0943: Vim9: vim9compile.c can be further improved
    * runtime(doc): Update README and mention make check to verify
    * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
    * runtime(vim): update base-syntax after v9.1.0936
    * 9.1.0942: a few typos were found
    * 9.1.0941: ComplMatchIns doesn't work after multibyte chars
    * runtime(doc): Fix style in fold.txt
    * translation(sv): Fix typo in Swedish translation
    * 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
    * runtime(doc): fix some small errors
    * 9.1.0939: make installtutor fails
    * 9.1.0938: exclusive selection not respected when re-selecting block mode
    * 9.1.0937: test_undolist() is flaky
    * 9.1.0936: cannot highlight completed text
    * 9.1.0935: SpotBugs compiler can be improved
    * 9.1.0934: hard to view an existing buffer in the preview window
    * runtime(doc): document how to minimize fold computation costs
    * 9.1.0933: Vim9: vim9compile.c can be further improved
    * 9.1.0932: new Italian tutor not installed
    * runtime(doc): fix a few minor errors from the last doc updates
    * translation(it): add Italian translation for the interactive tutor
    * runtime(doc): update the change.txt help file
    * runtime(help): Add Vim lang annotation support for codeblocks
    * 9.1.0931: ml_get error in terminal buffer
    * 9.1.0930: tests: test_terminal2 may hang in GUI mode
    * 9.1.0929: filetype: lalrpop files are not recognized
    * 9.1.0928: tests: test_popupwin fails because the filter command fails
    * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
    * 9.1.0927: style issues in insexpand.c
    * 9.1.0926: filetype: Pixi lock files are not recognized
    * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
    * runtime(doc): add a note about inclusive motions and exclusive selection
    * 9.1.0925: Vim9: expression compiled when not necessary
    * 9.1.0924: patch 9.1.0923 causes issues
    * 9.1.0923: too many strlen() calls in filepath.c
    * 9.1.0923: wrong MIN macro in popupmenu.c
    * 9.1.0921: popupmenu logic is a bit convoluted
    * 9.1.0920: Vim9: compile_assignment() too long
    * 9.1.0919: filetype: some assembler files are not recognized
    * runtime(netrw): do not pollute search history with symlinks
    * 9.1.0918: tiny Vim crashes with fuzzy buffer completion
    * 9.1.0917: various vartabstop and shiftround bugs when shifting lines
    * runtime(typst): add definition lists to formatlistpat, update maintainer
    * 9.1.0916: messages.c is exceeding 80 columns
    * runtime(proto): include filetype plugin for protobuf
    * 9.1.0915: GVim: default font size a bit too small
    * 9.1.0914: Vim9: compile_assignment() is too long
    * 9.1.0913: no error check for neg values for 'messagesopt'
    * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
    * 9.1.0912: xxd: integer overflow with sparse files and -autoskip
    * 9.1.0911: Variable name for 'messagesopt' doesn't match short name
    * 9.1.0910: 'messagesopt' does not check max wait time
    * runtime(doc): update wrong Vietnamese localization tag
    * 9.1.0909: Vim9: crash when calling instance method
  - update to 9.1.0908
    * refresh vim-7.3-mktemp_tutor.patch
    * 9.1.0908: not possible to configure :messages
    * 9.1.0907: printoptions:portrait does not change postscript Orientation
    * runtime(doc): Add vietnamese.txt to helps main TOC
    * 9.1.0906: filetype: Nvidia PTX files are not recognized
    * runtime(doc): updated version9.txt with changes from v9.1.0905
    * 9.1.0905: Missing information in CompleteDone event
    * 9.1.0904: Vim9: copy-paste error in class_defining_member()
    * 9.1.0903: potential overflow in spell_soundfold_wsal()
    * runtime(netrw): do not detach when launching external programs in gvim
    * runtime(doc): make tag alignment more consistent in filetype.txt
    * runtime(doc): fix wrong syntax and style of vietnamese.txt
    * translation(it): update Italian manpage for vimtutor
    * runtime(lua): add optional lua function folding
    * Filelist: include translations for Chapter 2 tutor
    * translation(vi): Update Vietnamese translation
    * runtime(doc): include vietnamese.txt
    * runtime(tutor): fix another typo in tutor2
    * runtime(doc): fix typo in vimtutor manpage
    * translation(it): update Italian manpage for vimtutor
    * translation(it): include Italian version of tutor chapter 2
    * runtime(tutor): regenerated some translated tutor1 files
    * runtime(tutor): fix typo in Chapter 2
    * 9.1.0902: filetype: Conda configuration files are not recognized
    * runtime(doc): Tweak documentation style a bit
    * runtime(tutor): update the tutor files and re-number the chapters
    * runtime(tutor): Update the makefiles for tutor1 and tutor2 files
    * 9.1.0901: MS-Windows: vimtutor batch script can be improved
    * runtime(doc): remove buffer-local completeopt todo item
    * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
    * runtime(typst): provide a formatlistpat in ftplugin
    * runtime(doc): Update documentation for "noselect" in 'completeopt'
    * 9.1.0899: default for 'backspace' can be set in C code
    * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
    * translation(ru): Updated messages translation
    * 9.1.0898: runtime(compiler): pytest compiler not included
    * 9.1.0897: filetype: pyrex files are not detected
    * runtime(compiler): update eslint compiler
    * 9.1.0896: completion list wrong after v9.1.0891
    * runtime(doc): document changed default value for 'history'
    * 9.1.0895: default history value is too small
    * 9.1.0894: No test for what the spotbug compiler parses
    * 9.1.0893: No test that undofile format does not regress
    * translation(de): update German manpages
    * runtime(compiler): include spotbugs Java linter
    * 9.1.0892: the max value of 'tabheight' is limited by other tabpages
    * runtime(po): remove poDiffOld/New, add po-format flags to syntax file
    * 9.1.0891: building the completion list array is inefficient
    * patch 9.1.0890: %! item not allowed for 'rulerformat'
    * runtime(gzip): load undofile if there exists one
    * 9.1.0889: Possible unnecessary redraw after adding/deleting lines
    * 9.1.0888: leftcol property not available in getwininfo()
    * 9.1.0887: Wrong expression in sign.c
    * 9.1.0886: filetype: debian control file not detected
    * runtime(c3): include c3 filetype plugin
    * 9.1.0885: style of sign.c can be improved
    * 9.1.0884: gcc warns about uninitialized variable
    * runtime(apache): Update syntax directives for apache server 2.4.62
    * translation(ru): updated vimtutor translation, update MAINTAINERS file
    * 9.1.0883: message history cleanup is missing some tests
    * runtime(doc): Expand docs on :! vs. :term
    * runtime(netrw): Fixing powershell execution issues on Windows
    * 9.1.0882: too many strlen() calls in insexpand.c
    * 9.1.0881: GUI: message dialog may not get focus
    * runtime(netrw): update netrw's decompress logic
    * runtime(apache): Update syntax keyword definition
    * runtime(misc): add Italian LICENSE and (top-level) README file
    * 9.1.0880: filetype: C3 files are not recognized
    * runtime(doc): add helptag for :HelpToc command
    * 9.1.0879: source is not consistently formatted
    * Add clang-format config file
    * runtime(compiler): fix escaping of arguments passed to :CompilerSet
    * 9.1.0878: termdebug: cannot enable DEBUG mode
    * 9.1.0877: tests: missing test for termdebug + decimal signs
    * 9.1.0876: filetype: openCL files are not recognized
    * 9.1.0875: filetype: hyprlang detection can be improved
    * 9.1.0874: filetype: karel files are not detected
    * 9.1.0873: filetype: Vivado files are not recognized
    * 9.1.0872: No test for W23 message
    * 9.1.0871: getcellpixels() can be further improved
    * 9.1.0870: too many strlen() calls in eval.c
    * 9.1.0869: Problem: curswant not set on gm in folded line
    * 9.1.0868: the warning about missing clipboard can be improved
    * runtime(doc): Makefile does not clean up all temporary files
    * 9.1.0867: ins_compl_add() has too many args
    * editorconfig: don't trim trailing whitespaces in runtime/doc
    * translation(am): Remove duplicate keys in desktop files
    * runtime(doc): update helptags
    * runtime(filetype): remove duplicated *.org file pattern
    * runtime(cfg): only consider leading // as starting a comment
    * 9.1.0866: filetype: LLVM IR files are not recognized
    * 9.1.0865: filetype: org files are not recognized
    * 9.1.0864: message history is fixed to 200
    * 9.1.0863: getcellpixels() can be further improved
    * runtime(sh): better function support for bash/zsh in indent script
    * runtime(netrw): small fixes to netrw#BrowseX
    * 9.1.0862: 'wildmenu' not enabled by default in nocp mode
    * runtime(doc): update how to report issues for mac Vim
    * runtime(doc): mention option-backslash at :h CompilerSet
    * runtime(compiler): include a Java Maven compiler plugin
    * runtime(racket): update Racket runtime files
    * runtime(doc): improve indentation in examples for netrw-handler
    * runtime(doc): improve examples for netrw-handler functions
    * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
    * runtime(doc): clarify the use of filters and external commands
    * 9.1.0861: Vim9: no runtime check for object member access of any var
    * runtime(compiler): update pylint linter
    * 9.1.0860: tests: mouse_shape tests use hard code sleep value
    * 9.1.0859: several problems with the GLVS plugin
    * 9.1.0858: Coverity complains about dead code
    * runtime(tar): Update tar.vim to support permissions
    * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
    * 9.1.0851: too many strlen() calls in getchar.c
    * 9.1.0850: Vim9: cannot access nested object inside objects
    * runtime(tex): extra Number highlighting causes issues
    * runtime(vim): Fix indent after :silent! function
    * 9.1.0849: there are a few typos in the source
    * runtime(netrw): directory symlink not resolved in tree view
    * runtime(doc): add a table of supported Operating Systems
    * runtime(tex): update Last Change header in syntax script
    * runtime(doc): fix typo in g:termdebug_config
    * runtime(vim): Update base-syntax, improve :normal highlighting
    * runtime(tex): add Number highlighting to syntax file
    * runtime(doc): Tweak documentation style a bit
    * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
    * runtime(dune): use :setl instead of :set in ftplugin
    * runtime(termdebug): allow to use decimal signs
    * translation(it): Updated Italian vimtutor
    * runtime(compiler): improve cppcheck
    * git: git-blame-ignore-revs shown as an error on Github
    * 9.1.0847: tests: test_popupwin fails because of updated help file
    * 9.1.0846: debug symbols for xxd are not cleaned in Makefile
    * runtime(structurizr): Update structurizr syntax
    * runtime(8th): updated 8th syntax
    * runtime(doc): Add pi_tutor.txt to help TOC
    * runtime(compiler): add mypy and ruff compiler; update pylint linter
    * runtime(netrw): fix several bugs in netrw tree listing
    * runtime(netrw): prevent polluting the search history
    * 9.1.0845: vimtutor shell script can be improved
    * 9.1.0844: if_python: no way to pass local vars to python
    * 9.1.0843: too many strlen() calls in undo.c
    * runtime(doc): update default value for fillchars option
    * runtime(compiler): fix typo in cppcheck compiler plugin
    * runtime(doc): simplify vimtutor manpage a bit more
    * runtime(matchparen): Add matchparen_disable_cursor_hl config option
    * 9.1.0842: not checking for the sync() systemcall
    * 9.1.0841: tests: still preferring python2 over python3
    * 9.1.0840: filetype: idris2 files are not recognized
    * 9.1.0839: filetype: leo files are not recognized
    * runtime(cook): include cook filetype plugin
    * runtime(debversions): Update Debian versions
    * patch 9.1.0838: vimtutor is bash-specific
    * runtime(doc): add help specific modeline to pi_tutor.txt
    * Filelist: vimtutor chapter 2 is missing in Filelist
    * 9.1.0837: cross-compiling has some issues
    * runtime(vimtutor): Add a second chapter

++++ vim:

  - 9.1.1101 is a fix for:
    bsc#1229685 (CVE-2024-43790)
    bsc#1229822 (CVE-2024-43802)
    bsc#1230078 (CVE-2024-45306)
    bsc#1235695 (CVE-2025-22134)
    bsc#1236151 (CVE-2025-24014)
    bsc#1237137 (CVE-2025-1215)
  - Remove obsoleted patch:
    * vim-7.3-mktemp_tutor.patch
  - update to 9.1.1101
    * insexpand.c hard to read
    * tests: Test_log_nonexistent only works on Linux
    * Update base-syntax, improve variable matching
    * Vim9: import with extends may crash
    * leaking memory with completing multi lines
    * --log with non-existent path causes a crash
    * if_perl: Perl 5.38 adds new symbols causing link failure
    * tests: matchparen plugin test wrongly named
    * Vim9: problem finding implemented method in type hierarchy
    * runtime(qf): Update syntax file, match second delimiter
    * tests: output of test ...win32_ctrl_z depends on python version
    * tests: fix expected return code for python 3.13 on Windows
    * tests: timeout might be a bit too small
    * tests: test_terminwscroll_topline2 unreliable
    * tests: No check when tests are run under Github actions
    * tests: plugin tests are named inconsistently
    * Vim9: import with extends may crash
    * completion doesn't work with multi lines
    * filetype: cmmt files are not recognized
    * Unable to persistently ignore events in a window and its buffers
    * improve syntax highlighting
    * setreg() doesn't correctly handle mbyte chars in blockwise mode
    * unexpected DCS responses may cause out of bounds reads
    * has('bsd') is true for GNU/Hurd
    * filetype: Mill files are not recognized
    * GUI late startup leads to uninitialized scrollbars
    * Add support for lz4 to tar & gzip plugin
    * Terminal ansi colors off by one after tgc reset
    * included syntax items do not understand contains=TOP
    * vim_strnchr() is strange and unnecessary
    * Vim9: len variable not used in compile_load()
    * runtime(vim): Update base-syntax, match :debuggreedy count prefix
    * Strange error when heredoc marker starts with "trim"
    * tests: test_compiler fails on Windows without Maven
    * 'diffopt' "linematch" cannot be used with {n} less than 10
    * args missing after failing to redefine a function
    * Cannot control cursor positioning of getchar()
    * preinsert text completions not deleted with <C-W>/<C-U>
    * getchar() can't distinguish between C-I and Tab
    * tests: Test_termwinscroll_topline2 fails on MacOS
    * heap-use-after-free and stack-use-after-scope with :14verbose
    * no digraph for "Approaches the limit"
    * not possible to use plural forms with gettext()
    * too many strlen() calls in userfunc.c
    * terminal: E315 when dragging the terminal with the mouse
    * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
    * runtime(doc): Tweak documentation style a bit
    * tests: test_glvs fails when unarchiver not available
    * Vim always enables 'termguicolors' in a terminal
    * completion: input text deleted with preinsert when adding leader
    * translation(sr): Missing Serbian translation for the tutor
    * Superfluous cleanup steps in test_ins_complete.vim
    * runtime(netrw): correct wrong version check
    * Vim doesn't highlight to be inserted text when completing
    * runtime(netrw): upstream snapshot of v176
    * runtime(dist/vim9): fix regressions in dist#vim9#Open
    * runtime(hyprlang): fix string recognition
    * make install fails because of a missing dependency
    * runtime(asm): add byte directives to syntax script
    * Vim doesn't work well with TERM=xterm-direct
    * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
    * runtime: decouple Open and Launch commands and gx mapping from netrw
    * "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
    * runtime(just): fix typo in syntax file
    * runtime(filetype): Improve Verilog detection by checking for modules definition
    * tests: off-by-one error in CheckCWD in test_debugger.vim
    * tests: no support for env variables when running Vim in terminal
    * too many strlen() calls in os_unix.c
    * insert-completed items are always sorted
    * crash after scrolling and pasting in silent Ex mode
    * Makefiles uses non-portable syntax
    * fuzzymatching doesn't prefer matching camelcase
    * filetype: N-Tripels and TriG files are not recognized
    * Vim9: Patch 9.1.1014 causes regressions
    * translation(sr): Update Serbian messages translation
  - updade to 9.1.1043
    * [security]: segfault in win_line()
    * update helptags
    * filetype: just files are not recognized
    * Update base-syntax, match ternary and falsy operators
    * Vim9: out-of-bound access when echoing an enum
    * Vim9: imported type cannot be used as func return type
    * runtime(kconfig): updated ftplugin and syntax script
    * runtime(doc): rename last t_BG reference to t_RB
    * Vim9: comments are outdated
    * tests: test_channel.py fails with IPv6
    * runtime(vim): Update base-syntax, fix is/isnot operator matching
    * Vim9: confusing error when using abstract method via super
    * make install fails when using shadowdir
    * Vim9: memory leak with blob2str()
    * runtime(tex): add texEmphStyle to texMatchGroup in syntax script
    * runtime(netrw): upstream snapshot of v175
    * Vim9: compiling abstract method fails without return
    * runtime(c): add new constexpr keyword to syntax file (C23)
    * tests: shaderslang was removed from test_filetype erroneously
    * link error when FEAT_SPELL not defined
    * Coverity complains about insecure data handling
    * runtime(sh): update syntax script
    * runtime(c): Add missing syntax test files
    * filetype: setting bash filetype is backwards incompatible
    * runtime(c): Update syntax and ftplugin files
    * the installer can be improved
    * too many strlen() calls in screen.c
    * no sanitize check when running linematch
    * filetype: swc configuration files are not recognized
    * runtime(netrw): change netrw maintainer
    * wrong return type of blob2str()
    * blob2str/str2blob() do not support list of strings
    * runtime(doc): fix typo in usr_02.txt
    * Coverity complains about dereferencing NULL pointer
    * linematch option value not completed
    * string might be used without a trailing NUL
    * no way to get current selected item in a async context
    * filetype: fd ignore files are not recognized
    * v9.1.0743 causes regression with diff mode
    * runtime(doc): fix base64 encode/decode examples
    * Vim9: Patch 9.1.1013 causes a few problems
    * Not possible to convert string2blob and blob2string
    * Coverity complains about dereferencing NULL value
    * Vim9: variable not found in transitive import
    * runtime(colors): Update colorschemes, include new unokai colorscheme
    * Vim9: Regression caused by patch v9.1.0646
    * runtime(lyrics): support milliseconds in syntax script
    * runtime(vim): Split Vim legacy and Vim9 script indent tests
    * Vim9: class interface inheritance not correctly working
    * popupmenu internal error with some abbr in completion item
    * filetype: VisualCode setting file not recognized
    * diff feature can be improved
    * tests: test for patch 9.1.1006 doesn't fail without the patch
    * filetype: various ignore are not recognized
    * tests: Load screendump files with "git vimdumps"
    * PmenuMatch completion highlight can be combined
    * completion text is highlighted even with no pattern found
    * tests: a few termdebug tests are flaky
    * [security]: heap-buffer-overflow with visual mode
    * runtime(doc): add package-<name> helptags for included packages
    * Vim9: unknown func error with interface declaring func var
    * runtime(filetype): don't detect string interpolation as angular
    * ComplMatchIns highlight hard to read on light background
    * runtime(vim): Update base-syntax, highlight literal string quote escape
    * runtime(editorconfig): set omnifunc to syntaxcomplete func
    * tests: ruby tests fail with Ruby 3.4
    * Vim9: leaking finished exception
    * runtime(tiasm):  use correct syntax name tiasm in syntax script
    * filetype: TI assembly files are not recognized
    * too many strlen() calls in drawscreen.c
    * runtime(xf86conf): add section name OutputClass to syntax script
    * ComplMatchIns may highlight wrong text
    * runtime(vim): Update base-syntax, improve ex-bang matching
    * runtime(doc): clarify buffer deletion on popup_close()
    * filetype: shaderslang files are not detected
    * Vim9: not able to use comment after opening curly brace
  - update to 9.1.0993
    * 9.1.0993: New 'cmdheight' behavior may be surprising
    * runtime(sh): fix typo in Last Change header
    * 9.1.0992: Vim9: double-free after v9.1.0988
    * 9.1.0991: v:stacktrace has wrong type in Vim9 script
    * runtime(sh): add PS0 to bashSpecialVariables in syntax script
    * runtime(vim): Remove trailing comma from match_words
    * runtime(zsh): sync syntax script with upstream repo
    * runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
    * 9.1.0990: Inconsistent behavior when changing cmdheight
    * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
    * runtime(java): Quietly opt out for unsupported markdown.vim versions
    * runtime(vim): fix failing vim syntax test
    * 9.1.0988: Vim9: no error when using uninitialized var in new()
    * runtime(doc): update index.txt
    * 9.1.0987: filetype: cake files are not recognized
    * 9.1.0986: filetype: 'jj' filetype is a bit imprecise
    * runtime(jj): Support diffs in jj syntax
    * runtime(vim): Update matchit pattern, no Vim9 short names
    * 9.1.0985: Vim9: some ex commands can be shortened
    * 9.1.0984: exception handling can be improved
    * runtime(doc): update doc for :horizontal
    * runtime(doc): update index.txt, windows.txt and version9.txt
    * runtime(doc): Tweak documentation about base64 function
    * runtime(chordpro): update syntax script
    * 9.1.0983: not able to get the displayed items in complete_info()
    * runtime(doc): use standard SGR format at :h xterm-true-color
    * 9.1.0982: TI linker files are not recognized
    * runtime(vim): update vim generator syntax script
    * 9.1.0981: tests: typo in test_filetype.vim
    * 9.1.0980: no support for base64 en-/decoding functions in Vim Script
    * syntax(sh): Improve the recognition of bracket expressions
    * runtime(doc): mention how NUL bytes are handled
    * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
    * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
    * 9.1.0977: filetype: msbuild filetypes are not recognized
    * 9.1.0976: Vim9: missing return statement with throw
    * 9.1.0975: Vim9: interpolated string expr not working in object methods
    * 9.1.0974: typo in change of commit v9.1.0873
    * 9.1.0973: too many strlen() calls in fileio.c
    * runtime(sh): set shellcheck as the compiler for supported shells
    * runtime(doc): Fix enum example syntax
    * 9.1.0972: filetype: TI linker map files are not recognized
    * runtime(vim): Improve syntax script generator for Vim Script
    * 9.1.0971: filetype: SLNX files are not recognized
    * 9.1.0970: VMS: build errors on VMS architecture
    * runtime(doc): Fix documentation typos
    * runtime(doc): update for new keyprotocol option value (after v9.1.0969)
    * 9.1.0969: ghostty not using kitty protocol by default
    * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
    * runtime(doc): update version9.txt for bash filetype
    * runtime(netrw): update last change header for #16265
    * runtime(doc): fix doc error in :r behaviour
    * 9.1.0967: SpotBugs compiler setup can be further improved
    * 9.1.0966: Vim9: :enum command can be shortened
    * runtime(compiler): include a basic bash syntax checker compiler
    * 9.1.0965: filetype: sh filetype set when detecting the use of bash
    * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
    * 9.1.0963: fuzzy-matching does not prefer full match
    * 9.1.0962: filetype: bun.lock file is not recognized
    * runtime(vim): update indentation plugin for Vim script
    * runtime(doc): tweak documentation style in helphelp.txt
    * runtime(vim): Update base-syntax, allow parens in default arguments
    * runtime(doc): mention auto-format using clang-format for sound.c/sign.c
    * runtime(help): fix typo s/additional/arbitrary/
    * runtime(help): Add better support for language annotation highlighting
    * 9.1.0961: filetype: TI gel files are not recognized
    * 9.1.0960: filetype: hy history files are not recognized
    * translation(fi): Fix typoes in Finish menu translation
    * 9.1.0959: Coverity complains about type conversion
    * runtime(vim): Use supported syntax in indent tests
    * 9.1.0958: filetype: supertux2 config files detected as lisp
    * 9.1.0956: completion may crash, completion highlight wrong with preview window
    * 9.1.0955: Vim9: vim9compile.c can be further improved
    * runtime(doc): move help tag E1182
    * runtime(graphql): contribute vim-graphql to Vim core
    * 9.1.0954: popupmenu.c can be improved
    * 9.1.0953: filetype: APKBUILD files not correctly detected
    * 9.1.0952: Vim9: missing type checking for any type assignment
    * 9.1.0951: filetype: jshell files are not recognized
    * runtime(dockerfile): do not set commentstring in syntax script
    * 9.1.0950: filetype: fennelrc files are not recognized
    * runtime(netrw): do not double escape Vim special characters
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): more reformating #16248
    * runtime(doc): Add a note about handling symbolic links in starting.txt
    * 9.1.0949: popups inconsistently shifted to the left
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): change indent size from 1 to 2
    * 9.1.0948: Missing cmdline completion for :pbuffer
    * runtime(tutor): Reformat tutor1
    * 9.1.0947: short-description
    * 9.1.0946: cross-compiling fails on osx-arm64
    * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
    * translation(sv): re-include the change from #16240
    * 9.1.0944: tests: test_registers fails when not run under X11
    * 9.1.0943: Vim9: vim9compile.c can be further improved
    * runtime(doc): Update README and mention make check to verify
    * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
    * runtime(vim): update base-syntax after v9.1.0936
    * 9.1.0942: a few typos were found
    * 9.1.0941: ComplMatchIns doesn't work after multibyte chars
    * runtime(doc): Fix style in fold.txt
    * translation(sv): Fix typo in Swedish translation
    * 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
    * runtime(doc): fix some small errors
    * 9.1.0939: make installtutor fails
    * 9.1.0938: exclusive selection not respected when re-selecting block mode
    * 9.1.0937: test_undolist() is flaky
    * 9.1.0936: cannot highlight completed text
    * 9.1.0935: SpotBugs compiler can be improved
    * 9.1.0934: hard to view an existing buffer in the preview window
    * runtime(doc): document how to minimize fold computation costs
    * 9.1.0933: Vim9: vim9compile.c can be further improved
    * 9.1.0932: new Italian tutor not installed
    * runtime(doc): fix a few minor errors from the last doc updates
    * translation(it): add Italian translation for the interactive tutor
    * runtime(doc): update the change.txt help file
    * runtime(help): Add Vim lang annotation support for codeblocks
    * 9.1.0931: ml_get error in terminal buffer
    * 9.1.0930: tests: test_terminal2 may hang in GUI mode
    * 9.1.0929: filetype: lalrpop files are not recognized
    * 9.1.0928: tests: test_popupwin fails because the filter command fails
    * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
    * 9.1.0927: style issues in insexpand.c
    * 9.1.0926: filetype: Pixi lock files are not recognized
    * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
    * runtime(doc): add a note about inclusive motions and exclusive selection
    * 9.1.0925: Vim9: expression compiled when not necessary
    * 9.1.0924: patch 9.1.0923 causes issues
    * 9.1.0923: too many strlen() calls in filepath.c
    * 9.1.0923: wrong MIN macro in popupmenu.c
    * 9.1.0921: popupmenu logic is a bit convoluted
    * 9.1.0920: Vim9: compile_assignment() too long
    * 9.1.0919: filetype: some assembler files are not recognized
    * runtime(netrw): do not pollute search history with symlinks
    * 9.1.0918: tiny Vim crashes with fuzzy buffer completion
    * 9.1.0917: various vartabstop and shiftround bugs when shifting lines
    * runtime(typst): add definition lists to formatlistpat, update maintainer
    * 9.1.0916: messages.c is exceeding 80 columns
    * runtime(proto): include filetype plugin for protobuf
    * 9.1.0915: GVim: default font size a bit too small
    * 9.1.0914: Vim9: compile_assignment() is too long
    * 9.1.0913: no error check for neg values for 'messagesopt'
    * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
    * 9.1.0912: xxd: integer overflow with sparse files and -autoskip
    * 9.1.0911: Variable name for 'messagesopt' doesn't match short name
    * 9.1.0910: 'messagesopt' does not check max wait time
    * runtime(doc): update wrong Vietnamese localization tag
    * 9.1.0909: Vim9: crash when calling instance method
  - update to 9.1.0908
    * refresh vim-7.3-mktemp_tutor.patch
    * 9.1.0908: not possible to configure :messages
    * 9.1.0907: printoptions:portrait does not change postscript Orientation
    * runtime(doc): Add vietnamese.txt to helps main TOC
    * 9.1.0906: filetype: Nvidia PTX files are not recognized
    * runtime(doc): updated version9.txt with changes from v9.1.0905
    * 9.1.0905: Missing information in CompleteDone event
    * 9.1.0904: Vim9: copy-paste error in class_defining_member()
    * 9.1.0903: potential overflow in spell_soundfold_wsal()
    * runtime(netrw): do not detach when launching external programs in gvim
    * runtime(doc): make tag alignment more consistent in filetype.txt
    * runtime(doc): fix wrong syntax and style of vietnamese.txt
    * translation(it): update Italian manpage for vimtutor
    * runtime(lua): add optional lua function folding
    * Filelist: include translations for Chapter 2 tutor
    * translation(vi): Update Vietnamese translation
    * runtime(doc): include vietnamese.txt
    * runtime(tutor): fix another typo in tutor2
    * runtime(doc): fix typo in vimtutor manpage
    * translation(it): update Italian manpage for vimtutor
    * translation(it): include Italian version of tutor chapter 2
    * runtime(tutor): regenerated some translated tutor1 files
    * runtime(tutor): fix typo in Chapter 2
    * 9.1.0902: filetype: Conda configuration files are not recognized
    * runtime(doc): Tweak documentation style a bit
    * runtime(tutor): update the tutor files and re-number the chapters
    * runtime(tutor): Update the makefiles for tutor1 and tutor2 files
    * 9.1.0901: MS-Windows: vimtutor batch script can be improved
    * runtime(doc): remove buffer-local completeopt todo item
    * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
    * runtime(typst): provide a formatlistpat in ftplugin
    * runtime(doc): Update documentation for "noselect" in 'completeopt'
    * 9.1.0899: default for 'backspace' can be set in C code
    * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
    * translation(ru): Updated messages translation
    * 9.1.0898: runtime(compiler): pytest compiler not included
    * 9.1.0897: filetype: pyrex files are not detected
    * runtime(compiler): update eslint compiler
    * 9.1.0896: completion list wrong after v9.1.0891
    * runtime(doc): document changed default value for 'history'
    * 9.1.0895: default history value is too small
    * 9.1.0894: No test for what the spotbug compiler parses
    * 9.1.0893: No test that undofile format does not regress
    * translation(de): update German manpages
    * runtime(compiler): include spotbugs Java linter
    * 9.1.0892: the max value of 'tabheight' is limited by other tabpages
    * runtime(po): remove poDiffOld/New, add po-format flags to syntax file
    * 9.1.0891: building the completion list array is inefficient
    * patch 9.1.0890: %! item not allowed for 'rulerformat'
    * runtime(gzip): load undofile if there exists one
    * 9.1.0889: Possible unnecessary redraw after adding/deleting lines
    * 9.1.0888: leftcol property not available in getwininfo()
    * 9.1.0887: Wrong expression in sign.c
    * 9.1.0886: filetype: debian control file not detected
    * runtime(c3): include c3 filetype plugin
    * 9.1.0885: style of sign.c can be improved
    * 9.1.0884: gcc warns about uninitialized variable
    * runtime(apache): Update syntax directives for apache server 2.4.62
    * translation(ru): updated vimtutor translation, update MAINTAINERS file
    * 9.1.0883: message history cleanup is missing some tests
    * runtime(doc): Expand docs on :! vs. :term
    * runtime(netrw): Fixing powershell execution issues on Windows
    * 9.1.0882: too many strlen() calls in insexpand.c
    * 9.1.0881: GUI: message dialog may not get focus
    * runtime(netrw): update netrw's decompress logic
    * runtime(apache): Update syntax keyword definition
    * runtime(misc): add Italian LICENSE and (top-level) README file
    * 9.1.0880: filetype: C3 files are not recognized
    * runtime(doc): add helptag for :HelpToc command
    * 9.1.0879: source is not consistently formatted
    * Add clang-format config file
    * runtime(compiler): fix escaping of arguments passed to :CompilerSet
    * 9.1.0878: termdebug: cannot enable DEBUG mode
    * 9.1.0877: tests: missing test for termdebug + decimal signs
    * 9.1.0876: filetype: openCL files are not recognized
    * 9.1.0875: filetype: hyprlang detection can be improved
    * 9.1.0874: filetype: karel files are not detected
    * 9.1.0873: filetype: Vivado files are not recognized
    * 9.1.0872: No test for W23 message
    * 9.1.0871: getcellpixels() can be further improved
    * 9.1.0870: too many strlen() calls in eval.c
    * 9.1.0869: Problem: curswant not set on gm in folded line
    * 9.1.0868: the warning about missing clipboard can be improved
    * runtime(doc): Makefile does not clean up all temporary files
    * 9.1.0867: ins_compl_add() has too many args
    * editorconfig: don't trim trailing whitespaces in runtime/doc
    * translation(am): Remove duplicate keys in desktop files
    * runtime(doc): update helptags
    * runtime(filetype): remove duplicated *.org file pattern
    * runtime(cfg): only consider leading // as starting a comment
    * 9.1.0866: filetype: LLVM IR files are not recognized
    * 9.1.0865: filetype: org files are not recognized
    * 9.1.0864: message history is fixed to 200
    * 9.1.0863: getcellpixels() can be further improved
    * runtime(sh): better function support for bash/zsh in indent script
    * runtime(netrw): small fixes to netrw#BrowseX
    * 9.1.0862: 'wildmenu' not enabled by default in nocp mode
    * runtime(doc): update how to report issues for mac Vim
    * runtime(doc): mention option-backslash at :h CompilerSet
    * runtime(compiler): include a Java Maven compiler plugin
    * runtime(racket): update Racket runtime files
    * runtime(doc): improve indentation in examples for netrw-handler
    * runtime(doc): improve examples for netrw-handler functions
    * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
    * runtime(doc): clarify the use of filters and external commands
    * 9.1.0861: Vim9: no runtime check for object member access of any var
    * runtime(compiler): update pylint linter
    * 9.1.0860: tests: mouse_shape tests use hard code sleep value
    * 9.1.0859: several problems with the GLVS plugin
    * 9.1.0858: Coverity complains about dead code
    * runtime(tar): Update tar.vim to support permissions
    * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
    * 9.1.0851: too many strlen() calls in getchar.c
    * 9.1.0850: Vim9: cannot access nested object inside objects
    * runtime(tex): extra Number highlighting causes issues
    * runtime(vim): Fix indent after :silent! function
    * 9.1.0849: there are a few typos in the source
    * runtime(netrw): directory symlink not resolved in tree view
    * runtime(doc): add a table of supported Operating Systems
    * runtime(tex): update Last Change header in syntax script
    * runtime(doc): fix typo in g:termdebug_config
    * runtime(vim): Update base-syntax, improve :normal highlighting
    * runtime(tex): add Number highlighting to syntax file
    * runtime(doc): Tweak documentation style a bit
    * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
    * runtime(dune): use :setl instead of :set in ftplugin
    * runtime(termdebug): allow to use decimal signs
    * translation(it): Updated Italian vimtutor
    * runtime(compiler): improve cppcheck
    * git: git-blame-ignore-revs shown as an error on Github
    * 9.1.0847: tests: test_popupwin fails because of updated help file
    * 9.1.0846: debug symbols for xxd are not cleaned in Makefile
    * runtime(structurizr): Update structurizr syntax
    * runtime(8th): updated 8th syntax
    * runtime(doc): Add pi_tutor.txt to help TOC
    * runtime(compiler): add mypy and ruff compiler; update pylint linter
    * runtime(netrw): fix several bugs in netrw tree listing
    * runtime(netrw): prevent polluting the search history
    * 9.1.0845: vimtutor shell script can be improved
    * 9.1.0844: if_python: no way to pass local vars to python
    * 9.1.0843: too many strlen() calls in undo.c
    * runtime(doc): update default value for fillchars option
    * runtime(compiler): fix typo in cppcheck compiler plugin
    * runtime(doc): simplify vimtutor manpage a bit more
    * runtime(matchparen): Add matchparen_disable_cursor_hl config option
    * 9.1.0842: not checking for the sync() systemcall
    * 9.1.0841: tests: still preferring python2 over python3
    * 9.1.0840: filetype: idris2 files are not recognized
    * 9.1.0839: filetype: leo files are not recognized
    * runtime(cook): include cook filetype plugin
    * runtime(debversions): Update Debian versions
    * patch 9.1.0838: vimtutor is bash-specific
    * runtime(doc): add help specific modeline to pi_tutor.txt
    * Filelist: vimtutor chapter 2 is missing in Filelist
    * 9.1.0837: cross-compiling has some issues
    * runtime(vimtutor): Add a second chapter

++++ vim:

  - 9.1.1101 is a fix for:
    bsc#1229685 (CVE-2024-43790)
    bsc#1229822 (CVE-2024-43802)
    bsc#1230078 (CVE-2024-45306)
    bsc#1235695 (CVE-2025-22134)
    bsc#1236151 (CVE-2025-24014)
    bsc#1237137 (CVE-2025-1215)
  - Remove obsoleted patch:
    * vim-7.3-mktemp_tutor.patch
  - update to 9.1.1101
    * insexpand.c hard to read
    * tests: Test_log_nonexistent only works on Linux
    * Update base-syntax, improve variable matching
    * Vim9: import with extends may crash
    * leaking memory with completing multi lines
    * --log with non-existent path causes a crash
    * if_perl: Perl 5.38 adds new symbols causing link failure
    * tests: matchparen plugin test wrongly named
    * Vim9: problem finding implemented method in type hierarchy
    * runtime(qf): Update syntax file, match second delimiter
    * tests: output of test ...win32_ctrl_z depends on python version
    * tests: fix expected return code for python 3.13 on Windows
    * tests: timeout might be a bit too small
    * tests: test_terminwscroll_topline2 unreliable
    * tests: No check when tests are run under Github actions
    * tests: plugin tests are named inconsistently
    * Vim9: import with extends may crash
    * completion doesn't work with multi lines
    * filetype: cmmt files are not recognized
    * Unable to persistently ignore events in a window and its buffers
    * improve syntax highlighting
    * setreg() doesn't correctly handle mbyte chars in blockwise mode
    * unexpected DCS responses may cause out of bounds reads
    * has('bsd') is true for GNU/Hurd
    * filetype: Mill files are not recognized
    * GUI late startup leads to uninitialized scrollbars
    * Add support for lz4 to tar & gzip plugin
    * Terminal ansi colors off by one after tgc reset
    * included syntax items do not understand contains=TOP
    * vim_strnchr() is strange and unnecessary
    * Vim9: len variable not used in compile_load()
    * runtime(vim): Update base-syntax, match :debuggreedy count prefix
    * Strange error when heredoc marker starts with "trim"
    * tests: test_compiler fails on Windows without Maven
    * 'diffopt' "linematch" cannot be used with {n} less than 10
    * args missing after failing to redefine a function
    * Cannot control cursor positioning of getchar()
    * preinsert text completions not deleted with <C-W>/<C-U>
    * getchar() can't distinguish between C-I and Tab
    * tests: Test_termwinscroll_topline2 fails on MacOS
    * heap-use-after-free and stack-use-after-scope with :14verbose
    * no digraph for "Approaches the limit"
    * not possible to use plural forms with gettext()
    * too many strlen() calls in userfunc.c
    * terminal: E315 when dragging the terminal with the mouse
    * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
    * runtime(doc): Tweak documentation style a bit
    * tests: test_glvs fails when unarchiver not available
    * Vim always enables 'termguicolors' in a terminal
    * completion: input text deleted with preinsert when adding leader
    * translation(sr): Missing Serbian translation for the tutor
    * Superfluous cleanup steps in test_ins_complete.vim
    * runtime(netrw): correct wrong version check
    * Vim doesn't highlight to be inserted text when completing
    * runtime(netrw): upstream snapshot of v176
    * runtime(dist/vim9): fix regressions in dist#vim9#Open
    * runtime(hyprlang): fix string recognition
    * make install fails because of a missing dependency
    * runtime(asm): add byte directives to syntax script
    * Vim doesn't work well with TERM=xterm-direct
    * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
    * runtime: decouple Open and Launch commands and gx mapping from netrw
    * "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
    * runtime(just): fix typo in syntax file
    * runtime(filetype): Improve Verilog detection by checking for modules definition
    * tests: off-by-one error in CheckCWD in test_debugger.vim
    * tests: no support for env variables when running Vim in terminal
    * too many strlen() calls in os_unix.c
    * insert-completed items are always sorted
    * crash after scrolling and pasting in silent Ex mode
    * Makefiles uses non-portable syntax
    * fuzzymatching doesn't prefer matching camelcase
    * filetype: N-Tripels and TriG files are not recognized
    * Vim9: Patch 9.1.1014 causes regressions
    * translation(sr): Update Serbian messages translation
  - updade to 9.1.1043
    * [security]: segfault in win_line()
    * update helptags
    * filetype: just files are not recognized
    * Update base-syntax, match ternary and falsy operators
    * Vim9: out-of-bound access when echoing an enum
    * Vim9: imported type cannot be used as func return type
    * runtime(kconfig): updated ftplugin and syntax script
    * runtime(doc): rename last t_BG reference to t_RB
    * Vim9: comments are outdated
    * tests: test_channel.py fails with IPv6
    * runtime(vim): Update base-syntax, fix is/isnot operator matching
    * Vim9: confusing error when using abstract method via super
    * make install fails when using shadowdir
    * Vim9: memory leak with blob2str()
    * runtime(tex): add texEmphStyle to texMatchGroup in syntax script
    * runtime(netrw): upstream snapshot of v175
    * Vim9: compiling abstract method fails without return
    * runtime(c): add new constexpr keyword to syntax file (C23)
    * tests: shaderslang was removed from test_filetype erroneously
    * link error when FEAT_SPELL not defined
    * Coverity complains about insecure data handling
    * runtime(sh): update syntax script
    * runtime(c): Add missing syntax test files
    * filetype: setting bash filetype is backwards incompatible
    * runtime(c): Update syntax and ftplugin files
    * the installer can be improved
    * too many strlen() calls in screen.c
    * no sanitize check when running linematch
    * filetype: swc configuration files are not recognized
    * runtime(netrw): change netrw maintainer
    * wrong return type of blob2str()
    * blob2str/str2blob() do not support list of strings
    * runtime(doc): fix typo in usr_02.txt
    * Coverity complains about dereferencing NULL pointer
    * linematch option value not completed
    * string might be used without a trailing NUL
    * no way to get current selected item in a async context
    * filetype: fd ignore files are not recognized
    * v9.1.0743 causes regression with diff mode
    * runtime(doc): fix base64 encode/decode examples
    * Vim9: Patch 9.1.1013 causes a few problems
    * Not possible to convert string2blob and blob2string
    * Coverity complains about dereferencing NULL value
    * Vim9: variable not found in transitive import
    * runtime(colors): Update colorschemes, include new unokai colorscheme
    * Vim9: Regression caused by patch v9.1.0646
    * runtime(lyrics): support milliseconds in syntax script
    * runtime(vim): Split Vim legacy and Vim9 script indent tests
    * Vim9: class interface inheritance not correctly working
    * popupmenu internal error with some abbr in completion item
    * filetype: VisualCode setting file not recognized
    * diff feature can be improved
    * tests: test for patch 9.1.1006 doesn't fail without the patch
    * filetype: various ignore are not recognized
    * tests: Load screendump files with "git vimdumps"
    * PmenuMatch completion highlight can be combined
    * completion text is highlighted even with no pattern found
    * tests: a few termdebug tests are flaky
    * [security]: heap-buffer-overflow with visual mode
    * runtime(doc): add package-<name> helptags for included packages
    * Vim9: unknown func error with interface declaring func var
    * runtime(filetype): don't detect string interpolation as angular
    * ComplMatchIns highlight hard to read on light background
    * runtime(vim): Update base-syntax, highlight literal string quote escape
    * runtime(editorconfig): set omnifunc to syntaxcomplete func
    * tests: ruby tests fail with Ruby 3.4
    * Vim9: leaking finished exception
    * runtime(tiasm):  use correct syntax name tiasm in syntax script
    * filetype: TI assembly files are not recognized
    * too many strlen() calls in drawscreen.c
    * runtime(xf86conf): add section name OutputClass to syntax script
    * ComplMatchIns may highlight wrong text
    * runtime(vim): Update base-syntax, improve ex-bang matching
    * runtime(doc): clarify buffer deletion on popup_close()
    * filetype: shaderslang files are not detected
    * Vim9: not able to use comment after opening curly brace
  - update to 9.1.0993
    * 9.1.0993: New 'cmdheight' behavior may be surprising
    * runtime(sh): fix typo in Last Change header
    * 9.1.0992: Vim9: double-free after v9.1.0988
    * 9.1.0991: v:stacktrace has wrong type in Vim9 script
    * runtime(sh): add PS0 to bashSpecialVariables in syntax script
    * runtime(vim): Remove trailing comma from match_words
    * runtime(zsh): sync syntax script with upstream repo
    * runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
    * 9.1.0990: Inconsistent behavior when changing cmdheight
    * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
    * runtime(java): Quietly opt out for unsupported markdown.vim versions
    * runtime(vim): fix failing vim syntax test
    * 9.1.0988: Vim9: no error when using uninitialized var in new()
    * runtime(doc): update index.txt
    * 9.1.0987: filetype: cake files are not recognized
    * 9.1.0986: filetype: 'jj' filetype is a bit imprecise
    * runtime(jj): Support diffs in jj syntax
    * runtime(vim): Update matchit pattern, no Vim9 short names
    * 9.1.0985: Vim9: some ex commands can be shortened
    * 9.1.0984: exception handling can be improved
    * runtime(doc): update doc for :horizontal
    * runtime(doc): update index.txt, windows.txt and version9.txt
    * runtime(doc): Tweak documentation about base64 function
    * runtime(chordpro): update syntax script
    * 9.1.0983: not able to get the displayed items in complete_info()
    * runtime(doc): use standard SGR format at :h xterm-true-color
    * 9.1.0982: TI linker files are not recognized
    * runtime(vim): update vim generator syntax script
    * 9.1.0981: tests: typo in test_filetype.vim
    * 9.1.0980: no support for base64 en-/decoding functions in Vim Script
    * syntax(sh): Improve the recognition of bracket expressions
    * runtime(doc): mention how NUL bytes are handled
    * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
    * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
    * 9.1.0977: filetype: msbuild filetypes are not recognized
    * 9.1.0976: Vim9: missing return statement with throw
    * 9.1.0975: Vim9: interpolated string expr not working in object methods
    * 9.1.0974: typo in change of commit v9.1.0873
    * 9.1.0973: too many strlen() calls in fileio.c
    * runtime(sh): set shellcheck as the compiler for supported shells
    * runtime(doc): Fix enum example syntax
    * 9.1.0972: filetype: TI linker map files are not recognized
    * runtime(vim): Improve syntax script generator for Vim Script
    * 9.1.0971: filetype: SLNX files are not recognized
    * 9.1.0970: VMS: build errors on VMS architecture
    * runtime(doc): Fix documentation typos
    * runtime(doc): update for new keyprotocol option value (after v9.1.0969)
    * 9.1.0969: ghostty not using kitty protocol by default
    * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
    * runtime(doc): update version9.txt for bash filetype
    * runtime(netrw): update last change header for #16265
    * runtime(doc): fix doc error in :r behaviour
    * 9.1.0967: SpotBugs compiler setup can be further improved
    * 9.1.0966: Vim9: :enum command can be shortened
    * runtime(compiler): include a basic bash syntax checker compiler
    * 9.1.0965: filetype: sh filetype set when detecting the use of bash
    * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
    * 9.1.0963: fuzzy-matching does not prefer full match
    * 9.1.0962: filetype: bun.lock file is not recognized
    * runtime(vim): update indentation plugin for Vim script
    * runtime(doc): tweak documentation style in helphelp.txt
    * runtime(vim): Update base-syntax, allow parens in default arguments
    * runtime(doc): mention auto-format using clang-format for sound.c/sign.c
    * runtime(help): fix typo s/additional/arbitrary/
    * runtime(help): Add better support for language annotation highlighting
    * 9.1.0961: filetype: TI gel files are not recognized
    * 9.1.0960: filetype: hy history files are not recognized
    * translation(fi): Fix typoes in Finish menu translation
    * 9.1.0959: Coverity complains about type conversion
    * runtime(vim): Use supported syntax in indent tests
    * 9.1.0958: filetype: supertux2 config files detected as lisp
    * 9.1.0956: completion may crash, completion highlight wrong with preview window
    * 9.1.0955: Vim9: vim9compile.c can be further improved
    * runtime(doc): move help tag E1182
    * runtime(graphql): contribute vim-graphql to Vim core
    * 9.1.0954: popupmenu.c can be improved
    * 9.1.0953: filetype: APKBUILD files not correctly detected
    * 9.1.0952: Vim9: missing type checking for any type assignment
    * 9.1.0951: filetype: jshell files are not recognized
    * runtime(dockerfile): do not set commentstring in syntax script
    * 9.1.0950: filetype: fennelrc files are not recognized
    * runtime(netrw): do not double escape Vim special characters
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): more reformating #16248
    * runtime(doc): Add a note about handling symbolic links in starting.txt
    * 9.1.0949: popups inconsistently shifted to the left
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): change indent size from 1 to 2
    * 9.1.0948: Missing cmdline completion for :pbuffer
    * runtime(tutor): Reformat tutor1
    * 9.1.0947: short-description
    * 9.1.0946: cross-compiling fails on osx-arm64
    * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
    * translation(sv): re-include the change from #16240
    * 9.1.0944: tests: test_registers fails when not run under X11
    * 9.1.0943: Vim9: vim9compile.c can be further improved
    * runtime(doc): Update README and mention make check to verify
    * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
    * runtime(vim): update base-syntax after v9.1.0936
    * 9.1.0942: a few typos were found
    * 9.1.0941: ComplMatchIns doesn't work after multibyte chars
    * runtime(doc): Fix style in fold.txt
    * translation(sv): Fix typo in Swedish translation
    * 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
    * runtime(doc): fix some small errors
    * 9.1.0939: make installtutor fails
    * 9.1.0938: exclusive selection not respected when re-selecting block mode
    * 9.1.0937: test_undolist() is flaky
    * 9.1.0936: cannot highlight completed text
    * 9.1.0935: SpotBugs compiler can be improved
    * 9.1.0934: hard to view an existing buffer in the preview window
    * runtime(doc): document how to minimize fold computation costs
    * 9.1.0933: Vim9: vim9compile.c can be further improved
    * 9.1.0932: new Italian tutor not installed
    * runtime(doc): fix a few minor errors from the last doc updates
    * translation(it): add Italian translation for the interactive tutor
    * runtime(doc): update the change.txt help file
    * runtime(help): Add Vim lang annotation support for codeblocks
    * 9.1.0931: ml_get error in terminal buffer
    * 9.1.0930: tests: test_terminal2 may hang in GUI mode
    * 9.1.0929: filetype: lalrpop files are not recognized
    * 9.1.0928: tests: test_popupwin fails because the filter command fails
    * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
    * 9.1.0927: style issues in insexpand.c
    * 9.1.0926: filetype: Pixi lock files are not recognized
    * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
    * runtime(doc): add a note about inclusive motions and exclusive selection
    * 9.1.0925: Vim9: expression compiled when not necessary
    * 9.1.0924: patch 9.1.0923 causes issues
    * 9.1.0923: too many strlen() calls in filepath.c
    * 9.1.0923: wrong MIN macro in popupmenu.c
    * 9.1.0921: popupmenu logic is a bit convoluted
    * 9.1.0920: Vim9: compile_assignment() too long
    * 9.1.0919: filetype: some assembler files are not recognized
    * runtime(netrw): do not pollute search history with symlinks
    * 9.1.0918: tiny Vim crashes with fuzzy buffer completion
    * 9.1.0917: various vartabstop and shiftround bugs when shifting lines
    * runtime(typst): add definition lists to formatlistpat, update maintainer
    * 9.1.0916: messages.c is exceeding 80 columns
    * runtime(proto): include filetype plugin for protobuf
    * 9.1.0915: GVim: default font size a bit too small
    * 9.1.0914: Vim9: compile_assignment() is too long
    * 9.1.0913: no error check for neg values for 'messagesopt'
    * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
    * 9.1.0912: xxd: integer overflow with sparse files and -autoskip
    * 9.1.0911: Variable name for 'messagesopt' doesn't match short name
    * 9.1.0910: 'messagesopt' does not check max wait time
    * runtime(doc): update wrong Vietnamese localization tag
    * 9.1.0909: Vim9: crash when calling instance method
  - update to 9.1.0908
    * refresh vim-7.3-mktemp_tutor.patch
    * 9.1.0908: not possible to configure :messages
    * 9.1.0907: printoptions:portrait does not change postscript Orientation
    * runtime(doc): Add vietnamese.txt to helps main TOC
    * 9.1.0906: filetype: Nvidia PTX files are not recognized
    * runtime(doc): updated version9.txt with changes from v9.1.0905
    * 9.1.0905: Missing information in CompleteDone event
    * 9.1.0904: Vim9: copy-paste error in class_defining_member()
    * 9.1.0903: potential overflow in spell_soundfold_wsal()
    * runtime(netrw): do not detach when launching external programs in gvim
    * runtime(doc): make tag alignment more consistent in filetype.txt
    * runtime(doc): fix wrong syntax and style of vietnamese.txt
    * translation(it): update Italian manpage for vimtutor
    * runtime(lua): add optional lua function folding
    * Filelist: include translations for Chapter 2 tutor
    * translation(vi): Update Vietnamese translation
    * runtime(doc): include vietnamese.txt
    * runtime(tutor): fix another typo in tutor2
    * runtime(doc): fix typo in vimtutor manpage
    * translation(it): update Italian manpage for vimtutor
    * translation(it): include Italian version of tutor chapter 2
    * runtime(tutor): regenerated some translated tutor1 files
    * runtime(tutor): fix typo in Chapter 2
    * 9.1.0902: filetype: Conda configuration files are not recognized
    * runtime(doc): Tweak documentation style a bit
    * runtime(tutor): update the tutor files and re-number the chapters
    * runtime(tutor): Update the makefiles for tutor1 and tutor2 files
    * 9.1.0901: MS-Windows: vimtutor batch script can be improved
    * runtime(doc): remove buffer-local completeopt todo item
    * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
    * runtime(typst): provide a formatlistpat in ftplugin
    * runtime(doc): Update documentation for "noselect" in 'completeopt'
    * 9.1.0899: default for 'backspace' can be set in C code
    * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
    * translation(ru): Updated messages translation
    * 9.1.0898: runtime(compiler): pytest compiler not included
    * 9.1.0897: filetype: pyrex files are not detected
    * runtime(compiler): update eslint compiler
    * 9.1.0896: completion list wrong after v9.1.0891
    * runtime(doc): document changed default value for 'history'
    * 9.1.0895: default history value is too small
    * 9.1.0894: No test for what the spotbug compiler parses
    * 9.1.0893: No test that undofile format does not regress
    * translation(de): update German manpages
    * runtime(compiler): include spotbugs Java linter
    * 9.1.0892: the max value of 'tabheight' is limited by other tabpages
    * runtime(po): remove poDiffOld/New, add po-format flags to syntax file
    * 9.1.0891: building the completion list array is inefficient
    * patch 9.1.0890: %! item not allowed for 'rulerformat'
    * runtime(gzip): load undofile if there exists one
    * 9.1.0889: Possible unnecessary redraw after adding/deleting lines
    * 9.1.0888: leftcol property not available in getwininfo()
    * 9.1.0887: Wrong expression in sign.c
    * 9.1.0886: filetype: debian control file not detected
    * runtime(c3): include c3 filetype plugin
    * 9.1.0885: style of sign.c can be improved
    * 9.1.0884: gcc warns about uninitialized variable
    * runtime(apache): Update syntax directives for apache server 2.4.62
    * translation(ru): updated vimtutor translation, update MAINTAINERS file
    * 9.1.0883: message history cleanup is missing some tests
    * runtime(doc): Expand docs on :! vs. :term
    * runtime(netrw): Fixing powershell execution issues on Windows
    * 9.1.0882: too many strlen() calls in insexpand.c
    * 9.1.0881: GUI: message dialog may not get focus
    * runtime(netrw): update netrw's decompress logic
    * runtime(apache): Update syntax keyword definition
    * runtime(misc): add Italian LICENSE and (top-level) README file
    * 9.1.0880: filetype: C3 files are not recognized
    * runtime(doc): add helptag for :HelpToc command
    * 9.1.0879: source is not consistently formatted
    * Add clang-format config file
    * runtime(compiler): fix escaping of arguments passed to :CompilerSet
    * 9.1.0878: termdebug: cannot enable DEBUG mode
    * 9.1.0877: tests: missing test for termdebug + decimal signs
    * 9.1.0876: filetype: openCL files are not recognized
    * 9.1.0875: filetype: hyprlang detection can be improved
    * 9.1.0874: filetype: karel files are not detected
    * 9.1.0873: filetype: Vivado files are not recognized
    * 9.1.0872: No test for W23 message
    * 9.1.0871: getcellpixels() can be further improved
    * 9.1.0870: too many strlen() calls in eval.c
    * 9.1.0869: Problem: curswant not set on gm in folded line
    * 9.1.0868: the warning about missing clipboard can be improved
    * runtime(doc): Makefile does not clean up all temporary files
    * 9.1.0867: ins_compl_add() has too many args
    * editorconfig: don't trim trailing whitespaces in runtime/doc
    * translation(am): Remove duplicate keys in desktop files
    * runtime(doc): update helptags
    * runtime(filetype): remove duplicated *.org file pattern
    * runtime(cfg): only consider leading // as starting a comment
    * 9.1.0866: filetype: LLVM IR files are not recognized
    * 9.1.0865: filetype: org files are not recognized
    * 9.1.0864: message history is fixed to 200
    * 9.1.0863: getcellpixels() can be further improved
    * runtime(sh): better function support for bash/zsh in indent script
    * runtime(netrw): small fixes to netrw#BrowseX
    * 9.1.0862: 'wildmenu' not enabled by default in nocp mode
    * runtime(doc): update how to report issues for mac Vim
    * runtime(doc): mention option-backslash at :h CompilerSet
    * runtime(compiler): include a Java Maven compiler plugin
    * runtime(racket): update Racket runtime files
    * runtime(doc): improve indentation in examples for netrw-handler
    * runtime(doc): improve examples for netrw-handler functions
    * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
    * runtime(doc): clarify the use of filters and external commands
    * 9.1.0861: Vim9: no runtime check for object member access of any var
    * runtime(compiler): update pylint linter
    * 9.1.0860: tests: mouse_shape tests use hard code sleep value
    * 9.1.0859: several problems with the GLVS plugin
    * 9.1.0858: Coverity complains about dead code
    * runtime(tar): Update tar.vim to support permissions
    * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
    * 9.1.0851: too many strlen() calls in getchar.c
    * 9.1.0850: Vim9: cannot access nested object inside objects
    * runtime(tex): extra Number highlighting causes issues
    * runtime(vim): Fix indent after :silent! function
    * 9.1.0849: there are a few typos in the source
    * runtime(netrw): directory symlink not resolved in tree view
    * runtime(doc): add a table of supported Operating Systems
    * runtime(tex): update Last Change header in syntax script
    * runtime(doc): fix typo in g:termdebug_config
    * runtime(vim): Update base-syntax, improve :normal highlighting
    * runtime(tex): add Number highlighting to syntax file
    * runtime(doc): Tweak documentation style a bit
    * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
    * runtime(dune): use :setl instead of :set in ftplugin
    * runtime(termdebug): allow to use decimal signs
    * translation(it): Updated Italian vimtutor
    * runtime(compiler): improve cppcheck
    * git: git-blame-ignore-revs shown as an error on Github
    * 9.1.0847: tests: test_popupwin fails because of updated help file
    * 9.1.0846: debug symbols for xxd are not cleaned in Makefile
    * runtime(structurizr): Update structurizr syntax
    * runtime(8th): updated 8th syntax
    * runtime(doc): Add pi_tutor.txt to help TOC
    * runtime(compiler): add mypy and ruff compiler; update pylint linter
    * runtime(netrw): fix several bugs in netrw tree listing
    * runtime(netrw): prevent polluting the search history
    * 9.1.0845: vimtutor shell script can be improved
    * 9.1.0844: if_python: no way to pass local vars to python
    * 9.1.0843: too many strlen() calls in undo.c
    * runtime(doc): update default value for fillchars option
    * runtime(compiler): fix typo in cppcheck compiler plugin
    * runtime(doc): simplify vimtutor manpage a bit more
    * runtime(matchparen): Add matchparen_disable_cursor_hl config option
    * 9.1.0842: not checking for the sync() systemcall
    * 9.1.0841: tests: still preferring python2 over python3
    * 9.1.0840: filetype: idris2 files are not recognized
    * 9.1.0839: filetype: leo files are not recognized
    * runtime(cook): include cook filetype plugin
    * runtime(debversions): Update Debian versions
    * patch 9.1.0838: vimtutor is bash-specific
    * runtime(doc): add help specific modeline to pi_tutor.txt
    * Filelist: vimtutor chapter 2 is missing in Filelist
    * 9.1.0837: cross-compiling has some issues
    * runtime(vimtutor): Add a second chapter

++++ vim:

  - 9.1.1101 is a fix for:
    bsc#1229685 (CVE-2024-43790)
    bsc#1229822 (CVE-2024-43802)
    bsc#1230078 (CVE-2024-45306)
    bsc#1235695 (CVE-2025-22134)
    bsc#1236151 (CVE-2025-24014)
    bsc#1237137 (CVE-2025-1215)
  - Remove obsoleted patch:
    * vim-7.3-mktemp_tutor.patch
  - update to 9.1.1101
    * insexpand.c hard to read
    * tests: Test_log_nonexistent only works on Linux
    * Update base-syntax, improve variable matching
    * Vim9: import with extends may crash
    * leaking memory with completing multi lines
    * --log with non-existent path causes a crash
    * if_perl: Perl 5.38 adds new symbols causing link failure
    * tests: matchparen plugin test wrongly named
    * Vim9: problem finding implemented method in type hierarchy
    * runtime(qf): Update syntax file, match second delimiter
    * tests: output of test ...win32_ctrl_z depends on python version
    * tests: fix expected return code for python 3.13 on Windows
    * tests: timeout might be a bit too small
    * tests: test_terminwscroll_topline2 unreliable
    * tests: No check when tests are run under Github actions
    * tests: plugin tests are named inconsistently
    * Vim9: import with extends may crash
    * completion doesn't work with multi lines
    * filetype: cmmt files are not recognized
    * Unable to persistently ignore events in a window and its buffers
    * improve syntax highlighting
    * setreg() doesn't correctly handle mbyte chars in blockwise mode
    * unexpected DCS responses may cause out of bounds reads
    * has('bsd') is true for GNU/Hurd
    * filetype: Mill files are not recognized
    * GUI late startup leads to uninitialized scrollbars
    * Add support for lz4 to tar & gzip plugin
    * Terminal ansi colors off by one after tgc reset
    * included syntax items do not understand contains=TOP
    * vim_strnchr() is strange and unnecessary
    * Vim9: len variable not used in compile_load()
    * runtime(vim): Update base-syntax, match :debuggreedy count prefix
    * Strange error when heredoc marker starts with "trim"
    * tests: test_compiler fails on Windows without Maven
    * 'diffopt' "linematch" cannot be used with {n} less than 10
    * args missing after failing to redefine a function
    * Cannot control cursor positioning of getchar()
    * preinsert text completions not deleted with <C-W>/<C-U>
    * getchar() can't distinguish between C-I and Tab
    * tests: Test_termwinscroll_topline2 fails on MacOS
    * heap-use-after-free and stack-use-after-scope with :14verbose
    * no digraph for "Approaches the limit"
    * not possible to use plural forms with gettext()
    * too many strlen() calls in userfunc.c
    * terminal: E315 when dragging the terminal with the mouse
    * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
    * runtime(doc): Tweak documentation style a bit
    * tests: test_glvs fails when unarchiver not available
    * Vim always enables 'termguicolors' in a terminal
    * completion: input text deleted with preinsert when adding leader
    * translation(sr): Missing Serbian translation for the tutor
    * Superfluous cleanup steps in test_ins_complete.vim
    * runtime(netrw): correct wrong version check
    * Vim doesn't highlight to be inserted text when completing
    * runtime(netrw): upstream snapshot of v176
    * runtime(dist/vim9): fix regressions in dist#vim9#Open
    * runtime(hyprlang): fix string recognition
    * make install fails because of a missing dependency
    * runtime(asm): add byte directives to syntax script
    * Vim doesn't work well with TERM=xterm-direct
    * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
    * runtime: decouple Open and Launch commands and gx mapping from netrw
    * "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
    * runtime(just): fix typo in syntax file
    * runtime(filetype): Improve Verilog detection by checking for modules definition
    * tests: off-by-one error in CheckCWD in test_debugger.vim
    * tests: no support for env variables when running Vim in terminal
    * too many strlen() calls in os_unix.c
    * insert-completed items are always sorted
    * crash after scrolling and pasting in silent Ex mode
    * Makefiles uses non-portable syntax
    * fuzzymatching doesn't prefer matching camelcase
    * filetype: N-Tripels and TriG files are not recognized
    * Vim9: Patch 9.1.1014 causes regressions
    * translation(sr): Update Serbian messages translation
  - updade to 9.1.1043
    * [security]: segfault in win_line()
    * update helptags
    * filetype: just files are not recognized
    * Update base-syntax, match ternary and falsy operators
    * Vim9: out-of-bound access when echoing an enum
    * Vim9: imported type cannot be used as func return type
    * runtime(kconfig): updated ftplugin and syntax script
    * runtime(doc): rename last t_BG reference to t_RB
    * Vim9: comments are outdated
    * tests: test_channel.py fails with IPv6
    * runtime(vim): Update base-syntax, fix is/isnot operator matching
    * Vim9: confusing error when using abstract method via super
    * make install fails when using shadowdir
    * Vim9: memory leak with blob2str()
    * runtime(tex): add texEmphStyle to texMatchGroup in syntax script
    * runtime(netrw): upstream snapshot of v175
    * Vim9: compiling abstract method fails without return
    * runtime(c): add new constexpr keyword to syntax file (C23)
    * tests: shaderslang was removed from test_filetype erroneously
    * link error when FEAT_SPELL not defined
    * Coverity complains about insecure data handling
    * runtime(sh): update syntax script
    * runtime(c): Add missing syntax test files
    * filetype: setting bash filetype is backwards incompatible
    * runtime(c): Update syntax and ftplugin files
    * the installer can be improved
    * too many strlen() calls in screen.c
    * no sanitize check when running linematch
    * filetype: swc configuration files are not recognized
    * runtime(netrw): change netrw maintainer
    * wrong return type of blob2str()
    * blob2str/str2blob() do not support list of strings
    * runtime(doc): fix typo in usr_02.txt
    * Coverity complains about dereferencing NULL pointer
    * linematch option value not completed
    * string might be used without a trailing NUL
    * no way to get current selected item in a async context
    * filetype: fd ignore files are not recognized
    * v9.1.0743 causes regression with diff mode
    * runtime(doc): fix base64 encode/decode examples
    * Vim9: Patch 9.1.1013 causes a few problems
    * Not possible to convert string2blob and blob2string
    * Coverity complains about dereferencing NULL value
    * Vim9: variable not found in transitive import
    * runtime(colors): Update colorschemes, include new unokai colorscheme
    * Vim9: Regression caused by patch v9.1.0646
    * runtime(lyrics): support milliseconds in syntax script
    * runtime(vim): Split Vim legacy and Vim9 script indent tests
    * Vim9: class interface inheritance not correctly working
    * popupmenu internal error with some abbr in completion item
    * filetype: VisualCode setting file not recognized
    * diff feature can be improved
    * tests: test for patch 9.1.1006 doesn't fail without the patch
    * filetype: various ignore are not recognized
    * tests: Load screendump files with "git vimdumps"
    * PmenuMatch completion highlight can be combined
    * completion text is highlighted even with no pattern found
    * tests: a few termdebug tests are flaky
    * [security]: heap-buffer-overflow with visual mode
    * runtime(doc): add package-<name> helptags for included packages
    * Vim9: unknown func error with interface declaring func var
    * runtime(filetype): don't detect string interpolation as angular
    * ComplMatchIns highlight hard to read on light background
    * runtime(vim): Update base-syntax, highlight literal string quote escape
    * runtime(editorconfig): set omnifunc to syntaxcomplete func
    * tests: ruby tests fail with Ruby 3.4
    * Vim9: leaking finished exception
    * runtime(tiasm):  use correct syntax name tiasm in syntax script
    * filetype: TI assembly files are not recognized
    * too many strlen() calls in drawscreen.c
    * runtime(xf86conf): add section name OutputClass to syntax script
    * ComplMatchIns may highlight wrong text
    * runtime(vim): Update base-syntax, improve ex-bang matching
    * runtime(doc): clarify buffer deletion on popup_close()
    * filetype: shaderslang files are not detected
    * Vim9: not able to use comment after opening curly brace
  - update to 9.1.0993
    * 9.1.0993: New 'cmdheight' behavior may be surprising
    * runtime(sh): fix typo in Last Change header
    * 9.1.0992: Vim9: double-free after v9.1.0988
    * 9.1.0991: v:stacktrace has wrong type in Vim9 script
    * runtime(sh): add PS0 to bashSpecialVariables in syntax script
    * runtime(vim): Remove trailing comma from match_words
    * runtime(zsh): sync syntax script with upstream repo
    * runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
    * 9.1.0990: Inconsistent behavior when changing cmdheight
    * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
    * runtime(java): Quietly opt out for unsupported markdown.vim versions
    * runtime(vim): fix failing vim syntax test
    * 9.1.0988: Vim9: no error when using uninitialized var in new()
    * runtime(doc): update index.txt
    * 9.1.0987: filetype: cake files are not recognized
    * 9.1.0986: filetype: 'jj' filetype is a bit imprecise
    * runtime(jj): Support diffs in jj syntax
    * runtime(vim): Update matchit pattern, no Vim9 short names
    * 9.1.0985: Vim9: some ex commands can be shortened
    * 9.1.0984: exception handling can be improved
    * runtime(doc): update doc for :horizontal
    * runtime(doc): update index.txt, windows.txt and version9.txt
    * runtime(doc): Tweak documentation about base64 function
    * runtime(chordpro): update syntax script
    * 9.1.0983: not able to get the displayed items in complete_info()
    * runtime(doc): use standard SGR format at :h xterm-true-color
    * 9.1.0982: TI linker files are not recognized
    * runtime(vim): update vim generator syntax script
    * 9.1.0981: tests: typo in test_filetype.vim
    * 9.1.0980: no support for base64 en-/decoding functions in Vim Script
    * syntax(sh): Improve the recognition of bracket expressions
    * runtime(doc): mention how NUL bytes are handled
    * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
    * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
    * 9.1.0977: filetype: msbuild filetypes are not recognized
    * 9.1.0976: Vim9: missing return statement with throw
    * 9.1.0975: Vim9: interpolated string expr not working in object methods
    * 9.1.0974: typo in change of commit v9.1.0873
    * 9.1.0973: too many strlen() calls in fileio.c
    * runtime(sh): set shellcheck as the compiler for supported shells
    * runtime(doc): Fix enum example syntax
    * 9.1.0972: filetype: TI linker map files are not recognized
    * runtime(vim): Improve syntax script generator for Vim Script
    * 9.1.0971: filetype: SLNX files are not recognized
    * 9.1.0970: VMS: build errors on VMS architecture
    * runtime(doc): Fix documentation typos
    * runtime(doc): update for new keyprotocol option value (after v9.1.0969)
    * 9.1.0969: ghostty not using kitty protocol by default
    * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
    * runtime(doc): update version9.txt for bash filetype
    * runtime(netrw): update last change header for #16265
    * runtime(doc): fix doc error in :r behaviour
    * 9.1.0967: SpotBugs compiler setup can be further improved
    * 9.1.0966: Vim9: :enum command can be shortened
    * runtime(compiler): include a basic bash syntax checker compiler
    * 9.1.0965: filetype: sh filetype set when detecting the use of bash
    * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
    * 9.1.0963: fuzzy-matching does not prefer full match
    * 9.1.0962: filetype: bun.lock file is not recognized
    * runtime(vim): update indentation plugin for Vim script
    * runtime(doc): tweak documentation style in helphelp.txt
    * runtime(vim): Update base-syntax, allow parens in default arguments
    * runtime(doc): mention auto-format using clang-format for sound.c/sign.c
    * runtime(help): fix typo s/additional/arbitrary/
    * runtime(help): Add better support for language annotation highlighting
    * 9.1.0961: filetype: TI gel files are not recognized
    * 9.1.0960: filetype: hy history files are not recognized
    * translation(fi): Fix typoes in Finish menu translation
    * 9.1.0959: Coverity complains about type conversion
    * runtime(vim): Use supported syntax in indent tests
    * 9.1.0958: filetype: supertux2 config files detected as lisp
    * 9.1.0956: completion may crash, completion highlight wrong with preview window
    * 9.1.0955: Vim9: vim9compile.c can be further improved
    * runtime(doc): move help tag E1182
    * runtime(graphql): contribute vim-graphql to Vim core
    * 9.1.0954: popupmenu.c can be improved
    * 9.1.0953: filetype: APKBUILD files not correctly detected
    * 9.1.0952: Vim9: missing type checking for any type assignment
    * 9.1.0951: filetype: jshell files are not recognized
    * runtime(dockerfile): do not set commentstring in syntax script
    * 9.1.0950: filetype: fennelrc files are not recognized
    * runtime(netrw): do not double escape Vim special characters
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): more reformating #16248
    * runtime(doc): Add a note about handling symbolic links in starting.txt
    * 9.1.0949: popups inconsistently shifted to the left
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): change indent size from 1 to 2
    * 9.1.0948: Missing cmdline completion for :pbuffer
    * runtime(tutor): Reformat tutor1
    * 9.1.0947: short-description
    * 9.1.0946: cross-compiling fails on osx-arm64
    * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
    * translation(sv): re-include the change from #16240
    * 9.1.0944: tests: test_registers fails when not run under X11
    * 9.1.0943: Vim9: vim9compile.c can be further improved
    * runtime(doc): Update README and mention make check to verify
    * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
    * runtime(vim): update base-syntax after v9.1.0936
    * 9.1.0942: a few typos were found
    * 9.1.0941: ComplMatchIns doesn't work after multibyte chars
    * runtime(doc): Fix style in fold.txt
    * translation(sv): Fix typo in Swedish translation
    * 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
    * runtime(doc): fix some small errors
    * 9.1.0939: make installtutor fails
    * 9.1.0938: exclusive selection not respected when re-selecting block mode
    * 9.1.0937: test_undolist() is flaky
    * 9.1.0936: cannot highlight completed text
    * 9.1.0935: SpotBugs compiler can be improved
    * 9.1.0934: hard to view an existing buffer in the preview window
    * runtime(doc): document how to minimize fold computation costs
    * 9.1.0933: Vim9: vim9compile.c can be further improved
    * 9.1.0932: new Italian tutor not installed
    * runtime(doc): fix a few minor errors from the last doc updates
    * translation(it): add Italian translation for the interactive tutor
    * runtime(doc): update the change.txt help file
    * runtime(help): Add Vim lang annotation support for codeblocks
    * 9.1.0931: ml_get error in terminal buffer
    * 9.1.0930: tests: test_terminal2 may hang in GUI mode
    * 9.1.0929: filetype: lalrpop files are not recognized
    * 9.1.0928: tests: test_popupwin fails because the filter command fails
    * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
    * 9.1.0927: style issues in insexpand.c
    * 9.1.0926: filetype: Pixi lock files are not recognized
    * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
    * runtime(doc): add a note about inclusive motions and exclusive selection
    * 9.1.0925: Vim9: expression compiled when not necessary
    * 9.1.0924: patch 9.1.0923 causes issues
    * 9.1.0923: too many strlen() calls in filepath.c
    * 9.1.0923: wrong MIN macro in popupmenu.c
    * 9.1.0921: popupmenu logic is a bit convoluted
    * 9.1.0920: Vim9: compile_assignment() too long
    * 9.1.0919: filetype: some assembler files are not recognized
    * runtime(netrw): do not pollute search history with symlinks
    * 9.1.0918: tiny Vim crashes with fuzzy buffer completion
    * 9.1.0917: various vartabstop and shiftround bugs when shifting lines
    * runtime(typst): add definition lists to formatlistpat, update maintainer
    * 9.1.0916: messages.c is exceeding 80 columns
    * runtime(proto): include filetype plugin for protobuf
    * 9.1.0915: GVim: default font size a bit too small
    * 9.1.0914: Vim9: compile_assignment() is too long
    * 9.1.0913: no error check for neg values for 'messagesopt'
    * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
    * 9.1.0912: xxd: integer overflow with sparse files and -autoskip
    * 9.1.0911: Variable name for 'messagesopt' doesn't match short name
    * 9.1.0910: 'messagesopt' does not check max wait time
    * runtime(doc): update wrong Vietnamese localization tag
    * 9.1.0909: Vim9: crash when calling instance method
  - update to 9.1.0908
    * refresh vim-7.3-mktemp_tutor.patch
    * 9.1.0908: not possible to configure :messages
    * 9.1.0907: printoptions:portrait does not change postscript Orientation
    * runtime(doc): Add vietnamese.txt to helps main TOC
    * 9.1.0906: filetype: Nvidia PTX files are not recognized
    * runtime(doc): updated version9.txt with changes from v9.1.0905
    * 9.1.0905: Missing information in CompleteDone event
    * 9.1.0904: Vim9: copy-paste error in class_defining_member()
    * 9.1.0903: potential overflow in spell_soundfold_wsal()
    * runtime(netrw): do not detach when launching external programs in gvim
    * runtime(doc): make tag alignment more consistent in filetype.txt
    * runtime(doc): fix wrong syntax and style of vietnamese.txt
    * translation(it): update Italian manpage for vimtutor
    * runtime(lua): add optional lua function folding
    * Filelist: include translations for Chapter 2 tutor
    * translation(vi): Update Vietnamese translation
    * runtime(doc): include vietnamese.txt
    * runtime(tutor): fix another typo in tutor2
    * runtime(doc): fix typo in vimtutor manpage
    * translation(it): update Italian manpage for vimtutor
    * translation(it): include Italian version of tutor chapter 2
    * runtime(tutor): regenerated some translated tutor1 files
    * runtime(tutor): fix typo in Chapter 2
    * 9.1.0902: filetype: Conda configuration files are not recognized
    * runtime(doc): Tweak documentation style a bit
    * runtime(tutor): update the tutor files and re-number the chapters
    * runtime(tutor): Update the makefiles for tutor1 and tutor2 files
    * 9.1.0901: MS-Windows: vimtutor batch script can be improved
    * runtime(doc): remove buffer-local completeopt todo item
    * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
    * runtime(typst): provide a formatlistpat in ftplugin
    * runtime(doc): Update documentation for "noselect" in 'completeopt'
    * 9.1.0899: default for 'backspace' can be set in C code
    * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
    * translation(ru): Updated messages translation
    * 9.1.0898: runtime(compiler): pytest compiler not included
    * 9.1.0897: filetype: pyrex files are not detected
    * runtime(compiler): update eslint compiler
    * 9.1.0896: completion list wrong after v9.1.0891
    * runtime(doc): document changed default value for 'history'
    * 9.1.0895: default history value is too small
    * 9.1.0894: No test for what the spotbug compiler parses
    * 9.1.0893: No test that undofile format does not regress
    * translation(de): update German manpages
    * runtime(compiler): include spotbugs Java linter
    * 9.1.0892: the max value of 'tabheight' is limited by other tabpages
    * runtime(po): remove poDiffOld/New, add po-format flags to syntax file
    * 9.1.0891: building the completion list array is inefficient
    * patch 9.1.0890: %! item not allowed for 'rulerformat'
    * runtime(gzip): load undofile if there exists one
    * 9.1.0889: Possible unnecessary redraw after adding/deleting lines
    * 9.1.0888: leftcol property not available in getwininfo()
    * 9.1.0887: Wrong expression in sign.c
    * 9.1.0886: filetype: debian control file not detected
    * runtime(c3): include c3 filetype plugin
    * 9.1.0885: style of sign.c can be improved
    * 9.1.0884: gcc warns about uninitialized variable
    * runtime(apache): Update syntax directives for apache server 2.4.62
    * translation(ru): updated vimtutor translation, update MAINTAINERS file
    * 9.1.0883: message history cleanup is missing some tests
    * runtime(doc): Expand docs on :! vs. :term
    * runtime(netrw): Fixing powershell execution issues on Windows
    * 9.1.0882: too many strlen() calls in insexpand.c
    * 9.1.0881: GUI: message dialog may not get focus
    * runtime(netrw): update netrw's decompress logic
    * runtime(apache): Update syntax keyword definition
    * runtime(misc): add Italian LICENSE and (top-level) README file
    * 9.1.0880: filetype: C3 files are not recognized
    * runtime(doc): add helptag for :HelpToc command
    * 9.1.0879: source is not consistently formatted
    * Add clang-format config file
    * runtime(compiler): fix escaping of arguments passed to :CompilerSet
    * 9.1.0878: termdebug: cannot enable DEBUG mode
    * 9.1.0877: tests: missing test for termdebug + decimal signs
    * 9.1.0876: filetype: openCL files are not recognized
    * 9.1.0875: filetype: hyprlang detection can be improved
    * 9.1.0874: filetype: karel files are not detected
    * 9.1.0873: filetype: Vivado files are not recognized
    * 9.1.0872: No test for W23 message
    * 9.1.0871: getcellpixels() can be further improved
    * 9.1.0870: too many strlen() calls in eval.c
    * 9.1.0869: Problem: curswant not set on gm in folded line
    * 9.1.0868: the warning about missing clipboard can be improved
    * runtime(doc): Makefile does not clean up all temporary files
    * 9.1.0867: ins_compl_add() has too many args
    * editorconfig: don't trim trailing whitespaces in runtime/doc
    * translation(am): Remove duplicate keys in desktop files
    * runtime(doc): update helptags
    * runtime(filetype): remove duplicated *.org file pattern
    * runtime(cfg): only consider leading // as starting a comment
    * 9.1.0866: filetype: LLVM IR files are not recognized
    * 9.1.0865: filetype: org files are not recognized
    * 9.1.0864: message history is fixed to 200
    * 9.1.0863: getcellpixels() can be further improved
    * runtime(sh): better function support for bash/zsh in indent script
    * runtime(netrw): small fixes to netrw#BrowseX
    * 9.1.0862: 'wildmenu' not enabled by default in nocp mode
    * runtime(doc): update how to report issues for mac Vim
    * runtime(doc): mention option-backslash at :h CompilerSet
    * runtime(compiler): include a Java Maven compiler plugin
    * runtime(racket): update Racket runtime files
    * runtime(doc): improve indentation in examples for netrw-handler
    * runtime(doc): improve examples for netrw-handler functions
    * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
    * runtime(doc): clarify the use of filters and external commands
    * 9.1.0861: Vim9: no runtime check for object member access of any var
    * runtime(compiler): update pylint linter
    * 9.1.0860: tests: mouse_shape tests use hard code sleep value
    * 9.1.0859: several problems with the GLVS plugin
    * 9.1.0858: Coverity complains about dead code
    * runtime(tar): Update tar.vim to support permissions
    * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
    * 9.1.0851: too many strlen() calls in getchar.c
    * 9.1.0850: Vim9: cannot access nested object inside objects
    * runtime(tex): extra Number highlighting causes issues
    * runtime(vim): Fix indent after :silent! function
    * 9.1.0849: there are a few typos in the source
    * runtime(netrw): directory symlink not resolved in tree view
    * runtime(doc): add a table of supported Operating Systems
    * runtime(tex): update Last Change header in syntax script
    * runtime(doc): fix typo in g:termdebug_config
    * runtime(vim): Update base-syntax, improve :normal highlighting
    * runtime(tex): add Number highlighting to syntax file
    * runtime(doc): Tweak documentation style a bit
    * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
    * runtime(dune): use :setl instead of :set in ftplugin
    * runtime(termdebug): allow to use decimal signs
    * translation(it): Updated Italian vimtutor
    * runtime(compiler): improve cppcheck
    * git: git-blame-ignore-revs shown as an error on Github
    * 9.1.0847: tests: test_popupwin fails because of updated help file
    * 9.1.0846: debug symbols for xxd are not cleaned in Makefile
    * runtime(structurizr): Update structurizr syntax
    * runtime(8th): updated 8th syntax
    * runtime(doc): Add pi_tutor.txt to help TOC
    * runtime(compiler): add mypy and ruff compiler; update pylint linter
    * runtime(netrw): fix several bugs in netrw tree listing
    * runtime(netrw): prevent polluting the search history
    * 9.1.0845: vimtutor shell script can be improved
    * 9.1.0844: if_python: no way to pass local vars to python
    * 9.1.0843: too many strlen() calls in undo.c
    * runtime(doc): update default value for fillchars option
    * runtime(compiler): fix typo in cppcheck compiler plugin
    * runtime(doc): simplify vimtutor manpage a bit more
    * runtime(matchparen): Add matchparen_disable_cursor_hl config option
    * 9.1.0842: not checking for the sync() systemcall
    * 9.1.0841: tests: still preferring python2 over python3
    * 9.1.0840: filetype: idris2 files are not recognized
    * 9.1.0839: filetype: leo files are not recognized
    * runtime(cook): include cook filetype plugin
    * runtime(debversions): Update Debian versions
    * patch 9.1.0838: vimtutor is bash-specific
    * runtime(doc): add help specific modeline to pi_tutor.txt
    * Filelist: vimtutor chapter 2 is missing in Filelist
    * 9.1.0837: cross-compiling has some issues
    * runtime(vimtutor): Add a second chapter

++++ vim:

  - 9.1.1101 is a fix for:
    bsc#1229685 (CVE-2024-43790)
    bsc#1229822 (CVE-2024-43802)
    bsc#1230078 (CVE-2024-45306)
    bsc#1235695 (CVE-2025-22134)
    bsc#1236151 (CVE-2025-24014)
    bsc#1237137 (CVE-2025-1215)
  - Remove obsoleted patch:
    * vim-7.3-mktemp_tutor.patch
  - update to 9.1.1101
    * insexpand.c hard to read
    * tests: Test_log_nonexistent only works on Linux
    * Update base-syntax, improve variable matching
    * Vim9: import with extends may crash
    * leaking memory with completing multi lines
    * --log with non-existent path causes a crash
    * if_perl: Perl 5.38 adds new symbols causing link failure
    * tests: matchparen plugin test wrongly named
    * Vim9: problem finding implemented method in type hierarchy
    * runtime(qf): Update syntax file, match second delimiter
    * tests: output of test ...win32_ctrl_z depends on python version
    * tests: fix expected return code for python 3.13 on Windows
    * tests: timeout might be a bit too small
    * tests: test_terminwscroll_topline2 unreliable
    * tests: No check when tests are run under Github actions
    * tests: plugin tests are named inconsistently
    * Vim9: import with extends may crash
    * completion doesn't work with multi lines
    * filetype: cmmt files are not recognized
    * Unable to persistently ignore events in a window and its buffers
    * improve syntax highlighting
    * setreg() doesn't correctly handle mbyte chars in blockwise mode
    * unexpected DCS responses may cause out of bounds reads
    * has('bsd') is true for GNU/Hurd
    * filetype: Mill files are not recognized
    * GUI late startup leads to uninitialized scrollbars
    * Add support for lz4 to tar & gzip plugin
    * Terminal ansi colors off by one after tgc reset
    * included syntax items do not understand contains=TOP
    * vim_strnchr() is strange and unnecessary
    * Vim9: len variable not used in compile_load()
    * runtime(vim): Update base-syntax, match :debuggreedy count prefix
    * Strange error when heredoc marker starts with "trim"
    * tests: test_compiler fails on Windows without Maven
    * 'diffopt' "linematch" cannot be used with {n} less than 10
    * args missing after failing to redefine a function
    * Cannot control cursor positioning of getchar()
    * preinsert text completions not deleted with <C-W>/<C-U>
    * getchar() can't distinguish between C-I and Tab
    * tests: Test_termwinscroll_topline2 fails on MacOS
    * heap-use-after-free and stack-use-after-scope with :14verbose
    * no digraph for "Approaches the limit"
    * not possible to use plural forms with gettext()
    * too many strlen() calls in userfunc.c
    * terminal: E315 when dragging the terminal with the mouse
    * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
    * runtime(doc): Tweak documentation style a bit
    * tests: test_glvs fails when unarchiver not available
    * Vim always enables 'termguicolors' in a terminal
    * completion: input text deleted with preinsert when adding leader
    * translation(sr): Missing Serbian translation for the tutor
    * Superfluous cleanup steps in test_ins_complete.vim
    * runtime(netrw): correct wrong version check
    * Vim doesn't highlight to be inserted text when completing
    * runtime(netrw): upstream snapshot of v176
    * runtime(dist/vim9): fix regressions in dist#vim9#Open
    * runtime(hyprlang): fix string recognition
    * make install fails because of a missing dependency
    * runtime(asm): add byte directives to syntax script
    * Vim doesn't work well with TERM=xterm-direct
    * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
    * runtime: decouple Open and Launch commands and gx mapping from netrw
    * "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
    * runtime(just): fix typo in syntax file
    * runtime(filetype): Improve Verilog detection by checking for modules definition
    * tests: off-by-one error in CheckCWD in test_debugger.vim
    * tests: no support for env variables when running Vim in terminal
    * too many strlen() calls in os_unix.c
    * insert-completed items are always sorted
    * crash after scrolling and pasting in silent Ex mode
    * Makefiles uses non-portable syntax
    * fuzzymatching doesn't prefer matching camelcase
    * filetype: N-Tripels and TriG files are not recognized
    * Vim9: Patch 9.1.1014 causes regressions
    * translation(sr): Update Serbian messages translation
  - updade to 9.1.1043
    * [security]: segfault in win_line()
    * update helptags
    * filetype: just files are not recognized
    * Update base-syntax, match ternary and falsy operators
    * Vim9: out-of-bound access when echoing an enum
    * Vim9: imported type cannot be used as func return type
    * runtime(kconfig): updated ftplugin and syntax script
    * runtime(doc): rename last t_BG reference to t_RB
    * Vim9: comments are outdated
    * tests: test_channel.py fails with IPv6
    * runtime(vim): Update base-syntax, fix is/isnot operator matching
    * Vim9: confusing error when using abstract method via super
    * make install fails when using shadowdir
    * Vim9: memory leak with blob2str()
    * runtime(tex): add texEmphStyle to texMatchGroup in syntax script
    * runtime(netrw): upstream snapshot of v175
    * Vim9: compiling abstract method fails without return
    * runtime(c): add new constexpr keyword to syntax file (C23)
    * tests: shaderslang was removed from test_filetype erroneously
    * link error when FEAT_SPELL not defined
    * Coverity complains about insecure data handling
    * runtime(sh): update syntax script
    * runtime(c): Add missing syntax test files
    * filetype: setting bash filetype is backwards incompatible
    * runtime(c): Update syntax and ftplugin files
    * the installer can be improved
    * too many strlen() calls in screen.c
    * no sanitize check when running linematch
    * filetype: swc configuration files are not recognized
    * runtime(netrw): change netrw maintainer
    * wrong return type of blob2str()
    * blob2str/str2blob() do not support list of strings
    * runtime(doc): fix typo in usr_02.txt
    * Coverity complains about dereferencing NULL pointer
    * linematch option value not completed
    * string might be used without a trailing NUL
    * no way to get current selected item in a async context
    * filetype: fd ignore files are not recognized
    * v9.1.0743 causes regression with diff mode
    * runtime(doc): fix base64 encode/decode examples
    * Vim9: Patch 9.1.1013 causes a few problems
    * Not possible to convert string2blob and blob2string
    * Coverity complains about dereferencing NULL value
    * Vim9: variable not found in transitive import
    * runtime(colors): Update colorschemes, include new unokai colorscheme
    * Vim9: Regression caused by patch v9.1.0646
    * runtime(lyrics): support milliseconds in syntax script
    * runtime(vim): Split Vim legacy and Vim9 script indent tests
    * Vim9: class interface inheritance not correctly working
    * popupmenu internal error with some abbr in completion item
    * filetype: VisualCode setting file not recognized
    * diff feature can be improved
    * tests: test for patch 9.1.1006 doesn't fail without the patch
    * filetype: various ignore are not recognized
    * tests: Load screendump files with "git vimdumps"
    * PmenuMatch completion highlight can be combined
    * completion text is highlighted even with no pattern found
    * tests: a few termdebug tests are flaky
    * [security]: heap-buffer-overflow with visual mode
    * runtime(doc): add package-<name> helptags for included packages
    * Vim9: unknown func error with interface declaring func var
    * runtime(filetype): don't detect string interpolation as angular
    * ComplMatchIns highlight hard to read on light background
    * runtime(vim): Update base-syntax, highlight literal string quote escape
    * runtime(editorconfig): set omnifunc to syntaxcomplete func
    * tests: ruby tests fail with Ruby 3.4
    * Vim9: leaking finished exception
    * runtime(tiasm):  use correct syntax name tiasm in syntax script
    * filetype: TI assembly files are not recognized
    * too many strlen() calls in drawscreen.c
    * runtime(xf86conf): add section name OutputClass to syntax script
    * ComplMatchIns may highlight wrong text
    * runtime(vim): Update base-syntax, improve ex-bang matching
    * runtime(doc): clarify buffer deletion on popup_close()
    * filetype: shaderslang files are not detected
    * Vim9: not able to use comment after opening curly brace
  - update to 9.1.0993
    * 9.1.0993: New 'cmdheight' behavior may be surprising
    * runtime(sh): fix typo in Last Change header
    * 9.1.0992: Vim9: double-free after v9.1.0988
    * 9.1.0991: v:stacktrace has wrong type in Vim9 script
    * runtime(sh): add PS0 to bashSpecialVariables in syntax script
    * runtime(vim): Remove trailing comma from match_words
    * runtime(zsh): sync syntax script with upstream repo
    * runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
    * 9.1.0990: Inconsistent behavior when changing cmdheight
    * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
    * runtime(java): Quietly opt out for unsupported markdown.vim versions
    * runtime(vim): fix failing vim syntax test
    * 9.1.0988: Vim9: no error when using uninitialized var in new()
    * runtime(doc): update index.txt
    * 9.1.0987: filetype: cake files are not recognized
    * 9.1.0986: filetype: 'jj' filetype is a bit imprecise
    * runtime(jj): Support diffs in jj syntax
    * runtime(vim): Update matchit pattern, no Vim9 short names
    * 9.1.0985: Vim9: some ex commands can be shortened
    * 9.1.0984: exception handling can be improved
    * runtime(doc): update doc for :horizontal
    * runtime(doc): update index.txt, windows.txt and version9.txt
    * runtime(doc): Tweak documentation about base64 function
    * runtime(chordpro): update syntax script
    * 9.1.0983: not able to get the displayed items in complete_info()
    * runtime(doc): use standard SGR format at :h xterm-true-color
    * 9.1.0982: TI linker files are not recognized
    * runtime(vim): update vim generator syntax script
    * 9.1.0981: tests: typo in test_filetype.vim
    * 9.1.0980: no support for base64 en-/decoding functions in Vim Script
    * syntax(sh): Improve the recognition of bracket expressions
    * runtime(doc): mention how NUL bytes are handled
    * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
    * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
    * 9.1.0977: filetype: msbuild filetypes are not recognized
    * 9.1.0976: Vim9: missing return statement with throw
    * 9.1.0975: Vim9: interpolated string expr not working in object methods
    * 9.1.0974: typo in change of commit v9.1.0873
    * 9.1.0973: too many strlen() calls in fileio.c
    * runtime(sh): set shellcheck as the compiler for supported shells
    * runtime(doc): Fix enum example syntax
    * 9.1.0972: filetype: TI linker map files are not recognized
    * runtime(vim): Improve syntax script generator for Vim Script
    * 9.1.0971: filetype: SLNX files are not recognized
    * 9.1.0970: VMS: build errors on VMS architecture
    * runtime(doc): Fix documentation typos
    * runtime(doc): update for new keyprotocol option value (after v9.1.0969)
    * 9.1.0969: ghostty not using kitty protocol by default
    * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
    * runtime(doc): update version9.txt for bash filetype
    * runtime(netrw): update last change header for #16265
    * runtime(doc): fix doc error in :r behaviour
    * 9.1.0967: SpotBugs compiler setup can be further improved
    * 9.1.0966: Vim9: :enum command can be shortened
    * runtime(compiler): include a basic bash syntax checker compiler
    * 9.1.0965: filetype: sh filetype set when detecting the use of bash
    * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
    * 9.1.0963: fuzzy-matching does not prefer full match
    * 9.1.0962: filetype: bun.lock file is not recognized
    * runtime(vim): update indentation plugin for Vim script
    * runtime(doc): tweak documentation style in helphelp.txt
    * runtime(vim): Update base-syntax, allow parens in default arguments
    * runtime(doc): mention auto-format using clang-format for sound.c/sign.c
    * runtime(help): fix typo s/additional/arbitrary/
    * runtime(help): Add better support for language annotation highlighting
    * 9.1.0961: filetype: TI gel files are not recognized
    * 9.1.0960: filetype: hy history files are not recognized
    * translation(fi): Fix typoes in Finish menu translation
    * 9.1.0959: Coverity complains about type conversion
    * runtime(vim): Use supported syntax in indent tests
    * 9.1.0958: filetype: supertux2 config files detected as lisp
    * 9.1.0956: completion may crash, completion highlight wrong with preview window
    * 9.1.0955: Vim9: vim9compile.c can be further improved
    * runtime(doc): move help tag E1182
    * runtime(graphql): contribute vim-graphql to Vim core
    * 9.1.0954: popupmenu.c can be improved
    * 9.1.0953: filetype: APKBUILD files not correctly detected
    * 9.1.0952: Vim9: missing type checking for any type assignment
    * 9.1.0951: filetype: jshell files are not recognized
    * runtime(dockerfile): do not set commentstring in syntax script
    * 9.1.0950: filetype: fennelrc files are not recognized
    * runtime(netrw): do not double escape Vim special characters
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): more reformating #16248
    * runtime(doc): Add a note about handling symbolic links in starting.txt
    * 9.1.0949: popups inconsistently shifted to the left
    * git: ignore reformatting change of netrw plugin
    * runtime(netrw): change indent size from 1 to 2
    * 9.1.0948: Missing cmdline completion for :pbuffer
    * runtime(tutor): Reformat tutor1
    * 9.1.0947: short-description
    * 9.1.0946: cross-compiling fails on osx-arm64
    * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
    * translation(sv): re-include the change from #16240
    * 9.1.0944: tests: test_registers fails when not run under X11
    * 9.1.0943: Vim9: vim9compile.c can be further improved
    * runtime(doc): Update README and mention make check to verify
    * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
    * runtime(vim): update base-syntax after v9.1.0936
    * 9.1.0942: a few typos were found
    * 9.1.0941: ComplMatchIns doesn't work after multibyte chars
    * runtime(doc): Fix style in fold.txt
    * translation(sv): Fix typo in Swedish translation
    * 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
    * runtime(doc): fix some small errors
    * 9.1.0939: make installtutor fails
    * 9.1.0938: exclusive selection not respected when re-selecting block mode
    * 9.1.0937: test_undolist() is flaky
    * 9.1.0936: cannot highlight completed text
    * 9.1.0935: SpotBugs compiler can be improved
    * 9.1.0934: hard to view an existing buffer in the preview window
    * runtime(doc): document how to minimize fold computation costs
    * 9.1.0933: Vim9: vim9compile.c can be further improved
    * 9.1.0932: new Italian tutor not installed
    * runtime(doc): fix a few minor errors from the last doc updates
    * translation(it): add Italian translation for the interactive tutor
    * runtime(doc): update the change.txt help file
    * runtime(help): Add Vim lang annotation support for codeblocks
    * 9.1.0931: ml_get error in terminal buffer
    * 9.1.0930: tests: test_terminal2 may hang in GUI mode
    * 9.1.0929: filetype: lalrpop files are not recognized
    * 9.1.0928: tests: test_popupwin fails because the filter command fails
    * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
    * 9.1.0927: style issues in insexpand.c
    * 9.1.0926: filetype: Pixi lock files are not recognized
    * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
    * runtime(doc): add a note about inclusive motions and exclusive selection
    * 9.1.0925: Vim9: expression compiled when not necessary
    * 9.1.0924: patch 9.1.0923 causes issues
    * 9.1.0923: too many strlen() calls in filepath.c
    * 9.1.0923: wrong MIN macro in popupmenu.c
    * 9.1.0921: popupmenu logic is a bit convoluted
    * 9.1.0920: Vim9: compile_assignment() too long
    * 9.1.0919: filetype: some assembler files are not recognized
    * runtime(netrw): do not pollute search history with symlinks
    * 9.1.0918: tiny Vim crashes with fuzzy buffer completion
    * 9.1.0917: various vartabstop and shiftround bugs when shifting lines
    * runtime(typst): add definition lists to formatlistpat, update maintainer
    * 9.1.0916: messages.c is exceeding 80 columns
    * runtime(proto): include filetype plugin for protobuf
    * 9.1.0915: GVim: default font size a bit too small
    * 9.1.0914: Vim9: compile_assignment() is too long
    * 9.1.0913: no error check for neg values for 'messagesopt'
    * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
    * 9.1.0912: xxd: integer overflow with sparse files and -autoskip
    * 9.1.0911: Variable name for 'messagesopt' doesn't match short name
    * 9.1.0910: 'messagesopt' does not check max wait time
    * runtime(doc): update wrong Vietnamese localization tag
    * 9.1.0909: Vim9: crash when calling instance method
  - update to 9.1.0908
    * refresh vim-7.3-mktemp_tutor.patch
    * 9.1.0908: not possible to configure :messages
    * 9.1.0907: printoptions:portrait does not change postscript Orientation
    * runtime(doc): Add vietnamese.txt to helps main TOC
    * 9.1.0906: filetype: Nvidia PTX files are not recognized
    * runtime(doc): updated version9.txt with changes from v9.1.0905
    * 9.1.0905: Missing information in CompleteDone event
    * 9.1.0904: Vim9: copy-paste error in class_defining_member()
    * 9.1.0903: potential overflow in spell_soundfold_wsal()
    * runtime(netrw): do not detach when launching external programs in gvim
    * runtime(doc): make tag alignment more consistent in filetype.txt
    * runtime(doc): fix wrong syntax and style of vietnamese.txt
    * translation(it): update Italian manpage for vimtutor
    * runtime(lua): add optional lua function folding
    * Filelist: include translations for Chapter 2 tutor
    * translation(vi): Update Vietnamese translation
    * runtime(doc): include vietnamese.txt
    * runtime(tutor): fix another typo in tutor2
    * runtime(doc): fix typo in vimtutor manpage
    * translation(it): update Italian manpage for vimtutor
    * translation(it): include Italian version of tutor chapter 2
    * runtime(tutor): regenerated some translated tutor1 files
    * runtime(tutor): fix typo in Chapter 2
    * 9.1.0902: filetype: Conda configuration files are not recognized
    * runtime(doc): Tweak documentation style a bit
    * runtime(tutor): update the tutor files and re-number the chapters
    * runtime(tutor): Update the makefiles for tutor1 and tutor2 files
    * 9.1.0901: MS-Windows: vimtutor batch script can be improved
    * runtime(doc): remove buffer-local completeopt todo item
    * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
    * runtime(typst): provide a formatlistpat in ftplugin
    * runtime(doc): Update documentation for "noselect" in 'completeopt'
    * 9.1.0899: default for 'backspace' can be set in C code
    * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
    * translation(ru): Updated messages translation
    * 9.1.0898: runtime(compiler): pytest compiler not included
    * 9.1.0897: filetype: pyrex files are not detected
    * runtime(compiler): update eslint compiler
    * 9.1.0896: completion list wrong after v9.1.0891
    * runtime(doc): document changed default value for 'history'
    * 9.1.0895: default history value is too small
    * 9.1.0894: No test for what the spotbug compiler parses
    * 9.1.0893: No test that undofile format does not regress
    * translation(de): update German manpages
    * runtime(compiler): include spotbugs Java linter
    * 9.1.0892: the max value of 'tabheight' is limited by other tabpages
    * runtime(po): remove poDiffOld/New, add po-format flags to syntax file
    * 9.1.0891: building the completion list array is inefficient
    * patch 9.1.0890: %! item not allowed for 'rulerformat'
    * runtime(gzip): load undofile if there exists one
    * 9.1.0889: Possible unnecessary redraw after adding/deleting lines
    * 9.1.0888: leftcol property not available in getwininfo()
    * 9.1.0887: Wrong expression in sign.c
    * 9.1.0886: filetype: debian control file not detected
    * runtime(c3): include c3 filetype plugin
    * 9.1.0885: style of sign.c can be improved
    * 9.1.0884: gcc warns about uninitialized variable
    * runtime(apache): Update syntax directives for apache server 2.4.62
    * translation(ru): updated vimtutor translation, update MAINTAINERS file
    * 9.1.0883: message history cleanup is missing some tests
    * runtime(doc): Expand docs on :! vs. :term
    * runtime(netrw): Fixing powershell execution issues on Windows
    * 9.1.0882: too many strlen() calls in insexpand.c
    * 9.1.0881: GUI: message dialog may not get focus
    * runtime(netrw): update netrw's decompress logic
    * runtime(apache): Update syntax keyword definition
    * runtime(misc): add Italian LICENSE and (top-level) README file
    * 9.1.0880: filetype: C3 files are not recognized
    * runtime(doc): add helptag for :HelpToc command
    * 9.1.0879: source is not consistently formatted
    * Add clang-format config file
    * runtime(compiler): fix escaping of arguments passed to :CompilerSet
    * 9.1.0878: termdebug: cannot enable DEBUG mode
    * 9.1.0877: tests: missing test for termdebug + decimal signs
    * 9.1.0876: filetype: openCL files are not recognized
    * 9.1.0875: filetype: hyprlang detection can be improved
    * 9.1.0874: filetype: karel files are not detected
    * 9.1.0873: filetype: Vivado files are not recognized
    * 9.1.0872: No test for W23 message
    * 9.1.0871: getcellpixels() can be further improved
    * 9.1.0870: too many strlen() calls in eval.c
    * 9.1.0869: Problem: curswant not set on gm in folded line
    * 9.1.0868: the warning about missing clipboard can be improved
    * runtime(doc): Makefile does not clean up all temporary files
    * 9.1.0867: ins_compl_add() has too many args
    * editorconfig: don't trim trailing whitespaces in runtime/doc
    * translation(am): Remove duplicate keys in desktop files
    * runtime(doc): update helptags
    * runtime(filetype): remove duplicated *.org file pattern
    * runtime(cfg): only consider leading // as starting a comment
    * 9.1.0866: filetype: LLVM IR files are not recognized
    * 9.1.0865: filetype: org files are not recognized
    * 9.1.0864: message history is fixed to 200
    * 9.1.0863: getcellpixels() can be further improved
    * runtime(sh): better function support for bash/zsh in indent script
    * runtime(netrw): small fixes to netrw#BrowseX
    * 9.1.0862: 'wildmenu' not enabled by default in nocp mode
    * runtime(doc): update how to report issues for mac Vim
    * runtime(doc): mention option-backslash at :h CompilerSet
    * runtime(compiler): include a Java Maven compiler plugin
    * runtime(racket): update Racket runtime files
    * runtime(doc): improve indentation in examples for netrw-handler
    * runtime(doc): improve examples for netrw-handler functions
    * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
    * runtime(doc): clarify the use of filters and external commands
    * 9.1.0861: Vim9: no runtime check for object member access of any var
    * runtime(compiler): update pylint linter
    * 9.1.0860: tests: mouse_shape tests use hard code sleep value
    * 9.1.0859: several problems with the GLVS plugin
    * 9.1.0858: Coverity complains about dead code
    * runtime(tar): Update tar.vim to support permissions
    * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
    * 9.1.0851: too many strlen() calls in getchar.c
    * 9.1.0850: Vim9: cannot access nested object inside objects
    * runtime(tex): extra Number highlighting causes issues
    * runtime(vim): Fix indent after :silent! function
    * 9.1.0849: there are a few typos in the source
    * runtime(netrw): directory symlink not resolved in tree view
    * runtime(doc): add a table of supported Operating Systems
    * runtime(tex): update Last Change header in syntax script
    * runtime(doc): fix typo in g:termdebug_config
    * runtime(vim): Update base-syntax, improve :normal highlighting
    * runtime(tex): add Number highlighting to syntax file
    * runtime(doc): Tweak documentation style a bit
    * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
    * runtime(dune): use :setl instead of :set in ftplugin
    * runtime(termdebug): allow to use decimal signs
    * translation(it): Updated Italian vimtutor
    * runtime(compiler): improve cppcheck
    * git: git-blame-ignore-revs shown as an error on Github
    * 9.1.0847: tests: test_popupwin fails because of updated help file
    * 9.1.0846: debug symbols for xxd are not cleaned in Makefile
    * runtime(structurizr): Update structurizr syntax
    * runtime(8th): updated 8th syntax
    * runtime(doc): Add pi_tutor.txt to help TOC
    * runtime(compiler): add mypy and ruff compiler; update pylint linter
    * runtime(netrw): fix several bugs in netrw tree listing
    * runtime(netrw): prevent polluting the search history
    * 9.1.0845: vimtutor shell script can be improved
    * 9.1.0844: if_python: no way to pass local vars to python
    * 9.1.0843: too many strlen() calls in undo.c
    * runtime(doc): update default value for fillchars option
    * runtime(compiler): fix typo in cppcheck compiler plugin
    * runtime(doc): simplify vimtutor manpage a bit more
    * runtime(matchparen): Add matchparen_disable_cursor_hl config option
    * 9.1.0842: not checking for the sync() systemcall
    * 9.1.0841: tests: still preferring python2 over python3
    * 9.1.0840: filetype: idris2 files are not recognized
    * 9.1.0839: filetype: leo files are not recognized
    * runtime(cook): include cook filetype plugin
    * runtime(debversions): Update Debian versions
    * patch 9.1.0838: vimtutor is bash-specific
    * runtime(doc): add help specific modeline to pi_tutor.txt
    * Filelist: vimtutor chapter 2 is missing in Filelist
    * 9.1.0837: cross-compiling has some issues
    * runtime(vimtutor): Add a second chapter

------------------------------------------------------------------
------------------  2025-2-18  -  Feb 18 2025  -------------------
------------------------------------------------------------------

++++ sqlite3:

  - Update to release 3.49.1:
    * Improve portability of makefiles and configure scripts.
    * CVE-2025-29087, bsc#1241020: Fix a bug in the concat_ws()
    function, introduced in version 3.44.0, that could lead to a
    memory error if the separator string is very large (hundreds
    of megabytes).
    * CVE-2025-29088, bsc#1241078: Enhanced the
    SQLITE_DBCONFIG_LOOKASIDE interface to make it  more robust
    against misuse.

++++ sqlite3:

  - Update to release 3.49.1:
    * Improve portability of makefiles and configure scripts.
    * CVE-2025-29087, CVE-2025-3277, bsc#1241020:
    Fix a bug in the concat_ws() function, introduced in version
    3.44.0, that could lead to a memory error if the separator
    string is very large (hundreds of megabytes).
    * CVE-2025-29088, bsc#1241078: Enhanced the
    SQLITE_DBCONFIG_LOOKASIDE interface to make it  more robust
    against misuse.

++++ sqlite3:

  - Update to release 3.49.1:
    * Improve portability of makefiles and configure scripts.
    * CVE-2025-29087, CVE-2025-3277, bsc#1241020:
    Fix a bug in the concat_ws() function, introduced in version
    3.44.0, that could lead to a memory error if the separator
    string is very large (hundreds of megabytes).
    * CVE-2025-29088, bsc#1241078: Enhanced the
    SQLITE_DBCONFIG_LOOKASIDE interface to make it  more robust
    against misuse.

++++ sqlite3:

  - Update to release 3.49.1:
    * Improve portability of makefiles and configure scripts.
    * CVE-2025-29087, CVE-2025-3277, bsc#1241020:
    Fix a bug in the concat_ws() function, introduced in version
    3.44.0, that could lead to a memory error if the separator
    string is very large (hundreds of megabytes).
    * CVE-2025-29088, bsc#1241078: Enhanced the
    SQLITE_DBCONFIG_LOOKASIDE interface to make it  more robust
    against misuse.

++++ openssh:

  - Fix ssh client segfault with GSSAPIKeyExchange=yes in ssh_kex2
    due to gssapi proposal not being correctly initialized
    (bsc#1236826). The problem was introduced in the rebase of
    the patch for 9.6p1:
    * openssh-8.0p1-gssapi-keyex.patch
  - From Wed Jul  3 16:53:53 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Add #include <stdlib.h> in some files added by the ldap patch to
    fix build with gcc14 (boo#1225904).
    * openssh-7.7p1-ldap.patch
  - From Mon Apr 15 13:21:50 UTC 2024 - Marcus Meissner <meissner@suse.com>
  - openssh-8.0p1-gssapi-keyex.patch: Added missing struct initializer,
    added missing parameter (bsc#1222840)
  - From Tue Apr  2 13:07:43 UTC 2024 - Martin Sirringhaus <martin.sirringhaus@suse.com>
  - Rebase openssh-7.7p1-fips.patch (bsc#1221928)
    Remove OPENSSL_HAVE_EVPGCM-ifdef, which is no longer supported by
    upstream
  - From Tue Apr  2 11:23:05 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Use %config(noreplace) for sshd_config . In any case, it's
    recommended to drop a file in sshd_config.d instead of editing
    sshd_config (bsc#1221063)

++++ openssh:

  - Fix ssh client segfault with GSSAPIKeyExchange=yes in ssh_kex2
    due to gssapi proposal not being correctly initialized
    (bsc#1236826). The problem was introduced in the rebase of
    the patch for 9.6p1:
    * openssh-8.0p1-gssapi-keyex.patch
  - From Wed Jul  3 16:53:53 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Add #include <stdlib.h> in some files added by the ldap patch to
    fix build with gcc14 (boo#1225904).
    * openssh-7.7p1-ldap.patch
  - From Mon Apr 15 13:21:50 UTC 2024 - Marcus Meissner <meissner@suse.com>
  - openssh-8.0p1-gssapi-keyex.patch: Added missing struct initializer,
    added missing parameter (bsc#1222840)
  - From Tue Apr  2 13:07:43 UTC 2024 - Martin Sirringhaus <martin.sirringhaus@suse.com>
  - Rebase openssh-7.7p1-fips.patch (bsc#1221928)
    Remove OPENSSL_HAVE_EVPGCM-ifdef, which is no longer supported by
    upstream
  - From Tue Apr  2 11:23:05 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Use %config(noreplace) for sshd_config . In any case, it's
    recommended to drop a file in sshd_config.d instead of editing
    sshd_config (bsc#1221063)

++++ python-M2Crypto:

  - Fix spelling of BSD-2-Clause license.
  - Add rpmlintrc … overflow of ignorable rpmlint warnings caused
    me not to see the previous problem.

------------------------------------------------------------------
------------------  2025-2-17  -  Feb 17 2025  -------------------
------------------------------------------------------------------

++++ python-M2Crypto:

  - Update to 0.44.0:
  - fix(rsa): introduce internal cache for rsa.check_key()
    (bsc#1236664, srht#mcepl/m2crypto#369)
  - fix[authcookie]: modernize the module
  - fix(_lib): add missing #include for windows
  - ci: relax fedora crypto policy to legacy.
  - enhance setup.py for macos compatibility
  - prefer packaging.version over distutils.version
  - fix segfault with openssl 3.4.0
  - fix[ec]: raise ioerror instead when load_key_bio() cannot read
    the file.
  - doc: update installation instructions for windows.
  - fix setting x509.verify_* variables
  - fix building against openssl in non-standard location
  - test_x509: use only x509_version_1 (0) as version for csr.

------------------------------------------------------------------
------------------  2025-2-16  -  Feb 16 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.10 → 10.2.11
  - Update box plugin documentation
    Add chapter about new container build feature. The
    box plugin can now also run the build in containers

++++ python-kiwi:

  - Bump version: 10.2.10 → 10.2.11
  - Update box plugin documentation
    Add chapter about new container build feature. The
    box plugin can now also run the build in containers

++++ python-kiwi:

  - Bump version: 10.2.10 → 10.2.11
  - Update box plugin documentation
    Add chapter about new container build feature. The
    box plugin can now also run the build in containers

------------------------------------------------------------------
------------------  2025-2-14  -  Feb 14 2025  -------------------
------------------------------------------------------------------

++++ gnutls:

  - Security fix [bsc#1236974, CVE-2024-12243]
    * gnutls: inefficient DER Decoding in libtasn1 could lead to remote DoS
    * Add gnutls-CVE-2024-12243.patch

++++ gnutls:

  - Security fix [bsc#1236974, CVE-2024-12243]
    * gnutls: inefficient DER Decoding in libtasn1 could lead to remote DoS
    * Add gnutls-CVE-2024-12243.patch

++++ gnutls:

  - Security fix [bsc#1236974, CVE-2024-12243]
    * gnutls: inefficient DER Decoding in libtasn1 could lead to remote DoS
    * Add gnutls-CVE-2024-12243.patch

++++ gnutls:

  - Security fix [bsc#1236974, CVE-2024-12243]
    * gnutls: inefficient DER Decoding in libtasn1 could lead to remote DoS
    * Add gnutls-CVE-2024-12243.patch

++++ grub2:

  - Security fixes for 2024
    * 0001-misc-Implement-grub_strlcpy.patch
  - Fix CVE-2024-45781 (bsc#1233617)
    * 0002-fs-ufs-Fix-a-heap-OOB-write.patch
  - Fix CVE-2024-56737 (bsc#1234958)
  - Fix CVE-2024-45782 (bsc#1233615)
    * 0003-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch
  - Fix CVE-2024-45780 (bsc#1233614)
    * 0004-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch
  - Fix CVE-2024-45783 (bsc#1233616)
    * 0005-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch
    * 0006-kern-file-Ensure-file-data-is-set.patch
    * 0007-kern-file-Implement-filesystem-reference-counting.patch
  - Fix CVE-2025-0624 (bsc#1236316)
    * 0008-net-Fix-OOB-write-in-grub_net_search_config_file.patch
  - Fix CVE-2024-45774 (bsc#1233609)
    * 0009-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch
  - Fix CVE-2024-45775 (bsc#1233610)
    * 0010-commands-extcmd-Missing-check-for-failed-allocation.patch
  - Fix CVE-2025-0622 (bsc#1236317)
    * 0011-commands-pgp-Unregister-the-check_signatures-hooks-o.patch
  - Fix CVE-2025-0622 (bsc#1236317)
    * 0012-normal-Remove-variables-hooks-on-module-unload.patch
  - Fix CVE-2025-0622 (bsc#1236317)
    * 0013-gettext-Remove-variables-hooks-on-module-unload.patch
  - Fix CVE-2024-45776 (bsc#1233612)
    * 0014-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch
  - Fix CVE-2024-45777 (bsc#1233613)
    * 0015-gettext-Integer-overflow-leads-to-heap-OOB-write.patch
  - Fix CVE-2025-0690 (bsc#1237012)
    * 0016-commands-read-Fix-an-integer-overflow-when-supplying.patch
  - Fix CVE-2025-1118 (bsc#1237013)
    * 0017-commands-minicmd-Block-the-dump-command-in-lockdown-.patch
  - Fix CVE-2024-45778 (bsc#1233606)
  - Fix CVE-2024-45779 (bsc#1233608)
    * 0018-fs-bfs-Disable-under-lockdown.patch
  - Fix CVE-2025-0677 (bsc#1237002)
  - Fix CVE-2025-0684 (bsc#1237008)
  - Fix CVE-2025-0685 (bsc#1237009)
  - Fix CVE-2025-0686 (bsc#1237010)
  - Fix CVE-2025-0689 (bsc#1237011)
    * 0019-fs-Disable-many-filesystems-under-lockdown.patch
  - Fix CVE-2025-1125 (bsc#1237014)
  - Fix CVE-2025-0678 (bsc#1237006)
    * 0020-fs-Prevent-overflows-when-allocating-memory-for-arra.patch
  - Bump upstream SBAT generation to 5

++++ grub2:

  - Security fixes for 2024
    * 0001-misc-Implement-grub_strlcpy.patch
  - Fix CVE-2024-45781 (bsc#1233617)
    * 0002-fs-ufs-Fix-a-heap-OOB-write.patch
  - Fix CVE-2024-56737 (bsc#1234958)
  - Fix CVE-2024-45782 (bsc#1233615)
    * 0003-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch
  - Fix CVE-2024-45780 (bsc#1233614)
    * 0004-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch
  - Fix CVE-2024-45783 (bsc#1233616)
    * 0005-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch
    * 0006-kern-file-Ensure-file-data-is-set.patch
    * 0007-kern-file-Implement-filesystem-reference-counting.patch
  - Fix CVE-2025-0624 (bsc#1236316)
    * 0008-net-Fix-OOB-write-in-grub_net_search_config_file.patch
  - Fix CVE-2024-45774 (bsc#1233609)
    * 0009-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch
  - Fix CVE-2024-45775 (bsc#1233610)
    * 0010-commands-extcmd-Missing-check-for-failed-allocation.patch
  - Fix CVE-2025-0622 (bsc#1236317)
    * 0011-commands-pgp-Unregister-the-check_signatures-hooks-o.patch
  - Fix CVE-2025-0622 (bsc#1236317)
    * 0012-normal-Remove-variables-hooks-on-module-unload.patch
  - Fix CVE-2025-0622 (bsc#1236317)
    * 0013-gettext-Remove-variables-hooks-on-module-unload.patch
  - Fix CVE-2024-45776 (bsc#1233612)
    * 0014-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch
  - Fix CVE-2024-45777 (bsc#1233613)
    * 0015-gettext-Integer-overflow-leads-to-heap-OOB-write.patch
  - Fix CVE-2025-0690 (bsc#1237012)
    * 0016-commands-read-Fix-an-integer-overflow-when-supplying.patch
  - Fix CVE-2025-1118 (bsc#1237013)
    * 0017-commands-minicmd-Block-the-dump-command-in-lockdown-.patch
  - Fix CVE-2024-45778 (bsc#1233606)
  - Fix CVE-2024-45779 (bsc#1233608)
    * 0018-fs-bfs-Disable-under-lockdown.patch
  - Fix CVE-2025-0677 (bsc#1237002)
  - Fix CVE-2025-0684 (bsc#1237008)
  - Fix CVE-2025-0685 (bsc#1237009)
  - Fix CVE-2025-0686 (bsc#1237010)
  - Fix CVE-2025-0689 (bsc#1237011)
    * 0019-fs-Disable-many-filesystems-under-lockdown.patch
  - Fix CVE-2025-1125 (bsc#1237014)
  - Fix CVE-2025-0678 (bsc#1237006)
    * 0020-fs-Prevent-overflows-when-allocating-memory-for-arra.patch
  - Bump upstream SBAT generation to 5

++++ runc:

  - Update to runc v1.2.5. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.5>.

++++ runc:

  - Update to runc v1.2.5. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.5>.

++++ runc:

  - Update to runc v1.2.5. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.5>.

++++ runc:

  - Update to runc v1.2.5. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.5>.

------------------------------------------------------------------
------------------  2025-2-13  -  Feb 13 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.12.1:
    * Bugfixes:
  - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  - asyn-thread: fix HTTPS RR crash
  - asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  - asyn-thread: survive a c-ares channel set to NULL
  - cmake: always reference OpenSSL and ZLIB via imported targets
  - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  - content_encoding: #error on too old zlib
  - imap: TLS upgrade fix
  - ldap: drop support for legacy Novell LDAP SDK
  - libssh2: comparison is always true because rc <= -1
  - libssh2: raise lowest supported version to 1.2.8
  - libssh: drop support for libssh older than 0.9.0
  - openssl-quic: ignore ciphers for h3
  - pop3: TLS upgrade fix
  - runtests: fix the disabling of the memory tracking
  - runtests: quote commands to support paths with spaces
  - scache: add magic checks
  - smb: silence '-Warray-bounds' with gcc 13+
  - smtp: TLS upgrade fix
  - tool_cfgable: sort struct fields by size, use bitfields for booleans
  - tool_getparam: add "TLS required" flag for each such option
  - vtls: fix multissl-init
  - wakeup_write: make sure the eventfd write sends eight bytes

++++ curl:

  - Update to 8.12.1:
    * Bugfixes:
  - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  - asyn-thread: fix HTTPS RR crash
  - asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  - asyn-thread: survive a c-ares channel set to NULL
  - cmake: always reference OpenSSL and ZLIB via imported targets
  - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  - content_encoding: #error on too old zlib
  - imap: TLS upgrade fix
  - ldap: drop support for legacy Novell LDAP SDK
  - libssh2: comparison is always true because rc <= -1
  - libssh2: raise lowest supported version to 1.2.8
  - libssh: drop support for libssh older than 0.9.0
  - openssl-quic: ignore ciphers for h3
  - pop3: TLS upgrade fix
  - runtests: fix the disabling of the memory tracking
  - runtests: quote commands to support paths with spaces
  - scache: add magic checks
  - smb: silence '-Warray-bounds' with gcc 13+
  - smtp: TLS upgrade fix
  - tool_cfgable: sort struct fields by size, use bitfields for booleans
  - tool_getparam: add "TLS required" flag for each such option
  - vtls: fix multissl-init
  - wakeup_write: make sure the eventfd write sends eight bytes

++++ curl:

  - Update to 8.12.1:
    * Bugfixes:
  - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  - asyn-thread: fix HTTPS RR crash
  - asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  - asyn-thread: survive a c-ares channel set to NULL
  - cmake: always reference OpenSSL and ZLIB via imported targets
  - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  - content_encoding: #error on too old zlib
  - imap: TLS upgrade fix
  - ldap: drop support for legacy Novell LDAP SDK
  - libssh2: comparison is always true because rc <= -1
  - libssh2: raise lowest supported version to 1.2.8
  - libssh: drop support for libssh older than 0.9.0
  - openssl-quic: ignore ciphers for h3
  - pop3: TLS upgrade fix
  - runtests: fix the disabling of the memory tracking
  - runtests: quote commands to support paths with spaces
  - scache: add magic checks
  - smb: silence '-Warray-bounds' with gcc 13+
  - smtp: TLS upgrade fix
  - tool_cfgable: sort struct fields by size, use bitfields for booleans
  - tool_getparam: add "TLS required" flag for each such option
  - vtls: fix multissl-init
  - wakeup_write: make sure the eventfd write sends eight bytes

++++ curl:

  - Update to 8.12.1:
    * Bugfixes:
  - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  - asyn-thread: fix HTTPS RR crash
  - asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  - asyn-thread: survive a c-ares channel set to NULL
  - cmake: always reference OpenSSL and ZLIB via imported targets
  - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  - content_encoding: #error on too old zlib
  - imap: TLS upgrade fix
  - ldap: drop support for legacy Novell LDAP SDK
  - libssh2: comparison is always true because rc <= -1
  - libssh2: raise lowest supported version to 1.2.8
  - libssh: drop support for libssh older than 0.9.0
  - openssl-quic: ignore ciphers for h3
  - pop3: TLS upgrade fix
  - runtests: fix the disabling of the memory tracking
  - runtests: quote commands to support paths with spaces
  - scache: add magic checks
  - smb: silence '-Warray-bounds' with gcc 13+
  - smtp: TLS upgrade fix
  - tool_cfgable: sort struct fields by size, use bitfields for booleans
  - tool_getparam: add "TLS required" flag for each such option
  - vtls: fix multissl-init
  - wakeup_write: make sure the eventfd write sends eight bytes

++++ curl:

  - Update to 8.12.1:
    * Bugfixes:
  - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  - asyn-thread: fix HTTPS RR crash
  - asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  - asyn-thread: survive a c-ares channel set to NULL
  - cmake: always reference OpenSSL and ZLIB via imported targets
  - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  - content_encoding: #error on too old zlib
  - imap: TLS upgrade fix
  - ldap: drop support for legacy Novell LDAP SDK
  - libssh2: comparison is always true because rc <= -1
  - libssh2: raise lowest supported version to 1.2.8
  - libssh: drop support for libssh older than 0.9.0
  - openssl-quic: ignore ciphers for h3
  - pop3: TLS upgrade fix
  - runtests: fix the disabling of the memory tracking
  - runtests: quote commands to support paths with spaces
  - scache: add magic checks
  - smb: silence '-Warray-bounds' with gcc 13+
  - smtp: TLS upgrade fix
  - tool_cfgable: sort struct fields by size, use bitfields for booleans
  - tool_getparam: add "TLS required" flag for each such option
  - vtls: fix multissl-init
  - wakeup_write: make sure the eventfd write sends eight bytes

++++ curl:

  - Update to 8.12.1:
    * Bugfixes:
  - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  - asyn-thread: fix HTTPS RR crash
  - asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  - asyn-thread: survive a c-ares channel set to NULL
  - cmake: always reference OpenSSL and ZLIB via imported targets
  - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  - content_encoding: #error on too old zlib
  - imap: TLS upgrade fix
  - ldap: drop support for legacy Novell LDAP SDK
  - libssh2: comparison is always true because rc <= -1
  - libssh2: raise lowest supported version to 1.2.8
  - libssh: drop support for libssh older than 0.9.0
  - openssl-quic: ignore ciphers for h3
  - pop3: TLS upgrade fix
  - runtests: fix the disabling of the memory tracking
  - runtests: quote commands to support paths with spaces
  - scache: add magic checks
  - smb: silence '-Warray-bounds' with gcc 13+
  - smtp: TLS upgrade fix
  - tool_cfgable: sort struct fields by size, use bitfields for booleans
  - tool_getparam: add "TLS required" flag for each such option
  - vtls: fix multissl-init
  - wakeup_write: make sure the eventfd write sends eight bytes

++++ openssh:

  - Fix a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled
    client and a DoS attack against OpenSSH's client and server
    (bsc#1237040, CVE-2025-26465, bsc#1237041, CVE-2025-26466):
    * fix-CVE-2025-26465-and-CVE-2025-26466.patch
  - From Mon Oct 14 15:06:19 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Use %{with ...} instead of 0%{with ...}
  - From Fri Oct 11 09:28:30 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Add a patch to fix a regression introduced in 9.6 that makes X11
    forwarding very slow. Submitted to upstream in
    https://bugzilla.mindrot.org/show_bug.cgi?id=3655#c4 . Fixes
    bsc#1229449:
    * fix-x11-regression-bsc1229449.patch
  - Drop most of openssh-6.6p1-keycat.patch (actually, it was just
    commented out). The keycat binary isn't really installed nor
    supported, so we can drop it, except for the code that is used
    by other SELinux patches, which is what I kept from that patch
    (boo#1229072).
  - Add patch submitted to upstream to fix RFC4256 implementation
    so that keyboard-interactive authentication method can send
    instructions and sshd shows them to users even before a prompt
    is requested. This fixes MFA push notifications (boo#1229010).
    * 0001-auth-pam-Immediately-report-instructions-to-clients-and-fix-handling-in-ssh-client.patch
  - Fix a dbus connection leaked in the logind patch that was
    missing a sd_bus_unref call (found by Matthias Gerstner):
    * logind_set_tty.patch
  - Add a patch that fixes a small memory leak when parsing the
    subsystem configuration option:
    * fix-memleak-in-process_server_config_line_depth.patch
  - From Mon Jun  7 20:54:09 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
  - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which
    attempts to mitigate instances of secrets lingering in memory
    after a session exits. (bsc#1213004 bsc#1213008)
  - Rebase patches:
    * openssh-6.6p1-privsep-selinux.patch

++++ openssh:

  - Fix a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled
    client and a DoS attack against OpenSSH's client and server
    (bsc#1237040, CVE-2025-26465, bsc#1237041, CVE-2025-26466):
    * fix-CVE-2025-26465-and-CVE-2025-26466.patch
  - From Mon Oct 14 15:06:19 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Use %{with ...} instead of 0%{with ...}
  - From Fri Oct 11 09:28:30 UTC 2024 - Antonio Larrosa <alarrosa@suse.com>
  - Add a patch to fix a regression introduced in 9.6 that makes X11
    forwarding very slow. Submitted to upstream in
    https://bugzilla.mindrot.org/show_bug.cgi?id=3655#c4 . Fixes
    bsc#1229449:
    * fix-x11-regression-bsc1229449.patch
  - Drop most of openssh-6.6p1-keycat.patch (actually, it was just
    commented out). The keycat binary isn't really installed nor
    supported, so we can drop it, except for the code that is used
    by other SELinux patches, which is what I kept from that patch
    (boo#1229072).
  - Add patch submitted to upstream to fix RFC4256 implementation
    so that keyboard-interactive authentication method can send
    instructions and sshd shows them to users even before a prompt
    is requested. This fixes MFA push notifications (boo#1229010).
    * 0001-auth-pam-Immediately-report-instructions-to-clients-and-fix-handling-in-ssh-client.patch
  - Fix a dbus connection leaked in the logind patch that was
    missing a sd_bus_unref call (found by Matthias Gerstner):
    * logind_set_tty.patch
  - Add a patch that fixes a small memory leak when parsing the
    subsystem configuration option:
    * fix-memleak-in-process_server_config_line_depth.patch
  - From Mon Jun  7 20:54:09 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
  - Add openssh-mitigate-lingering-secrets.patch (bsc#1186673), which
    attempts to mitigate instances of secrets lingering in memory
    after a session exits. (bsc#1213004 bsc#1213008)
  - Rebase patches:
    * openssh-6.6p1-privsep-selinux.patch

++++ qemu:

  - Fix bsc#1228343:
    * tests/acpi: q35: Update host address width in DMAR (bsc#1228343)
    * intel_iommu: Set default aw_bits to 48 starting from QEMU 9.2 (bsc#1228343)
    * tests/acpi: q35: allow DMAR acpi table changes (bsc#1228343)
  - Update version to 8.2.9
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/568115c5-8908-4931-aae0-a57bf542f68a@tls.msk.ru/
    * Some backports:
    gdbstub/user-target: fix gdbserver int format (%d -> %x)
    target/s390x: Fix MVC not always invalidating translation blocks
    physmem: fix qemu_ram_alloc_from_fd size calculation
    hw/usb/canokey: Fix buffer overflow for OUT packet
    target/arm: arm_reset_sve_state() should set FPSR, not FPCR
    hw/cxl: Fix msix_notify: Assertion `vector < dev->msix_entries_nr`
    tests: acpi: update expected blobs
    pci: acpi: Windows 'PCI Label Id' bug workaround
    tests: acpi: whitelist expected blobs
    pci/msix: Fix msix pba read vector poll end calculation
    pci: ensure valid link status bits for downstream ports
    hw/usb/hcd-xhci-pci: Use modulo to select MSI vector as per spec
    backends/cryptodev-vhost-user: Fix local_error leaks
    tests/qtest/boot-serial-test: Correct HPPA machine name
    target/i386/cpu: Fix notes for CPU models
    docs: Correct release of TCG trace-events removal
    target/loongarch: Use actual operand size with vbsrl check
    s390x/s390-virtio-ccw: don't crash on weird RAM sizes
    vhost-user: fix shared object return values
    meson.build: Disallow libnfs v6 to fix the broken macOS build
    hw/intc/arm_gicv3_its: Zero initialize local DTEntry etc structs
    roms: re-add edk2-basetools target
    edk2: commit version info
    edk2: get version + date from git submodule
    x86/loader: only patch linux kernels
    ...

++++ qemu:

  - Fix bsc#1228343:
    * tests/acpi: q35: Update host address width in DMAR (bsc#1228343)
    * intel_iommu: Set default aw_bits to 48 starting from QEMU 9.2 (bsc#1228343)
    * tests/acpi: q35: allow DMAR acpi table changes (bsc#1228343)
  - Update version to 8.2.9
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/568115c5-8908-4931-aae0-a57bf542f68a@tls.msk.ru/
    * Some backports:
    gdbstub/user-target: fix gdbserver int format (%d -> %x)
    target/s390x: Fix MVC not always invalidating translation blocks
    physmem: fix qemu_ram_alloc_from_fd size calculation
    hw/usb/canokey: Fix buffer overflow for OUT packet
    target/arm: arm_reset_sve_state() should set FPSR, not FPCR
    hw/cxl: Fix msix_notify: Assertion `vector < dev->msix_entries_nr`
    tests: acpi: update expected blobs
    pci: acpi: Windows 'PCI Label Id' bug workaround
    tests: acpi: whitelist expected blobs
    pci/msix: Fix msix pba read vector poll end calculation
    pci: ensure valid link status bits for downstream ports
    hw/usb/hcd-xhci-pci: Use modulo to select MSI vector as per spec
    backends/cryptodev-vhost-user: Fix local_error leaks
    tests/qtest/boot-serial-test: Correct HPPA machine name
    target/i386/cpu: Fix notes for CPU models
    docs: Correct release of TCG trace-events removal
    target/loongarch: Use actual operand size with vbsrl check
    s390x/s390-virtio-ccw: don't crash on weird RAM sizes
    vhost-user: fix shared object return values
    meson.build: Disallow libnfs v6 to fix the broken macOS build
    hw/intc/arm_gicv3_its: Zero initialize local DTEntry etc structs
    roms: re-add edk2-basetools target
    edk2: commit version info
    edk2: get version + date from git submodule
    x86/loader: only patch linux kernels
    ...

++++ qemu:

  - Fix bsc#1228343:
    * tests/acpi: q35: Update host address width in DMAR (bsc#1228343)
    * intel_iommu: Set default aw_bits to 48 starting from QEMU 9.2 (bsc#1228343)
    * tests/acpi: q35: allow DMAR acpi table changes (bsc#1228343)
  - Update version to 8.2.9
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/568115c5-8908-4931-aae0-a57bf542f68a@tls.msk.ru/
    * Some backports:
    gdbstub/user-target: fix gdbserver int format (%d -> %x)
    target/s390x: Fix MVC not always invalidating translation blocks
    physmem: fix qemu_ram_alloc_from_fd size calculation
    hw/usb/canokey: Fix buffer overflow for OUT packet
    target/arm: arm_reset_sve_state() should set FPSR, not FPCR
    hw/cxl: Fix msix_notify: Assertion `vector < dev->msix_entries_nr`
    tests: acpi: update expected blobs
    pci: acpi: Windows 'PCI Label Id' bug workaround
    tests: acpi: whitelist expected blobs
    pci/msix: Fix msix pba read vector poll end calculation
    pci: ensure valid link status bits for downstream ports
    hw/usb/hcd-xhci-pci: Use modulo to select MSI vector as per spec
    backends/cryptodev-vhost-user: Fix local_error leaks
    tests/qtest/boot-serial-test: Correct HPPA machine name
    target/i386/cpu: Fix notes for CPU models
    docs: Correct release of TCG trace-events removal
    target/loongarch: Use actual operand size with vbsrl check
    s390x/s390-virtio-ccw: don't crash on weird RAM sizes
    vhost-user: fix shared object return values
    meson.build: Disallow libnfs v6 to fix the broken macOS build
    hw/intc/arm_gicv3_its: Zero initialize local DTEntry etc structs
    roms: re-add edk2-basetools target
    edk2: commit version info
    edk2: get version + date from git submodule
    x86/loader: only patch linux kernels
    ...

------------------------------------------------------------------
------------------  2025-2-12  -  Feb 12 2025  -------------------
------------------------------------------------------------------

++++ aardvark-dns:

  - Update to version 1.12.2:
    * Release v1.12.2
    * Update release notes for 1.12.2
    * coredns: work on tcp requests concurrently
    * tcp: add timeout to connection
    * cirrus: update branch names
    * Release v1.12.1
    * Updated release notes for 1.12.1
    * Change av cargo categories
    * Bump to 1.13.0-dev
    * Release 1.12.0
    * Release notes for 1.12
    * config: ignore enoent errors while reading configs
    * run cargo update
    * update upsteam resolvers on each refresh
    * fix(deps): update rust crate syslog to v7
    * fix(deps): update rust crate tokio to 1.39.2
    * add tcp support for forwarding (bsc#1234660)
    * add tcp listening support
    * test: add new test to check for startup error
    * return bind error to caller on first start
    * add our own error type and use it over anyhow
    * server: use anyhow to wrap parse_configs error
    * server: split out main loop into new function
    * main: remove aardvark-dns error prefix
    * coredns: remove unnecessary try_join! call
    * coredns: drop pointless name var
    * serve: read nameservers once
    * replace signal-hook with tokio::signal
    * serve: fix broken error logging
    * server: improve parent <-> child error handling
    * add some basic perf check script
    * fix(deps): update rust crate tokio to 1.39.0
    * coredns: create reply_ip() function
    * coredns: match dns type explicitly
    * server: use only one tokio runtime
    * coredns: improve indentation for process_message()
    * coredns: move upstream resolvers detection later
    * coredns: do not clone sender
    * read AARDVARK_NO_PROXY once
    * coredns: move main code out of select!
    * coredns: fix "name" naming
    * coredns: remove unused forward_addr/port
    * coredns: fix handling of dns search domain
    * coredns: rework PTR lookup flow
    * fix(deps): update rust crate tokio to 1.38.1
    * [skip-ci] TMT: Reorg upstream tests for downstream reusability
    * [skip-ci] Packit: use `packages: [aardvark-dns-fedora]` for podman-next builds
    * Be sure to have at least Epoch 2 to preserve upgrade path in c10s.
    * fix(deps): update rust crate log to 0.4.22
    * [CI:BUILD] rpm: Update Rust macro usage
    * fix(deps): update rust crate tokio to 1.38.0
    * Bump to 1.12.0-dev

++++ docker-compose:

  - remove docker-compose-switch dependency
  - Update to version 2.33.0:
    * Important
  - This release introduce support for Bake to manage builds as
    an alternative to the internal buildkit client. This new
    feature can be enabled by setting COMPOSE_BAKE=1 variable.
    Bake will become the default builder in a future release.
    * Improvements
  - let user know bake is now supported by @ndeloof in #12524
  - support additional_context reference to another service by
    @ndeloof in #12485
  - add support for BUILDKIT_PROGRESS by @ndeloof in #12458
  - add --with-env flag to publish command by @glours in #12482
  - Update ls --quiet help description by @maxproske in #12541
  - Publish warn display env vars by @glours in #12486
    * Fixes
  - Fix bake support by @ndeloof in #12507
  - Update link in stats --help output by @maxproske in #12523
  - Properly handle "builtin" seccomp profile by @r-bk in #12478
  - manage watch applied to mulitple services by @ndeloof in
    [#12469]
    * Internal
  - use main branch for docs upstream validation workflow by
    @crazy-max in #12487
  - fix provenance for binaries and generate sbom by @crazy-max
    in #12479
  - add codeowners file by @glours in #12480
  - remove exit code per error type used by legacy metrics system
    by @ndeloof in #12502
  - Dockerfile: update golangci-lint to v1.63.4 by @thaJeztah in
    [#12546]
  - Full test coverage for compatibility cmd by @maxproske in
    [#12528]
  - don't send raw os.Args to opentelemetry but a pseudo command
    line by @ndeloof in #12530
  - add docker engine v28.x to the test-matrix by @thaJeztah in
    [#12539]
  - enable copyloopvar linter by @thaJeztah in #12542
  - go.mod: remove toolchain directive by @thaJeztah in #12551
    * Dependencies
  - bump buildx v0.20.1 by @ndeloof in #12488
  - bump docker to v27.5.1 by @ndeloof in #12491
  - bump compose-go v2.4.8 by @ndeloof in #12543
  - bump golang.org/x/sys from 0.28.0 to 0.30.0 by @dependabot in
    [#12529]
  - bump github.com/moby/term v0.5.2 by @thaJeztah in #12540
  - bump github.com/otiai10/copy from 1.14.0 to 1.14.1 by
    @dependabot in #12493
  - bump github.com/jonboulle/clockwork from 0.4.0 to 0.5.0 by
    @dependabot in #12430
  - bump github.com/spf13/pflag from 1.0.5 to 1.0.6 by
    @dependabot in #12548
  - bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot
    in #12547
  - bump gotest.tools/v3 from 3.5.1 to 3.5.2 by @dependabot in
    [#12549]

++++ docker-compose:

  - remove docker-compose-switch dependency
  - Update to version 2.33.0:
    * Important
  - This release introduce support for Bake to manage builds as
    an alternative to the internal buildkit client. This new
    feature can be enabled by setting COMPOSE_BAKE=1 variable.
    Bake will become the default builder in a future release.
    * Improvements
  - let user know bake is now supported by @ndeloof in #12524
  - support additional_context reference to another service by
    @ndeloof in #12485
  - add support for BUILDKIT_PROGRESS by @ndeloof in #12458
  - add --with-env flag to publish command by @glours in #12482
  - Update ls --quiet help description by @maxproske in #12541
  - Publish warn display env vars by @glours in #12486
    * Fixes
  - Fix bake support by @ndeloof in #12507
  - Update link in stats --help output by @maxproske in #12523
  - Properly handle "builtin" seccomp profile by @r-bk in #12478
  - manage watch applied to mulitple services by @ndeloof in
    [#12469]
    * Internal
  - use main branch for docs upstream validation workflow by
    @crazy-max in #12487
  - fix provenance for binaries and generate sbom by @crazy-max
    in #12479
  - add codeowners file by @glours in #12480
  - remove exit code per error type used by legacy metrics system
    by @ndeloof in #12502
  - Dockerfile: update golangci-lint to v1.63.4 by @thaJeztah in
    [#12546]
  - Full test coverage for compatibility cmd by @maxproske in
    [#12528]
  - don't send raw os.Args to opentelemetry but a pseudo command
    line by @ndeloof in #12530
  - add docker engine v28.x to the test-matrix by @thaJeztah in
    [#12539]
  - enable copyloopvar linter by @thaJeztah in #12542
  - go.mod: remove toolchain directive by @thaJeztah in #12551
    * Dependencies
  - bump buildx v0.20.1 by @ndeloof in #12488
  - bump docker to v27.5.1 by @ndeloof in #12491
  - bump compose-go v2.4.8 by @ndeloof in #12543
  - bump golang.org/x/sys from 0.28.0 to 0.30.0 by @dependabot in
    [#12529]
  - bump github.com/moby/term v0.5.2 by @thaJeztah in #12540
  - bump github.com/otiai10/copy from 1.14.0 to 1.14.1 by
    @dependabot in #12493
  - bump github.com/jonboulle/clockwork from 0.4.0 to 0.5.0 by
    @dependabot in #12430
  - bump github.com/spf13/pflag from 1.0.5 to 1.0.6 by
    @dependabot in #12548
  - bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot
    in #12547
  - bump gotest.tools/v3 from 3.5.1 to 3.5.2 by @dependabot in
    [#12549]

++++ docker-compose:

  - remove docker-compose-switch dependency
  - Update to version 2.33.0:
    * Important
  - This release introduce support for Bake to manage builds as
    an alternative to the internal buildkit client. This new
    feature can be enabled by setting COMPOSE_BAKE=1 variable.
    Bake will become the default builder in a future release.
    * Improvements
  - let user know bake is now supported by @ndeloof in #12524
  - support additional_context reference to another service by
    @ndeloof in #12485
  - add support for BUILDKIT_PROGRESS by @ndeloof in #12458
  - add --with-env flag to publish command by @glours in #12482
  - Update ls --quiet help description by @maxproske in #12541
  - Publish warn display env vars by @glours in #12486
    * Fixes
  - Fix bake support by @ndeloof in #12507
  - Update link in stats --help output by @maxproske in #12523
  - Properly handle "builtin" seccomp profile by @r-bk in #12478
  - manage watch applied to mulitple services by @ndeloof in
    [#12469]
    * Internal
  - use main branch for docs upstream validation workflow by
    @crazy-max in #12487
  - fix provenance for binaries and generate sbom by @crazy-max
    in #12479
  - add codeowners file by @glours in #12480
  - remove exit code per error type used by legacy metrics system
    by @ndeloof in #12502
  - Dockerfile: update golangci-lint to v1.63.4 by @thaJeztah in
    [#12546]
  - Full test coverage for compatibility cmd by @maxproske in
    [#12528]
  - don't send raw os.Args to opentelemetry but a pseudo command
    line by @ndeloof in #12530
  - add docker engine v28.x to the test-matrix by @thaJeztah in
    [#12539]
  - enable copyloopvar linter by @thaJeztah in #12542
  - go.mod: remove toolchain directive by @thaJeztah in #12551
    * Dependencies
  - bump buildx v0.20.1 by @ndeloof in #12488
  - bump docker to v27.5.1 by @ndeloof in #12491
  - bump compose-go v2.4.8 by @ndeloof in #12543
  - bump golang.org/x/sys from 0.28.0 to 0.30.0 by @dependabot in
    [#12529]
  - bump github.com/moby/term v0.5.2 by @thaJeztah in #12540
  - bump github.com/otiai10/copy from 1.14.0 to 1.14.1 by
    @dependabot in #12493
  - bump github.com/jonboulle/clockwork from 0.4.0 to 0.5.0 by
    @dependabot in #12430
  - bump github.com/spf13/pflag from 1.0.5 to 1.0.6 by
    @dependabot in #12548
  - bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot
    in #12547
  - bump gotest.tools/v3 from 3.5.1 to 3.5.2 by @dependabot in
    [#12549]

++++ libzypp:

  - Don't issue deprecated warnings if -DNDEBUG is set (bsc#1236983)
    Released libyui packages compile with -Werror=deprecated-declarations
    so we can't add deprecated warnings without breaking them.
  - make gcc15 happy (fixes #613)
  - version 17.36.1 (35)

++++ libzypp:

  - Don't issue deprecated warnings if -DNDEBUG is set (bsc#1236983)
    Released libyui packages compile with -Werror=deprecated-declarations
    so we can't add deprecated warnings without breaking them.
  - make gcc15 happy (fixes #613)
  - version 17.36.1 (35)

++++ libzypp:

  - Don't issue deprecated warnings if -DNDEBUG is set (bsc#1236983)
    Released libyui packages compile with -Werror=deprecated-declarations
    so we can't add deprecated warnings without breaking them.
  - make gcc15 happy (fixes #613)
  - version 17.36.1 (35)

++++ python-M2Crypto:

  - The real license is BSD 2-Clause, not MIT.

++++ zypper:

  - Let zypper dup fail in case of (temporarily) unaccessible repos
    (bsc#1228434, bsc#1236939, fixes #446)
  - version 1.14.84

++++ zypper:

  - Let zypper dup fail in case of (temporarily) unaccessible repos
    (bsc#1228434, bsc#1236939, fixes #446)
  - version 1.14.84

------------------------------------------------------------------
------------------  2025-2-11  -  Feb 11 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - The ubuntu 20.04 github runner is closing down
    Make sure to move to another runner for workloads which
    still uses ubuntu 20.04

++++ python-kiwi:

  - The ubuntu 20.04 github runner is closing down
    Make sure to move to another runner for workloads which
    still uses ubuntu 20.04

++++ python-kiwi:

  - The ubuntu 20.04 github runner is closing down
    Make sure to move to another runner for workloads which
    still uses ubuntu 20.04

++++ netavark:

  - Use recommended way to require latest rust—require cargo.
  - Update to version 1.12.2:
    * Release v1.12.2
    * Release notes for 1.12.2
    * fix new rust 1.80 lint issues
    * silence new rust 1.80 warnings
    * aardvark: on start failure delete entries again
    * iptables: make dns rules cover tcp as well
    * nftables: make dns rules cover tcp as well
    * Release v1.12.1
    * Update release notes for v1.12.1
    * Change nv cargo categories
    * Bump to 1.13.0-dev
    * Release 1.12
    * Release Notes for 1.12
    * run cargo update
    * rpm: use nftables as default for f41
    * fix(deps): update rust crate serde_json to 1.0.121
    * fix(deps): update rust crate tokio to 1.39.2
    * aardvark-dns: trim whitespaces from error text
    * fix(deps): update rust crate env_logger to 0.11.5
    * [skip-ci] RPM: handle iptables/nftables dependencies
    * fix aardvark-dns error handling
    * fix(deps): update rust crate tokio to 1.39.1
    * fix(deps): update rust crate env_logger to 0.11.4
    * fix(deps): update rust crate tokio to 1.38.1
    * update mozim to 0.2.4 (bsc#1236567)
    * fix(deps): update rust crate serde_json to 1.0.120
    * netavark: dhcp_proxy: use dns servers from dhcp lease
    * fix(deps): update rust crate serde_json to 1.0.119
    * fix(deps): update rust crate netlink-packet-route to 0.20.1
    * fix(deps): update rust crate log to 0.4.22
    * Fix Epoch so upgrade path is preserved from Fedora/RHEL.
    * test: add macvlan metric test
    * fix(deps): update rust crate serde_json to 1.0.118
    * fix(deps): update rust crate url to 2.5.2
    * fix(deps): update rust crate prost to 0.12.6
    * fix(deps): update rust crate url to 2.5.1
    * fix(deps): update rust crate iptables to 0.5.2
    * [CI:BUILD] rpm: Update Rust macro usage
    * fix(deps): update rust crate nftables to 0.4.1
    * fix(deps): update rust crate tokio to 1.38.0
    * Bump to 1.12.0-dev

------------------------------------------------------------------
------------------  2025-2-10  -  Feb 10 2025  -------------------
------------------------------------------------------------------

++++ libtasn1:

  - Security fix: [bsc#1236878, CVE-2024-12133]
    * Potential DoS in handling of numerous SEQUENCE OF or SET OF elements
    * Add libtasn1-CVE-2024-12133.patch

++++ libtasn1:

  - Security fix: [bsc#1236878, CVE-2024-12133]
    * Potential DoS in handling of numerous SEQUENCE OF or SET OF elements
    * Add libtasn1-CVE-2024-12133.patch

++++ libzypp:

  - Drop zypp-CheckAccessDeleted in favor of 'zypper ps'.
  - Fix Repoverification plugin not being executed (fixes #614)
  - Refresh: Fetch the master index file before key and signature
    (bsc#1236820)
  - Allow libzypp to compile with C++20.
  - Deprecate RepoReports we do not trigger.
  - version 17.36.0 (35)

++++ libzypp:

  - Drop zypp-CheckAccessDeleted in favor of 'zypper ps'.
  - Fix Repoverification plugin not being executed (fixes #614)
  - Refresh: Fetch the master index file before key and signature
    (bsc#1236820)
  - Allow libzypp to compile with C++20.
  - Deprecate RepoReports we do not trigger.
  - version 17.36.0 (35)

++++ libzypp:

  - Drop zypp-CheckAccessDeleted in favor of 'zypper ps'.
  - Fix Repoverification plugin not being executed (fixes #614)
  - Refresh: Fetch the master index file before key and signature
    (bsc#1236820)
  - Allow libzypp to compile with C++20.
  - Deprecate RepoReports we do not trigger.
  - version 17.36.0 (35)

++++ zypper:

  - New system-architecture command (bsc#1236384)
    Prints the detected system architecture.
  - version 1.14.83
  - requires: libzypp >= 17.36.0.
  - Change versioncmp command to return exit code according to the
    comparison result (#593)
  - version 1.14.82

++++ zypper:

  - New system-architecture command (bsc#1236384)
    Prints the detected system architecture.
  - version 1.14.83
  - requires: libzypp >= 17.36.0.
  - Change versioncmp command to return exit code according to the
    comparison result (#593)
  - version 1.14.82

------------------------------------------------------------------
------------------  2025-2-9  -  Feb 9 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.9 → 10.2.10
  - Poetry build sdist timestamps set to epoch 0
    Newer versions of poetry set the timestamp for all source
    files to epoch 0. Such sources are not accepted by e.g
    Debian FTP servers and in general I don't like when tools
    changes their behavior just like that. This commit forces
    an older version of poetry for the purpose of creating the
    sdist tarball which then gets published on pypi. The
    argumentation for reproducible builds by forcing source
    files to a certain timestamp doesn't fly for me. I'm open
    for any better solution though. This Fixes #2730

++++ python-kiwi:

  - Bump version: 10.2.9 → 10.2.10
  - Poetry build sdist timestamps set to epoch 0
    Newer versions of poetry set the timestamp for all source
    files to epoch 0. Such sources are not accepted by e.g
    Debian FTP servers and in general I don't like when tools
    changes their behavior just like that. This commit forces
    an older version of poetry for the purpose of creating the
    sdist tarball which then gets published on pypi. The
    argumentation for reproducible builds by forcing source
    files to a certain timestamp doesn't fly for me. I'm open
    for any better solution though. This Fixes #2730

++++ python-kiwi:

  - Bump version: 10.2.9 → 10.2.10
  - Poetry build sdist timestamps set to epoch 0
    Newer versions of poetry set the timestamp for all source
    files to epoch 0. Such sources are not accepted by e.g
    Debian FTP servers and in general I don't like when tools
    changes their behavior just like that. This commit forces
    an older version of poetry for the purpose of creating the
    sdist tarball which then gets published on pypi. The
    argumentation for reproducible builds by forcing source
    files to a certain timestamp doesn't fly for me. I'm open
    for any better solution though. This Fixes #2730

------------------------------------------------------------------
------------------  2025-2-6  -  Feb 6 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.12.0:
    * Security fixes:
  - [bsc#1234068, CVE-2024-11053] curl could leak the password used
    for the first host to the followed-to host under certain circumstances.
  - [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  - [bsc#1236589, CVE-2025-0665] eventfd double close
    * Changes:
  - curl: add byte range support to --variable reading from file
  - curl: make --etag-save acknowledge --create-dirs
  - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  - getinfo: provide info which auth was used for HTTP and proxy
  - hyper: drop support
  - openssl: add support to use keys and certificates from PKCS#11 provider
  - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  - vtls: feature ssls-export for SSL session im-/export
    * Bugfixes:
  - altsvc: avoid integer overflow in expire calculation
  - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  - asyn-ares: fix memory leak
  - asyn-ares: initial HTTPS resolve support
  - asyn-thread: use c-ares to resolve HTTPS RR
  - async-thread: avoid closing eventfd twice
  - cd2nroff: do not insist on quoted <> within backticks
  - cd2nroff: support "none" as a TLS backend
  - conncache: count shutdowns against host and max limits
  - content_encoding: drop support for zlib before 1.2.0.4
  - content_encoding: namespace GZIP flag constants
  - content_encoding: put the decomp buffers into the writer structs
  - content_encoding: support use of custom libzstd memory functions
  - cookie: cap expire times to 400 days
  - cookie: parse only the exact expire date
  - curl: return error if etag options are used with multiple URLs
  - curl_multi_fdset: include the shutdown connections in the set
  - curl_sha512_256: rename symbols to the curl namespace
  - curl_url_set.md: adjust the added-in to 7.62.0
  - doh: send HTTPS RR requests for all HTTP(S) transfers
  - easy: allow connect-only handle reuse with easy_perform
  - easy: make curl_easy_perform() return error if connection still there
  - easy_lock: use Sleep(1) for thread yield on old Windows
  - ECH: update APIs to those agreed with OpenSSL maintainers
  - GnuTLS: fix 'time_appconnect' for early data
  - HTTP/2: strip TE request header
  - http2: fix data_pending check
  - http2: fix value stored to 'result' is never read
  - http: ignore invalid Retry-After times
  - http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  - https-connect: start next immediately on failure
  - lib: redirect handling by protocol handler
  - multi: fix curl_multi_waitfds reporting of fd_count
  - netrc: 'default' with no credentials is not a match
  - netrc: fix password-only entries
  - netrc: restore _netrc fallback logic
  - ngtcp2: fix memory leak on connect failure
  - openssl: define `HAVE_KEYLOG_CALLBACK` before use
  - openssl: fix ECH logic
  - osslq: use SSL_poll to determine writeability of QUIC streams
  - sectransp: free certificate on error
  - select: avoid a NULL deref in cwfds_add_sock
  - src: omit hugehelp and ca-embed from libcurltool
  - ssl session cache: change cache dimensions
  - system.h: add 64-bit curl_off_t definitions for NonStop
  - telnet: handle single-byte input option
  - TLS: check connection for SSL use, not handler
  - tool_formparse.c: make curlx_uztoso a static in here
  - tool_formparse: accept digits in --form type= strings
  - tool_getparam: ECH param parsing refix
  - tool_getparam: fail --hostpubsha256 if libssh2 is not used
  - tool_getparam: fix "Ignored Return Value"
  - tool_getparam: fix memory leak on error in parse_ech
  - tool_getparam: fix the ECH parser
  - tool_operate: make --etag-compare always accept a non-existing file
  - transfer: fix CURLOPT_CURLU override logic
  - urlapi: fix redirect to a new fragment or query (only)
  - vquic: make vquic_send_packets not return without setting psent
  - vtls: fix default SSL backend as a fallback
  - vtls: only remember the expiry timestamp in session cache
  - websocket: fix message send corruption
  - x509asn1: add parse recursion limit
    * Rebase pathes:
  - libcurl-ocloexec.patch
  - dont-mess-with-rpmoptflags.patch

++++ curl:

  - Update to 8.12.0:
    * Security fixes:
  - [bsc#1234068, CVE-2024-11053] curl could leak the password used
    for the first host to the followed-to host under certain circumstances.
  - [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  - [bsc#1236589, CVE-2025-0665] eventfd double close
    * Changes:
  - curl: add byte range support to --variable reading from file
  - curl: make --etag-save acknowledge --create-dirs
  - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  - getinfo: provide info which auth was used for HTTP and proxy
  - hyper: drop support
  - openssl: add support to use keys and certificates from PKCS#11 provider
  - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  - vtls: feature ssls-export for SSL session im-/export
    * Bugfixes:
  - altsvc: avoid integer overflow in expire calculation
  - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  - asyn-ares: fix memory leak
  - asyn-ares: initial HTTPS resolve support
  - asyn-thread: use c-ares to resolve HTTPS RR
  - async-thread: avoid closing eventfd twice
  - cd2nroff: do not insist on quoted <> within backticks
  - cd2nroff: support "none" as a TLS backend
  - conncache: count shutdowns against host and max limits
  - content_encoding: drop support for zlib before 1.2.0.4
  - content_encoding: namespace GZIP flag constants
  - content_encoding: put the decomp buffers into the writer structs
  - content_encoding: support use of custom libzstd memory functions
  - cookie: cap expire times to 400 days
  - cookie: parse only the exact expire date
  - curl: return error if etag options are used with multiple URLs
  - curl_multi_fdset: include the shutdown connections in the set
  - curl_sha512_256: rename symbols to the curl namespace
  - curl_url_set.md: adjust the added-in to 7.62.0
  - doh: send HTTPS RR requests for all HTTP(S) transfers
  - easy: allow connect-only handle reuse with easy_perform
  - easy: make curl_easy_perform() return error if connection still there
  - easy_lock: use Sleep(1) for thread yield on old Windows
  - ECH: update APIs to those agreed with OpenSSL maintainers
  - GnuTLS: fix 'time_appconnect' for early data
  - HTTP/2: strip TE request header
  - http2: fix data_pending check
  - http2: fix value stored to 'result' is never read
  - http: ignore invalid Retry-After times
  - http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  - https-connect: start next immediately on failure
  - lib: redirect handling by protocol handler
  - multi: fix curl_multi_waitfds reporting of fd_count
  - netrc: 'default' with no credentials is not a match
  - netrc: fix password-only entries
  - netrc: restore _netrc fallback logic
  - ngtcp2: fix memory leak on connect failure
  - openssl: define `HAVE_KEYLOG_CALLBACK` before use
  - openssl: fix ECH logic
  - osslq: use SSL_poll to determine writeability of QUIC streams
  - sectransp: free certificate on error
  - select: avoid a NULL deref in cwfds_add_sock
  - src: omit hugehelp and ca-embed from libcurltool
  - ssl session cache: change cache dimensions
  - system.h: add 64-bit curl_off_t definitions for NonStop
  - telnet: handle single-byte input option
  - TLS: check connection for SSL use, not handler
  - tool_formparse.c: make curlx_uztoso a static in here
  - tool_formparse: accept digits in --form type= strings
  - tool_getparam: ECH param parsing refix
  - tool_getparam: fail --hostpubsha256 if libssh2 is not used
  - tool_getparam: fix "Ignored Return Value"
  - tool_getparam: fix memory leak on error in parse_ech
  - tool_getparam: fix the ECH parser
  - tool_operate: make --etag-compare always accept a non-existing file
  - transfer: fix CURLOPT_CURLU override logic
  - urlapi: fix redirect to a new fragment or query (only)
  - vquic: make vquic_send_packets not return without setting psent
  - vtls: fix default SSL backend as a fallback
  - vtls: only remember the expiry timestamp in session cache
  - websocket: fix message send corruption
  - x509asn1: add parse recursion limit
    * Rebase pathes:
  - libcurl-ocloexec.patch
  - dont-mess-with-rpmoptflags.patch

++++ curl:

  - Update to 8.12.0:
    * Security fixes:
  - [bsc#1234068, CVE-2024-11053] curl could leak the password used
    for the first host to the followed-to host under certain circumstances.
  - [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  - [bsc#1236589, CVE-2025-0665] eventfd double close
    * Changes:
  - curl: add byte range support to --variable reading from file
  - curl: make --etag-save acknowledge --create-dirs
  - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  - getinfo: provide info which auth was used for HTTP and proxy
  - hyper: drop support
  - openssl: add support to use keys and certificates from PKCS#11 provider
  - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  - vtls: feature ssls-export for SSL session im-/export
    * Bugfixes:
  - altsvc: avoid integer overflow in expire calculation
  - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  - asyn-ares: fix memory leak
  - asyn-ares: initial HTTPS resolve support
  - asyn-thread: use c-ares to resolve HTTPS RR
  - async-thread: avoid closing eventfd twice
  - cd2nroff: do not insist on quoted <> within backticks
  - cd2nroff: support "none" as a TLS backend
  - conncache: count shutdowns against host and max limits
  - content_encoding: drop support for zlib before 1.2.0.4
  - content_encoding: namespace GZIP flag constants
  - content_encoding: put the decomp buffers into the writer structs
  - content_encoding: support use of custom libzstd memory functions
  - cookie: cap expire times to 400 days
  - cookie: parse only the exact expire date
  - curl: return error if etag options are used with multiple URLs
  - curl_multi_fdset: include the shutdown connections in the set
  - curl_sha512_256: rename symbols to the curl namespace
  - curl_url_set.md: adjust the added-in to 7.62.0
  - doh: send HTTPS RR requests for all HTTP(S) transfers
  - easy: allow connect-only handle reuse with easy_perform
  - easy: make curl_easy_perform() return error if connection still there
  - easy_lock: use Sleep(1) for thread yield on old Windows
  - ECH: update APIs to those agreed with OpenSSL maintainers
  - GnuTLS: fix 'time_appconnect' for early data
  - HTTP/2: strip TE request header
  - http2: fix data_pending check
  - http2: fix value stored to 'result' is never read
  - http: ignore invalid Retry-After times
  - http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  - https-connect: start next immediately on failure
  - lib: redirect handling by protocol handler
  - multi: fix curl_multi_waitfds reporting of fd_count
  - netrc: 'default' with no credentials is not a match
  - netrc: fix password-only entries
  - netrc: restore _netrc fallback logic
  - ngtcp2: fix memory leak on connect failure
  - openssl: define `HAVE_KEYLOG_CALLBACK` before use
  - openssl: fix ECH logic
  - osslq: use SSL_poll to determine writeability of QUIC streams
  - sectransp: free certificate on error
  - select: avoid a NULL deref in cwfds_add_sock
  - src: omit hugehelp and ca-embed from libcurltool
  - ssl session cache: change cache dimensions
  - system.h: add 64-bit curl_off_t definitions for NonStop
  - telnet: handle single-byte input option
  - TLS: check connection for SSL use, not handler
  - tool_formparse.c: make curlx_uztoso a static in here
  - tool_formparse: accept digits in --form type= strings
  - tool_getparam: ECH param parsing refix
  - tool_getparam: fail --hostpubsha256 if libssh2 is not used
  - tool_getparam: fix "Ignored Return Value"
  - tool_getparam: fix memory leak on error in parse_ech
  - tool_getparam: fix the ECH parser
  - tool_operate: make --etag-compare always accept a non-existing file
  - transfer: fix CURLOPT_CURLU override logic
  - urlapi: fix redirect to a new fragment or query (only)
  - vquic: make vquic_send_packets not return without setting psent
  - vtls: fix default SSL backend as a fallback
  - vtls: only remember the expiry timestamp in session cache
  - websocket: fix message send corruption
  - x509asn1: add parse recursion limit
    * Rebase pathes:
  - libcurl-ocloexec.patch
  - dont-mess-with-rpmoptflags.patch

++++ curl:

  - Update to 8.12.0:
    * Security fixes:
  - [bsc#1234068, CVE-2024-11053] curl could leak the password used
    for the first host to the followed-to host under certain circumstances.
  - [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  - [bsc#1236589, CVE-2025-0665] eventfd double close
    * Changes:
  - curl: add byte range support to --variable reading from file
  - curl: make --etag-save acknowledge --create-dirs
  - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  - getinfo: provide info which auth was used for HTTP and proxy
  - hyper: drop support
  - openssl: add support to use keys and certificates from PKCS#11 provider
  - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  - vtls: feature ssls-export for SSL session im-/export
    * Bugfixes:
  - altsvc: avoid integer overflow in expire calculation
  - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  - asyn-ares: fix memory leak
  - asyn-ares: initial HTTPS resolve support
  - asyn-thread: use c-ares to resolve HTTPS RR
  - async-thread: avoid closing eventfd twice
  - cd2nroff: do not insist on quoted <> within backticks
  - cd2nroff: support "none" as a TLS backend
  - conncache: count shutdowns against host and max limits
  - content_encoding: drop support for zlib before 1.2.0.4
  - content_encoding: namespace GZIP flag constants
  - content_encoding: put the decomp buffers into the writer structs
  - content_encoding: support use of custom libzstd memory functions
  - cookie: cap expire times to 400 days
  - cookie: parse only the exact expire date
  - curl: return error if etag options are used with multiple URLs
  - curl_multi_fdset: include the shutdown connections in the set
  - curl_sha512_256: rename symbols to the curl namespace
  - curl_url_set.md: adjust the added-in to 7.62.0
  - doh: send HTTPS RR requests for all HTTP(S) transfers
  - easy: allow connect-only handle reuse with easy_perform
  - easy: make curl_easy_perform() return error if connection still there
  - easy_lock: use Sleep(1) for thread yield on old Windows
  - ECH: update APIs to those agreed with OpenSSL maintainers
  - GnuTLS: fix 'time_appconnect' for early data
  - HTTP/2: strip TE request header
  - http2: fix data_pending check
  - http2: fix value stored to 'result' is never read
  - http: ignore invalid Retry-After times
  - http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  - https-connect: start next immediately on failure
  - lib: redirect handling by protocol handler
  - multi: fix curl_multi_waitfds reporting of fd_count
  - netrc: 'default' with no credentials is not a match
  - netrc: fix password-only entries
  - netrc: restore _netrc fallback logic
  - ngtcp2: fix memory leak on connect failure
  - openssl: define `HAVE_KEYLOG_CALLBACK` before use
  - openssl: fix ECH logic
  - osslq: use SSL_poll to determine writeability of QUIC streams
  - sectransp: free certificate on error
  - select: avoid a NULL deref in cwfds_add_sock
  - src: omit hugehelp and ca-embed from libcurltool
  - ssl session cache: change cache dimensions
  - system.h: add 64-bit curl_off_t definitions for NonStop
  - telnet: handle single-byte input option
  - TLS: check connection for SSL use, not handler
  - tool_formparse.c: make curlx_uztoso a static in here
  - tool_formparse: accept digits in --form type= strings
  - tool_getparam: ECH param parsing refix
  - tool_getparam: fail --hostpubsha256 if libssh2 is not used
  - tool_getparam: fix "Ignored Return Value"
  - tool_getparam: fix memory leak on error in parse_ech
  - tool_getparam: fix the ECH parser
  - tool_operate: make --etag-compare always accept a non-existing file
  - transfer: fix CURLOPT_CURLU override logic
  - urlapi: fix redirect to a new fragment or query (only)
  - vquic: make vquic_send_packets not return without setting psent
  - vtls: fix default SSL backend as a fallback
  - vtls: only remember the expiry timestamp in session cache
  - websocket: fix message send corruption
  - x509asn1: add parse recursion limit
    * Rebase pathes:
  - libcurl-ocloexec.patch
  - dont-mess-with-rpmoptflags.patch

++++ curl:

  - Update to 8.12.0:
    * Security fixes:
  - [bsc#1234068, CVE-2024-11053] curl could leak the password used
    for the first host to the followed-to host under certain circumstances.
  - [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  - [bsc#1236589, CVE-2025-0665] eventfd double close
    * Changes:
  - curl: add byte range support to --variable reading from file
  - curl: make --etag-save acknowledge --create-dirs
  - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  - getinfo: provide info which auth was used for HTTP and proxy
  - hyper: drop support
  - openssl: add support to use keys and certificates from PKCS#11 provider
  - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  - vtls: feature ssls-export for SSL session im-/export
    * Bugfixes:
  - altsvc: avoid integer overflow in expire calculation
  - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  - asyn-ares: fix memory leak
  - asyn-ares: initial HTTPS resolve support
  - asyn-thread: use c-ares to resolve HTTPS RR
  - async-thread: avoid closing eventfd twice
  - cd2nroff: do not insist on quoted <> within backticks
  - cd2nroff: support "none" as a TLS backend
  - conncache: count shutdowns against host and max limits
  - content_encoding: drop support for zlib before 1.2.0.4
  - content_encoding: namespace GZIP flag constants
  - content_encoding: put the decomp buffers into the writer structs
  - content_encoding: support use of custom libzstd memory functions
  - cookie: cap expire times to 400 days
  - cookie: parse only the exact expire date
  - curl: return error if etag options are used with multiple URLs
  - curl_multi_fdset: include the shutdown connections in the set
  - curl_sha512_256: rename symbols to the curl namespace
  - curl_url_set.md: adjust the added-in to 7.62.0
  - doh: send HTTPS RR requests for all HTTP(S) transfers
  - easy: allow connect-only handle reuse with easy_perform
  - easy: make curl_easy_perform() return error if connection still there
  - easy_lock: use Sleep(1) for thread yield on old Windows
  - ECH: update APIs to those agreed with OpenSSL maintainers
  - GnuTLS: fix 'time_appconnect' for early data
  - HTTP/2: strip TE request header
  - http2: fix data_pending check
  - http2: fix value stored to 'result' is never read
  - http: ignore invalid Retry-After times
  - http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  - https-connect: start next immediately on failure
  - lib: redirect handling by protocol handler
  - multi: fix curl_multi_waitfds reporting of fd_count
  - netrc: 'default' with no credentials is not a match
  - netrc: fix password-only entries
  - netrc: restore _netrc fallback logic
  - ngtcp2: fix memory leak on connect failure
  - openssl: define `HAVE_KEYLOG_CALLBACK` before use
  - openssl: fix ECH logic
  - osslq: use SSL_poll to determine writeability of QUIC streams
  - sectransp: free certificate on error
  - select: avoid a NULL deref in cwfds_add_sock
  - src: omit hugehelp and ca-embed from libcurltool
  - ssl session cache: change cache dimensions
  - system.h: add 64-bit curl_off_t definitions for NonStop
  - telnet: handle single-byte input option
  - TLS: check connection for SSL use, not handler
  - tool_formparse.c: make curlx_uztoso a static in here
  - tool_formparse: accept digits in --form type= strings
  - tool_getparam: ECH param parsing refix
  - tool_getparam: fail --hostpubsha256 if libssh2 is not used
  - tool_getparam: fix "Ignored Return Value"
  - tool_getparam: fix memory leak on error in parse_ech
  - tool_getparam: fix the ECH parser
  - tool_operate: make --etag-compare always accept a non-existing file
  - transfer: fix CURLOPT_CURLU override logic
  - urlapi: fix redirect to a new fragment or query (only)
  - vquic: make vquic_send_packets not return without setting psent
  - vtls: fix default SSL backend as a fallback
  - vtls: only remember the expiry timestamp in session cache
  - websocket: fix message send corruption
  - x509asn1: add parse recursion limit
    * Rebase pathes:
  - libcurl-ocloexec.patch
  - dont-mess-with-rpmoptflags.patch

++++ curl:

  - Update to 8.12.0:
    * Security fixes:
  - [bsc#1234068, CVE-2024-11053] curl could leak the password used
    for the first host to the followed-to host under certain circumstances.
  - [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  - [bsc#1236589, CVE-2025-0665] eventfd double close
    * Changes:
  - curl: add byte range support to --variable reading from file
  - curl: make --etag-save acknowledge --create-dirs
  - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  - getinfo: provide info which auth was used for HTTP and proxy
  - hyper: drop support
  - openssl: add support to use keys and certificates from PKCS#11 provider
  - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  - vtls: feature ssls-export for SSL session im-/export
    * Bugfixes:
  - altsvc: avoid integer overflow in expire calculation
  - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  - asyn-ares: fix memory leak
  - asyn-ares: initial HTTPS resolve support
  - asyn-thread: use c-ares to resolve HTTPS RR
  - async-thread: avoid closing eventfd twice
  - cd2nroff: do not insist on quoted <> within backticks
  - cd2nroff: support "none" as a TLS backend
  - conncache: count shutdowns against host and max limits
  - content_encoding: drop support for zlib before 1.2.0.4
  - content_encoding: namespace GZIP flag constants
  - content_encoding: put the decomp buffers into the writer structs
  - content_encoding: support use of custom libzstd memory functions
  - cookie: cap expire times to 400 days
  - cookie: parse only the exact expire date
  - curl: return error if etag options are used with multiple URLs
  - curl_multi_fdset: include the shutdown connections in the set
  - curl_sha512_256: rename symbols to the curl namespace
  - curl_url_set.md: adjust the added-in to 7.62.0
  - doh: send HTTPS RR requests for all HTTP(S) transfers
  - easy: allow connect-only handle reuse with easy_perform
  - easy: make curl_easy_perform() return error if connection still there
  - easy_lock: use Sleep(1) for thread yield on old Windows
  - ECH: update APIs to those agreed with OpenSSL maintainers
  - GnuTLS: fix 'time_appconnect' for early data
  - HTTP/2: strip TE request header
  - http2: fix data_pending check
  - http2: fix value stored to 'result' is never read
  - http: ignore invalid Retry-After times
  - http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  - https-connect: start next immediately on failure
  - lib: redirect handling by protocol handler
  - multi: fix curl_multi_waitfds reporting of fd_count
  - netrc: 'default' with no credentials is not a match
  - netrc: fix password-only entries
  - netrc: restore _netrc fallback logic
  - ngtcp2: fix memory leak on connect failure
  - openssl: define `HAVE_KEYLOG_CALLBACK` before use
  - openssl: fix ECH logic
  - osslq: use SSL_poll to determine writeability of QUIC streams
  - sectransp: free certificate on error
  - select: avoid a NULL deref in cwfds_add_sock
  - src: omit hugehelp and ca-embed from libcurltool
  - ssl session cache: change cache dimensions
  - system.h: add 64-bit curl_off_t definitions for NonStop
  - telnet: handle single-byte input option
  - TLS: check connection for SSL use, not handler
  - tool_formparse.c: make curlx_uztoso a static in here
  - tool_formparse: accept digits in --form type= strings
  - tool_getparam: ECH param parsing refix
  - tool_getparam: fail --hostpubsha256 if libssh2 is not used
  - tool_getparam: fix "Ignored Return Value"
  - tool_getparam: fix memory leak on error in parse_ech
  - tool_getparam: fix the ECH parser
  - tool_operate: make --etag-compare always accept a non-existing file
  - transfer: fix CURLOPT_CURLU override logic
  - urlapi: fix redirect to a new fragment or query (only)
  - vquic: make vquic_send_packets not return without setting psent
  - vtls: fix default SSL backend as a fallback
  - vtls: only remember the expiry timestamp in session cache
  - websocket: fix message send corruption
  - x509asn1: add parse recursion limit
    * Rebase pathes:
  - libcurl-ocloexec.patch
  - dont-mess-with-rpmoptflags.patch

++++ sqlite3:

  - Update to release 3.49.0:
    * Enhancements to the query planner:
  - Improve the query-time index optimization so that it works on
    WITHOUT ROWID tables.
  - Better query plans for large star-query joins. This fixes
    three different performance regressions that were reported
    on the SQLite Forum.
  - When two or more queries have the same estimated cost, use
    the one with the fewer bytes per row.
    * Enhance the iif() SQL function so that it can accept any number
    of arguments greater than or equal to two.
    * Enhance the session extension so that it works on databases
    that make use of generated columns.
    * Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which
    was not implemented correctly and never worked right. In its place
    add the SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This
    option applies to command-line tools like the CLI only, not to the
    SQLite core. It causes Win32 APIs to be used for console I/O
    instead of stdio. This option affects Windows builds only.
    * Three new options to sqlite3_db_config(). All default "on".
    SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE
    SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE
    SQLITE_DBCONFIG_ENABLE_COMMENTS

++++ sqlite3:

  - Update to release 3.49.0:
    * Enhancements to the query planner:
  - Improve the query-time index optimization so that it works on
    WITHOUT ROWID tables.
  - Better query plans for large star-query joins. This fixes
    three different performance regressions that were reported
    on the SQLite Forum.
  - When two or more queries have the same estimated cost, use
    the one with the fewer bytes per row.
    * Enhance the iif() SQL function so that it can accept any number
    of arguments greater than or equal to two.
    * Enhance the session extension so that it works on databases
    that make use of generated columns.
    * Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which
    was not implemented correctly and never worked right. In its place
    add the SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This
    option applies to command-line tools like the CLI only, not to the
    SQLite core. It causes Win32 APIs to be used for console I/O
    instead of stdio. This option affects Windows builds only.
    * Three new options to sqlite3_db_config(). All default "on".
    SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE
    SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE
    SQLITE_DBCONFIG_ENABLE_COMMENTS

++++ sqlite3:

  - Update to release 3.49.0:
    * Enhancements to the query planner:
  - Improve the query-time index optimization so that it works on
    WITHOUT ROWID tables.
  - Better query plans for large star-query joins. This fixes
    three different performance regressions that were reported
    on the SQLite Forum.
  - When two or more queries have the same estimated cost, use
    the one with the fewer bytes per row.
    * Enhance the iif() SQL function so that it can accept any number
    of arguments greater than or equal to two.
    * Enhance the session extension so that it works on databases
    that make use of generated columns.
    * Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which
    was not implemented correctly and never worked right. In its place
    add the SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This
    option applies to command-line tools like the CLI only, not to the
    SQLite core. It causes Win32 APIs to be used for console I/O
    instead of stdio. This option affects Windows builds only.
    * Three new options to sqlite3_db_config(). All default "on".
    SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE
    SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE
    SQLITE_DBCONFIG_ENABLE_COMMENTS

++++ sqlite3:

  - Update to release 3.49.0:
    * Enhancements to the query planner:
  - Improve the query-time index optimization so that it works on
    WITHOUT ROWID tables.
  - Better query plans for large star-query joins. This fixes
    three different performance regressions that were reported
    on the SQLite Forum.
  - When two or more queries have the same estimated cost, use
    the one with the fewer bytes per row.
    * Enhance the iif() SQL function so that it can accept any number
    of arguments greater than or equal to two.
    * Enhance the session extension so that it works on databases
    that make use of generated columns.
    * Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which
    was not implemented correctly and never worked right. In its place
    add the SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This
    option applies to command-line tools like the CLI only, not to the
    SQLite core. It causes Win32 APIs to be used for console I/O
    instead of stdio. This option affects Windows builds only.
    * Three new options to sqlite3_db_config(). All default "on".
    SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE
    SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE
    SQLITE_DBCONFIG_ENABLE_COMMENTS

------------------------------------------------------------------
------------------  2025-2-5  -  Feb 5 2025  -------------------
------------------------------------------------------------------

++++ chrony:

  - Update to version 4.6.1:
    * Add ntsaeads directive to enable only selected AEAD algorithms
    for NTS.
    * Negotiate use of compliant NTS keys with AES-128-GCM-SIV AEAD
    algorithm.
    * Switch to compliant NTS keys if first response from server is
    NTS NAK.

++++ tiff:

  - Update test/test_directory.c not to fail on big-endian machines.
    * Add tiff-4.7.0-test_directory.patch
    Fix memory leaks (fixes issue #652)
    * Resolves bsc#1236834
    fix build fail on s390x

++++ pam_pkcs11:

  - Security fix [bsc#1236314, CVE-2025-24531]
    * fix regression returning PAM_IGNORE in many situations with possible authentication bypass
    * Add pam_pkcs11-CVE-2025-24531.patch
  - Fix RPM warnings
  - Add %check section running test suite

++++ pam_pkcs11:

  - Security fix [bsc#1236314, CVE-2025-24531]
    * fix regression returning PAM_IGNORE in many situations with possible authentication bypass
    * Add pam_pkcs11-CVE-2025-24531.patch
  - Fix RPM warnings
  - Add %check section running test suite

++++ pam_pkcs11:

  - Security fix [bsc#1236314, CVE-2025-24531]
    * fix regression returning PAM_IGNORE in many situations with possible authentication bypass
    * Add pam_pkcs11-CVE-2025-24531.patch
  - Fix RPM warnings
  - Add %check section running test suite

++++ skopeo:

  - Add patches for CVE-2024-6104 & CVE-2023-45288
    Add patches:
    * 0001-http2-close-connections-when-receiving-too-many-head.patch (CVE-2023-45288, bsc#1236483)
    * 0002-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch (CVE-2024-6104, bsc#1227056)
    Remove patch:
    * 0001-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
    Skopeo is not affected by the CVE-2024-9676, thus this patch is not necessary

++++ skopeo:

  - Add patches for CVE-2024-6104 & CVE-2023-45288
    Add patches:
    * 0001-http2-close-connections-when-receiving-too-many-head.patch (CVE-2023-45288, bsc#1236483)
    * 0002-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch (CVE-2024-6104, bsc#1227056)
    Remove patch:
    * 0001-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
    Skopeo is not affected by the CVE-2024-9676, thus this patch is not necessary

------------------------------------------------------------------
------------------  2025-2-4  -  Feb 4 2025  -------------------
------------------------------------------------------------------

++++ ca-certificates-mozilla:

  - update to 2.74 state of Mozilla SSL root CAs:
    Removed:
    * SwissSign Silver CA - G2
    Added:
    * D-TRUST BR Root CA 2 2023
    * D-TRUST EV Root CA 2 2023
  - remove extensive signature printing in comments of the cert
    bundle

++++ ca-certificates-mozilla:

  - update to 2.74 state of Mozilla SSL root CAs:
    Removed:
    * SwissSign Silver CA - G2
    Added:
    * D-TRUST BR Root CA 2 2023
    * D-TRUST EV Root CA 2 2023
  - remove extensive signature printing in comments of the cert
    bundle

++++ cloud-init:

  - Add cloud-init-direxist.patch (bsc#1236720)
    + Make sure the directory exists, if not create it, before writing in that
    location.

++++ cloud-init:

  - Add cloud-init-direxist.patch (bsc#1236720)
    + Make sure the directory exists, if not create it, before writing in that
    location.

++++ container-selinux:

  - OBS service file: use the tagged commit for archive versioning and don't
    just archive the latest changes from the main branch using the latest tag

++++ findutils:

  - do not crash when file system loop was encountered [bsc#1231472]
  - added patches
    fix https://git.savannah.gnu.org/cgit/findutils.git/commit/?id=e5d6eb919b9
    + findutils-avoid-crash-system-loop.patch
  - modified patches
    % findutils-xautofs.patch (p1)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311-core:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

++++ python311:

  - Add CVE-2025-0938-sq-brackets-domain-names.patch which
    disallows square brackets ([ and ]) in domain names for parsed
    URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)

------------------------------------------------------------------
------------------  2025-2-2  -  Feb 2 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.8 → 10.2.9

++++ python-kiwi:

  - Bump version: 10.2.8 → 10.2.9

------------------------------------------------------------------
------------------  2025-2-1  -  Feb 1 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.8 → 10.2.9

------------------------------------------------------------------
------------------  2025-1-31  -  Jan 31 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Classify missing chkstat as debug message
    chkstat is a distribution specific tool. If it is
    present we use it, if not we don't but it's not worth
    a warning. This Fixes #2711

++++ python-kiwi:

  - Classify missing chkstat as debug message
    chkstat is a distribution specific tool. If it is
    present we use it, if not we don't but it's not worth
    a warning. This Fixes #2711

------------------------------------------------------------------
------------------  2025-1-30  -  Jan 30 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fix: [bsc#1236590, CVE-2025-0725]
    * content_encoding: drop support for zlib before 1.2.0.4
    * content_encoding: put the decomp buffers into the writer structs
    * Add curl-CVE-2025-0725.patch
  - Security fix: [bsc#1236588, CVE-2025-0167]
    * netrc: 'default' with no credentials is not a match
    * Add curl-CVE-2025-0167.patch

++++ curl:

  - Security fix: [bsc#1236590, CVE-2025-0725]
    * content_encoding: drop support for zlib before 1.2.0.4
    * content_encoding: put the decomp buffers into the writer structs
    * Add curl-CVE-2025-0725.patch
  - Security fix: [bsc#1236588, CVE-2025-0167]
    * netrc: 'default' with no credentials is not a match
    * Add curl-CVE-2025-0167.patch

++++ curl:

  - Security fix: [bsc#1236590, CVE-2025-0725]
    * content_encoding: drop support for zlib before 1.2.0.4
    * content_encoding: put the decomp buffers into the writer structs
    * Add curl-CVE-2025-0725.patch
  - Security fix: [bsc#1236588, CVE-2025-0167]
    * netrc: 'default' with no credentials is not a match
    * Add curl-CVE-2025-0167.patch

++++ curl:

  - Security fix: [bsc#1236590, CVE-2025-0725]
    * content_encoding: drop support for zlib before 1.2.0.4
    * content_encoding: put the decomp buffers into the writer structs
    * Add curl-CVE-2025-0725.patch
  - Security fix: [bsc#1236588, CVE-2025-0167]
    * netrc: 'default' with no credentials is not a match
    * Add curl-CVE-2025-0167.patch

++++ curl:

  - Security fix: [bsc#1236590, CVE-2025-0725]
    * content_encoding: drop support for zlib before 1.2.0.4
    * content_encoding: put the decomp buffers into the writer structs
    * Add curl-CVE-2025-0725.patch
  - Security fix: [bsc#1236588, CVE-2025-0167]
    * netrc: 'default' with no credentials is not a match
    * Add curl-CVE-2025-0167.patch

++++ curl:

  - Security fix: [bsc#1236590, CVE-2025-0725]
    * content_encoding: drop support for zlib before 1.2.0.4
    * content_encoding: put the decomp buffers into the writer structs
    * Add curl-CVE-2025-0725.patch
  - Security fix: [bsc#1236588, CVE-2025-0167]
    * netrc: 'default' with no credentials is not a match
    * Add curl-CVE-2025-0167.patch

++++ curl:

  - Security fix: [bsc#1236590, CVE-2025-0725]
    * content_encoding: drop support for zlib before 1.2.0.4
    * content_encoding: put the decomp buffers into the writer structs
    * Add curl-CVE-2025-0725.patch
  - Security fix: [bsc#1236588, CVE-2025-0167]
    * netrc: 'default' with no credentials is not a match
    * Add curl-CVE-2025-0167.patch

++++ python-kiwi:

  - Classify missing chkstat as debug message
    chkstat is a distribution specific tool. If it is
    present we use it, if not we don't but it's not worth
    a warning. This Fixes #2711
  - Allow to run setfiles multi threaded
    Use option -T0 for newer setfiles version.
    This Fixes #2719
  - Add rd.kiwi.dialog.timeout option
    Allow to configure the timeout value for dialogs displayed
    by the kiwi dracut code. By default the timeout is set to
    60 seconds. With the special value "off" the dialog will
    never timeout. This Fixes #2718
  - Make sure copy actions does not drop context
    Use shutil.copy2 to copy files preserving their
    attributes in the grub BootLoader space.
    This Fixes #2709
  - Improve unit test for archive target_dir
    Add a test case with absolute path in the target_dir
    to make sure we never unpack the archive to the host
    system. The actual issue was resolved together with
    the implementation in #1953 and commit
    78238a993c966d1229cd2fc1f5923673a90de14d
    This Fixes #2701
  - Fixed profiled overlay imports
    When building an image for profile: SOME and providing
    an overlay directory named SOME/... kiwi will sync the
    contents of this overlay directory to the root tree.
    However it took the toplevel name SOME/ into account
    which is unwanted because only the sub data structure
    should be synced into the new root tree. This
    Fixes #2690

++++ python-kiwi:

  - Allow to run setfiles multi threaded
    Use option -T0 for newer setfiles version.
    This Fixes #2719
  - Add rd.kiwi.dialog.timeout option
    Allow to configure the timeout value for dialogs displayed
    by the kiwi dracut code. By default the timeout is set to
    60 seconds. With the special value "off" the dialog will
    never timeout. This Fixes #2718
  - Make sure copy actions does not drop context
    Use shutil.copy2 to copy files preserving their
    attributes in the grub BootLoader space.
    This Fixes #2709
  - Improve unit test for archive target_dir
    Add a test case with absolute path in the target_dir
    to make sure we never unpack the archive to the host
    system. The actual issue was resolved together with
    the implementation in #1953 and commit
    78238a993c966d1229cd2fc1f5923673a90de14d
    This Fixes #2701
  - Fixed profiled overlay imports
    When building an image for profile: SOME and providing
    an overlay directory named SOME/... kiwi will sync the
    contents of this overlay directory to the root tree.
    However it took the toplevel name SOME/ into account
    which is unwanted because only the sub data structure
    should be synced into the new root tree. This
    Fixes #2690

++++ python-kiwi:

  - Allow to run setfiles multi threaded
    Use option -T0 for newer setfiles version.
    This Fixes #2719
  - Add rd.kiwi.dialog.timeout option
    Allow to configure the timeout value for dialogs displayed
    by the kiwi dracut code. By default the timeout is set to
    60 seconds. With the special value "off" the dialog will
    never timeout. This Fixes #2718
  - Make sure copy actions does not drop context
    Use shutil.copy2 to copy files preserving their
    attributes in the grub BootLoader space.
    This Fixes #2709
  - Improve unit test for archive target_dir
    Add a test case with absolute path in the target_dir
    to make sure we never unpack the archive to the host
    system. The actual issue was resolved together with
    the implementation in #1953 and commit
    78238a993c966d1229cd2fc1f5923673a90de14d
    This Fixes #2701
  - Fixed profiled overlay imports
    When building an image for profile: SOME and providing
    an overlay directory named SOME/... kiwi will sync the
    contents of this overlay directory to the root tree.
    However it took the toplevel name SOME/ into account
    which is unwanted because only the sub data structure
    should be synced into the new root tree. This
    Fixes #2690

++++ krb5:

  - Prevent overflow when calculating ulog block size. An authenticated
    attacker can cause kadmind to write beyond the end of the mapped
    region for the iprop log file, likely causing a process crash;
    (CVE-2025-24528); (bsc#1236619).
  - Add patch 0012-Prevent-overflow-when-calculating-ulog-block-size.patch

++++ krb5:

  - Prevent overflow when calculating ulog block size. An authenticated
    attacker can cause kadmind to write beyond the end of the mapped
    region for the iprop log file, likely causing a process crash;
    (CVE-2025-24528); (bsc#1236619).
  - Add patch 0012-Prevent-overflow-when-calculating-ulog-block-size.patch

++++ openssl-3:

  - Security fix: [bsc#1236136, CVE-2024-13176]
    * timing side-channel in the ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch

++++ orc:

  - follow up of CVE-2024-40897 fix [bsc#1228184]
  - added patches
    fix https://gitlab.freedesktop.org/gstreamer/orc/-/commit/13ad22b4bc75feb71cefc6b9c0c9cb81ff8c73c4
    + orc-check-return-value-of-vasprintf.patch

------------------------------------------------------------------
------------------  2025-1-27  -  Jan 27 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.7 → 10.2.8
  - Use multipath child instead of parent device
    On multipath systems we need to find underlying child device
    instead of using parent device.
    This prevents listing all parent devices for a multipath device

++++ python-kiwi:

  - Bump version: 10.2.7 → 10.2.8
  - Use multipath child instead of parent device
    On multipath systems we need to find underlying child device
    instead of using parent device.
    This prevents listing all parent devices for a multipath device

++++ python-kiwi:

  - Bump version: 10.2.7 → 10.2.8
  - Use multipath child instead of parent device
    On multipath systems we need to find underlying child device
    instead of using parent device.
    This prevents listing all parent devices for a multipath device

++++ openssl-3:

  - Security fix: [bsc#1236136, CVE-2024-13176]
    * Fix timing side-channel in ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch

++++ openssl-3:

  - Security fix: [bsc#1236136, CVE-2024-13176]
    * Fix timing side-channel in ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch

++++ openssl-3:

  - Security fix: [bsc#1236136, CVE-2024-13176]
    * Fix timing side-channel in ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch

++++ openssl-3:

  - Security fix: [bsc#1236136, CVE-2024-13176]
    * Fix timing side-channel in ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch

++++ openssl-3:

  - Security fix: [bsc#1236136, CVE-2024-13176]
    * Fix timing side-channel in ECDSA signature computation
    * Add openssl-CVE-2024-13176.patch

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311-core:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ podman:

  - Add patch for CVE-2024-11218 (bsc#1236270):
    * 0001-vendor-update-c-buildah-to-1.33.12.patch
  - Add patch for CVE-2023-45288 (bsc#1236507):
    * 0004-http2-close-connections-when-receiving-too-many-head.patch
  - Add supplemental patch for CVE-2024-6104 (bsc#1227052):
    * 0003-Switch-hashicorp-go-retryablehttp-to-the-SUSE-fork.patch
  - Rebase patch:
    * 0002-Backport-fix-for-CVE-2024-6104.patch
  - Remove patch(es) (merged upstream):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ python311:

  - Configure externally_managed with a bcond
    https://en.opensuse.org/openSUSE:Python:Externally_managed
    bsc#1228165

++++ rust-keylime:

  - Update to version 0.2.7+1:
    * dist: Enable logging for keylime library in the service
    * Bump version to 0.2.7
    * scripts: Download coverage data from Testing Farm directly
    * main: Remove unnecessary lifetime
    * cargo: Bump pretty_env_logger to version 0.5.0
    * scripts: Fix regex in download_packit_coverage.sh
    * cargo: Bump clap crate to version 4.5.23
    * cargo: Bump base64 crate to version 0.22.1
    * build(deps): bump log from 0.4.22 to 0.4.25
    * build(deps): bump serde_json from 1.0.133 to 1.0.135
    * cargo: Bump tokio crate to version 1.42.0
    * packit: Fix RPM builds on copr
    * cargo: Bump thiserror crate to version 0.2.9
    * cargo: Update reqwest to version 0.12.12
    * build(deps): bump libc from 0.2.168 to 0.2.169
    * build(deps): bump glob from 0.3.1 to 0.3.2
    * version: Implement API version validation and ordering
    * main: Support using multiple API versions for registration
    * keylime: Introduce the registrar_client module
    * Provide endpoints under multiple API versions
    * Move 'serialization' module to the keylime library
    * Drop unnecessary dependency on common::API_VERSION
    * keylime-agent.conf: Bump version to 2.3
    * build(deps): bump serde from 1.0.210 to 1.0.217
    * build(deps): bump pest_derive from 2.7.14 to 2.7.15
    * build(deps): bump pest from 2.7.14 to 2.7.15
    * build(deps): bump libc from 0.2.167 to 0.2.168
    * config: Make IAK and IDevID certificates optional
    * Fix warnings reported by clippy
    * workflows: Run job in the CI container directly
    * tests: Add unit test for device ID builder
    * main: Move IAK/IDevID related code to dedicated module
    * tests: Add script to generate IAK and IDevID certificates
    * build(deps): bump openssl from 0.10.66 to 0.10.68
    * build(deps): bump uuid from 1.10.0 to 1.11.0
    * build(deps): bump serde_json from 1.0.128 to 1.0.133
    * build(deps): bump actix-web from 4.5.1 to 4.9.0
    * build(deps): bump reqwest from 0.12.7 to 0.12.9
    * tests/setup_swtpm.sh: Add script to setup temporary TPM
    * Use a single TPM context and avoid race conditions during tests
    * config: Enable passing a hostname instead of IP
    * build(deps): bump clap from 4.3.11 to 4.5.21
    * build(deps): bump tempfile from 3.10.1 to 3.14.0
    * build(deps): bump pest_derive from 2.7.6 to 2.7.14
    * build(deps): bump pest from 2.7.6 to 2.7.14
    * build(deps): bump codecov/codecov-action from 4 to 5
    * workflows: Submit the coverage for merged PR from Fedora 41
    * tests: Use Fedora 41 to generate code coverage
    * api: Make API configuration modular
    * agent_handler: Move the /agent scope configuration
    * notifications_handler: Move the /notifications scope configuration
    * quotes_handler: Move the /quotes scope configuration to quotes_handler
    * keys_handler: Move /keys scope configuration to keys_handler
    * Use ${DESTDIR} for config
    * Fix showing wrong UUID
    * build(deps): bump actix-rt from 2.9.0 to 2.10.0
    * config: Refactor AgentConfig Source trait implementation
    * build(deps): bump log from 0.4.21 to 0.4.22
    * build(deps): bump serde_json from 1.0.120 to 1.0.128
    * tpm: check if EK certificate has valid ASN.1 DER encoding
    * build(deps): bump futures from 0.3.27 to 0.3.31
    * cargo: Bump reqwest to version 0.12.7
    * build(deps): bump serde from 1.0.203 to 1.0.210
    * tests: Add more tests to Packit CI
    * build(deps): bump docker/build-push-action from 5 to 6
    * tests: apply workarounds to known bugs

++++ rust-keylime:

  - Update to version 0.2.7+1:
    * dist: Enable logging for keylime library in the service
    * Bump version to 0.2.7
    * scripts: Download coverage data from Testing Farm directly
    * main: Remove unnecessary lifetime
    * cargo: Bump pretty_env_logger to version 0.5.0
    * scripts: Fix regex in download_packit_coverage.sh
    * cargo: Bump clap crate to version 4.5.23
    * cargo: Bump base64 crate to version 0.22.1
    * build(deps): bump log from 0.4.22 to 0.4.25
    * build(deps): bump serde_json from 1.0.133 to 1.0.135
    * cargo: Bump tokio crate to version 1.42.0
    * packit: Fix RPM builds on copr
    * cargo: Bump thiserror crate to version 0.2.9
    * cargo: Update reqwest to version 0.12.12
    * build(deps): bump libc from 0.2.168 to 0.2.169
    * build(deps): bump glob from 0.3.1 to 0.3.2
    * version: Implement API version validation and ordering
    * main: Support using multiple API versions for registration
    * keylime: Introduce the registrar_client module
    * Provide endpoints under multiple API versions
    * Move 'serialization' module to the keylime library
    * Drop unnecessary dependency on common::API_VERSION
    * keylime-agent.conf: Bump version to 2.3
    * build(deps): bump serde from 1.0.210 to 1.0.217
    * build(deps): bump pest_derive from 2.7.14 to 2.7.15
    * build(deps): bump pest from 2.7.14 to 2.7.15
    * build(deps): bump libc from 0.2.167 to 0.2.168
    * config: Make IAK and IDevID certificates optional
    * Fix warnings reported by clippy
    * workflows: Run job in the CI container directly
    * tests: Add unit test for device ID builder
    * main: Move IAK/IDevID related code to dedicated module
    * tests: Add script to generate IAK and IDevID certificates
    * build(deps): bump openssl from 0.10.66 to 0.10.68
    * build(deps): bump uuid from 1.10.0 to 1.11.0
    * build(deps): bump serde_json from 1.0.128 to 1.0.133
    * build(deps): bump actix-web from 4.5.1 to 4.9.0
    * build(deps): bump reqwest from 0.12.7 to 0.12.9
    * tests/setup_swtpm.sh: Add script to setup temporary TPM
    * Use a single TPM context and avoid race conditions during tests
    * config: Enable passing a hostname instead of IP
    * build(deps): bump clap from 4.3.11 to 4.5.21
    * build(deps): bump tempfile from 3.10.1 to 3.14.0
    * build(deps): bump pest_derive from 2.7.6 to 2.7.14
    * build(deps): bump pest from 2.7.6 to 2.7.14
    * build(deps): bump codecov/codecov-action from 4 to 5
    * workflows: Submit the coverage for merged PR from Fedora 41
    * tests: Use Fedora 41 to generate code coverage
    * api: Make API configuration modular
    * agent_handler: Move the /agent scope configuration
    * notifications_handler: Move the /notifications scope configuration
    * quotes_handler: Move the /quotes scope configuration to quotes_handler
    * keys_handler: Move /keys scope configuration to keys_handler
    * Use ${DESTDIR} for config
    * Fix showing wrong UUID
    * build(deps): bump actix-rt from 2.9.0 to 2.10.0
    * config: Refactor AgentConfig Source trait implementation
    * build(deps): bump log from 0.4.21 to 0.4.22
    * build(deps): bump serde_json from 1.0.120 to 1.0.128
    * tpm: check if EK certificate has valid ASN.1 DER encoding
    * build(deps): bump futures from 0.3.27 to 0.3.31
    * cargo: Bump reqwest to version 0.12.7
    * build(deps): bump serde from 1.0.203 to 1.0.210
    * tests: Add more tests to Packit CI
    * build(deps): bump docker/build-push-action from 5 to 6
    * tests: apply workarounds to known bugs

++++ rust-keylime:

  - Update to version 0.2.7+1:
    * dist: Enable logging for keylime library in the service
    * Bump version to 0.2.7
    * scripts: Download coverage data from Testing Farm directly
    * main: Remove unnecessary lifetime
    * cargo: Bump pretty_env_logger to version 0.5.0
    * scripts: Fix regex in download_packit_coverage.sh
    * cargo: Bump clap crate to version 4.5.23
    * cargo: Bump base64 crate to version 0.22.1
    * build(deps): bump log from 0.4.22 to 0.4.25
    * build(deps): bump serde_json from 1.0.133 to 1.0.135
    * cargo: Bump tokio crate to version 1.42.0
    * packit: Fix RPM builds on copr
    * cargo: Bump thiserror crate to version 0.2.9
    * cargo: Update reqwest to version 0.12.12
    * build(deps): bump libc from 0.2.168 to 0.2.169
    * build(deps): bump glob from 0.3.1 to 0.3.2
    * version: Implement API version validation and ordering
    * main: Support using multiple API versions for registration
    * keylime: Introduce the registrar_client module
    * Provide endpoints under multiple API versions
    * Move 'serialization' module to the keylime library
    * Drop unnecessary dependency on common::API_VERSION
    * keylime-agent.conf: Bump version to 2.3
    * build(deps): bump serde from 1.0.210 to 1.0.217
    * build(deps): bump pest_derive from 2.7.14 to 2.7.15
    * build(deps): bump pest from 2.7.14 to 2.7.15
    * build(deps): bump libc from 0.2.167 to 0.2.168
    * config: Make IAK and IDevID certificates optional
    * Fix warnings reported by clippy
    * workflows: Run job in the CI container directly
    * tests: Add unit test for device ID builder
    * main: Move IAK/IDevID related code to dedicated module
    * tests: Add script to generate IAK and IDevID certificates
    * build(deps): bump openssl from 0.10.66 to 0.10.68
    * build(deps): bump uuid from 1.10.0 to 1.11.0
    * build(deps): bump serde_json from 1.0.128 to 1.0.133
    * build(deps): bump actix-web from 4.5.1 to 4.9.0
    * build(deps): bump reqwest from 0.12.7 to 0.12.9
    * tests/setup_swtpm.sh: Add script to setup temporary TPM
    * Use a single TPM context and avoid race conditions during tests
    * config: Enable passing a hostname instead of IP
    * build(deps): bump clap from 4.3.11 to 4.5.21
    * build(deps): bump tempfile from 3.10.1 to 3.14.0
    * build(deps): bump pest_derive from 2.7.6 to 2.7.14
    * build(deps): bump pest from 2.7.6 to 2.7.14
    * build(deps): bump codecov/codecov-action from 4 to 5
    * workflows: Submit the coverage for merged PR from Fedora 41
    * tests: Use Fedora 41 to generate code coverage
    * api: Make API configuration modular
    * agent_handler: Move the /agent scope configuration
    * notifications_handler: Move the /notifications scope configuration
    * quotes_handler: Move the /quotes scope configuration to quotes_handler
    * keys_handler: Move /keys scope configuration to keys_handler
    * Use ${DESTDIR} for config
    * Fix showing wrong UUID
    * build(deps): bump actix-rt from 2.9.0 to 2.10.0
    * config: Refactor AgentConfig Source trait implementation
    * build(deps): bump log from 0.4.21 to 0.4.22
    * build(deps): bump serde_json from 1.0.120 to 1.0.128
    * tpm: check if EK certificate has valid ASN.1 DER encoding
    * build(deps): bump futures from 0.3.27 to 0.3.31
    * cargo: Bump reqwest to version 0.12.7
    * build(deps): bump serde from 1.0.203 to 1.0.210
    * tests: Add more tests to Packit CI
    * build(deps): bump docker/build-push-action from 5 to 6
    * tests: apply workarounds to known bugs

++++ rust-keylime:

  - Update to version 0.2.7+1:
    * dist: Enable logging for keylime library in the service
    * Bump version to 0.2.7
    * scripts: Download coverage data from Testing Farm directly
    * main: Remove unnecessary lifetime
    * cargo: Bump pretty_env_logger to version 0.5.0
    * scripts: Fix regex in download_packit_coverage.sh
    * cargo: Bump clap crate to version 4.5.23
    * cargo: Bump base64 crate to version 0.22.1
    * build(deps): bump log from 0.4.22 to 0.4.25
    * build(deps): bump serde_json from 1.0.133 to 1.0.135
    * cargo: Bump tokio crate to version 1.42.0
    * packit: Fix RPM builds on copr
    * cargo: Bump thiserror crate to version 0.2.9
    * cargo: Update reqwest to version 0.12.12
    * build(deps): bump libc from 0.2.168 to 0.2.169
    * build(deps): bump glob from 0.3.1 to 0.3.2
    * version: Implement API version validation and ordering
    * main: Support using multiple API versions for registration
    * keylime: Introduce the registrar_client module
    * Provide endpoints under multiple API versions
    * Move 'serialization' module to the keylime library
    * Drop unnecessary dependency on common::API_VERSION
    * keylime-agent.conf: Bump version to 2.3
    * build(deps): bump serde from 1.0.210 to 1.0.217
    * build(deps): bump pest_derive from 2.7.14 to 2.7.15
    * build(deps): bump pest from 2.7.14 to 2.7.15
    * build(deps): bump libc from 0.2.167 to 0.2.168
    * config: Make IAK and IDevID certificates optional
    * Fix warnings reported by clippy
    * workflows: Run job in the CI container directly
    * tests: Add unit test for device ID builder
    * main: Move IAK/IDevID related code to dedicated module
    * tests: Add script to generate IAK and IDevID certificates
    * build(deps): bump openssl from 0.10.66 to 0.10.68
    * build(deps): bump uuid from 1.10.0 to 1.11.0
    * build(deps): bump serde_json from 1.0.128 to 1.0.133
    * build(deps): bump actix-web from 4.5.1 to 4.9.0
    * build(deps): bump reqwest from 0.12.7 to 0.12.9
    * tests/setup_swtpm.sh: Add script to setup temporary TPM
    * Use a single TPM context and avoid race conditions during tests
    * config: Enable passing a hostname instead of IP
    * build(deps): bump clap from 4.3.11 to 4.5.21
    * build(deps): bump tempfile from 3.10.1 to 3.14.0
    * build(deps): bump pest_derive from 2.7.6 to 2.7.14
    * build(deps): bump pest from 2.7.6 to 2.7.14
    * build(deps): bump codecov/codecov-action from 4 to 5
    * workflows: Submit the coverage for merged PR from Fedora 41
    * tests: Use Fedora 41 to generate code coverage
    * api: Make API configuration modular
    * agent_handler: Move the /agent scope configuration
    * notifications_handler: Move the /notifications scope configuration
    * quotes_handler: Move the /quotes scope configuration to quotes_handler
    * keys_handler: Move /keys scope configuration to keys_handler
    * Use ${DESTDIR} for config
    * Fix showing wrong UUID
    * build(deps): bump actix-rt from 2.9.0 to 2.10.0
    * config: Refactor AgentConfig Source trait implementation
    * build(deps): bump log from 0.4.21 to 0.4.22
    * build(deps): bump serde_json from 1.0.120 to 1.0.128
    * tpm: check if EK certificate has valid ASN.1 DER encoding
    * build(deps): bump futures from 0.3.27 to 0.3.31
    * cargo: Bump reqwest to version 0.12.7
    * build(deps): bump serde from 1.0.203 to 1.0.210
    * tests: Add more tests to Packit CI
    * build(deps): bump docker/build-push-action from 5 to 6
    * tests: apply workarounds to known bugs

------------------------------------------------------------------
------------------  2025-1-25  -  Jan 25 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Increase size for agama integration test build
    Agama needs more space to build now
  - Fixed agama integration test
    rubygem-byebug and rubygem-agama-yast seems to
    no longer exist
  - Update TW integration tests
    Package nscd was dropped from TW

++++ python-kiwi:

  - Increase size for agama integration test build
    Agama needs more space to build now
  - Fixed agama integration test
    rubygem-byebug and rubygem-agama-yast seems to
    no longer exist
  - Update TW integration tests
    Package nscd was dropped from TW

++++ python-kiwi:

  - Increase size for agama integration test build
    Agama needs more space to build now
  - Fixed agama integration test
    rubygem-byebug and rubygem-agama-yast seems to
    no longer exist
  - Update TW integration tests
    Package nscd was dropped from TW

------------------------------------------------------------------
------------------  2025-1-23  -  Jan 23 2025  -------------------
------------------------------------------------------------------

++++ NetworkManager:

  - Add config-server subpackage (bsc#1224868).

++++ NetworkManager:

  - Add config-server subpackage (bsc#1224868).

++++ ca-certificates-mozilla:

  - Define two macros to break a build cycle with p11-kit.

++++ ca-certificates-mozilla:

  - Define two macros to break a build cycle with p11-kit.

++++ glibc:

  - assert-message-allocation.patch: Fix underallocation of abort_msg_s
    struct (CVE-2025-0395, bsc#1236282, BZ #32582))

++++ glibc:

  - assert-message-allocation.patch: Fix underallocation of abort_msg_s
    struct (CVE-2025-0395, bsc#1236282, BZ #32582))

++++ glibc:

  - assert-message-allocation.patch: Fix underallocation of abort_msg_s
    struct (CVE-2025-0395, bsc#1236282, BZ #32582))

++++ glibc:

  - assert-message-allocation.patch: Fix underallocation of abort_msg_s
    struct (CVE-2025-0395, bsc#1236282, BZ #32582))

++++ rsync:

  - Bump protocol version to 32 - make it easier to show server is patched.
    * Add rsync-protocol-version-32.patch

++++ rsync:

  - Bump protocol version to 32 - make it easier to show server is patched.
    * Add rsync-protocol-version-32.patch

------------------------------------------------------------------
------------------  2025-1-22  -  Jan 22 2025  -------------------
------------------------------------------------------------------

++++ chrony:

  - Drop rcFOO symlinks for CODE16 (PED-266).

++++ python-kiwi:

  - Fix documentation regarding URI styles
    In reference to commit 760a65558f9e2e91d3eaa3a2f9503ff596984b48
    the support for iso:// URI types was dropped some time ago.
    However, the documentation was not properly updated. This
    commit fixes it

++++ python-kiwi:

  - Fix documentation regarding URI styles
    In reference to commit 760a65558f9e2e91d3eaa3a2f9503ff596984b48
    the support for iso:// URI types was dropped some time ago.
    However, the documentation was not properly updated. This
    commit fixes it

++++ python-kiwi:

  - Fix documentation regarding URI styles
    In reference to commit 760a65558f9e2e91d3eaa3a2f9503ff596984b48
    the support for iso:// URI types was dropped some time ago.
    However, the documentation was not properly updated. This
    commit fixes it

++++ grub2:

  - Fix CVE-2024-49504 (bsc#1229163) (bsc#1229164)
  - Restrict CLI access if the encrypted root device is automatically unlocked by
    the TPM. LUKS password authentication is required for access to be granted
    * 0001-cli_lock-Add-build-option-to-block-command-line-inte.patch
    * 0002-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch
  - Obsolete, as CLI access is now locked and granted access no longer requires
    the previous restrictions
    * 0002-Restrict-file-access-on-cryptodisk-print.patch
    * 0003-Restrict-ls-and-auto-file-completion-on-cryptodisk-p.patch
  - Rediff
    * 0004-Key-revocation-on-out-of-bound-file-access.patch

++++ grub2:

  - Fix CVE-2024-49504 (bsc#1229163) (bsc#1229164)
  - Restrict CLI access if the encrypted root device is automatically unlocked by
    the TPM. LUKS password authentication is required for access to be granted
    * 0001-cli_lock-Add-build-option-to-block-command-line-inte.patch
    * 0002-Requiring-authentication-after-tpm-unlock-for-CLI-ac.patch
  - Obsolete, as CLI access is now locked and granted access no longer requires
    the previous restrictions
    * 0002-Restrict-file-access-on-cryptodisk-print.patch
    * 0003-Restrict-ls-and-auto-file-completion-on-cryptodisk-p.patch
  - Rediff
    * 0004-Key-revocation-on-out-of-bound-file-access.patch

++++ libzypp:

  - Create '.keep_packages' in the package cache dir to enforce
    keeping downloaded packages of all repos cahed there (bsc#1232458)
  - version 17.35.19 (35)

++++ libzypp:

  - Create '.keep_packages' in the package cache dir to enforce
    keeping downloaded packages of all repos cahed there (bsc#1232458)
  - version 17.35.19 (35)

++++ libzypp:

  - Create '.keep_packages' in the package cache dir to enforce
    keeping downloaded packages of all repos cahed there (bsc#1232458)
  - version 17.35.19 (35)

++++ zypper:

  - lr: show the repositories keep-packages flag (bsc#1232458)
    It is shown in the  details view or by using -k,--keep-packages.
    In addition libyzpp supports to enforce keeping downloaded
    packages of all repos within a package cache by creating a
    '.keep_packages' file there.
  - version 1.14.81

++++ zypper:

  - lr: show the repositories keep-packages flag (bsc#1232458)
    It is shown in the  details view or by using -k,--keep-packages.
    In addition libyzpp supports to enforce keeping downloaded
    packages of all repos within a package cache by creating a
    '.keep_packages' file there.
  - version 1.14.81

------------------------------------------------------------------
------------------  2025-1-21  -  Jan 21 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix return value of grub helper methods
    The grub helper methods to find grub tools returns a
    None value if the tool cannot be found. This None value
    could be used later in a Command call where it will be
    used in a join() command to log the resulting commandline.
    This join() call then fails and raises an unhandled error
    causing a stack trace in the application. This commit
    fixes it

++++ python-kiwi:

  - Fix return value of grub helper methods
    The grub helper methods to find grub tools returns a
    None value if the tool cannot be found. This None value
    could be used later in a Command call where it will be
    used in a join() command to log the resulting commandline.
    This join() call then fails and raises an unhandled error
    causing a stack trace in the application. This commit
    fixes it

++++ python-kiwi:

  - Fix return value of grub helper methods
    The grub helper methods to find grub tools returns a
    None value if the tool cannot be found. This None value
    could be used later in a Command call where it will be
    used in a join() command to log the resulting commandline.
    This join() call then fails and raises an unhandled error
    causing a stack trace in the application. This commit
    fixes it

++++ pam_u2f:

  - update to 1.3.2:
    * Relax authfile permission check to a warning instead of an error to prevent
    a breaking change locking existing users out of their systems.

------------------------------------------------------------------
------------------  2025-1-20  -  Jan 20 2025  -------------------
------------------------------------------------------------------

++++ cloud-init:

  - Support python 3.13 (bsc#1233649):
    + pep-594-drop-pipes.patch, gh#canonical/cloud-init#4392
    + cloud-init-fix-python313.patch, gh#canonical/cloud-init#4669
    + cloud-init-dont-assume-ordering-of-ThreadPoolExecutor.patch gh#canonical/cloud-init#5052

++++ cloud-init:

  - Support python 3.13 (bsc#1233649):
    + pep-594-drop-pipes.patch, gh#canonical/cloud-init#4392
    + cloud-init-fix-python313.patch, gh#canonical/cloud-init#4669
    + cloud-init-dont-assume-ordering-of-ThreadPoolExecutor.patch gh#canonical/cloud-init#5052

++++ python-kiwi:

  - Added disk validation for duplicate installs
    Installing the same image to different storage disks on the
    same machine creates device conflicts with unexpected side
    effects. This commit adds a validation based on the PTUUID
    of the disk image to check if another device on the system
    has the same ID and if yes, does not allow to install the
    image again including a message which device takes the same
    identifier. This references bsc#1228741
  - Fixed documentation for signing key attribute
    The source locator name for local files was incorrect

++++ python-kiwi:

  - Added disk validation for duplicate installs
    Installing the same image to different storage disks on the
    same machine creates device conflicts with unexpected side
    effects. This commit adds a validation based on the PTUUID
    of the disk image to check if another device on the system
    has the same ID and if yes, does not allow to install the
    image again including a message which device takes the same
    identifier. This references bsc#1228741
  - Fixed documentation for signing key attribute
    The source locator name for local files was incorrect

++++ python-kiwi:

  - Added disk validation for duplicate installs
    Installing the same image to different storage disks on the
    same machine creates device conflicts with unexpected side
    effects. This commit adds a validation based on the PTUUID
    of the disk image to check if another device on the system
    has the same ID and if yes, does not allow to install the
    image again including a message which device takes the same
    identifier. This references bsc#1228741
  - Fixed documentation for signing key attribute
    The source locator name for local files was incorrect

++++ libzypp:

  - Fix missing UID checks in repomanager workflow (fixes #603)
  - version 17.35.18 (35)
  - Move cmake config files to LIB_INSTALL_DIR/cmake/Zypp (fixes #28)
  - Fix 'zypper ps' when running in incus container (bsc#1229106)
    Should apply to lxc and lxd containers as well.
  - Re-enable 'rpm --runposttrans' usage for chrooted systems
    (bsc#1216091)
  - version 17.35.17 (35)

++++ libzypp:

  - Fix missing UID checks in repomanager workflow (fixes #603)
  - version 17.35.18 (35)
  - Move cmake config files to LIB_INSTALL_DIR/cmake/Zypp (fixes #28)
  - Fix 'zypper ps' when running in incus container (bsc#1229106)
    Should apply to lxc and lxd containers as well.
  - Re-enable 'rpm --runposttrans' usage for chrooted systems
    (bsc#1216091)
  - version 17.35.17 (35)

++++ libzypp:

  - Fix missing UID checks in repomanager workflow (fixes #603)
  - version 17.35.18 (35)
  - Move cmake config files to LIB_INSTALL_DIR/cmake/Zypp (fixes #28)
  - Fix 'zypper ps' when running in incus container (bsc#1229106)
    Should apply to lxc and lxd containers as well.
  - Re-enable 'rpm --runposttrans' usage for chrooted systems
    (bsc#1216091)
  - version 17.35.17 (35)

------------------------------------------------------------------
------------------  2025-1-18  -  Jan 18 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.6 → 10.2.7
  - Update documentation
    Added a new troubleshooting chapter as subsection to
    the Build Host Constraints named Package Manager Behavior.
    It serves the purpose to describe options for the customer
    to change the default package manager behavior which
    we from the kiwi side do not influence intentionally.
    This is a followup change to bsc#1235448

++++ python-kiwi:

  - Bump version: 10.2.6 → 10.2.7
  - Update documentation
    Added a new troubleshooting chapter as subsection to
    the Build Host Constraints named Package Manager Behavior.
    It serves the purpose to describe options for the customer
    to change the default package manager behavior which
    we from the kiwi side do not influence intentionally.
    This is a followup change to bsc#1235448

++++ python-kiwi:

  - Bump version: 10.2.6 → 10.2.7
  - Update documentation
    Added a new troubleshooting chapter as subsection to
    the Build Host Constraints named Package Manager Behavior.
    It serves the purpose to describe options for the customer
    to change the default package manager behavior which
    we from the kiwi side do not influence intentionally.
    This is a followup change to bsc#1235448

------------------------------------------------------------------
------------------  2025-1-17  -  Jan 17 2025  -------------------
------------------------------------------------------------------

++++ zypper:

  - Try to refresh update repos first to have updated GPG keys on
    the fly (bsc#1234752)
    An update repo may contain a prolonged GPG key for the GA repo.
    Refreshing the update repo first updates a trusted key on the fly
    and avoids a 'key has expired' warning being issued when
    refreshing the GA repo.
  - Refresh: restore legacy behavior and suppress Exception
    reporting as non-root (bsc#1235636)
  - version 1.14.80

++++ zypper:

  - Try to refresh update repos first to have updated GPG keys on
    the fly (bsc#1234752)
    An update repo may contain a prolonged GPG key for the GA repo.
    Refreshing the update repo first updates a trusted key on the fly
    and avoids a 'key has expired' warning being issued when
    refreshing the GA repo.
  - Refresh: restore legacy behavior and suppress Exception
    reporting as non-root (bsc#1235636)
  - version 1.14.80

------------------------------------------------------------------
------------------  2025-1-16  -  Jan 16 2025  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.32.4:
    * add missing tag for build during merge workflow
    * ci: re-use local source to build binary images
    * ci: use local source for binary builds

++++ docker-compose:

  - Update to version 2.32.4:
    * add missing tag for build during merge workflow
    * ci: re-use local source to build binary images
    * ci: use local source for binary builds

++++ docker-compose:

  - Update to version 2.32.4:
    * add missing tag for build during merge workflow
    * ci: re-use local source to build binary images
    * ci: use local source for binary builds

++++ git:

  - Add CVE-2024-50349-1.patch, CVE-2024-50349-2.patch
    * CVE-2024-50349: passwords for trusted sites could be sent to untrusted
    sites (bsc#1235600)
  - Add CVE-2024-52006.patch
    * CVE-2024-52006: Carriage Returns via the credential protocol to credential
    helpers (bsc#1235601)

++++ sqlite3:

  - Re-enable SONAME which got disabled by default in 3.48.0.
    * https://www.sqlite.org/src/forumpost/5a3b44f510df8ded
    * https://sqlite.org/forum/forumpost/ab8f15697a

++++ sqlite3:

  - Re-enable SONAME which got disabled by default in 3.48.0.
    * https://www.sqlite.org/src/forumpost/5a3b44f510df8ded
    * https://sqlite.org/forum/forumpost/ab8f15697a

++++ sqlite3:

  - Re-enable SONAME which got disabled by default in 3.48.0.
    * https://www.sqlite.org/src/forumpost/5a3b44f510df8ded
    * https://sqlite.org/forum/forumpost/ab8f15697a

++++ sqlite3:

  - Re-enable SONAME which got disabled by default in 3.48.0.
    * https://www.sqlite.org/src/forumpost/5a3b44f510df8ded
    * https://sqlite.org/forum/forumpost/ab8f15697a

------------------------------------------------------------------
------------------  2025-1-15  -  Jan 15 2025  -------------------
------------------------------------------------------------------

++++ libsolv:

  - Provide a symbol specific for the ruby-version
    so yast does not break across updates (boo#1235598)

++++ libsolv:

  - Provide a symbol specific for the ruby-version
    so yast does not break across updates (boo#1235598)

++++ libsolv:

  - Provide a symbol specific for the ruby-version
    so yast does not break across updates (boo#1235598)

++++ systemd:

  - Add 0004-core-create-the-credential-directory-even-if-it-s-em.patch (bsc#1229228)
  - Import commit d7a56d70fb052f738442c2874b072d6514242050 (merge of v254.23)
    f028f2298e hwdb: comment out the entry for Logitech MX Keys for Mac
    e808cbdd6d test: answer 2nd mdadm --create question for compat with new version
    bf01f3d692 core/unit-serialize: fix serialization of markers
    f043ab6f34 locale-setup: do not load locale from environemnt when /etc/locale.conf is unchanged
    71efbe69b6 core: fix assert when AddDependencyUnitFiles is called with invalid parameter

++++ systemd:

  - Add 0004-core-create-the-credential-directory-even-if-it-s-em.patch (bsc#1229228)
  - Import commit d7a56d70fb052f738442c2874b072d6514242050 (merge of v254.23)
    eab1d9753b stdio-bridge: fix polled fds
    f028f2298e hwdb: comment out the entry for Logitech MX Keys for Mac
    e808cbdd6d test: answer 2nd mdadm --create question for compat with new version
    bf01f3d692 core/unit-serialize: fix serialization of markers
    f043ab6f34 locale-setup: do not load locale from environemnt when /etc/locale.conf is unchanged
    71efbe69b6 core: fix assert when AddDependencyUnitFiles is called with invalid parameter

++++ systemd:

  - Add 0004-core-create-the-credential-directory-even-if-it-s-em.patch (bsc#1229228)
  - Import commit d7a56d70fb052f738442c2874b072d6514242050 (merge of v254.23)
    eab1d9753b stdio-bridge: fix polled fds
    f028f2298e hwdb: comment out the entry for Logitech MX Keys for Mac
    e808cbdd6d test: answer 2nd mdadm --create question for compat with new version
    bf01f3d692 core/unit-serialize: fix serialization of markers
    f043ab6f34 locale-setup: do not load locale from environemnt when /etc/locale.conf is unchanged
    71efbe69b6 core: fix assert when AddDependencyUnitFiles is called with invalid parameter

++++ systemd:

  - Add 0004-core-create-the-credential-directory-even-if-it-s-em.patch (bsc#1229228)
  - Import commit d7a56d70fb052f738442c2874b072d6514242050 (merge of v254.23)
    eab1d9753b stdio-bridge: fix polled fds
    f028f2298e hwdb: comment out the entry for Logitech MX Keys for Mac
    e808cbdd6d test: answer 2nd mdadm --create question for compat with new version
    bf01f3d692 core/unit-serialize: fix serialization of markers
    f043ab6f34 locale-setup: do not load locale from environemnt when /etc/locale.conf is unchanged
    71efbe69b6 core: fix assert when AddDependencyUnitFiles is called with invalid parameter

++++ systemd:

  - Add 0004-core-create-the-credential-directory-even-if-it-s-em.patch (bsc#1229228)
  - Import commit d7a56d70fb052f738442c2874b072d6514242050 (merge of v254.23)
    eab1d9753b stdio-bridge: fix polled fds
    f028f2298e hwdb: comment out the entry for Logitech MX Keys for Mac
    e808cbdd6d test: answer 2nd mdadm --create question for compat with new version
    bf01f3d692 core/unit-serialize: fix serialization of markers
    f043ab6f34 locale-setup: do not load locale from environemnt when /etc/locale.conf is unchanged
    71efbe69b6 core: fix assert when AddDependencyUnitFiles is called with invalid parameter

++++ systemd:

  - Add 0004-core-create-the-credential-directory-even-if-it-s-em.patch (bsc#1229228)
  - Import commit d7a56d70fb052f738442c2874b072d6514242050 (merge of v254.23)
    eab1d9753b stdio-bridge: fix polled fds
    f028f2298e hwdb: comment out the entry for Logitech MX Keys for Mac
    e808cbdd6d test: answer 2nd mdadm --create question for compat with new version
    bf01f3d692 core/unit-serialize: fix serialization of markers
    f043ab6f34 locale-setup: do not load locale from environemnt when /etc/locale.conf is unchanged
    71efbe69b6 core: fix assert when AddDependencyUnitFiles is called with invalid parameter

++++ pam_u2f:

  - update to 1.3.1:
    * Fix incorrect usage of PAM_IGNORE (YSA-2025-01, CVE-2025-23013).
    * Changed return value when nouserok is enabled and the user has no
    credentials, PAM_IGNORE is used instead of PAM_SUCCESS.
    * Hardened checks of authfile permissions.
    * Hardened checks for nouserok.
    * Improved debug messages.
    * Improved documentation.

++++ rsync:

  - Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED
    * Added rsync-fix-FLAG_GOT_DIR_FLIST.patch

++++ rsync:

  - Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED
    * Added rsync-fix-FLAG_GOT_DIR_FLIST.patch

++++ salt:

  - Revert setting SELinux context for minion service (bsc#1233667)
  - Remove System V init support
  - Make systemd the only supported init system by removing System V init
    and insserv references
  - Ensure package builds with no init system dependencies if built
    without systemd (for example for use in containers)
  - Apply some spec-cleaner suggestions (update copyright year, sort
    requirements, adjust spacing)
  - Signed-off-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
  - Fix the condition of alternatives for Tumbleweed and Leap 16
  - Use update-alternatives for salt-call and fix builing on EL8
  - Build all python bindings for all flavors
  - Make minion reconnecting on changing master IP (bsc#1228182)
  - Handle logger exception when flushing already closed file
  - Include passlib as a recommended dependency
  - Make Salt Bundle more tolerant to long running jobs (bsc#1228690)
  - Fix additional x509 tests and test_suse tests for SLE12
  - Added:
    * enhance-cleanup-mechanism-after-salt-bundle-upgrade-.patch
    * revert-setting-selinux-context-for-minion-service-bs.patch
    * handle-logger-flushing-already-closed-file-686.patch
    * fix-x509-private-key-tests-and-test_suse-on-sle12-68.patch
    * make-minion-reconnecting-on-changing-master-ip-bsc-1.patch

++++ salt:

  - Revert setting SELinux context for minion service (bsc#1233667)
  - Remove System V init support
  - Make systemd the only supported init system by removing System V init
    and insserv references
  - Ensure package builds with no init system dependencies if built
    without systemd (for example for use in containers)
  - Apply some spec-cleaner suggestions (update copyright year, sort
    requirements, adjust spacing)
  - Signed-off-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
  - Fix the condition of alternatives for Tumbleweed and Leap 16
  - Use update-alternatives for salt-call and fix builing on EL8
  - Build all python bindings for all flavors
  - Make minion reconnecting on changing master IP (bsc#1228182)
  - Handle logger exception when flushing already closed file
  - Include passlib as a recommended dependency
  - Make Salt Bundle more tolerant to long running jobs (bsc#1228690)
  - Fix additional x509 tests and test_suse tests for SLE12
  - Added:
    * enhance-cleanup-mechanism-after-salt-bundle-upgrade-.patch
    * revert-setting-selinux-context-for-minion-service-bs.patch
    * handle-logger-flushing-already-closed-file-686.patch
    * fix-x509-private-key-tests-and-test_suse-on-sle12-68.patch
    * make-minion-reconnecting-on-changing-master-ip-bsc-1.patch

++++ salt:

  - Revert setting SELinux context for minion service (bsc#1233667)
  - Remove System V init support
  - Make systemd the only supported init system by removing System V init
    and insserv references
  - Ensure package builds with no init system dependencies if built
    without systemd (for example for use in containers)
  - Apply some spec-cleaner suggestions (update copyright year, sort
    requirements, adjust spacing)
  - Signed-off-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
  - Fix the condition of alternatives for Tumbleweed and Leap 16
  - Use update-alternatives for salt-call and fix builing on EL8
  - Build all python bindings for all flavors
  - Make minion reconnecting on changing master IP (bsc#1228182)
  - Handle logger exception when flushing already closed file
  - Include passlib as a recommended dependency
  - Make Salt Bundle more tolerant to long running jobs (bsc#1228690)
  - Fix additional x509 tests and test_suse tests for SLE12
  - Added:
    * enhance-cleanup-mechanism-after-salt-bundle-upgrade-.patch
    * revert-setting-selinux-context-for-minion-service-bs.patch
    * handle-logger-flushing-already-closed-file-686.patch
    * fix-x509-private-key-tests-and-test_suse-on-sle12-68.patch
    * make-minion-reconnecting-on-changing-master-ip-bsc-1.patch

++++ salt:

  - Revert setting SELinux context for minion service (bsc#1233667)
  - Remove System V init support
  - Make systemd the only supported init system by removing System V init
    and insserv references
  - Ensure package builds with no init system dependencies if built
    without systemd (for example for use in containers)
  - Apply some spec-cleaner suggestions (update copyright year, sort
    requirements, adjust spacing)
  - Signed-off-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
  - Fix the condition of alternatives for Tumbleweed and Leap 16
  - Use update-alternatives for salt-call and fix builing on EL8
  - Build all python bindings for all flavors
  - Make minion reconnecting on changing master IP (bsc#1228182)
  - Handle logger exception when flushing already closed file
  - Include passlib as a recommended dependency
  - Make Salt Bundle more tolerant to long running jobs (bsc#1228690)
  - Fix additional x509 tests and test_suse tests for SLE12
  - Added:
    * enhance-cleanup-mechanism-after-salt-bundle-upgrade-.patch
    * revert-setting-selinux-context-for-minion-service-bs.patch
    * handle-logger-flushing-already-closed-file-686.patch
    * fix-x509-private-key-tests-and-test_suse-on-sle12-68.patch
    * make-minion-reconnecting-on-changing-master-ip-bsc-1.patch

++++ salt:

  - Revert setting SELinux context for minion service (bsc#1233667)
  - Remove System V init support
  - Make systemd the only supported init system by removing System V init
    and insserv references
  - Ensure package builds with no init system dependencies if built
    without systemd (for example for use in containers)
  - Apply some spec-cleaner suggestions (update copyright year, sort
    requirements, adjust spacing)
  - Signed-off-by: Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
  - Fix the condition of alternatives for Tumbleweed and Leap 16
  - Use update-alternatives for salt-call and fix builing on EL8
  - Build all python bindings for all flavors
  - Make minion reconnecting on changing master IP (bsc#1228182)
  - Handle logger exception when flushing already closed file
  - Include passlib as a recommended dependency
  - Make Salt Bundle more tolerant to long running jobs (bsc#1228690)
  - Fix additional x509 tests and test_suse tests for SLE12
  - Added:
    * enhance-cleanup-mechanism-after-salt-bundle-upgrade-.patch
    * revert-setting-selinux-context-for-minion-service-bs.patch
    * handle-logger-flushing-already-closed-file-686.patch
    * fix-x509-private-key-tests-and-test_suse-on-sle12-68.patch
    * make-minion-reconnecting-on-changing-master-ip-bsc-1.patch

------------------------------------------------------------------
------------------  2025-1-14  -  Jan 14 2025  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Drop still present tox artifacts
    There were still some left over tox files and the
    documentation contribution chapter was also wrong at
    several places

++++ python-kiwi:

  - Drop still present tox artifacts
    There were still some left over tox files and the
    documentation contribution chapter was also wrong at
    several places

++++ python-kiwi:

  - Drop still present tox artifacts
    There were still some left over tox files and the
    documentation contribution chapter was also wrong at
    several places

++++ git:

  - update to 2.48.1: (boo#1235600 boo#1235601)
    * CVE-2024-50349, CVE-2024-52006:
    refuse to accept URLs that contain control sequences

++++ sqlite3:

  - Update to release 3.48.0:
    * Improved EXPLAIN QUERY PLAN output for covering indexes.
    * Allow a two-argument version of the iif() SQL function.
    * Also allow if() as an alternative spelling for iif().
    * Add the ".dbtotxt" command to the CLI.
    * Add the SQLITE_IOCAP_SUBPAGE_READ property to the
    xDeviceCharacteristics method of the sqlite3_io_methods object.
    * Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3()
    that prevents warning messages being sent to the error log if
    the SQL is ill-formed. This allows sqlite3_prepare_v3() to be
    used to do test compiles of SQL to check for validity without
    polluting the error log with false messages.
    * Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from
    1 to 30.
    * Added the SQLITE_FCNTL_NULL_IO file control.
    * Extend the FTS5 auxiliary API xInstToken() to work with prefix
    queries via the insttoken configuration option and the
    fts5_insttoken() SQL function.
    * Increase the maximum number of arguments to an SQL function
    from 127 to 1000.
    * Obsoletes sqlite3-6216bfcb.patch .

++++ sqlite3:

  - Update to release 3.48.0:
    * Improved EXPLAIN QUERY PLAN output for covering indexes.
    * Allow a two-argument version of the iif() SQL function.
    * Also allow if() as an alternative spelling for iif().
    * Add the ".dbtotxt" command to the CLI.
    * Add the SQLITE_IOCAP_SUBPAGE_READ property to the
    xDeviceCharacteristics method of the sqlite3_io_methods object.
    * Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3()
    that prevents warning messages being sent to the error log if
    the SQL is ill-formed. This allows sqlite3_prepare_v3() to be
    used to do test compiles of SQL to check for validity without
    polluting the error log with false messages.
    * Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from
    1 to 30.
    * Added the SQLITE_FCNTL_NULL_IO file control.
    * Extend the FTS5 auxiliary API xInstToken() to work with prefix
    queries via the insttoken configuration option and the
    fts5_insttoken() SQL function.
    * Increase the maximum number of arguments to an SQL function
    from 127 to 1000.
    * Obsoletes sqlite3-6216bfcb.patch .

++++ sqlite3:

  - Update to release 3.48.0:
    * Improved EXPLAIN QUERY PLAN output for covering indexes.
    * Allow a two-argument version of the iif() SQL function.
    * Also allow if() as an alternative spelling for iif().
    * Add the ".dbtotxt" command to the CLI.
    * Add the SQLITE_IOCAP_SUBPAGE_READ property to the
    xDeviceCharacteristics method of the sqlite3_io_methods object.
    * Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3()
    that prevents warning messages being sent to the error log if
    the SQL is ill-formed. This allows sqlite3_prepare_v3() to be
    used to do test compiles of SQL to check for validity without
    polluting the error log with false messages.
    * Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from
    1 to 30.
    * Added the SQLITE_FCNTL_NULL_IO file control.
    * Extend the FTS5 auxiliary API xInstToken() to work with prefix
    queries via the insttoken configuration option and the
    fts5_insttoken() SQL function.
    * Increase the maximum number of arguments to an SQL function
    from 127 to 1000.
    * Obsoletes sqlite3-6216bfcb.patch .

++++ sqlite3:

  - Update to release 3.48.0:
    * Improved EXPLAIN QUERY PLAN output for covering indexes.
    * Allow a two-argument version of the iif() SQL function.
    * Also allow if() as an alternative spelling for iif().
    * Add the ".dbtotxt" command to the CLI.
    * Add the SQLITE_IOCAP_SUBPAGE_READ property to the
    xDeviceCharacteristics method of the sqlite3_io_methods object.
    * Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3()
    that prevents warning messages being sent to the error log if
    the SQL is ill-formed. This allows sqlite3_prepare_v3() to be
    used to do test compiles of SQL to check for validity without
    polluting the error log with false messages.
    * Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from
    1 to 30.
    * Added the SQLITE_FCNTL_NULL_IO file control.
    * Extend the FTS5 auxiliary API xInstToken() to work with prefix
    queries via the insttoken configuration option and the
    fts5_insttoken() SQL function.
    * Increase the maximum number of arguments to an SQL function
    from 127 to 1000.
    * Obsoletes sqlite3-6216bfcb.patch .

++++ rsync:

  - Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links
    * Added rsync-CVE-2024-12747.patch

++++ rsync:

  - Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links
    * Added rsync-CVE-2024-12747.patch

------------------------------------------------------------------
------------------  2025-1-13  -  Jan 13 2025  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.32.3:
    * ci: update bake-action to v6
    * simplification
    * image can be set to a local ID, that isn't a valid docker ref
    * can't render progress concurrently with buildkit
    * exclude one-off container running convergence
    * Only override service mac if set on the main network.

++++ docker-compose:

  - Update to version 2.32.3:
    * ci: update bake-action to v6
    * simplification
    * image can be set to a local ID, that isn't a valid docker ref
    * can't render progress concurrently with buildkit
    * exclude one-off container running convergence
    * Only override service mac if set on the main network.

++++ docker-compose:

  - Update to version 2.32.3:
    * ci: update bake-action to v6
    * simplification
    * image can be set to a local ID, that isn't a valid docker ref
    * can't render progress concurrently with buildkit
    * exclude one-off container running convergence
    * Only override service mac if set on the main network.

++++ python-kiwi:

  - Add support for reading optional pkgmgr env file
    If there is a file .kiwi.package_manager.env in the root of
    the image tree it will be read and put into the caller environment for
    the selected package and repository manager. There are features
    in e.g zypper which can only be used via env variables.
    This Fixes bsc#1235448
  - Auto convert unit test XML data to schema v8.3
  - Rename btrfs_root_is_snapshot
    Rename btrfs_root_is_snapshot to btrfs_root_is_snapper_snapshot.
    This happens in preparation for the changes suggested in #2697
    where we want to get rid of snapper specific btrfs code which
    will be available in snapper natively soon. To make sure a btrfs
    layout specific to snapper(and SUSE), the implicitly used attribute
    named btrfs_root_is_snapshot now becomes explicit and its new
    name will indicate that snapper sits behind it. Along with the
    rename a XSLT stylesheet to automatically convert the old name
    into the new name for schema v8.3 will be performed.
  - Bump version: 10.2.5 → 10.2.6

++++ python-kiwi:

  - Add support for reading optional pkgmgr env file
    If there is a file .kiwi.package_manager.env in the root of
    the image tree it will be read and put into the caller environment for
    the selected package and repository manager. There are features
    in e.g zypper which can only be used via env variables.
    This Fixes bsc#1235448
  - Auto convert unit test XML data to schema v8.3
  - Rename btrfs_root_is_snapshot
    Rename btrfs_root_is_snapshot to btrfs_root_is_snapper_snapshot.
    This happens in preparation for the changes suggested in #2697
    where we want to get rid of snapper specific btrfs code which
    will be available in snapper natively soon. To make sure a btrfs
    layout specific to snapper(and SUSE), the implicitly used attribute
    named btrfs_root_is_snapshot now becomes explicit and its new
    name will indicate that snapper sits behind it. Along with the
    rename a XSLT stylesheet to automatically convert the old name
    into the new name for schema v8.3 will be performed.
  - Bump version: 10.2.5 → 10.2.6

++++ python-kiwi:

  - Add support for reading optional pkgmgr env file
    If there is a file .kiwi.package_manager.env in the root of
    the image tree it will be read and put into the caller environment for
    the selected package and repository manager. There are features
    in e.g zypper which can only be used via env variables.
    This Fixes bsc#1235448
  - Auto convert unit test XML data to schema v8.3
  - Rename btrfs_root_is_snapshot
    Rename btrfs_root_is_snapshot to btrfs_root_is_snapper_snapshot.
    This happens in preparation for the changes suggested in #2697
    where we want to get rid of snapper specific btrfs code which
    will be available in snapper natively soon. To make sure a btrfs
    layout specific to snapper(and SUSE), the implicitly used attribute
    named btrfs_root_is_snapshot now becomes explicit and its new
    name will indicate that snapper sits behind it. Along with the
    rename a XSLT stylesheet to automatically convert the old name
    into the new name for schema v8.3 will be performed.
  - Bump version: 10.2.5 → 10.2.6

++++ git:

  - update to 2.48.0
    * Reference consistency checks: git refs verify
    * Reflogs can now be migrated with git refs migrate
    * git is free of memory leaks as covered by the test suite
    * Performance improvements
    * Other improvements, UI changes, options extensions and largely
    compatible behavior changes as listed in
    https://raw.githubusercontent.com/git/git/refs/tags/v2.48.0/Documentation/RelNotes/2.48.0.txt

++++ tiff:

  - Fix versioning of tiff-docs under Recommends

------------------------------------------------------------------
------------------  2025-1-12  -  Jan 12 2025  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.25. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.25>
    <https://github.com/containerd/containerd/releases/tag/v1.7.24>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.25. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.25>
    <https://github.com/containerd/containerd/releases/tag/v1.7.24>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.25. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.25>
    <https://github.com/containerd/containerd/releases/tag/v1.7.24>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

------------------------------------------------------------------
------------------  2025-1-10  -  Jan 10 2025  -------------------
------------------------------------------------------------------

++++ container-selinux:

  - Update to version 2.234.2:
    * TMT: enable epel idomatically
    * Packit: switch back to fedora-all
    * RPM: Bump Epoch to 4
    * rpm: ship manpage
    * Add proper labeling for RamaLama
    * Packit: remove rhel / epel jobs
    * packit: remove unused file

++++ python-kiwi:

  - Fixed donate button target

++++ python-kiwi:

  - Fixed donate button target

++++ python-kiwi:

  - Fixed donate button target

------------------------------------------------------------------
------------------  2025-1-9  -  Jan 9 2025  -------------------
------------------------------------------------------------------

++++ container-selinux:

  - Add BuildRequires selinux-policy-%{selinuxtype} to enable building
    for SLFO. Might be removed in the future again when 1231252
    is fixed.

++++ glibc:

  - prctl-syscall-wrapper.patch: Linux: Switch back to assembly syscall
    wrapper for prctl (bsc#1234665, BZ #29770)

++++ glibc:

  - prctl-syscall-wrapper.patch: Linux: Switch back to assembly syscall
    wrapper for prctl (bsc#1234665, BZ #29770)

++++ glibc:

  - prctl-syscall-wrapper.patch: Linux: Switch back to assembly syscall
    wrapper for prctl (bsc#1234665, BZ #29770)

++++ glibc:

  - prctl-syscall-wrapper.patch: Linux: Switch back to assembly syscall
    wrapper for prctl (bsc#1234665, BZ #29770)

++++ sssd:

  - Fix possible race evaluating GPO based access policies;
    (CVE-2023-3758); (bsc#1223100); Add patch
    0005-ad-gpo-use-hash-to-store-intermediate-results.patch

++++ sssd:

  - Fix possible race evaluating GPO based access policies;
    (CVE-2023-3758); (bsc#1223100); Add patch
    0005-ad-gpo-use-hash-to-store-intermediate-results.patch

++++ rsync:

  - Security update, fix multiple vulnerabilities:
    * CVE-2024-12084, bsc#1234100 - Heap Buffer Overflow in Checksum Parsing
    * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR
    * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files
    * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links
    * CVE-2024-12088, bsc#1234104 - --safe-links Bypass
    * Added rsync-CVE-2024-12084-overflow-01.patch
    * Added rsync-CVE-2024-12084-overflow-02.patch
    * Added rsync-CVE-2024-12085.patch
    * Added rsync-CVE-2024-12086_01.patch
    * Added rsync-CVE-2024-12086_02.patch
    * Added rsync-CVE-2024-12086_03.patch
    * Added rsync-CVE-2024-12086_04.patch
    * Added rsync-CVE-2024-12087_01.patch
    * Added rsync-CVE-2024-12087_02.patch
    * Added rsync-CVE-2024-12088.patch

++++ rsync:

  - Security update, fix multiple vulnerabilities:
    * CVE-2024-12084, bsc#1234100 - Heap Buffer Overflow in Checksum Parsing
    * CVE-2024-12085, bsc#1234101 - Info Leak via uninitialized Stack contents defeats ASLR
    * CVE-2024-12086, bsc#1234102 - Server leaks arbitrary client files
    * CVE-2024-12087, bsc#1234103 - Server can make client write files outside of destination directory using symbolic links
    * CVE-2024-12088, bsc#1234104 - --safe-links Bypass
    * Added rsync-CVE-2024-12084-overflow-01.patch
    * Added rsync-CVE-2024-12084-overflow-02.patch
    * Added rsync-CVE-2024-12085.patch
    * Added rsync-CVE-2024-12086_01.patch
    * Added rsync-CVE-2024-12086_02.patch
    * Added rsync-CVE-2024-12086_03.patch
    * Added rsync-CVE-2024-12086_04.patch
    * Added rsync-CVE-2024-12087_01.patch
    * Added rsync-CVE-2024-12087_02.patch
    * Added rsync-CVE-2024-12088.patch

------------------------------------------------------------------
------------------  2025-1-8  -  Jan 8 2025  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.32.2:
    * remove engine v25 from e2e test matrix The 1st version
    available for Ubuntu 24.x is Docker Engine v26
    * fix relative path in compose file
    * bump compose-go to v2.4.7
    * replace tibdex/github-app-token by official GitHub
    create-github-app-token
    * bump golang.org/x/net to v0.33.0 to fix potential security
    issue https://github.com/golang/go/issues/70906
    * checkExpectedVolumes must ignore anonymous volumes
    * When retrying to resolveOrCreateNetwork, retry with a valid
    network name
    * only check bind mount conflict if sync action is involved
    * use the 3 latest major versions of the engine to run e2e step
    * bump Golang version to v1.22.10 and update CI actions
    * add --pull to run command
    * CI to validate fmt
    * `make fmt` so any contributor can enforce formatting
    * format code with gofumpt

++++ docker-compose:

  - Update to version 2.32.2:
    * remove engine v25 from e2e test matrix The 1st version
    available for Ubuntu 24.x is Docker Engine v26
    * fix relative path in compose file
    * bump compose-go to v2.4.7
    * replace tibdex/github-app-token by official GitHub
    create-github-app-token
    * bump golang.org/x/net to v0.33.0 to fix potential security
    issue https://github.com/golang/go/issues/70906
    * checkExpectedVolumes must ignore anonymous volumes
    * When retrying to resolveOrCreateNetwork, retry with a valid
    network name
    * only check bind mount conflict if sync action is involved
    * use the 3 latest major versions of the engine to run e2e step
    * bump Golang version to v1.22.10 and update CI actions
    * add --pull to run command
    * CI to validate fmt
    * `make fmt` so any contributor can enforce formatting
    * format code with gofumpt

++++ docker-compose:

  - Update to version 2.32.2:
    * remove engine v25 from e2e test matrix The 1st version
    available for Ubuntu 24.x is Docker Engine v26
    * fix relative path in compose file
    * bump compose-go to v2.4.7
    * replace tibdex/github-app-token by official GitHub
    create-github-app-token
    * bump golang.org/x/net to v0.33.0 to fix potential security
    issue https://github.com/golang/go/issues/70906
    * checkExpectedVolumes must ignore anonymous volumes
    * When retrying to resolveOrCreateNetwork, retry with a valid
    network name
    * only check bind mount conflict if sync action is involved
    * use the 3 latest major versions of the engine to run e2e step
    * bump Golang version to v1.22.10 and update CI actions
    * add --pull to run command
    * CI to validate fmt
    * `make fmt` so any contributor can enforce formatting
    * format code with gofumpt

++++ python-kiwi:

  - Added LUKS reencryption support
    Added rd.kiwi.oem.luks.reencrypt boot option consumed by the
    kiwi-repart dracut module. For OEM LUKS2 encrypted disk images.
    If set, reencrypts the disk prior an eventual resize and therefore
    creates a new key pool and master key. The reencryption is advisable
    if the image binary is not protected. With access to the image
    binary it's possible to extract the luks header which then allows to
    decrypt the data unless it was reencrypted. The reencryption process
    only runs if the checksum of the luks header still matches the one
    from the original disk image. Be aware that the reencryption will
    ask for the passphrase if the image has been built with an initial
    luks passphrase.
  - Fixed arm/tumbleweed/test-image-rpi
    No ruby required for this integration test build

++++ python-kiwi:

  - Added LUKS reencryption support
    Added rd.kiwi.oem.luks.reencrypt boot option consumed by the
    kiwi-repart dracut module. For OEM LUKS2 encrypted disk images.
    If set, reencrypts the disk prior an eventual resize and therefore
    creates a new key pool and master key. The reencryption is advisable
    if the image binary is not protected. With access to the image
    binary it's possible to extract the luks header which then allows to
    decrypt the data unless it was reencrypted. The reencryption process
    only runs if the checksum of the luks header still matches the one
    from the original disk image. Be aware that the reencryption will
    ask for the passphrase if the image has been built with an initial
    luks passphrase.
  - Fixed arm/tumbleweed/test-image-rpi
    No ruby required for this integration test build

++++ python-kiwi:

  - Added LUKS reencryption support
    Added rd.kiwi.oem.luks.reencrypt boot option consumed by the
    kiwi-repart dracut module. For OEM LUKS2 encrypted disk images.
    If set, reencrypts the disk prior an eventual resize and therefore
    creates a new key pool and master key. The reencryption is advisable
    if the image binary is not protected. With access to the image
    binary it's possible to extract the luks header which then allows to
    decrypt the data unless it was reencrypted. The reencryption process
    only runs if the checksum of the luks header still matches the one
    from the original disk image. Be aware that the reencryption will
    ask for the passphrase if the image has been built with an initial
    luks passphrase.
  - Fixed arm/tumbleweed/test-image-rpi
    No ruby required for this integration test build

++++ zypper:

  - info: Allow to query a specific version (jsc#PED-11268)
    To query for a specific version simply append "-<version>" or
    "-<version>-<release>" to the "<name>" pattern. Note that the
    edition part must always match exactly.
  - version 1.14.79

++++ zypper:

  - info: Allow to query a specific version (jsc#PED-11268)
    To query for a specific version simply append "-<version>" or
    "-<version>-<release>" to the "<name>" pattern. Note that the
    edition part must always match exactly.
  - version 1.14.79

------------------------------------------------------------------
------------------  2025-1-7  -  Jan 7 2025  -------------------
------------------------------------------------------------------

++++ curl:

  - smtp: for starttls, do full upgrade [bsc#1235151]
    * Make sure the TLS handshake after a successful STARTTLS command
    is fully done before further sending/receiving on the connection.
    * Add curl-mstp-starttls.patch

++++ curl:

  - smtp: for starttls, do full upgrade [bsc#1235151]
    * Make sure the TLS handshake after a successful STARTTLS command
    is fully done before further sending/receiving on the connection.
    * Add curl-mstp-starttls.patch

++++ curl:

  - smtp: for starttls, do full upgrade [bsc#1235151]
    * Make sure the TLS handshake after a successful STARTTLS command
    is fully done before further sending/receiving on the connection.
    * Add curl-mstp-starttls.patch

++++ curl:

  - smtp: for starttls, do full upgrade [bsc#1235151]
    * Make sure the TLS handshake after a successful STARTTLS command
    is fully done before further sending/receiving on the connection.
    * Add curl-mstp-starttls.patch

++++ curl:

  - smtp: for starttls, do full upgrade [bsc#1235151]
    * Make sure the TLS handshake after a successful STARTTLS command
    is fully done before further sending/receiving on the connection.
    * Add curl-mstp-starttls.patch

++++ curl:

  - smtp: for starttls, do full upgrade [bsc#1235151]
    * Make sure the TLS handshake after a successful STARTTLS command
    is fully done before further sending/receiving on the connection.
    * Add curl-mstp-starttls.patch

++++ curl:

  - smtp: for starttls, do full upgrade [bsc#1235151]
    * Make sure the TLS handshake after a successful STARTTLS command
    is fully done before further sending/receiving on the connection.
    * Add curl-mstp-starttls.patch

++++ python-kiwi:

  - Plain zipl loader needs boot partition
    If the rootfs is something zipl cannot read, we need an
    extra boot partition using a supported filesystem
  - Fixed IBM-Cloud-Standard profile
    The test-image-MicroOS integration test builds an IBM-Cloud-Standard
    profile as encrypted variant with a random key that is not protected
    by an encrypted boot image. This doesn't make sense. Thus the
    encryption setup for the IBM cloud standard build got removed.
    Use the IBM-Cloud-Secure-Execution profile to test encrypted
    secure linux builds
  - Fixed test-image-qcow-openstack
    rsh package was dropped from TW

++++ python-kiwi:

  - Plain zipl loader needs boot partition
    If the rootfs is something zipl cannot read, we need an
    extra boot partition using a supported filesystem
  - Fixed IBM-Cloud-Standard profile
    The test-image-MicroOS integration test builds an IBM-Cloud-Standard
    profile as encrypted variant with a random key that is not protected
    by an encrypted boot image. This doesn't make sense. Thus the
    encryption setup for the IBM cloud standard build got removed.
    Use the IBM-Cloud-Secure-Execution profile to test encrypted
    secure linux builds
  - Fixed test-image-qcow-openstack
    rsh package was dropped from TW

++++ python-kiwi:

  - Plain zipl loader needs boot partition
    If the rootfs is something zipl cannot read, we need an
    extra boot partition using a supported filesystem
  - Fixed IBM-Cloud-Standard profile
    The test-image-MicroOS integration test builds an IBM-Cloud-Standard
    profile as encrypted variant with a random key that is not protected
    by an encrypted boot image. This doesn't make sense. Thus the
    encryption setup for the IBM cloud standard build got removed.
    Use the IBM-Cloud-Secure-Execution profile to test encrypted
    secure linux builds
  - Fixed test-image-qcow-openstack
    rsh package was dropped from TW

++++ glibc:

  - Correctly determine livepatching support

++++ glibc:

  - Correctly determine livepatching support

++++ glibc:

  - Correctly determine livepatching support

++++ glibc:

  - Correctly determine livepatching support

++++ gstreamer:

  - Add CVE-2024-47606.patch: avoid integer overflow when allocating
    sysmem (boo#1234449 CVE-2024-47606).
  - Add various CVE fixes:
    + CVE-2024-47538.patch (boo#1234415 CVE-2024-47538)
    + CVE-2024-47835.patch (boo#1234450 CVe-2024-47835)
    + CVE-2024-47600.patch (boo#1234453 CVE-2024-47600)
    + CVE-2024-47615.patch (boo#1234456 CVE-2024-47615)
    + CVE-2024-47541.patch (boo#1234459 CVE-2024-47541)
    + CVE-2024-47542.patch (boo#1234460 CVE-2024-47542)
    + CVE-2024-47607.patch (boo#1234455 CVE-2024-47607)

++++ gstreamer-plugins-base:

  - Add various CVE fixes:
    + CVE-2024-47538.patch (boo#1234415 CVE-2024-47538)
    + CVE-2024-47835.patch (boo#1234450 CVe-2024-47835)
    + CVE-2024-47600.patch (boo#1234453 CVE-2024-47600)
    + CVE-2024-47615.patch (boo#1234456 CVE-2024-47615)
    + CVE-2024-47541.patch (boo#1234459 CVE-2024-47541)
    + CVE-2024-47542.patch (boo#1234460 CVE-2024-47542)
    + CVE-2024-47607.patch (boo#1234455 CVE-2024-47607)

++++ python-dnspython:

  - Add upstream patches to solve CVE-2023-29483:
  - CVE-2023-29483.patch
    (bsc#1222693, CVE-2023-29483, gh#rthalley/dnspython#1044)

++++ runc:

  - Update to runc v1.2.4. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.4>.
  - Update runc.keyring to match upstream.

++++ runc:

  - Update to runc v1.2.4. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.4>.
  - Update runc.keyring to match upstream.

++++ runc:

  - Update to runc v1.2.4. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.4>.
  - Update runc.keyring to match upstream.

++++ runc:

  - Update to runc v1.2.4. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.4>.
  - Update runc.keyring to match upstream.

------------------------------------------------------------------
------------------  2025-1-6  -  Jan 6 2025  -------------------
------------------------------------------------------------------

++++ cloud-init:

  - Add cloud-init-wait-for-net.patch (bsc#1227237)
    + Wait for udev once if we cannot find the expected MAC

++++ cloud-init:

  - Add cloud-init-wait-for-net.patch (bsc#1227237)
    + Wait for udev once if we cannot find the expected MAC

++++ cloud-init:

  - Add cloud-init-wait-for-net.patch (bsc#1227237)
    + Wait for udev once if we cannot find the expected MAC

++++ iptables:

  - Add iptables-1.8.9-fix-checking-existence-of-rule.patch
    * Fixes checking existence of rules. Fixes issues with rule creation
    with podman/netavark. (bsc#1235088, bsc#1234996)

++++ libvirt:

  - security: apparmor: Fix probing of apparmor availability on the
    VM host when using modular daemons
    bsc#1235079

------------------------------------------------------------------
------------------  2025-1-4  -  Jan 4 2025  -------------------
------------------------------------------------------------------

++++ nvidia-open-driver-G06-signed:

  - set-FOP_UNSIGNED_OFFSET-for-nv_drm_fops.fop_flags.patch
    * needed for Kernel 6.12 for 565.57.01 driver; already fixed
    for 550.142
  - -> https://forums.developer.nvidia.com/t/patch-for-565-57-01-linux-kernel-6-12/313260

------------------------------------------------------------------
------------------  2025-1-2  -  Jan 2 2025  -------------------
------------------------------------------------------------------

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-40896 [bsc#1234812], XXE vulnerability
    + libxml2-CVE-2024-40896.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-40896 [bsc#1234812], XXE vulnerability
    + libxml2-CVE-2024-40896.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-40896 [bsc#1234812], XXE vulnerability
    + libxml2-CVE-2024-40896.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-40896 [bsc#1234812], XXE vulnerability
    + libxml2-CVE-2024-40896.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-40896 [bsc#1234812], XXE vulnerability
    + libxml2-CVE-2024-40896.patch

++++ libxml2:

  - security update
  - added patches
    fix CVE-2024-40896 [bsc#1234812], XXE vulnerability
    + libxml2-CVE-2024-40896.patch

++++ libxml2-python:

  - security update
  - added patches
    fix CVE-2024-40896 [bsc#1234812], XXE vulnerability
    + libxml2-CVE-2024-40896.patch

------------------------------------------------------------------
------------------  2024-12-31  -  Dec 31 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix genprotimg for s390 builds
    A recent change on genprotimg now forbids to use --cert in
    combination with --no-verify, even though this was allowed
    before.

++++ python-kiwi:

  - Fix genprotimg for s390 builds
    A recent change on genprotimg now forbids to use --cert in
    combination with --no-verify, even though this was allowed
    before.

++++ python-kiwi:

  - Fix genprotimg for s390 builds
    A recent change on genprotimg now forbids to use --cert in
    combination with --no-verify, even though this was allowed
    before.

------------------------------------------------------------------
------------------  2024-12-27  -  Dec 27 2024  -------------------
------------------------------------------------------------------

++++ python-Jinja2:

  - Add security patch CVE-2024-56201.patch (bsc#1234808)
  - Add security patch CVE-2024-56326.patch (bsc#1234809)

++++ python-Jinja2:

  - Add security patch CVE-2024-56201.patch (bsc#1234808)
  - Add security patch CVE-2024-56326.patch (bsc#1234809)

------------------------------------------------------------------
------------------  2024-12-24  -  Dec 24 2024  -------------------
------------------------------------------------------------------

++++ systemd:

  - Fix systemd-network recommending libidn2-devel (boo#1234765)

++++ systemd:

  - Fix systemd-network recommending libidn2-devel (boo#1234765)

++++ systemd:

  - Fix systemd-network recommending libidn2-devel (boo#1234765)

++++ systemd:

  - Fix systemd-network recommending libidn2-devel (boo#1234765)

++++ systemd:

  - Fix systemd-network recommending libidn2-devel (boo#1234765)

++++ systemd:

  - Fix systemd-network recommending libidn2-devel (boo#1234765)

------------------------------------------------------------------
------------------  2024-12-23  -  Dec 23 2024  -------------------
------------------------------------------------------------------

++++ systemd:

  - Import commit 679c57667db0e755271f392775908d18e4976406
    679c57667d tpm2-util: Also retry unsealing after policy_pcr returns PCR_CHANGED (boo#1233752 bsc#1234313)
  - Import commit 8752ef2f258c62470bef3bb24ca1ef3a969ac474 (merge of v254.22)
    This merge includes the following fix:
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e107182cb3dd1702b291d0455bdabcb7db28e537...8752ef2f258c62470bef3bb24ca1ef3a969ac474

++++ systemd:

  - Import commit 679c57667db0e755271f392775908d18e4976406
    679c57667d tpm2-util: Also retry unsealing after policy_pcr returns PCR_CHANGED (boo#1233752 bsc#1234313)
  - Import commit 8752ef2f258c62470bef3bb24ca1ef3a969ac474 (merge of v254.22)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e107182cb3dd1702b291d0455bdabcb7db28e537...8752ef2f258c62470bef3bb24ca1ef3a969ac474

++++ systemd:

  - Import commit 679c57667db0e755271f392775908d18e4976406
    679c57667d tpm2-util: Also retry unsealing after policy_pcr returns PCR_CHANGED (boo#1233752 bsc#1234313)
  - Import commit 8752ef2f258c62470bef3bb24ca1ef3a969ac474 (merge of v254.22)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e107182cb3dd1702b291d0455bdabcb7db28e537...8752ef2f258c62470bef3bb24ca1ef3a969ac474

++++ systemd:

  - Import commit 679c57667db0e755271f392775908d18e4976406
    679c57667d tpm2-util: Also retry unsealing after policy_pcr returns PCR_CHANGED (boo#1233752 bsc#1234313)
  - Import commit 8752ef2f258c62470bef3bb24ca1ef3a969ac474 (merge of v254.22)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e107182cb3dd1702b291d0455bdabcb7db28e537...8752ef2f258c62470bef3bb24ca1ef3a969ac474

++++ systemd:

  - Import commit 679c57667db0e755271f392775908d18e4976406
    679c57667d tpm2-util: Also retry unsealing after policy_pcr returns PCR_CHANGED (boo#1233752 bsc#1234313)
  - Import commit 8752ef2f258c62470bef3bb24ca1ef3a969ac474 (merge of v254.22)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e107182cb3dd1702b291d0455bdabcb7db28e537...8752ef2f258c62470bef3bb24ca1ef3a969ac474

++++ systemd:

  - Import commit 679c57667db0e755271f392775908d18e4976406
    679c57667d tpm2-util: Also retry unsealing after policy_pcr returns PCR_CHANGED (boo#1233752 bsc#1234313)
  - Import commit 8752ef2f258c62470bef3bb24ca1ef3a969ac474 (merge of v254.22)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e107182cb3dd1702b291d0455bdabcb7db28e537...8752ef2f258c62470bef3bb24ca1ef3a969ac474

++++ regionServiceClientConfigAzure:

  - Update to version 2.2.2
    + Replacing certificate for rgnsrv-azure-southeastasia to get
    rid of weird chain cert
  - Update to version 2.2.1
    + New 4096 certificate for rgnsrv-azure-southeastasia

++++ regionServiceClientConfigEC2:

  - Update to version 4.3.2
    + Fix us-east-1 cert
  - Update to version 4.3.1
    + New 4096 certificate for rgnsrv-ec2-us-east1

------------------------------------------------------------------
------------------  2024-12-20  -  Dec 20 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix documentation for repo, package gpg settings
    In contrast to the documentation, kiwi sets default values
    for any gpg setting if not explicitly specified differently.
    We want to avoid to inherit a behavior from how the distribution
    packages the package manager. This commit fixes the documentation
    to be in line with the implementation

++++ python-kiwi:

  - Fix documentation for repo, package gpg settings
    In contrast to the documentation, kiwi sets default values
    for any gpg setting if not explicitly specified differently.
    We want to avoid to inherit a behavior from how the distribution
    packages the package manager. This commit fixes the documentation
    to be in line with the implementation

++++ python-kiwi:

  - Fix documentation for repo, package gpg settings
    In contrast to the documentation, kiwi sets default values
    for any gpg setting if not explicitly specified differently.
    We want to avoid to inherit a behavior from how the distribution
    packages the package manager. This commit fixes the documentation
    to be in line with the implementation

++++ qemu:

  - Properly fix bsc#1232283:
    * nbd/server: avoid per-NBDRequest nbd_client_get/put() (bsc#1232283)

++++ qemu:

  - Properly fix bsc#1232283:
    * nbd/server: avoid per-NBDRequest nbd_client_get/put() (bsc#1232283)

++++ qemu:

  - Properly fix bsc#1232283:
    * nbd/server: avoid per-NBDRequest nbd_client_get/put() (bsc#1232283)

------------------------------------------------------------------
------------------  2024-12-19  -  Dec 19 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Drop insecure and unsupported md5 digest
    Decommission the Checksum.md5() method and move all places
    in code to sha256(). The md5 digest is considered insecure
    and has also been removed from hashlib as a supported digest.
    This Fixes #2696
  - Fix config functions action
    The action failed on the setup of the runtime because the upgrade
    of pip failed.
  - Bump version: 10.2.4 → 10.2.5

++++ python-kiwi:

  - Drop insecure and unsupported md5 digest
    Decommission the Checksum.md5() method and move all places
    in code to sha256(). The md5 digest is considered insecure
    and has also been removed from hashlib as a supported digest.
    This Fixes #2696
  - Fix config functions action
    The action failed on the setup of the runtime because the upgrade
    of pip failed.
  - Bump version: 10.2.4 → 10.2.5

++++ python-kiwi:

  - Drop insecure and unsupported md5 digest
    Decommission the Checksum.md5() method and move all places
    in code to sha256(). The md5 digest is considered insecure
    and has also been removed from hashlib as a supported digest.
    This Fixes #2696
  - Fix config functions action
    The action failed on the setup of the runtime because the upgrade
    of pip failed.
  - Bump version: 10.2.4 → 10.2.5

------------------------------------------------------------------
------------------  2024-12-18  -  Dec 18 2024  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 27.4.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 27.4.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 27.4.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 27.4.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 27.4.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 27.4.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 27.4.1-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#2741>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ libzypp:

  - Url: queryparams without value should not have a trailing "=".
  - version 17.35.16 (35)

++++ libzypp:

  - Url: queryparams without value should not have a trailing "=".
  - version 17.35.16 (35)

++++ libzypp:

  - Url: queryparams without value should not have a trailing "=".
  - version 17.35.16 (35)

------------------------------------------------------------------
------------------  2024-12-17  -  Dec 17 2024  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to docker-buildx 0.19.3. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.3>

++++ docker:

  - Update to docker-buildx 0.19.3. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.3>

++++ docker:

  - Update to docker-buildx 0.19.3. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.3>

++++ docker:

  - Update to docker-buildx 0.19.3. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.3>

++++ docker:

  - Update to docker-buildx 0.19.3. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.3>

++++ docker:

  - Update to docker-buildx 0.19.3. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.3>

++++ docker:

  - Update to docker-buildx 0.19.3. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.3>

++++ docker-compose:

  - Update to version 2.32.1:
    * e2e test to prevent future regression
    * only check volume mounts for updated config

++++ docker-compose:

  - Update to version 2.32.1:
    * e2e test to prevent future regression
    * only check volume mounts for updated config

++++ docker-compose:

  - Update to version 2.32.1:
    * e2e test to prevent future regression
    * only check volume mounts for updated config

++++ nvidia-open-driver-G06-signed:

  - Update to 550.142 (boo#1234675)
  - supersedes 550.135.patch
  - for SLE Micro 6.x use
    '%if 0%{?suse_version} == 1600 && !0%{?is_opensuse}'; SLE16
    doesn't set %sle_version and SLE Micro 6.x is already SLE16!

------------------------------------------------------------------
------------------  2024-12-16  -  Dec 16 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Changed systemfiles provider
    Instead of providing a static list of filenames, provide a list
    of package names. It is expected that the pilot of flake-pilot
    resolves this list against the local package database to build
    up the filelist for provisioning

++++ python-kiwi:

  - Changed systemfiles provider
    Instead of providing a static list of filenames, provide a list
    of package names. It is expected that the pilot of flake-pilot
    resolves this list against the local package database to build
    up the filelist for provisioning

++++ python-kiwi:

  - Changed systemfiles provider
    Instead of providing a static list of filenames, provide a list
    of package names. It is expected that the pilot of flake-pilot
    resolves this list against the local package database to build
    up the filelist for provisioning

++++ sqlite3:

  - Add sqlite3-6216bfcb.patch to fix a test suite regression in
    3.47.0 on s390x. Only the test was broken, not the code itself.
    https://sqlite.org/forum/forumpost/7b2bab04c5

++++ sqlite3:

  - Add sqlite3-6216bfcb.patch to fix a test suite regression in
    3.47.0 on s390x. Only the test was broken, not the code itself.
    https://sqlite.org/forum/forumpost/7b2bab04c5

++++ sqlite3:

  - Add sqlite3-6216bfcb.patch to fix a test suite regression in
    3.47.0 on s390x. Only the test was broken, not the code itself.
    https://sqlite.org/forum/forumpost/7b2bab04c5

++++ sqlite3:

  - Add sqlite3-6216bfcb.patch to fix a test suite regression in
    3.47.0 on s390x. Only the test was broken, not the code itself.
    https://sqlite.org/forum/forumpost/7b2bab04c5

++++ systemd:

  - Add 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch (bsc#1234015)
    Temporarily add this patch. It will be integrated in the git repository if no
    issues are reported in the coming months.
  - Import commit 807fe764111b5a74cc8618b8e4ec437a0dec91ff
    807fe76411 udev: add new builtin net_driver
    3a48b5f21d udev-builtin-net_id: split-out pci_get_onboard_index() from dev_pci_onboard()
    5359c1d6d4 udev-builtin-net_id: split-out get_pci_slot_specifiers()
    1cd915ac7b udev-builtin-net_id: introduce get_port_specifier() helper function
    72a4218155 udev-builtin-net_id: split out get_dev_port() and make its failure critical
    f6c721b4da udev-builtin-net_id: split-out pci_get_hotplug_slot() and pci_get_hotplug_slot_from_address()
    9e16c3cf27 udev-builtin-net_id: return earlier when hotplug slot is not found
    4851355767 udev-builtin-net_id: skip non-directory entry earlier
    a571e5f1dd udev-builtin-net_id: make names_xen() self-contained
    9acc241d5f udev-builtin-net_id: use sd_device_get_sysnum() to get index of netdevsim
    ca8a431b55 udev-builtin-net_id: make names_netdevsim() self-contained
    a66251d666 udev-builtin-net_id: make names_platform() self-contained
    1e834d7157 udev-builtin-net_id: make names_vio() self-contained
    8b236dcd7a udev-builtin-net_id: make names_ccw() self-contained
    7d70e2fa7d udev-builtin-net_id: make dev_devicetree_onboard() self-contained
    46158a6e91 udev-builtin-net_id: make names_mac() self-contained
    7789e7f886 udev-builtin-net_id: split out get_ifname_prefix()
    9b0062a667 udev-builtin-net_id: swap arguments for streq() and friends
    181a775b40 udev-builtin-net_id: drop unused value from NetNameType
    Refactoring to prepare for backporting the filtering mechanism of specific
    sysfs attributes during predictable NIC name generation.

++++ systemd:

  - Add 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch (bsc#1234015)
    Temporarily add this patch. It will be integrated in the git repository if no
    issues are reported in the coming months.
  - Import commit 807fe764111b5a74cc8618b8e4ec437a0dec91ff
    807fe76411 udev: add new builtin net_driver
    3a48b5f21d udev-builtin-net_id: split-out pci_get_onboard_index() from dev_pci_onboard()
    5359c1d6d4 udev-builtin-net_id: split-out get_pci_slot_specifiers()
    1cd915ac7b udev-builtin-net_id: introduce get_port_specifier() helper function
    72a4218155 udev-builtin-net_id: split out get_dev_port() and make its failure critical
    f6c721b4da udev-builtin-net_id: split-out pci_get_hotplug_slot() and pci_get_hotplug_slot_from_address()
    9e16c3cf27 udev-builtin-net_id: return earlier when hotplug slot is not found
    4851355767 udev-builtin-net_id: skip non-directory entry earlier
    a571e5f1dd udev-builtin-net_id: make names_xen() self-contained
    9acc241d5f udev-builtin-net_id: use sd_device_get_sysnum() to get index of netdevsim
    ca8a431b55 udev-builtin-net_id: make names_netdevsim() self-contained
    a66251d666 udev-builtin-net_id: make names_platform() self-contained
    1e834d7157 udev-builtin-net_id: make names_vio() self-contained
    8b236dcd7a udev-builtin-net_id: make names_ccw() self-contained
    7d70e2fa7d udev-builtin-net_id: make dev_devicetree_onboard() self-contained
    46158a6e91 udev-builtin-net_id: make names_mac() self-contained
    7789e7f886 udev-builtin-net_id: split out get_ifname_prefix()
    9b0062a667 udev-builtin-net_id: swap arguments for streq() and friends
    181a775b40 udev-builtin-net_id: drop unused value from NetNameType
    Refactoring to prepare for backporting the filtering mechanism of specific
    sysfs attributes during predictable NIC name generation.

++++ systemd:

  - Add 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch (bsc#1234015)
    Temporarily add this patch. It will be integrated in the git repository if no
    issues are reported in the coming months.
  - Import commit 807fe764111b5a74cc8618b8e4ec437a0dec91ff
    807fe76411 udev: add new builtin net_driver
    3a48b5f21d udev-builtin-net_id: split-out pci_get_onboard_index() from dev_pci_onboard()
    5359c1d6d4 udev-builtin-net_id: split-out get_pci_slot_specifiers()
    1cd915ac7b udev-builtin-net_id: introduce get_port_specifier() helper function
    72a4218155 udev-builtin-net_id: split out get_dev_port() and make its failure critical
    f6c721b4da udev-builtin-net_id: split-out pci_get_hotplug_slot() and pci_get_hotplug_slot_from_address()
    9e16c3cf27 udev-builtin-net_id: return earlier when hotplug slot is not found
    4851355767 udev-builtin-net_id: skip non-directory entry earlier
    a571e5f1dd udev-builtin-net_id: make names_xen() self-contained
    9acc241d5f udev-builtin-net_id: use sd_device_get_sysnum() to get index of netdevsim
    ca8a431b55 udev-builtin-net_id: make names_netdevsim() self-contained
    a66251d666 udev-builtin-net_id: make names_platform() self-contained
    1e834d7157 udev-builtin-net_id: make names_vio() self-contained
    8b236dcd7a udev-builtin-net_id: make names_ccw() self-contained
    7d70e2fa7d udev-builtin-net_id: make dev_devicetree_onboard() self-contained
    46158a6e91 udev-builtin-net_id: make names_mac() self-contained
    7789e7f886 udev-builtin-net_id: split out get_ifname_prefix()
    9b0062a667 udev-builtin-net_id: swap arguments for streq() and friends
    181a775b40 udev-builtin-net_id: drop unused value from NetNameType
    Refactoring to prepare for backporting the filtering mechanism of specific
    sysfs attributes during predictable NIC name generation.

++++ systemd:

  - Add 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch (bsc#1234015)
    Temporarily add this patch. It will be integrated in the git repository if no
    issues are reported in the coming months.
  - Import commit 807fe764111b5a74cc8618b8e4ec437a0dec91ff
    807fe76411 udev: add new builtin net_driver
    3a48b5f21d udev-builtin-net_id: split-out pci_get_onboard_index() from dev_pci_onboard()
    5359c1d6d4 udev-builtin-net_id: split-out get_pci_slot_specifiers()
    1cd915ac7b udev-builtin-net_id: introduce get_port_specifier() helper function
    72a4218155 udev-builtin-net_id: split out get_dev_port() and make its failure critical
    f6c721b4da udev-builtin-net_id: split-out pci_get_hotplug_slot() and pci_get_hotplug_slot_from_address()
    9e16c3cf27 udev-builtin-net_id: return earlier when hotplug slot is not found
    4851355767 udev-builtin-net_id: skip non-directory entry earlier
    a571e5f1dd udev-builtin-net_id: make names_xen() self-contained
    9acc241d5f udev-builtin-net_id: use sd_device_get_sysnum() to get index of netdevsim
    ca8a431b55 udev-builtin-net_id: make names_netdevsim() self-contained
    a66251d666 udev-builtin-net_id: make names_platform() self-contained
    1e834d7157 udev-builtin-net_id: make names_vio() self-contained
    8b236dcd7a udev-builtin-net_id: make names_ccw() self-contained
    7d70e2fa7d udev-builtin-net_id: make dev_devicetree_onboard() self-contained
    46158a6e91 udev-builtin-net_id: make names_mac() self-contained
    7789e7f886 udev-builtin-net_id: split out get_ifname_prefix()
    9b0062a667 udev-builtin-net_id: swap arguments for streq() and friends
    181a775b40 udev-builtin-net_id: drop unused value from NetNameType
    Refactoring to prepare for backporting the filtering mechanism of specific
    sysfs attributes during predictable NIC name generation.

++++ systemd:

  - Add 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch (bsc#1234015)
    Temporarily add this patch. It will be integrated in the git repository if no
    issues are reported in the coming months.
  - Import commit 807fe764111b5a74cc8618b8e4ec437a0dec91ff
    807fe76411 udev: add new builtin net_driver
    3a48b5f21d udev-builtin-net_id: split-out pci_get_onboard_index() from dev_pci_onboard()
    5359c1d6d4 udev-builtin-net_id: split-out get_pci_slot_specifiers()
    1cd915ac7b udev-builtin-net_id: introduce get_port_specifier() helper function
    72a4218155 udev-builtin-net_id: split out get_dev_port() and make its failure critical
    f6c721b4da udev-builtin-net_id: split-out pci_get_hotplug_slot() and pci_get_hotplug_slot_from_address()
    9e16c3cf27 udev-builtin-net_id: return earlier when hotplug slot is not found
    4851355767 udev-builtin-net_id: skip non-directory entry earlier
    a571e5f1dd udev-builtin-net_id: make names_xen() self-contained
    9acc241d5f udev-builtin-net_id: use sd_device_get_sysnum() to get index of netdevsim
    ca8a431b55 udev-builtin-net_id: make names_netdevsim() self-contained
    a66251d666 udev-builtin-net_id: make names_platform() self-contained
    1e834d7157 udev-builtin-net_id: make names_vio() self-contained
    8b236dcd7a udev-builtin-net_id: make names_ccw() self-contained
    7d70e2fa7d udev-builtin-net_id: make dev_devicetree_onboard() self-contained
    46158a6e91 udev-builtin-net_id: make names_mac() self-contained
    7789e7f886 udev-builtin-net_id: split out get_ifname_prefix()
    9b0062a667 udev-builtin-net_id: swap arguments for streq() and friends
    181a775b40 udev-builtin-net_id: drop unused value from NetNameType
    Refactoring to prepare for backporting the filtering mechanism of specific
    sysfs attributes during predictable NIC name generation.

++++ systemd:

  - Add 5004-udev-allow-denylist-for-reading-sysfs-attributes-whe.patch (bsc#1234015)
    Temporarily add this patch. It will be integrated in the git repository if no
    issues are reported in the coming months.
  - Import commit 807fe764111b5a74cc8618b8e4ec437a0dec91ff
    807fe76411 udev: add new builtin net_driver
    3a48b5f21d udev-builtin-net_id: split-out pci_get_onboard_index() from dev_pci_onboard()
    5359c1d6d4 udev-builtin-net_id: split-out get_pci_slot_specifiers()
    1cd915ac7b udev-builtin-net_id: introduce get_port_specifier() helper function
    72a4218155 udev-builtin-net_id: split out get_dev_port() and make its failure critical
    f6c721b4da udev-builtin-net_id: split-out pci_get_hotplug_slot() and pci_get_hotplug_slot_from_address()
    9e16c3cf27 udev-builtin-net_id: return earlier when hotplug slot is not found
    4851355767 udev-builtin-net_id: skip non-directory entry earlier
    a571e5f1dd udev-builtin-net_id: make names_xen() self-contained
    9acc241d5f udev-builtin-net_id: use sd_device_get_sysnum() to get index of netdevsim
    ca8a431b55 udev-builtin-net_id: make names_netdevsim() self-contained
    a66251d666 udev-builtin-net_id: make names_platform() self-contained
    1e834d7157 udev-builtin-net_id: make names_vio() self-contained
    8b236dcd7a udev-builtin-net_id: make names_ccw() self-contained
    7d70e2fa7d udev-builtin-net_id: make dev_devicetree_onboard() self-contained
    46158a6e91 udev-builtin-net_id: make names_mac() self-contained
    7789e7f886 udev-builtin-net_id: split out get_ifname_prefix()
    9b0062a667 udev-builtin-net_id: swap arguments for streq() and friends
    181a775b40 udev-builtin-net_id: drop unused value from NetNameType
    Refactoring to prepare for backporting the filtering mechanism of specific
    sysfs attributes during predictable NIC name generation.

------------------------------------------------------------------
------------------  2024-12-15  -  Dec 15 2024  -------------------
------------------------------------------------------------------

++++ ca-certificates-mozilla:

  - Updated to 2.72 state of Mozilla SSL root CAs (bsc#1234798)
    Removed:
  - SecureSign RootCA11
  - Security Communication RootCA3
    Added:
  - TWCA CYBER Root CA
  - TWCA Global Root CA G2
  - SecureSign Root CA12
  - SecureSign Root CA14
  - SecureSign Root CA15

++++ ca-certificates-mozilla:

  - Updated to 2.72 state of Mozilla SSL root CAs (bsc#1234798)
    Removed:
  - SecureSign RootCA11
  - Security Communication RootCA3
    Added:
  - TWCA CYBER Root CA
  - TWCA Global Root CA G2
  - SecureSign Root CA12
  - SecureSign Root CA14
  - SecureSign Root CA15

------------------------------------------------------------------
------------------  2024-12-14  -  Dec 14 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.3 → 10.2.4

++++ python-kiwi:

  - Bump version: 10.2.3 → 10.2.4

++++ python-kiwi:

  - Bump version: 10.2.3 → 10.2.4

------------------------------------------------------------------
------------------  2024-12-13  -  Dec 13 2024  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 27.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#274>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Remove upstreamed patches:
  - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 27.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#274>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Remove upstreamed patches:
  - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 27.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#274>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Remove upstreamed patches:
  - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 27.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#274>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Remove upstreamed patches:
  - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 27.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#274>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Remove upstreamed patches:
  - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 27.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#274>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Remove upstreamed patches:
  - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 27.4.0-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/27/#274>
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
  - Remove upstreamed patches:
  - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker-compose:

  - Update to version 2.32.0:
    * e2e test for recreate volume
    * build(deps): bump google.golang.org/grpc from 1.68.0 to 1.68.1
    * build(deps): bump golang.org/x/crypto from 0.27.0 to 0.31.0
    * build(deps): bump golang.org/x/sys from 0.27.0 to 0.28.0
    * prompt user to confirm volume recreation
    * Recreate container on volume configuration change
    * introduce watch restart action
    * bump otel dependencies to v1.28.0 and v0.53.0 to align with
    buildx, buildkit and engine versions
    * bump docker/buildx to latest release
    * fix support for service.mac_address
    * update xx to v1.6.1 for compatibility with alpine 3.21 and file
    5.46+
    * build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0
    * Update pkg/e2e/watch_test.go
    * first watch action for a file event wins
    * fix
    * revisit TestDebounceBatching
    * introduce sync+exec watch action
    * log configuration error as a watch log event
    * do not require a build section but for `rebuild` action
    * pull --quiet should not drop status message, only progress
    * use latest engine tags
    * Bump buildx to 0.19.1
    * be sure everything has been cleanup at the end of each tests
    * add local config.json to test configuration dir if exists
    * disable failing TestBuildSSH test
    * fix build with bake

++++ docker-compose:

  - Update to version 2.32.0:
    * e2e test for recreate volume
    * build(deps): bump google.golang.org/grpc from 1.68.0 to 1.68.1
    * build(deps): bump golang.org/x/crypto from 0.27.0 to 0.31.0
    * build(deps): bump golang.org/x/sys from 0.27.0 to 0.28.0
    * prompt user to confirm volume recreation
    * Recreate container on volume configuration change
    * introduce watch restart action
    * bump otel dependencies to v1.28.0 and v0.53.0 to align with
    buildx, buildkit and engine versions
    * bump docker/buildx to latest release
    * fix support for service.mac_address
    * update xx to v1.6.1 for compatibility with alpine 3.21 and file
    5.46+
    * build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0
    * Update pkg/e2e/watch_test.go
    * first watch action for a file event wins
    * fix
    * revisit TestDebounceBatching
    * introduce sync+exec watch action
    * log configuration error as a watch log event
    * do not require a build section but for `rebuild` action
    * pull --quiet should not drop status message, only progress
    * use latest engine tags
    * Bump buildx to 0.19.1
    * be sure everything has been cleanup at the end of each tests
    * add local config.json to test configuration dir if exists
    * disable failing TestBuildSSH test
    * fix build with bake

++++ docker-compose:

  - Update to version 2.32.0:
    * e2e test for recreate volume
    * build(deps): bump google.golang.org/grpc from 1.68.0 to 1.68.1
    * build(deps): bump golang.org/x/crypto from 0.27.0 to 0.31.0
    * build(deps): bump golang.org/x/sys from 0.27.0 to 0.28.0
    * prompt user to confirm volume recreation
    * Recreate container on volume configuration change
    * introduce watch restart action
    * bump otel dependencies to v1.28.0 and v0.53.0 to align with
    buildx, buildkit and engine versions
    * bump docker/buildx to latest release
    * fix support for service.mac_address
    * update xx to v1.6.1 for compatibility with alpine 3.21 and file
    5.46+
    * build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0
    * Update pkg/e2e/watch_test.go
    * first watch action for a file event wins
    * fix
    * revisit TestDebounceBatching
    * introduce sync+exec watch action
    * log configuration error as a watch log event
    * do not require a build section but for `rebuild` action
    * pull --quiet should not drop status message, only progress
    * use latest engine tags
    * Bump buildx to 0.19.1
    * be sure everything has been cleanup at the end of each tests
    * add local config.json to test configuration dir if exists
    * disable failing TestBuildSSH test
    * fix build with bake

------------------------------------------------------------------
------------------  2024-12-11  -  Dec 11 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.11.1:
    * Security fixes:
  - netrc and redirect credential leak [bsc#1234068, CVE-2024-11053]
    * Bugfixes:
  - build: fix ECH to always enable HTTPS RR
  - cookie: treat cookie name case sensitively
  - curl-rustls.m4: keep existing 'CPPFLAGS'/'LDFLAGS' when detected
  - curl: use realtime in trace timestamps
  - digest: produce a shorter cnonce in Digest headers
  - docs: document default 'User-Agent'
  - docs: suggest --ssl-reqd instead of --ftp-ssl
  - duphandle: also init netrc
  - hostip: don't use the resolver for FQDN localhost
  - http_negotiate: allow for a one byte larger channel binding buffer
  - krb5: fix socket/sockindex confusion, MSVC compiler warnings
  - libssh: use libssh sftp_aio to upload file
  - libssh: when using IPv6 numerical address, add brackets
  - mime: fix reader stall on small read lengths
  - mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
  - mprintf: fix the integer overflow checks
  - multi: fix callback for 'CURLMOPT_TIMERFUNCTION' not being called again when...
  - netrc: address several netrc parser flaws
  - netrc: support large file, longer lines, longer tokens
  - nghttp2: use custom memory functions
  - OpenSSL: improvde error message on expired certificate
  - openssl: remove three "Useless Assignments"
  - openssl: stop using SSL_CTX_ function prefix for our functions
  - pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
  - rtsp: check EOS in the RTSP receive and return an error code
  - schannel: remove TLS 1.3 ciphersuite-list support
  - setopt: fix CURLOPT_HTTP_CONTENT_DECODING
  - setopt: fix missing options for builds without HTTP & MQTT
  - socket: handle binding to "host!<ip>"
  - socketpair: fix enabling 'USE_EVENTFD'
  - strtok: use namespaced 'strtok_r' macro instead of redefining it
    * Remove 0001-duphandle-also-init-netrc.patch upstream

++++ curl:

  - Update to 8.11.1:
    * Security fixes:
  - netrc and redirect credential leak [bsc#1234068, CVE-2024-11053]
    * Bugfixes:
  - build: fix ECH to always enable HTTPS RR
  - cookie: treat cookie name case sensitively
  - curl-rustls.m4: keep existing 'CPPFLAGS'/'LDFLAGS' when detected
  - curl: use realtime in trace timestamps
  - digest: produce a shorter cnonce in Digest headers
  - docs: document default 'User-Agent'
  - docs: suggest --ssl-reqd instead of --ftp-ssl
  - duphandle: also init netrc
  - hostip: don't use the resolver for FQDN localhost
  - http_negotiate: allow for a one byte larger channel binding buffer
  - krb5: fix socket/sockindex confusion, MSVC compiler warnings
  - libssh: use libssh sftp_aio to upload file
  - libssh: when using IPv6 numerical address, add brackets
  - mime: fix reader stall on small read lengths
  - mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
  - mprintf: fix the integer overflow checks
  - multi: fix callback for 'CURLMOPT_TIMERFUNCTION' not being called again when...
  - netrc: address several netrc parser flaws
  - netrc: support large file, longer lines, longer tokens
  - nghttp2: use custom memory functions
  - OpenSSL: improvde error message on expired certificate
  - openssl: remove three "Useless Assignments"
  - openssl: stop using SSL_CTX_ function prefix for our functions
  - pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
  - rtsp: check EOS in the RTSP receive and return an error code
  - schannel: remove TLS 1.3 ciphersuite-list support
  - setopt: fix CURLOPT_HTTP_CONTENT_DECODING
  - setopt: fix missing options for builds without HTTP & MQTT
  - socket: handle binding to "host!<ip>"
  - socketpair: fix enabling 'USE_EVENTFD'
  - strtok: use namespaced 'strtok_r' macro instead of redefining it
    * Remove 0001-duphandle-also-init-netrc.patch upstream

++++ curl:

  - Update to 8.11.1:
    * Security fixes:
  - netrc and redirect credential leak [bsc#1234068, CVE-2024-11053]
    * Bugfixes:
  - build: fix ECH to always enable HTTPS RR
  - cookie: treat cookie name case sensitively
  - curl-rustls.m4: keep existing 'CPPFLAGS'/'LDFLAGS' when detected
  - curl: use realtime in trace timestamps
  - digest: produce a shorter cnonce in Digest headers
  - docs: document default 'User-Agent'
  - docs: suggest --ssl-reqd instead of --ftp-ssl
  - duphandle: also init netrc
  - hostip: don't use the resolver for FQDN localhost
  - http_negotiate: allow for a one byte larger channel binding buffer
  - krb5: fix socket/sockindex confusion, MSVC compiler warnings
  - libssh: use libssh sftp_aio to upload file
  - libssh: when using IPv6 numerical address, add brackets
  - mime: fix reader stall on small read lengths
  - mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
  - mprintf: fix the integer overflow checks
  - multi: fix callback for 'CURLMOPT_TIMERFUNCTION' not being called again when...
  - netrc: address several netrc parser flaws
  - netrc: support large file, longer lines, longer tokens
  - nghttp2: use custom memory functions
  - OpenSSL: improvde error message on expired certificate
  - openssl: remove three "Useless Assignments"
  - openssl: stop using SSL_CTX_ function prefix for our functions
  - pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
  - rtsp: check EOS in the RTSP receive and return an error code
  - schannel: remove TLS 1.3 ciphersuite-list support
  - setopt: fix CURLOPT_HTTP_CONTENT_DECODING
  - setopt: fix missing options for builds without HTTP & MQTT
  - socket: handle binding to "host!<ip>"
  - socketpair: fix enabling 'USE_EVENTFD'
  - strtok: use namespaced 'strtok_r' macro instead of redefining it
    * Remove 0001-duphandle-also-init-netrc.patch upstream

++++ curl:

  - Update to 8.11.1:
    * Security fixes:
  - netrc and redirect credential leak [bsc#1234068, CVE-2024-11053]
    * Bugfixes:
  - build: fix ECH to always enable HTTPS RR
  - cookie: treat cookie name case sensitively
  - curl-rustls.m4: keep existing 'CPPFLAGS'/'LDFLAGS' when detected
  - curl: use realtime in trace timestamps
  - digest: produce a shorter cnonce in Digest headers
  - docs: document default 'User-Agent'
  - docs: suggest --ssl-reqd instead of --ftp-ssl
  - duphandle: also init netrc
  - hostip: don't use the resolver for FQDN localhost
  - http_negotiate: allow for a one byte larger channel binding buffer
  - krb5: fix socket/sockindex confusion, MSVC compiler warnings
  - libssh: use libssh sftp_aio to upload file
  - libssh: when using IPv6 numerical address, add brackets
  - mime: fix reader stall on small read lengths
  - mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
  - mprintf: fix the integer overflow checks
  - multi: fix callback for 'CURLMOPT_TIMERFUNCTION' not being called again when...
  - netrc: address several netrc parser flaws
  - netrc: support large file, longer lines, longer tokens
  - nghttp2: use custom memory functions
  - OpenSSL: improvde error message on expired certificate
  - openssl: remove three "Useless Assignments"
  - openssl: stop using SSL_CTX_ function prefix for our functions
  - pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
  - rtsp: check EOS in the RTSP receive and return an error code
  - schannel: remove TLS 1.3 ciphersuite-list support
  - setopt: fix CURLOPT_HTTP_CONTENT_DECODING
  - setopt: fix missing options for builds without HTTP & MQTT
  - socket: handle binding to "host!<ip>"
  - socketpair: fix enabling 'USE_EVENTFD'
  - strtok: use namespaced 'strtok_r' macro instead of redefining it
    * Remove 0001-duphandle-also-init-netrc.patch upstream

++++ curl:

  - Update to 8.11.1:
    * Security fixes:
  - netrc and redirect credential leak [bsc#1234068, CVE-2024-11053]
    * Bugfixes:
  - build: fix ECH to always enable HTTPS RR
  - cookie: treat cookie name case sensitively
  - curl-rustls.m4: keep existing 'CPPFLAGS'/'LDFLAGS' when detected
  - curl: use realtime in trace timestamps
  - digest: produce a shorter cnonce in Digest headers
  - docs: document default 'User-Agent'
  - docs: suggest --ssl-reqd instead of --ftp-ssl
  - duphandle: also init netrc
  - hostip: don't use the resolver for FQDN localhost
  - http_negotiate: allow for a one byte larger channel binding buffer
  - krb5: fix socket/sockindex confusion, MSVC compiler warnings
  - libssh: use libssh sftp_aio to upload file
  - libssh: when using IPv6 numerical address, add brackets
  - mime: fix reader stall on small read lengths
  - mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
  - mprintf: fix the integer overflow checks
  - multi: fix callback for 'CURLMOPT_TIMERFUNCTION' not being called again when...
  - netrc: address several netrc parser flaws
  - netrc: support large file, longer lines, longer tokens
  - nghttp2: use custom memory functions
  - OpenSSL: improvde error message on expired certificate
  - openssl: remove three "Useless Assignments"
  - openssl: stop using SSL_CTX_ function prefix for our functions
  - pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
  - rtsp: check EOS in the RTSP receive and return an error code
  - schannel: remove TLS 1.3 ciphersuite-list support
  - setopt: fix CURLOPT_HTTP_CONTENT_DECODING
  - setopt: fix missing options for builds without HTTP & MQTT
  - socket: handle binding to "host!<ip>"
  - socketpair: fix enabling 'USE_EVENTFD'
  - strtok: use namespaced 'strtok_r' macro instead of redefining it
    * Remove 0001-duphandle-also-init-netrc.patch upstream

++++ curl:

  - Update to 8.11.1:
    * Security fixes:
  - netrc and redirect credential leak [bsc#1234068, CVE-2024-11053]
    * Bugfixes:
  - build: fix ECH to always enable HTTPS RR
  - cookie: treat cookie name case sensitively
  - curl-rustls.m4: keep existing 'CPPFLAGS'/'LDFLAGS' when detected
  - curl: use realtime in trace timestamps
  - digest: produce a shorter cnonce in Digest headers
  - docs: document default 'User-Agent'
  - docs: suggest --ssl-reqd instead of --ftp-ssl
  - duphandle: also init netrc
  - hostip: don't use the resolver for FQDN localhost
  - http_negotiate: allow for a one byte larger channel binding buffer
  - krb5: fix socket/sockindex confusion, MSVC compiler warnings
  - libssh: use libssh sftp_aio to upload file
  - libssh: when using IPv6 numerical address, add brackets
  - mime: fix reader stall on small read lengths
  - mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
  - mprintf: fix the integer overflow checks
  - multi: fix callback for 'CURLMOPT_TIMERFUNCTION' not being called again when...
  - netrc: address several netrc parser flaws
  - netrc: support large file, longer lines, longer tokens
  - nghttp2: use custom memory functions
  - OpenSSL: improvde error message on expired certificate
  - openssl: remove three "Useless Assignments"
  - openssl: stop using SSL_CTX_ function prefix for our functions
  - pytest: add test for use of CURLMOPT_MAX_HOST_CONNECTIONS
  - rtsp: check EOS in the RTSP receive and return an error code
  - schannel: remove TLS 1.3 ciphersuite-list support
  - setopt: fix CURLOPT_HTTP_CONTENT_DECODING
  - setopt: fix missing options for builds without HTTP & MQTT
  - socket: handle binding to "host!<ip>"
  - socketpair: fix enabling 'USE_EVENTFD'
  - strtok: use namespaced 'strtok_r' macro instead of redefining it
    * Remove 0001-duphandle-also-init-netrc.patch upstream

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ docker:

  - Update docker-buildx to v0.19.2. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.19.2>.
    Some notable changelogs from the last update:
    * <https://github.com/docker/buildx/releases/tag/v0.19.0>
    * <https://github.com/docker/buildx/releases/tag/v0.18.0>
  - Update to Go 1.22.
  - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to
    disable the SUSEConnect integration with Docker (which creates special mounts
    in /run/secrets to allow container-suseconnect to authenticate containers
    with registries on registered hosts). bsc#1231348 bsc#1232999
    In order to disable these mounts, just do
    echo 0 > /etc/docker/suse-secrets-enable
    and restart Docker. In order to re-enable them, just do
    echo 1 > /etc/docker/suse-secrets-enable
    and restart Docker. Docker will output information on startup to tell you
    whether the SUSE secrets feature is enabled or not.
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch

++++ python-kiwi:

  - Update system files setup for containers
    The attribute provide_system_files creates a meta file in the
    root tree named 'systemfiles'. The contents of this file were
    produced by just a dump of the package database so far. For
    a more generic use of this data some adaptions were needed.
    First we allow to skip packages matching a pattern from being
    part of the system files. Next we do not put ghost and doc
    files into account. And last we handle library files in a different
    file named 'systemfiles.libs' where we do not add symlink targets
    if the target path is also part of the package. The consumer
    of this information is flake-pilot which syncs that library system
    files from the host via --copy-links. This allows a more generic
    use with regards to versioned libraries e.g. libc

++++ python-kiwi:

  - Update system files setup for containers
    The attribute provide_system_files creates a meta file in the
    root tree named 'systemfiles'. The contents of this file were
    produced by just a dump of the package database so far. For
    a more generic use of this data some adaptions were needed.
    First we allow to skip packages matching a pattern from being
    part of the system files. Next we do not put ghost and doc
    files into account. And last we handle library files in a different
    file named 'systemfiles.libs' where we do not add symlink targets
    if the target path is also part of the package. The consumer
    of this information is flake-pilot which syncs that library system
    files from the host via --copy-links. This allows a more generic
    use with regards to versioned libraries e.g. libc

++++ python-kiwi:

  - Update system files setup for containers
    The attribute provide_system_files creates a meta file in the
    root tree named 'systemfiles'. The contents of this file were
    produced by just a dump of the package database so far. For
    a more generic use of this data some adaptions were needed.
    First we allow to skip packages matching a pattern from being
    part of the system files. Next we do not put ghost and doc
    files into account. And last we handle library files in a different
    file named 'systemfiles.libs' where we do not add symlink targets
    if the target path is also part of the package. The consumer
    of this information is flake-pilot which syncs that library system
    files from the host via --copy-links. This allows a more generic
    use with regards to versioned libraries e.g. libc

++++ nvidia-open-driver-G06-signed:

  - Do not set %{?linux_make_arch} for running make modules/modules-install
  - supersedes 550.135.patch

++++ runc:

  - Update to runc v1.2.3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.3>.

++++ runc:

  - Update to runc v1.2.3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.3>.

++++ runc:

  - Update to runc v1.2.3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.3>.

++++ runc:

  - Update to runc v1.2.3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.3>.

------------------------------------------------------------------
------------------  2024-12-10  -  Dec 10 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Drop /dev/pts from bind mount locations
    This has created havoc in the Fedora build environments by
    fully unmounting /dev/pts and breaking the builders for
    subsquent tasks.
    This is a partial revert of commit daf1323c5ded7e4e7783205f5e30457b40eb322f.

++++ python-kiwi:

  - Drop /dev/pts from bind mount locations
    This has created havoc in the Fedora build environments by
    fully unmounting /dev/pts and breaking the builders for
    subsquent tasks.
    This is a partial revert of commit daf1323c5ded7e4e7783205f5e30457b40eb322f.

++++ python-kiwi:

  - Drop /dev/pts from bind mount locations
    This has created havoc in the Fedora build environments by
    fully unmounting /dev/pts and breaking the builders for
    subsquent tasks.
    This is a partial revert of commit daf1323c5ded7e4e7783205f5e30457b40eb322f.

------------------------------------------------------------------
------------------  2024-12-9  -  Dec 9 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed unit test

++++ python-kiwi:

  - Fixed unit test

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.
  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ libsoup:

  - Add 04df03bc.patch: strictly don't allow NUL bytes in headers
    (boo#1233285 CVE-2024-52530 glgo#GNOME/libsoup#377).
  - Add 6adc0e3e.patch: websocket: Process the frame as soon as we
    read data (boo#1233287 CVE-2024-52532 glgo#GNOME/libsoup#391).
  - Add 29b96fab.patch: websocket-test: disconnect error copy after
    the test ends (glgo#GNOME/libsoup#391).
  - Add a35222dd.patch: be more robust against invalid input when
    parsing params (boo#1233292 CVE-2024-52531
    glgo#GNOME/libsoup!407).
  - Add 4c9e75c6.patch: fix an intermittent test failure
    (glgo#GNOME/soup#399).
  - Increase test timeout on s390x. The http2-body-stream test can be
    slow and sometimes times out in our builds.

++++ sqlite3:

  - Update to release 3.47.2:
    * Fix a problem in text-to-floating-point conversion that affects
    text values where the first 16 significant digits are
    '1844674407370955'. This issue was introduced in 3.47.0 and
    only arises on x64 and i386 hardware.
    * Other minor bug fixes.
  - Enable the session extension, because NodeJS 22 needs it.

++++ sqlite3:

  - Update to release 3.47.2:
    * Fix a problem in text-to-floating-point conversion that affects
    text values where the first 16 significant digits are
    '1844674407370955'. This issue was introduced in 3.47.0 and
    only arises on x64 and i386 hardware.
    * Other minor bug fixes.
  - Enable the session extension, because NodeJS 22 needs it.

++++ sqlite3:

  - Update to release 3.47.2:
    * Fix a problem in text-to-floating-point conversion that affects
    text values where the first 16 significant digits are
    '1844674407370955'. This issue was introduced in 3.47.0 and
    only arises on x64 and i386 hardware.
    * Other minor bug fixes.
  - Enable the session extension, because NodeJS 22 needs it.

++++ sqlite3:

  - Update to release 3.47.2:
    * Fix a problem in text-to-floating-point conversion that affects
    text values where the first 16 significant digits are
    '1844674407370955'. This issue was introduced in 3.47.0 and
    only arises on x64 and i386 hardware.
    * Other minor bug fixes.
  - Enable the session extension, because NodeJS 22 needs it.

++++ libzypp:

  - Url query part: `=` is a safe char in value (bsc#1234304)
  - RpmDb: Recognize rpmdb.sqlite as database file (#593)
  - Fix typo (fixes #592)
  - cmake: check location of fcgi header and adjust include
    accordingly. On Debian and derivatives the fcgi headers
    are not stored in a fastcgi/ subdirectory.(#590)
  - version 17.35.15 (35)

++++ libzypp:

  - Url query part: `=` is a safe char in value (bsc#1234304)
  - RpmDb: Recognize rpmdb.sqlite as database file (#593)
  - Fix typo (fixes #592)
  - cmake: check location of fcgi header and adjust include
    accordingly. On Debian and derivatives the fcgi headers
    are not stored in a fastcgi/ subdirectory.(#590)
  - version 17.35.15 (35)

++++ libzypp:

  - Url query part: `=` is a safe char in value (bsc#1234304)
  - RpmDb: Recognize rpmdb.sqlite as database file (#593)
  - Fix typo (fixes #592)
  - cmake: check location of fcgi header and adjust include
    accordingly. On Debian and derivatives the fcgi headers
    are not stored in a fastcgi/ subdirectory.(#590)
  - version 17.35.15 (35)

------------------------------------------------------------------
------------------  2024-12-8  -  Dec 8 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Don't take ghost files into account
    When creating the system files information do not
    take ghost files and artifact files into account

++++ python-kiwi:

  - Don't take ghost files into account
    When creating the system files information do not
    take ghost files and artifact files into account

++++ python-kiwi:

  - Don't take ghost files into account
    When creating the system files information do not
    take ghost files and artifact files into account

------------------------------------------------------------------
------------------  2024-12-5  -  Dec 5 2024  -------------------
------------------------------------------------------------------

++++ haproxy:

  - Update to version 2.8.11+git0.01c1056a4:
    VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server
    (bsc#1233973)
    * [RELEASE] Released version 2.8.11
    * BUG/MINOR: cfgparse-listen: fix option httpslog override warning message
    * BUG/MEDIUM: promex: Wait to have the request before sending the response
    * BUG/MEDIUM: cache/stats: Wait to have the request before sending the response
    * BUG/MEDIUM: queue: implement a flag to check for the dequeuing
    * BUG/MINOR: clock: validate that now_offset still applies to the current date
    * BUG/MINOR: clock: make time jump corrections a bit more accurate
    * BUG/MINOR: polling: fix time reporting when using busy polling
    * BUG/MAJOR: mux-h1: Wake SC to perform 0-copy forwarding in CLOSING state
    * BUG/MEDIUM: pattern: prevent UAF on reused pattern expr
    * BUG/MINOR: pattern: prevent const sample from being tampered in pat_match_beg()
    * BUG/MEDIUM: clock: detect and cover jumps during execution
    * REGTESTS: fix random failures with wrong_ip_port_logging.vtc under load
    * DOC: configuration: place the HAPROXY_HTTP_LOG_FMT example on the correct line
    * BUG/MINOR: pattern: do not leave a leading comma on "set" error messages
    * BUG/MINOR: pattern: pat_ref_set: return 0 if err was found
    * BUG/MINOR: pattern: pat_ref_set: fix UAF reported by coverity
    * BUG/MINOR: stconn: Request to send something to be woken up when the pipe is full
    * BUG/MEDIUM: mux-pt/mux-h1: Release the pipe on connection error on sending path
    * BUG/MEDIUM: clock: also update the date offset on time jumps
    * DOC: config: correct the table for option tcplog
    * BUG/MINOR: h3: properly reject too long header responses
    * BUG/MINOR: proto_uxst: delete fd from fdtab if listen() fails
    * BUG/MINOR: mux-quic: do not send too big MAX_STREAMS ID
    * REGTESTS: mcli: test the pipelined commands on master CLI
    * BUG/MEDIUM: mworker/cli: fix pipelined modes on master CLI
    * MINOR: channel: implement ci_insert() function
    * BUG/MINOR: proto_tcp: keep error msg if listen() fails
    * BUG/MINOR: proto_tcp: delete fd from fdtab if listen() fails
    * BUG/MINOR: quic/trace: make quic_conn_enc_level_init() emit NEW not CLOSE
    * BUG/MINOR: trace/quic: make "qconn" selectable as a lockon criterion
    * BUG/MINOR: trace: automatically start in waiting mode with "start <evt>"
    * BUG/MEDIUM: trace: fix null deref in lockon mechanism since TRACE_ENABLED()
    * BUG/MINOR: trace/quic: permit to lock on frontend/connect/session etc
    * BUG/MINOR: trace/quic: enable conn/session pointer recovery from quic_conn
    * BUG/MINOR: fcgi-app: handle a possible strdup() failure
    * BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream
    * BUG/MEDIUM: h2: Only report early HTX EOM for tunneled streams
    * BUG/MEDIUM: http-ana: Report error on write error waiting for the response
    * BUG/MEDIUM: quic: prevent conn freeze on 0RTT undeciphered content
    * BUG/MEDIUM: stconn: Report error on SC on send if a previous SE error was set
    * BUG/MEDIUM: mux-h1: Properly handle empty message when an error is triggered
    * BUG/MEDIUM: cli: Always release back endpoint between two commands on the mcli
    * BUG/MEDIUM: stream: Prevent mux upgrades if client connection is no longer ready
    * BUG/MEDIUM: init: fix fd_hard_limit default in compute_ideal_maxconn
    * MEDIUM: init: set default for fd_hard_limit via DEFAULT_MAXFD (take #2)
    * BUG/MEDIUM: queue: deal with a rare TOCTOU in assign_server_and_queue()
    * MINOR: queue: add a function to check for TOCTOU after queueing
    * BUG/MEDIUM: jwt: Clear SSL error queue on error when checking the signature
    * BUG/MINOR: quic: Lack of precision when computing K (cubic only cc)
    * BUG/MINOR: cli: Atomically inc the global request counter between CLI commands
    * BUG/MINOR: server: Don't warn fallback IP is used during init-addr resolution
    * BUG/MINOR: stick-table: fix crash for src_inc_gpc() without stkcounter
    * DOC: config: improve the http-keep-alive section
    * DOC: configuration: issuers-chain-path not compatible with OCSP
    * BUG/MEDIUM: ssl_sock: fix deadlock in ssl_sock_load_ocsp() on error path
    * BUG/MEDIUM: debug/cli: fix "show threads" crashing with low thread counts
    * BUG/MINOR: session: Eval L4/L5 rules defined in the default section
    * BUG/MEDIUM: bwlim: Be sure to never set the analyze expiration date in past
    * BUG/MEDIUM: spoe: Be sure to create a SPOE applet if none on the current thread
    * BUG/MEDIUM: h1: Reject empty Transfer-encoding header
    * BUG/MINOR: h1: Reject empty coding name as last transfer-encoding value
    * BUG/MINOR: h1: Fail to parse empty transfer coding names
    * BUG/MINOR: jwt: fix variable initialisation
    * DOC: configuration: update maxconn description
    * BUG/MINOR: jwt: don't try to load files with HMAC algorithm
    * MEDIUM: ssl: initialize the SSL stack explicitely
    * DOC: configuration: more details about the master-worker mode
    * BUG/MEDIUM: quic: fix possible exit from qc_check_dcid() without unlocking
    * BUG/MINOR: quic: fix race-condition on trace for CID retrieval
    * BUG/MINOR: quic: fix race condition in qc_check_dcid()
    * BUG/MEDIUM: quic: fix race-condition in quic_get_cid_tid()
    * BUG/MEDIUM: h3: ensure the ":scheme" pseudo header is totally valid
    * BUG/MEDIUM: h3: ensure the ":method" pseudo header is totally valid
    * MINOR: activity: make the memory profiling hash size configurable at build time
    * BUG/MINOR: hlua: report proper context upon error in hlua_cli_io_handler_fct()
    * BUG/MINOR: quic: fix BUG_ON() on Tx pkt alloc failure
    * BUG/MINOR: mux-quic: fix crash on qcs SD alloc failure
    * BUG/MINOR: h3: fix crash on STOP_SENDING receive after GOAWAY emission
    * DOC: api/event_hdl: small updates, fix an example and add some precisions
    * SCRIPTS: git-show-backports: do not truncate git-show output
    * DOC: configuration: fix alphabetical order of bind options
    * DOC: management: rename show stats domain cli "dns" to "resolvers"
    * DOC/MINOR: management: add missed -dR and -dv options
    * BUG/MINOR: proxy: fix header_unique_id leak on deinit()
    * BUG/MINOR: proxy: fix source interface and usesrc leaks on deinit()
    * BUG/MINOR: proxy: fix dyncookie_key leak on deinit()
    * BUG/MINOR: proxy: fix check_{command,path} leak on deinit()
    * BUG/MINOR: proxy: fix log_tag leak on deinit()
    * BUG/MINOR: proxy: fix server_id_hdr_name leak on deinit()
    * BUG/MINOR: quic: fix computed length of emitted STREAM frames
    * [RELEASE] Released version 2.8.10
    * BUG/MEDIUM: quic: don't blindly rely on unaligned accesses
    * BUG/MAJOR: connection: fix server used_conns with H2 + reuse safe
    * BUG/MEDIUM: http_ana: ignore NTLM for reuse aggressive/always and no H1
    * BUG/MAJOR: server: do not delete srv referenced by session
    * MINOR: session: rename private conns elements
    * BUG/MEDIUM: quic: fix connection freeze on post handshake
    * BUG/MEDIUM: server: fix dynamic servers initial settings
    * BUG/MEDIUM: ssl: wrong priority whem limiting ECDSA ciphers in ECDSA+RSA configuration
    * CLEANUP: hlua: simplify ambiguous lua_insert() usage in hlua_ctx_resume()
    * BUG/MINOR: hlua: fix leak in hlua_ckch_set() error path
    * BUG/MINOR: hlua: prevent LJMP in hlua_traceback()
    * BUG/MINOR: hlua: fix unsafe hlua_pusherror() usage
    * BUG/MINOR: hlua: don't use lua_pushfstring() when we don't expect LJMP
    * CLEANUP: hlua: use hlua_pusherror() where relevant
    * BUG/MINOR: quic: prevent crash on qc_kill_conn()
    * BUG/MINOR: hlua: use CertCache.set() from various hlua contexts
    * BUG/MINOR: tools: fix possible null-deref in env_expand() on out-of-memory
    * BUG/MINOR: tcpcheck: report correct error in tcp-check rule parser
    * BUG/MINOR: cfgparse: remove the correct option on httpcheck send-state warning
    * BUG/MINOR: activity: fix Delta_calls and Delta_bytes count
    * BUG/MINOR: ssl/ocsp: init callback func ptr as NULL
    * CLEANUP: ssl/ocsp: readable ifdef in ssl_sock_load_ocsp
    * BUILD: fd: errno is also needed without poll()
    * CI: scripts: fix build of vtest regarding option -C
    * REGTESTS: acl_cli_spaces: avoid a warning caused by undefined logs
    * DOC: config: fix incorrect section reference about custom log format
    * DOC: quic: specify that connection migration is not supported
    * BUG/MINOR: server: Don't reset resolver options on a new default-server line
    * BUG/MINOR: http-htx: Support default path during scheme based normalization
    * BUG/MINOR: quic: adjust restriction for stateless reset emission
    * MEDIUM: config: prevent communication with privileged ports
    * BUILD: quic: fix unused variable warning when threads are disabled
    * BUG/MEDIUM: mux-quic: Create sedesc in same time of the QUIC stream
    * BUG/MEDIUM: quic_tls: prevent LibreSSL < 4.0 from negotiating CHACHA20_POLY1305
    * BUG/MAJOR: quic: Crash with TLS_AES_128_CCM_SHA256 (libressl only)
    * BUG/MINOR: connection: parse PROXY TLV for LOCAL mode
    * DOC: configuration: update the crt-list documentation
    * CLEANUP: ssl/cli: remove unused code in dump_crtlist_conf
    * BUG/MINOR: stats: Don't state the 303 redirect response is chunked
    * BUG/MINOR: htpp-ana/stats: Specify that HTX redirect messages have a C-L header
    * BUG/MEDIUM: fd: prevent memory waste in fdtab array
    * BUILD: stick-tables: better mark the stktable_data as 32-bit aligned
    * BUG/MEDIUM: h1: Reject CONNECT request if the target has a scheme
    * BUG/MINOR: h1: Check authority for non-CONNECT methods only if a scheme is found
    * BUG/MEDIUM: stick-tables: properly mark stktable_data as packed
    * BUG/MEDIUM: htx: mark htx_sl as packed since it may be realigned
    * BUG/MINOR: qpack: fix error code reported on QPACK decoding failure
    * BUG/MINOR: mux-quic: fix error code on shutdown for non HTTP/3
    * BUG/MINOR: log: smp_rgs array issues with inherited global log directives
    * BUG/MINOR: log: keep the ref in dup_logger()
    * MINOR: log: add dup_logsrv() helper function
    * DOC: lua: fix filters.txt file location
    * BUG/MINOR: haproxy: only tid 0 must not sleep if got signal
    * BUILD: clock: improve check for pthread_getcpuclockid()
    * BUG/MINOR: mworker: reintroduce way to disable seamless reload with -x /dev/null
    * BUG/MINOR: h1: fix detection of upper bytes in the URI
    * BUG/MINOR: backend: use cum_sess counters instead of cum_conn
    * BUG/MINOR: fd: my_closefrom() on Linux could skip contiguous series of sockets
    * BUG/MINOR: sock: handle a weird condition with connect()
    * BUG/MINOR: stconn: Fix sc_mux_strm() return value
    * BUG/MEDIUM: cache: Vary not working properly on anything other than accept-encoding
    * BUG/MINOR: server: fix slowstart behavior
    * BUG/MEDIUM: peers: Fix exit condition when max-updates-at-once is reached
    * BUG/MEDIUM: spoe: Always retry when an applet fails to send a frame
    * BUG/MEDIUM: applet: Fix applet API to put input data in a buffer
    * BUG/MEDIUM: evports: do not clear returned events list on signal
    * BUG/MEDIUM: stconn: Don't forward channel data if input data must be filtered
    * BUG/MEDIUM: grpc: Fix several unaligned 32/64 bits accesses
    * MINOR: net_helper: Add support for floats/doubles.
    * CI: revert kernel addr randomization introduced in 3a0fc864
    * BUG/MEDIUM: peers/trace: fix crash when listing event types
    * BUG/MINOR: debug: make sure DEBUG_STRICT=0 does work as documented
    * BUG/MINOR: http-ana: Fix TX_L7_RETRY and TX_D_L7_RETRY values
    * BUG/MEDIUM: http-ana: Deliver 502 on keep-alive for fressh server connection
    * CLEANUP: log: lf_text_len() returns a pointer not an integer
    * BUG/MINOR: log: invalid snprintf() usage in sess_build_logline()
    * BUG/MINOR: tools/log: invalid encode_{chunk,string} usage
    * BUG/MINOR: log: fix lf_text_len() truncate inconsistency
    * BUG/MINOR: listener: always assign distinct IDs to shards
    * BUG/MINOR: cli: Report an error to user if command or payload is too big
    * [RELEASE] Released version 2.8.9
    * BUILD: proxy: Replace free_logformat_list() to manually release log-format
    * [RELEASE] Released version 2.8.8
    * BUG/MINOR: proxy: fix logformat expression leak in use_backend rules
    * BUG/MINOR: backend: properly handle redispatch 0
    * BUG/MINOR: server: ignore 'enabled' for dynamic servers
    * BUG/MEDIUM: cli: Warn if pipelined commands are delimited by a \n
    * MINOR: cli: Remove useless loop on commands to find unescaped semi-colon
    * MINOR: server: allow cookie for dynamic servers
    * BUG/MINOR: server: fix persistence cookie for dynamic servers
    * BUG/MINOR: ssl: Detect more 'ocsp-update' incompatibilities
    * BUG/MINOR: ssl: Wrong ocsp-update "incompatibility" error message
    * BUG/MINOR: server: 'source' interface ignored from 'default-server' directive
    * OPTIM: http_ext: avoid useless copy in http_7239_extract_{ipv4,ipv6}
    * BUG/MEDIUM: mux-fcgi: Properly handle EOM flag on end-of-trailers HTX block
    * BUG/MINOR: mux-quic: close all QCS before freeing QCC tasklet
    * BUG/MEDIUM: ssl: Fix crash in ocsp-update log function
    * BUG/MINOR: session: ensure conn owner is set after insert into session
    * BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small
    * CI: temporarily adjust kernel entropy to work with ASAN/clang
    * BUG/MINOR: spoe: Be sure to be able to quickly close IDLE applets on soft-stop
    * BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing timeout
    * BUG/MINOR: listener: Don't schedule frontend without task in listener_release()
    * BUG/MINOR: listener: Wake proxy's mngmt task up if necessary on session release
    * BUG/MEDIUM: hlua: streams don't support mixing lua-load with lua-load-per-thread (2nd try)
    * MINOR: hlua: use accessors for stream hlua ctx
    * DEBUG: lua: precisely identify if stream is stuck inside lua or not
    * BUG/MINOR: hlua: fix missing lock in hlua_filter_delete()
    * BUG/MINOR: hlua: missing lock in hlua_filter_new()
    * BUG/MINOR: hlua: segfault when loading the same filter from different contexts
    * BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm()
    * DOC: configuration: clarify ciphersuites usage (V2)
    * BUILD: solaris: fix compilation errors
    * BUG/MINOR: cfgparse: report proper location for log-format-sd errors
    * BUG/MINOR: ssl/cli: typo in new ssl crl-file CLI description
    * CI: skip scheduled builds on forks
    * BUG/MINOR: sink: fix a race condition in the TCP log forwarding code
    * BUG/MINOR: hlua: don't call ha_alert() in hlua_event_subscribe()
    * BUG/MAJOR: hlua: improper lock usage with hlua_ctx_resume()
    * BUG/MEDIUM: hlua: improper lock usage with SET_SAFE_LJMP()
    * BUG/MINOR: hlua: improper lock usage in hlua_filter_new()
    * BUG/MINOR: hlua: improper lock usage in hlua_filter_callback()
    * BUG/MINOR: hlua: fix possible crash in hlua_filter_new() under load
    * BUG/MINOR: hlua: don't use lua_tostring() from unprotected contexts
    * BUG/MINOR: hlua: fix unsafe lua_tostring() usage with empty stack
    * BUG/MINOR: tools: seed the statistical PRNG slightly better
    * MINOR: hlua: Be able to disable logging from lua
    * BUG/MINOR: hlua: Fix log level to the right value when set via TXN:set_loglevel
    * BUG/MINOR: config/quic: Alert about PROXY protocol use on a QUIC listener
    * DOC: configuration: clarify ciphersuites usage
    * LICENSE: http_ext: fix GPL license version
    * LICENSE: event_hdl: fix GPL license version
    * BUG/MINOR: ssl/cli: duplicate cleaning code in cli_parse_del_crtlist
    * BUG/MINOR: ist: only store NUL byte on succeeded alloc
    * BUG/MINOR: quic: fix output of show quic
    * BUG/MAJOR: server: fix stream crash due to deleted server
    * BUG/MINOR: stats: drop srv refcount on early release
    * BUG/MINOR: ist: allocate nul byte on istdup
    * MINOR: quic: warn on bind on multiple addresses if no IP_PKTINFO support
    * DOC: quic: fix recommandation for bind on multiple address
    * BUG/MEDIUM: quic: fix transient send error with listener socket
    * BUG/MEDIUM: hlua: Don't loop if a lua socket does not consume received data
    * BUG/MEDIUM: hlua: Be able to garbage collect uninitialized lua sockets
    * BUG/MEDIUM: applet: Immediately free appctx on early error
    * DOC: quic: Missing tuning setting in "Global parameters"
    * BUG/MINOR: qpack: reject invalid dynamic table capacity
    * BUG/MINOR: qpack: reject invalid increment count decoding
    * BUG/MINOR: quic: reject HANDSHAKE_DONE as server
    * BUG/MINOR: quic: reject unknown frame type
    * BUG/MAJOR: promex: fix crash on deleted server
    * MINOR: connection: add sample fetches to report per-connection glitches
    * MINOR: mux-h2: implement MUX_CTL_GET_GLITCHES
    * MINOR: connection: add a new mux_ctl to report number of connection glitches
    * MEDIUM: mux-h2: allow to set the glitches threshold to kill a connection
    * MINOR: mux-h2: always use h2c_report_glitch()
    * MINOR: mux-h2: count late reduction of INITIAL_WINDOW_SIZE as a glitch
    * MINOR: mux-h2: count excess of CONTINUATION frames as a glitch
    * BUG/MINOR: mux-h2: count rejected DATA frames against the connection's flow control
    * MINOR: mux-h2: add a counter of "glitches" on a connection
    * [RELEASE] Released version 2.8.7
    * BUG/MAJOR: ssl/ocsp: crash with ocsp when old process exit or using ocsp CLI
    * [RELEASE] Released version 2.8.6
    * DEV: makefile: fix POSIX compatibility for "range" target
    * DEV: makefile: add a new "range" target to iteratively build all commits
    * CI: Update to actions/cache@v4
    * DOC: internal: update missing data types in peers-v2.0.txt
    * DOC: install: recommend pcre2
    * DOC: httpclient: add dedicated httpclient section
    * DOC: configuration: clarify http-request wait-for-body
    * BUILD: address a few remaining calloc(size, n) cases
    * BUG/MINOR: ext-check: cannot use without preserve-env
    * MINOR: ext-check: add an option to preserve environment variables
    * BUG/MINOR: diag: run the final diags before quitting when using -c
    * BUG/MINOR: diag: always show the version before dumping a diag warning
    * MINOR: errors: ha_alert() and ha_warning() uses warn_exec_path()
    * MINOR: quic: Add a counter for reordered packets
    * MINOR: quic: Dynamic packet reordering threshold
    * MINOR: quic: Update K CUBIC calculation (RFC 9438)
    * BUG/MEDIUM: quic: Wrong K CUBIC calculation.
    * MINOR: quic: Stop using 1024th of a second.
    * BUG/MINOR: quic: fix possible integer wrap around in cubic window calculation
    * CLEANUP: quic: Code clarifications for QUIC CUBIC (RFC 9438)
    * BUG/MINOR: quic: Wrong ack ranges handling when reaching the limit.
    * BUG/MEDIUM: quic: fix crash on invalid qc_stream_buf_free() BUG_ON
    * BUG/MEDIUM: qpack: allow 6xx..9xx status codes
    * BUG/MEDIUM: h3: do not crash on invalid response status code
    * MINOR: h3: add traces for stream sending function
    * BUG/MEDIUM: quic: remove unsent data from qc_stream_desc buf
    * MINOR: quic: extract qc_stream_buf free in a dedicated function
    * MINOR: quic: Stop hardcoding a scale shifting value (CUBIC_BETA_SCALE_FACTOR_SHIFT)
    * CLEANUP: quic: Remove unused CUBIC_BETA_SCALE_FACTOR_SHIFT macro.
    * BUG/MEDIUM: mux-quic: report early error on stream
    * BUG/MINOR: h3: fix checking on NULL Tx buffer
    * BUG/MEDIUM: ssl: Fix crash when calling "update ssl ocsp-response" when an update is ongoing
    * REGTESTS: ssl: Add OCSP related tests
    * REGTESTS: ssl: Fix empty line in cli command input
    * BUG/MINOR: ssl: Reenable ocsp auto-update after an "add ssl crt-list"
    * BUG/MINOR: ssl: Destroy ckch instances before the store during deinit
    * BUG/MEDIUM: ocsp: Separate refcount per instance and per store
    * MINOR: ssl: Use OCSP_CERTID instead of ckch_store in ckch_store_build_certid
    * BUG/MINOR: ssl: Clear the ckch instance when deleting a crt-list line
    * BUG/MINOR: ssl: Duplicate ocsp update mode when dup'ing ckch
    * BUG/MINOR: ssl: Fix error message after ssl_sock_load_ocsp call
    * BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions
    * BUG/MEDIUM: h1: always reject the NUL character in header values
    * BUG/MINOR: h1-htx: properly initialize the err_pos field
    * BUG/MEDIUM: h1: Don't support LF only to mark the end of a chunk size
    * BUG/MINOR: h1: Don't support LF only at the end of chunks
    * BUG/MEDIUM: stconn: Don't check pending shutdown to wake an applet up
    * BUG/MEDIUM: stconn: Allow expiration update when READ/WRITE event is pending
    * BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush()
    * BUG/MINOR: jwt: fix jwt_verify crash on 32-bit archs
    * BUG/MEDIUM: cli: fix once for all the problem of missing trailing LFs
    * BUG/MINOR: vars/cli: fix missing LF after "get var" output
    * BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI
    * REGTESTS: add a test to ensure map-ordering is preserved
    * MINOR: mux-h2/traces: add a missing trace on connection WU with negative inc
    * BUG/MEDIUM: mux-h2: refine connection vs stream error on headers
    * MINOR: mux-h2/traces: clarify the "rejected H2 request" event
    * MINOR: mux-h2/traces: explicitly show the error/refused stream states
    * MINOR: mux-h2/traces: also suggest invalid header upon parsing error
    * MINOR: debug: make BUG_ON() catch build errors even without DEBUG_STRICT
    * MINOR: debug: make ABORT_NOW() store the caller's line number when using abort
    * MINOR: debug: make sure calls to ha_crash_now() are never merged
    * MINOR: compiler: add a new DO_NOT_FOLD() macro to prevent code folding
    * BUG/MEDIUM: quic: keylog callback not called (USE_OPENSSL_COMPAT)
    * BUG/MINOR: mux-h2: also count streams for refused ones
    * BUG/MINOR: mux-quic: do not prevent non-STREAM sending on flow control
    * DOC: configuration: corrected description of keyword tune.ssl.ocsp-update.mindelay
    * MINOR: mux-h2: support limiting the total number of H2 streams per connection
    * BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up
    * BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it is forwardable
    * BUG/MEDIUM: h3: fix incorrect snd_buf return value
    * CLEANUP: quic: Remaining useless code into server part
    * BUG/MINOR: h3: close connection on sending alloc errors
    * BUG/MINOR: h3: properly handle alloc failure on finalize
    * BUG/MINOR: h3: close connection on header list too big
    * MINOR: h3: check connection error during sending
    * BUG/MINOR: quic: Missing call to TLS message callbacks
    * BUG/MINOR: quic: Wrong keylog callback setting.
    * BUG/MINOR: mux-quic: always report error to SC on RESET_STREAM emission
    * BUG/MEDIUM: stats: unhandled switching rules with TCP frontend
    * MINOR: stats: store the parent proxy in stats ctx (http)
    * DOC: config: Update documentation about local haproxy response
    * BUG/MINOR: resolvers: default resolvers fails when network not configured
    * BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty
    * BUG/MEDIUM: quic: QUIC CID removed from tree without locking
    * BUG/MEDIUM: quic: Possible buffer overflow when building TLS records
    * BUG/MINOR: mworker/cli: fix set severity-output support
    * DOC: configuration: typo req.ssl_hello_type
    * [RELEASE] Released version 2.8.5
    * BUG/MEDIUM: proxy: always initialize the default settings after init
    * BUG/MINOR: lua: Wrong OCSP CID after modifying an SSL certficate (LUA)
    * BUG/MINOR: ssl: Wrong OCSP CID after modifying an SSL certficate
    * MINOR: ssl/cli: Add ha_(warning|alert) msgs to CLI ckch callback
    * BUG/MINOR: ssl: Double free of OCSP Certificate ID
    * BUG/MINOR: quic: Packet number spaces too lately initialized
    * BUG/MINOR: quic: Missing QUIC connection path member initialization
    * BUG/MINOR: quic: Possible leak of TX packets under heavy load
    * BUG/MEDIUM: quic: Possible crash during retransmissions and heavy load
    * BUG/MINOR: cache: Remove incomplete entries from the cache when stream is closed
    * BUG/MEDIUM: peers: fix partial message decoding
    * DOC: Clarify the differences between field() and word()
    * BUG/MINOR: sample: Make the `word` converter compatible with `-m found`
    * REGTESTS: sample: Test the behavior of consecutive delimiters for the field converter
    * DOC: config: fix monitor-fail typo
    * DOC: config: add matrix entry for "max-session-srv-conns"
    * DOC: config: specify supported sections for "max-session-srv-conns"
    * BUG/MINOR: cfgparse-listen: fix warning being reported as an alert
    * BUG/MINOR: config: Stopped parsing upon unmatched environment variables
    * BUG/MINOR: quic_tp: fix preferred_address decoding
    * DOC: config: fix missing characters in set-spoe-group action
    * BUG/MINOR: h3: always reject PUSH_PROMISE
    * BUG/MINOR: h3: fix TRAILERS encoding
    * BUG/MEDIUM: master/cli: Properly pin the master CLI on thread 1 / group 1
    * BUG/MINOR: compression: possible NULL dereferences in comp_prepare_compress_request()
    * BUG/MINOR: quic: fix CONNECTION_CLOSE_APP encoding
    * DOC: lua: fix Proxy.get_mode() output
    * DOC: lua: add sticktable class reference from Proxy.stktable
    * REGTESTS: connection: disable http_reuse_be_transparent.vtc if !TPROXY
    * DOC: config: fix timeout check inheritance restrictions
    * DOC: 51d: updated 51Degrees repo URL for v3.2.10
    * BUG/MINOR: server: do not leak default-server in defaults sections
    * BUG/MINOR: quic: Possible RX packet memory leak under heavy load
    * BUG/MEDIUM: quic: Possible crash for connections to be killed
    * BUG/MINOR: sock: mark abns sockets as non-suspendable and always unbind them
    * BUG/MINOR: startup: set GTUNE_SOCKET_TRANSFER correctly
    * REGTESTS: http: add a test to validate chunked responses delivery
    * BUG/MINOR: proxy/stktable: missing frees on proxy cleanup
    * MINOR: stktable: add stktable_deinit function
    * BUG/MINOR: stream/cli: report correct stream age in "show sess"
    * BUG/MEDIUM: mux-fcgi: fail earlier on malloc in takeover()
    * BUG/MEDIUM: mux-h1: fail earlier on malloc in takeover()
    * BUG/MEDIUM: mux-h2: fail earlier on malloc in takeover()
    * BUG/MAJOR: quic: complete thread migration before tcp-rules
    * [RELEASE] Released version 2.8.4
    * BUG/MINOR: stconn: Report read activity on non-indep streams for partial sends
    * BUG/MINOR: stconn/applet: Report send activity only if there was output data
    * BUG/MINOR: stconn: Use HTX-aware channel's functions to get info on buffer
    * BUG/MINOR: stconn: Fix streamer detection for HTX streams
    * MINOR: channel: Add functions to get info on buffers and deal with HTX streams
    * MINOR: htx: Use a macro for overhead induced by HTX
    * BUG/MEDIUM: stconn: Update fsb date on partial sends
    * BUG/MEDIUM: stream: Don't call mux .ctl() callback if not implemented
    * BUG/MEDIUM: mworker: set the master variable earlier
    * BUG/MEDIUM: applet: Report a send activity everytime data were sent
    * BUG/MEDIUM: stconn: Report a send activity everytime data were sent
    * REGTESTS: http: Improve script testing abortonclose option
    * BUG/MEDIUM: stream: Properly handle abortonclose when set on backend only
    * MEDIUM: mux-h1: Handle MUX_SUBS_RECV flag in h1_ctl() and susbscribe for reads
    * MINOR: connection: Add a CTL flag to notify mux it should wait for reads again
    * BUG/MINOR: stconn: Handle abortonclose if backend connection was already set up
    * BUG/MEDIUM: connection: report connection errors even when no mux is installed
    * DOC: quic: Wrong syntax for "quic-cc-algo" keyword.
    * BUG/MINOR: sink: don't learn srv port from srv addr
    * BUG/MEDIUM: applet: Remove appctx from buffer wait list on release
    * DOC: config: use the word 'backend' instead of 'proxy' in 'track' description
    * BUG/MINOR: quic: fix retry token check inconsistency
    * DOC: management: -q is quiet all the time
    * BUG/MEDIUM: stconn: Don't update stream expiration date if already expired
    * BUG/MEDIUM: quic: Avoid some crashes upon TX packet allocation failures
    * BUG/MEDIUM: quic: Possible crashes when sending too short Initial packets
    * BUG/MEDIUM: quic: Avoid trying to send ACK frames from an empty ack ranges tree
    * BUG/MINOR: quic: idle timer task requeued in the past
    * BUG/MEDIUM: pool: fix releasable pool calculation when overloaded
    * BUG/MEDIUM: freq-ctr: Don't report overshoot for long inactivity period
    * BUG/MINOR: mux-h1: Properly handle http-request and http-keep-alive timeouts
    * BUG/MINOR: stick-table/cli: Check for invalid ipv4 key
    * BUG/MEDIUM: quic: fix sslconns on quic_conn alloc failure
    * BUG/MEDIUM: quic: fix actconn on quic_conn alloc failure
    * CLEANUP: htx: Properly indent htx_reserve_max_data() function
    * BUG/MINOR: stconn: Sanitize report for read activity
    * BUG/MEDIUM: Don't apply a max value on room_needed in sc_need_room()
    * BUG/MEDIUM: stconn: Don't report rcv/snd expiration date if SC cannot epxire
    * BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range()
    * BUG/MINOR: cfgparse/stktable: fix error message on stktable_init() failure
    * BUG/MINOR: stktable: missing free in parse_stick_table()
    * BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure
    * BUG/MEDIUM: ssl: segfault when cipher is NULL
    * BUG/MINOR: mux-quic: fix early close if unset client timeout
    * BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3 and dual ECDSA/RSA
    * MEDIUM: quic: count quic_conn for global sslconns
    * MEDIUM: quic: count quic_conn instance for maxconn
    * MINOR: frontend: implement a dedicated actconn increment function
    * BUG/MINOR: ssl: use a thread-safe sslconns increment
    * BUG/MINOR: quic: do not consider idle timeout on CLOSING state
    * BUG/MEDIUM: server: "proto" not working for dynamic servers
    * MINOR: connection: add conn_pr_mode_to_proto_mode() helper func
    * DEBUG: mux-h2/flags: fix list of h2c flags used by the flags decoder
    * MINOR: lua: Add flags to configure logging behaviour
    * BUG/MINOR: ssl: load correctly @system-ca when ca-base is define
    * DOC: internal: filters: fix reference to entities.pdf
    * BUG/MINOR: mux-h2: update tracked counters with req cnt/req err
    * BUG/MINOR: mux-h2: commit the current stream ID even on reject
    * BUG/MEDIUM: peers: Fix synchro for huge number of tables
    * BUG/MEDIUM: peers: Be sure to always refresh recconnect timer in sync task
    * BUG/MINOR: trace: fix trace parser error reporting
    * BUG/MINOR: mux-h2: fix http-request and http-keep-alive timeouts again
    * BUG/MEDIUM: mux-h2: Don't report an error on shutr if a shutw is pending
    * BUG/MINOR: mux-h2: make up other blocked streams upon removal from list
    * BUG/MINOR: mux-h1: Send a 400-bad-request on shutdown before the first request
    * BUG/MEDIUM: quic-conn: free unsent frames on retransmit to prevent crash
    * BUG/MINOR: mux-quic: fix free on qcs-new fail alloc
    * BUG/MINOR: h3: strengthen host/authority header parsing
    * BUG/MINOR: mux-quic: support initial 0 max-stream-data
    * BUG/MEDIUM: mux-quic: fix RESET_STREAM on send-only stream
    * BUG/MINOR: quic: reject packet with no frame
    * BUG/MINOR: quic: Avoid crashing with unsupported cryptographic algos
    * BUG/MEDIUM: stconn: Fix comparison sign in sc_need_room()
    * BUG/MINOR: hq-interop: simplify parser requirement
    * BUG/MEDIUM: h1: Ignore C-L value in the H1 parser if T-E is also set
    * BUG/MINOR: mux-h1: Ignore C-L when sending H1 messages if T-E is also set
    * BUG/MINOR: mux-h1: Handle read0 in rcv_pipe() only when data receipt was tried
    * BUG/MEDIUM: hlua: Initialize appctx used by a lua socket on connect only
    * MINOR: hlua: Test the hlua struct first when the lua socket is connecting
    * MINOR: hlua: Save the lua socket's server in its context
    * MINOR: hlua: Save the lua socket's timeout in its context
    * MINOR: hlua: Don't preform operations on a not connected socket
    * MINOR: hlua: Set context's appctx when the lua socket is created
    * BUG/MEDIUM: http-ana: Try to handle response before handling server abort
    * BUG/MEDIUM: quic_conn: let the scheduler kill the task when needed
    * BUG/MEDIUM: actions: always apply a longest match on prefix lookup
    * BUG/MINOR: mux-quic: remove full demux flag on ncbuf release
    * BUG/MEDIUM: server/cli: don't delete a dynamic server that has streams
    * MINOR: pattern: fix pat_{parse,match}_ip() function comments
    * BUG/MINOR: server: add missing free for server->rdr_pfx
    * BUG/MAJOR: mux-h2: Report a protocol error for any DATA frame before headers
    * BUG/MINOR: freq_ctr: fix possible negative rate with the scaled API
    * BUG/MEDIUM: master/cli: Pin the master CLI on the first thread of the group 1
    * BUG/MINOR: promex: fix backend_agg_check_status
    * BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
    * BUG/MINOR: hlua/init: coroutine may not resume itself
    * BUG/MEDIUM: hlua: don't pass stale nargs argument to lua_resume()
    * CI: musl: drop shopt in workflow invocation
    * CI: musl: highlight section if there are coredumps
    * Revert "BUG/MEDIUM: quic: missing check of dcid for init pkt including a token"
    * BUG/MEDIUM: hlua: streams don't support mixing lua-load with lua-load-per-thread
    * MINOR: hlua: add hlua_stream_ctx_prepare helper function
    * BUILD: quic: fix build on centos 8 and USE_QUIC_OPENSSL_COMPAT
    * BUG/MINOR: quic: ssl_quic_initial_ctx() uses error count not error code
    * BUG/MINOR: quic: allow-0rtt warning must only be emitted with quic bind
    * BUILD: Makefile: add USE_QUIC_OPENSSL_COMPAT to make help
    * MINOR: quic+openssl_compat: Emit an alert for "allow-0rtt" option
    * MINOR: quic+openssl_compat: Do not start without "limited-quic"
    * MINOR: quic: Warning for OpenSSL wrapper QUIC bindings without "limited-quic"
    * BUG/MINOR: quic+openssl_compat: Non initialized TLS encryption levels
    * DOC: quic: Add "limited-quic" new tuning setting
    * MINOR: quic: Add "limited-quic" new tuning setting
    * MINOR: quic: SSL context initialization with QUIC OpenSSL wrapper.
    * MINOR: quic: Add a quic_openssl_compat struct to quic_conn struct
    * MINOR: quic: Call the keylog callback for QUIC openssl wrapper from SSL_CTX_keylog()
    * MINOR: quic: Initialize TLS contexts for QUIC openssl wrapper
    * MINOR: quic: Export some KDF functions (QUIC-TLS)
    * MINOR: quic: Add a compilation option for the QUIC OpenSSL wrapper
    * MINOR: quic: Do not enable 0RTT with SSL_set_quic_early_data_enabled()
    * MINOR: quic: Set the QUIC connection as extra data before calling SSL_set_quic_method()
    * MINOR: quic: Do not enable O-RTT with USE_QUIC_OPENSSL_COMPAT
    * MINOR: quic: Include QUIC opensssl wrapper header from TLS stacks compatibility header
    * MINOR: quic: QUIC openssl wrapper implementation
    * BUG/MINOR: quic: Wrong cluster secret initialization
    * BUG/MINOR: quic: Leak of frames to send.
    * BUILD: bug: make BUG_ON() void to avoid a rare warning
  - VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server
    (bsc#1233973)
    Add upsream patch: 0001-MINOR-h3-Add-HTTP-3-definitions.patch

++++ haproxy:

  - Update to version 2.8.11+git0.01c1056a4:
    VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server
    (bsc#1233973)
    * [RELEASE] Released version 2.8.11
    * BUG/MINOR: cfgparse-listen: fix option httpslog override warning message
    * BUG/MEDIUM: promex: Wait to have the request before sending the response
    * BUG/MEDIUM: cache/stats: Wait to have the request before sending the response
    * BUG/MEDIUM: queue: implement a flag to check for the dequeuing
    * BUG/MINOR: clock: validate that now_offset still applies to the current date
    * BUG/MINOR: clock: make time jump corrections a bit more accurate
    * BUG/MINOR: polling: fix time reporting when using busy polling
    * BUG/MAJOR: mux-h1: Wake SC to perform 0-copy forwarding in CLOSING state
    * BUG/MEDIUM: pattern: prevent UAF on reused pattern expr
    * BUG/MINOR: pattern: prevent const sample from being tampered in pat_match_beg()
    * BUG/MEDIUM: clock: detect and cover jumps during execution
    * REGTESTS: fix random failures with wrong_ip_port_logging.vtc under load
    * DOC: configuration: place the HAPROXY_HTTP_LOG_FMT example on the correct line
    * BUG/MINOR: pattern: do not leave a leading comma on "set" error messages
    * BUG/MINOR: pattern: pat_ref_set: return 0 if err was found
    * BUG/MINOR: pattern: pat_ref_set: fix UAF reported by coverity
    * BUG/MINOR: stconn: Request to send something to be woken up when the pipe is full
    * BUG/MEDIUM: mux-pt/mux-h1: Release the pipe on connection error on sending path
    * BUG/MEDIUM: clock: also update the date offset on time jumps
    * DOC: config: correct the table for option tcplog
    * BUG/MINOR: h3: properly reject too long header responses
    * BUG/MINOR: proto_uxst: delete fd from fdtab if listen() fails
    * BUG/MINOR: mux-quic: do not send too big MAX_STREAMS ID
    * REGTESTS: mcli: test the pipelined commands on master CLI
    * BUG/MEDIUM: mworker/cli: fix pipelined modes on master CLI
    * MINOR: channel: implement ci_insert() function
    * BUG/MINOR: proto_tcp: keep error msg if listen() fails
    * BUG/MINOR: proto_tcp: delete fd from fdtab if listen() fails
    * BUG/MINOR: quic/trace: make quic_conn_enc_level_init() emit NEW not CLOSE
    * BUG/MINOR: trace/quic: make "qconn" selectable as a lockon criterion
    * BUG/MINOR: trace: automatically start in waiting mode with "start <evt>"
    * BUG/MEDIUM: trace: fix null deref in lockon mechanism since TRACE_ENABLED()
    * BUG/MINOR: trace/quic: permit to lock on frontend/connect/session etc
    * BUG/MINOR: trace/quic: enable conn/session pointer recovery from quic_conn
    * BUG/MINOR: fcgi-app: handle a possible strdup() failure
    * BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream
    * BUG/MEDIUM: h2: Only report early HTX EOM for tunneled streams
    * BUG/MEDIUM: http-ana: Report error on write error waiting for the response
    * BUG/MEDIUM: quic: prevent conn freeze on 0RTT undeciphered content
    * BUG/MEDIUM: stconn: Report error on SC on send if a previous SE error was set
    * BUG/MEDIUM: mux-h1: Properly handle empty message when an error is triggered
    * BUG/MEDIUM: cli: Always release back endpoint between two commands on the mcli
    * BUG/MEDIUM: stream: Prevent mux upgrades if client connection is no longer ready
    * BUG/MEDIUM: init: fix fd_hard_limit default in compute_ideal_maxconn
    * MEDIUM: init: set default for fd_hard_limit via DEFAULT_MAXFD (take #2)
    * BUG/MEDIUM: queue: deal with a rare TOCTOU in assign_server_and_queue()
    * MINOR: queue: add a function to check for TOCTOU after queueing
    * BUG/MEDIUM: jwt: Clear SSL error queue on error when checking the signature
    * BUG/MINOR: quic: Lack of precision when computing K (cubic only cc)
    * BUG/MINOR: cli: Atomically inc the global request counter between CLI commands
    * BUG/MINOR: server: Don't warn fallback IP is used during init-addr resolution
    * BUG/MINOR: stick-table: fix crash for src_inc_gpc() without stkcounter
    * DOC: config: improve the http-keep-alive section
    * DOC: configuration: issuers-chain-path not compatible with OCSP
    * BUG/MEDIUM: ssl_sock: fix deadlock in ssl_sock_load_ocsp() on error path
    * BUG/MEDIUM: debug/cli: fix "show threads" crashing with low thread counts
    * BUG/MINOR: session: Eval L4/L5 rules defined in the default section
    * BUG/MEDIUM: bwlim: Be sure to never set the analyze expiration date in past
    * BUG/MEDIUM: spoe: Be sure to create a SPOE applet if none on the current thread
    * BUG/MEDIUM: h1: Reject empty Transfer-encoding header
    * BUG/MINOR: h1: Reject empty coding name as last transfer-encoding value
    * BUG/MINOR: h1: Fail to parse empty transfer coding names
    * BUG/MINOR: jwt: fix variable initialisation
    * DOC: configuration: update maxconn description
    * BUG/MINOR: jwt: don't try to load files with HMAC algorithm
    * MEDIUM: ssl: initialize the SSL stack explicitely
    * DOC: configuration: more details about the master-worker mode
    * BUG/MEDIUM: quic: fix possible exit from qc_check_dcid() without unlocking
    * BUG/MINOR: quic: fix race-condition on trace for CID retrieval
    * BUG/MINOR: quic: fix race condition in qc_check_dcid()
    * BUG/MEDIUM: quic: fix race-condition in quic_get_cid_tid()
    * BUG/MEDIUM: h3: ensure the ":scheme" pseudo header is totally valid
    * BUG/MEDIUM: h3: ensure the ":method" pseudo header is totally valid
    * MINOR: activity: make the memory profiling hash size configurable at build time
    * BUG/MINOR: hlua: report proper context upon error in hlua_cli_io_handler_fct()
    * BUG/MINOR: quic: fix BUG_ON() on Tx pkt alloc failure
    * BUG/MINOR: mux-quic: fix crash on qcs SD alloc failure
    * BUG/MINOR: h3: fix crash on STOP_SENDING receive after GOAWAY emission
    * DOC: api/event_hdl: small updates, fix an example and add some precisions
    * SCRIPTS: git-show-backports: do not truncate git-show output
    * DOC: configuration: fix alphabetical order of bind options
    * DOC: management: rename show stats domain cli "dns" to "resolvers"
    * DOC/MINOR: management: add missed -dR and -dv options
    * BUG/MINOR: proxy: fix header_unique_id leak on deinit()
    * BUG/MINOR: proxy: fix source interface and usesrc leaks on deinit()
    * BUG/MINOR: proxy: fix dyncookie_key leak on deinit()
    * BUG/MINOR: proxy: fix check_{command,path} leak on deinit()
    * BUG/MINOR: proxy: fix log_tag leak on deinit()
    * BUG/MINOR: proxy: fix server_id_hdr_name leak on deinit()
    * BUG/MINOR: quic: fix computed length of emitted STREAM frames
    * [RELEASE] Released version 2.8.10
    * BUG/MEDIUM: quic: don't blindly rely on unaligned accesses
    * BUG/MAJOR: connection: fix server used_conns with H2 + reuse safe
    * BUG/MEDIUM: http_ana: ignore NTLM for reuse aggressive/always and no H1
    * BUG/MAJOR: server: do not delete srv referenced by session
    * MINOR: session: rename private conns elements
    * BUG/MEDIUM: quic: fix connection freeze on post handshake
    * BUG/MEDIUM: server: fix dynamic servers initial settings
    * BUG/MEDIUM: ssl: wrong priority whem limiting ECDSA ciphers in ECDSA+RSA configuration
    * CLEANUP: hlua: simplify ambiguous lua_insert() usage in hlua_ctx_resume()
    * BUG/MINOR: hlua: fix leak in hlua_ckch_set() error path
    * BUG/MINOR: hlua: prevent LJMP in hlua_traceback()
    * BUG/MINOR: hlua: fix unsafe hlua_pusherror() usage
    * BUG/MINOR: hlua: don't use lua_pushfstring() when we don't expect LJMP
    * CLEANUP: hlua: use hlua_pusherror() where relevant
    * BUG/MINOR: quic: prevent crash on qc_kill_conn()
    * BUG/MINOR: hlua: use CertCache.set() from various hlua contexts
    * BUG/MINOR: tools: fix possible null-deref in env_expand() on out-of-memory
    * BUG/MINOR: tcpcheck: report correct error in tcp-check rule parser
    * BUG/MINOR: cfgparse: remove the correct option on httpcheck send-state warning
    * BUG/MINOR: activity: fix Delta_calls and Delta_bytes count
    * BUG/MINOR: ssl/ocsp: init callback func ptr as NULL
    * CLEANUP: ssl/ocsp: readable ifdef in ssl_sock_load_ocsp
    * BUILD: fd: errno is also needed without poll()
    * CI: scripts: fix build of vtest regarding option -C
    * REGTESTS: acl_cli_spaces: avoid a warning caused by undefined logs
    * DOC: config: fix incorrect section reference about custom log format
    * DOC: quic: specify that connection migration is not supported
    * BUG/MINOR: server: Don't reset resolver options on a new default-server line
    * BUG/MINOR: http-htx: Support default path during scheme based normalization
    * BUG/MINOR: quic: adjust restriction for stateless reset emission
    * MEDIUM: config: prevent communication with privileged ports
    * BUILD: quic: fix unused variable warning when threads are disabled
    * BUG/MEDIUM: mux-quic: Create sedesc in same time of the QUIC stream
    * BUG/MEDIUM: quic_tls: prevent LibreSSL < 4.0 from negotiating CHACHA20_POLY1305
    * BUG/MAJOR: quic: Crash with TLS_AES_128_CCM_SHA256 (libressl only)
    * BUG/MINOR: connection: parse PROXY TLV for LOCAL mode
    * DOC: configuration: update the crt-list documentation
    * CLEANUP: ssl/cli: remove unused code in dump_crtlist_conf
    * BUG/MINOR: stats: Don't state the 303 redirect response is chunked
    * BUG/MINOR: htpp-ana/stats: Specify that HTX redirect messages have a C-L header
    * BUG/MEDIUM: fd: prevent memory waste in fdtab array
    * BUILD: stick-tables: better mark the stktable_data as 32-bit aligned
    * BUG/MEDIUM: h1: Reject CONNECT request if the target has a scheme
    * BUG/MINOR: h1: Check authority for non-CONNECT methods only if a scheme is found
    * BUG/MEDIUM: stick-tables: properly mark stktable_data as packed
    * BUG/MEDIUM: htx: mark htx_sl as packed since it may be realigned
    * BUG/MINOR: qpack: fix error code reported on QPACK decoding failure
    * BUG/MINOR: mux-quic: fix error code on shutdown for non HTTP/3
    * BUG/MINOR: log: smp_rgs array issues with inherited global log directives
    * BUG/MINOR: log: keep the ref in dup_logger()
    * MINOR: log: add dup_logsrv() helper function
    * DOC: lua: fix filters.txt file location
    * BUG/MINOR: haproxy: only tid 0 must not sleep if got signal
    * BUILD: clock: improve check for pthread_getcpuclockid()
    * BUG/MINOR: mworker: reintroduce way to disable seamless reload with -x /dev/null
    * BUG/MINOR: h1: fix detection of upper bytes in the URI
    * BUG/MINOR: backend: use cum_sess counters instead of cum_conn
    * BUG/MINOR: fd: my_closefrom() on Linux could skip contiguous series of sockets
    * BUG/MINOR: sock: handle a weird condition with connect()
    * BUG/MINOR: stconn: Fix sc_mux_strm() return value
    * BUG/MEDIUM: cache: Vary not working properly on anything other than accept-encoding
    * BUG/MINOR: server: fix slowstart behavior
    * BUG/MEDIUM: peers: Fix exit condition when max-updates-at-once is reached
    * BUG/MEDIUM: spoe: Always retry when an applet fails to send a frame
    * BUG/MEDIUM: applet: Fix applet API to put input data in a buffer
    * BUG/MEDIUM: evports: do not clear returned events list on signal
    * BUG/MEDIUM: stconn: Don't forward channel data if input data must be filtered
    * BUG/MEDIUM: grpc: Fix several unaligned 32/64 bits accesses
    * MINOR: net_helper: Add support for floats/doubles.
    * CI: revert kernel addr randomization introduced in 3a0fc864
    * BUG/MEDIUM: peers/trace: fix crash when listing event types
    * BUG/MINOR: debug: make sure DEBUG_STRICT=0 does work as documented
    * BUG/MINOR: http-ana: Fix TX_L7_RETRY and TX_D_L7_RETRY values
    * BUG/MEDIUM: http-ana: Deliver 502 on keep-alive for fressh server connection
    * CLEANUP: log: lf_text_len() returns a pointer not an integer
    * BUG/MINOR: log: invalid snprintf() usage in sess_build_logline()
    * BUG/MINOR: tools/log: invalid encode_{chunk,string} usage
    * BUG/MINOR: log: fix lf_text_len() truncate inconsistency
    * BUG/MINOR: listener: always assign distinct IDs to shards
    * BUG/MINOR: cli: Report an error to user if command or payload is too big
    * [RELEASE] Released version 2.8.9
    * BUILD: proxy: Replace free_logformat_list() to manually release log-format
    * [RELEASE] Released version 2.8.8
    * BUG/MINOR: proxy: fix logformat expression leak in use_backend rules
    * BUG/MINOR: backend: properly handle redispatch 0
    * BUG/MINOR: server: ignore 'enabled' for dynamic servers
    * BUG/MEDIUM: cli: Warn if pipelined commands are delimited by a \n
    * MINOR: cli: Remove useless loop on commands to find unescaped semi-colon
    * MINOR: server: allow cookie for dynamic servers
    * BUG/MINOR: server: fix persistence cookie for dynamic servers
    * BUG/MINOR: ssl: Detect more 'ocsp-update' incompatibilities
    * BUG/MINOR: ssl: Wrong ocsp-update "incompatibility" error message
    * BUG/MINOR: server: 'source' interface ignored from 'default-server' directive
    * OPTIM: http_ext: avoid useless copy in http_7239_extract_{ipv4,ipv6}
    * BUG/MEDIUM: mux-fcgi: Properly handle EOM flag on end-of-trailers HTX block
    * BUG/MINOR: mux-quic: close all QCS before freeing QCC tasklet
    * BUG/MEDIUM: ssl: Fix crash in ocsp-update log function
    * BUG/MINOR: session: ensure conn owner is set after insert into session
    * BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small
    * CI: temporarily adjust kernel entropy to work with ASAN/clang
    * BUG/MINOR: spoe: Be sure to be able to quickly close IDLE applets on soft-stop
    * BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing timeout
    * BUG/MINOR: listener: Don't schedule frontend without task in listener_release()
    * BUG/MINOR: listener: Wake proxy's mngmt task up if necessary on session release
    * BUG/MEDIUM: hlua: streams don't support mixing lua-load with lua-load-per-thread (2nd try)
    * MINOR: hlua: use accessors for stream hlua ctx
    * DEBUG: lua: precisely identify if stream is stuck inside lua or not
    * BUG/MINOR: hlua: fix missing lock in hlua_filter_delete()
    * BUG/MINOR: hlua: missing lock in hlua_filter_new()
    * BUG/MINOR: hlua: segfault when loading the same filter from different contexts
    * BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm()
    * DOC: configuration: clarify ciphersuites usage (V2)
    * BUILD: solaris: fix compilation errors
    * BUG/MINOR: cfgparse: report proper location for log-format-sd errors
    * BUG/MINOR: ssl/cli: typo in new ssl crl-file CLI description
    * CI: skip scheduled builds on forks
    * BUG/MINOR: sink: fix a race condition in the TCP log forwarding code
    * BUG/MINOR: hlua: don't call ha_alert() in hlua_event_subscribe()
    * BUG/MAJOR: hlua: improper lock usage with hlua_ctx_resume()
    * BUG/MEDIUM: hlua: improper lock usage with SET_SAFE_LJMP()
    * BUG/MINOR: hlua: improper lock usage in hlua_filter_new()
    * BUG/MINOR: hlua: improper lock usage in hlua_filter_callback()
    * BUG/MINOR: hlua: fix possible crash in hlua_filter_new() under load
    * BUG/MINOR: hlua: don't use lua_tostring() from unprotected contexts
    * BUG/MINOR: hlua: fix unsafe lua_tostring() usage with empty stack
    * BUG/MINOR: tools: seed the statistical PRNG slightly better
    * MINOR: hlua: Be able to disable logging from lua
    * BUG/MINOR: hlua: Fix log level to the right value when set via TXN:set_loglevel
    * BUG/MINOR: config/quic: Alert about PROXY protocol use on a QUIC listener
    * DOC: configuration: clarify ciphersuites usage
    * LICENSE: http_ext: fix GPL license version
    * LICENSE: event_hdl: fix GPL license version
    * BUG/MINOR: ssl/cli: duplicate cleaning code in cli_parse_del_crtlist
    * BUG/MINOR: ist: only store NUL byte on succeeded alloc
    * BUG/MINOR: quic: fix output of show quic
    * BUG/MAJOR: server: fix stream crash due to deleted server
    * BUG/MINOR: stats: drop srv refcount on early release
    * BUG/MINOR: ist: allocate nul byte on istdup
    * MINOR: quic: warn on bind on multiple addresses if no IP_PKTINFO support
    * DOC: quic: fix recommandation for bind on multiple address
    * BUG/MEDIUM: quic: fix transient send error with listener socket
    * BUG/MEDIUM: hlua: Don't loop if a lua socket does not consume received data
    * BUG/MEDIUM: hlua: Be able to garbage collect uninitialized lua sockets
    * BUG/MEDIUM: applet: Immediately free appctx on early error
    * DOC: quic: Missing tuning setting in "Global parameters"
    * BUG/MINOR: qpack: reject invalid dynamic table capacity
    * BUG/MINOR: qpack: reject invalid increment count decoding
    * BUG/MINOR: quic: reject HANDSHAKE_DONE as server
    * BUG/MINOR: quic: reject unknown frame type
    * BUG/MAJOR: promex: fix crash on deleted server
    * MINOR: connection: add sample fetches to report per-connection glitches
    * MINOR: mux-h2: implement MUX_CTL_GET_GLITCHES
    * MINOR: connection: add a new mux_ctl to report number of connection glitches
    * MEDIUM: mux-h2: allow to set the glitches threshold to kill a connection
    * MINOR: mux-h2: always use h2c_report_glitch()
    * MINOR: mux-h2: count late reduction of INITIAL_WINDOW_SIZE as a glitch
    * MINOR: mux-h2: count excess of CONTINUATION frames as a glitch
    * BUG/MINOR: mux-h2: count rejected DATA frames against the connection's flow control
    * MINOR: mux-h2: add a counter of "glitches" on a connection
    * [RELEASE] Released version 2.8.7
    * BUG/MAJOR: ssl/ocsp: crash with ocsp when old process exit or using ocsp CLI
    * [RELEASE] Released version 2.8.6
    * DEV: makefile: fix POSIX compatibility for "range" target
    * DEV: makefile: add a new "range" target to iteratively build all commits
    * CI: Update to actions/cache@v4
    * DOC: internal: update missing data types in peers-v2.0.txt
    * DOC: install: recommend pcre2
    * DOC: httpclient: add dedicated httpclient section
    * DOC: configuration: clarify http-request wait-for-body
    * BUILD: address a few remaining calloc(size, n) cases
    * BUG/MINOR: ext-check: cannot use without preserve-env
    * MINOR: ext-check: add an option to preserve environment variables
    * BUG/MINOR: diag: run the final diags before quitting when using -c
    * BUG/MINOR: diag: always show the version before dumping a diag warning
    * MINOR: errors: ha_alert() and ha_warning() uses warn_exec_path()
    * MINOR: quic: Add a counter for reordered packets
    * MINOR: quic: Dynamic packet reordering threshold
    * MINOR: quic: Update K CUBIC calculation (RFC 9438)
    * BUG/MEDIUM: quic: Wrong K CUBIC calculation.
    * MINOR: quic: Stop using 1024th of a second.
    * BUG/MINOR: quic: fix possible integer wrap around in cubic window calculation
    * CLEANUP: quic: Code clarifications for QUIC CUBIC (RFC 9438)
    * BUG/MINOR: quic: Wrong ack ranges handling when reaching the limit.
    * BUG/MEDIUM: quic: fix crash on invalid qc_stream_buf_free() BUG_ON
    * BUG/MEDIUM: qpack: allow 6xx..9xx status codes
    * BUG/MEDIUM: h3: do not crash on invalid response status code
    * MINOR: h3: add traces for stream sending function
    * BUG/MEDIUM: quic: remove unsent data from qc_stream_desc buf
    * MINOR: quic: extract qc_stream_buf free in a dedicated function
    * MINOR: quic: Stop hardcoding a scale shifting value (CUBIC_BETA_SCALE_FACTOR_SHIFT)
    * CLEANUP: quic: Remove unused CUBIC_BETA_SCALE_FACTOR_SHIFT macro.
    * BUG/MEDIUM: mux-quic: report early error on stream
    * BUG/MINOR: h3: fix checking on NULL Tx buffer
    * BUG/MEDIUM: ssl: Fix crash when calling "update ssl ocsp-response" when an update is ongoing
    * REGTESTS: ssl: Add OCSP related tests
    * REGTESTS: ssl: Fix empty line in cli command input
    * BUG/MINOR: ssl: Reenable ocsp auto-update after an "add ssl crt-list"
    * BUG/MINOR: ssl: Destroy ckch instances before the store during deinit
    * BUG/MEDIUM: ocsp: Separate refcount per instance and per store
    * MINOR: ssl: Use OCSP_CERTID instead of ckch_store in ckch_store_build_certid
    * BUG/MINOR: ssl: Clear the ckch instance when deleting a crt-list line
    * BUG/MINOR: ssl: Duplicate ocsp update mode when dup'ing ckch
    * BUG/MINOR: ssl: Fix error message after ssl_sock_load_ocsp call
    * BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions
    * BUG/MEDIUM: h1: always reject the NUL character in header values
    * BUG/MINOR: h1-htx: properly initialize the err_pos field
    * BUG/MEDIUM: h1: Don't support LF only to mark the end of a chunk size
    * BUG/MINOR: h1: Don't support LF only at the end of chunks
    * BUG/MEDIUM: stconn: Don't check pending shutdown to wake an applet up
    * BUG/MEDIUM: stconn: Allow expiration update when READ/WRITE event is pending
    * BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush()
    * BUG/MINOR: jwt: fix jwt_verify crash on 32-bit archs
    * BUG/MEDIUM: cli: fix once for all the problem of missing trailing LFs
    * BUG/MINOR: vars/cli: fix missing LF after "get var" output
    * BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI
    * REGTESTS: add a test to ensure map-ordering is preserved
    * MINOR: mux-h2/traces: add a missing trace on connection WU with negative inc
    * BUG/MEDIUM: mux-h2: refine connection vs stream error on headers
    * MINOR: mux-h2/traces: clarify the "rejected H2 request" event
    * MINOR: mux-h2/traces: explicitly show the error/refused stream states
    * MINOR: mux-h2/traces: also suggest invalid header upon parsing error
    * MINOR: debug: make BUG_ON() catch build errors even without DEBUG_STRICT
    * MINOR: debug: make ABORT_NOW() store the caller's line number when using abort
    * MINOR: debug: make sure calls to ha_crash_now() are never merged
    * MINOR: compiler: add a new DO_NOT_FOLD() macro to prevent code folding
    * BUG/MEDIUM: quic: keylog callback not called (USE_OPENSSL_COMPAT)
    * BUG/MINOR: mux-h2: also count streams for refused ones
    * BUG/MINOR: mux-quic: do not prevent non-STREAM sending on flow control
    * DOC: configuration: corrected description of keyword tune.ssl.ocsp-update.mindelay
    * MINOR: mux-h2: support limiting the total number of H2 streams per connection
    * BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up
    * BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it is forwardable
    * BUG/MEDIUM: h3: fix incorrect snd_buf return value
    * CLEANUP: quic: Remaining useless code into server part
    * BUG/MINOR: h3: close connection on sending alloc errors
    * BUG/MINOR: h3: properly handle alloc failure on finalize
    * BUG/MINOR: h3: close connection on header list too big
    * MINOR: h3: check connection error during sending
    * BUG/MINOR: quic: Missing call to TLS message callbacks
    * BUG/MINOR: quic: Wrong keylog callback setting.
    * BUG/MINOR: mux-quic: always report error to SC on RESET_STREAM emission
    * BUG/MEDIUM: stats: unhandled switching rules with TCP frontend
    * MINOR: stats: store the parent proxy in stats ctx (http)
    * DOC: config: Update documentation about local haproxy response
    * BUG/MINOR: resolvers: default resolvers fails when network not configured
    * BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty
    * BUG/MEDIUM: quic: QUIC CID removed from tree without locking
    * BUG/MEDIUM: quic: Possible buffer overflow when building TLS records
    * BUG/MINOR: mworker/cli: fix set severity-output support
    * DOC: configuration: typo req.ssl_hello_type
    * [RELEASE] Released version 2.8.5
    * BUG/MEDIUM: proxy: always initialize the default settings after init
    * BUG/MINOR: lua: Wrong OCSP CID after modifying an SSL certficate (LUA)
    * BUG/MINOR: ssl: Wrong OCSP CID after modifying an SSL certficate
    * MINOR: ssl/cli: Add ha_(warning|alert) msgs to CLI ckch callback
    * BUG/MINOR: ssl: Double free of OCSP Certificate ID
    * BUG/MINOR: quic: Packet number spaces too lately initialized
    * BUG/MINOR: quic: Missing QUIC connection path member initialization
    * BUG/MINOR: quic: Possible leak of TX packets under heavy load
    * BUG/MEDIUM: quic: Possible crash during retransmissions and heavy load
    * BUG/MINOR: cache: Remove incomplete entries from the cache when stream is closed
    * BUG/MEDIUM: peers: fix partial message decoding
    * DOC: Clarify the differences between field() and word()
    * BUG/MINOR: sample: Make the `word` converter compatible with `-m found`
    * REGTESTS: sample: Test the behavior of consecutive delimiters for the field converter
    * DOC: config: fix monitor-fail typo
    * DOC: config: add matrix entry for "max-session-srv-conns"
    * DOC: config: specify supported sections for "max-session-srv-conns"
    * BUG/MINOR: cfgparse-listen: fix warning being reported as an alert
    * BUG/MINOR: config: Stopped parsing upon unmatched environment variables
    * BUG/MINOR: quic_tp: fix preferred_address decoding
    * DOC: config: fix missing characters in set-spoe-group action
    * BUG/MINOR: h3: always reject PUSH_PROMISE
    * BUG/MINOR: h3: fix TRAILERS encoding
    * BUG/MEDIUM: master/cli: Properly pin the master CLI on thread 1 / group 1
    * BUG/MINOR: compression: possible NULL dereferences in comp_prepare_compress_request()
    * BUG/MINOR: quic: fix CONNECTION_CLOSE_APP encoding
    * DOC: lua: fix Proxy.get_mode() output
    * DOC: lua: add sticktable class reference from Proxy.stktable
    * REGTESTS: connection: disable http_reuse_be_transparent.vtc if !TPROXY
    * DOC: config: fix timeout check inheritance restrictions
    * DOC: 51d: updated 51Degrees repo URL for v3.2.10
    * BUG/MINOR: server: do not leak default-server in defaults sections
    * BUG/MINOR: quic: Possible RX packet memory leak under heavy load
    * BUG/MEDIUM: quic: Possible crash for connections to be killed
    * BUG/MINOR: sock: mark abns sockets as non-suspendable and always unbind them
    * BUG/MINOR: startup: set GTUNE_SOCKET_TRANSFER correctly
    * REGTESTS: http: add a test to validate chunked responses delivery
    * BUG/MINOR: proxy/stktable: missing frees on proxy cleanup
    * MINOR: stktable: add stktable_deinit function
    * BUG/MINOR: stream/cli: report correct stream age in "show sess"
    * BUG/MEDIUM: mux-fcgi: fail earlier on malloc in takeover()
    * BUG/MEDIUM: mux-h1: fail earlier on malloc in takeover()
    * BUG/MEDIUM: mux-h2: fail earlier on malloc in takeover()
    * BUG/MAJOR: quic: complete thread migration before tcp-rules
    * [RELEASE] Released version 2.8.4
    * BUG/MINOR: stconn: Report read activity on non-indep streams for partial sends
    * BUG/MINOR: stconn/applet: Report send activity only if there was output data
    * BUG/MINOR: stconn: Use HTX-aware channel's functions to get info on buffer
    * BUG/MINOR: stconn: Fix streamer detection for HTX streams
    * MINOR: channel: Add functions to get info on buffers and deal with HTX streams
    * MINOR: htx: Use a macro for overhead induced by HTX
    * BUG/MEDIUM: stconn: Update fsb date on partial sends
    * BUG/MEDIUM: stream: Don't call mux .ctl() callback if not implemented
    * BUG/MEDIUM: mworker: set the master variable earlier
    * BUG/MEDIUM: applet: Report a send activity everytime data were sent
    * BUG/MEDIUM: stconn: Report a send activity everytime data were sent
    * REGTESTS: http: Improve script testing abortonclose option
    * BUG/MEDIUM: stream: Properly handle abortonclose when set on backend only
    * MEDIUM: mux-h1: Handle MUX_SUBS_RECV flag in h1_ctl() and susbscribe for reads
    * MINOR: connection: Add a CTL flag to notify mux it should wait for reads again
    * BUG/MINOR: stconn: Handle abortonclose if backend connection was already set up
    * BUG/MEDIUM: connection: report connection errors even when no mux is installed
    * DOC: quic: Wrong syntax for "quic-cc-algo" keyword.
    * BUG/MINOR: sink: don't learn srv port from srv addr
    * BUG/MEDIUM: applet: Remove appctx from buffer wait list on release
    * DOC: config: use the word 'backend' instead of 'proxy' in 'track' description
    * BUG/MINOR: quic: fix retry token check inconsistency
    * DOC: management: -q is quiet all the time
    * BUG/MEDIUM: stconn: Don't update stream expiration date if already expired
    * BUG/MEDIUM: quic: Avoid some crashes upon TX packet allocation failures
    * BUG/MEDIUM: quic: Possible crashes when sending too short Initial packets
    * BUG/MEDIUM: quic: Avoid trying to send ACK frames from an empty ack ranges tree
    * BUG/MINOR: quic: idle timer task requeued in the past
    * BUG/MEDIUM: pool: fix releasable pool calculation when overloaded
    * BUG/MEDIUM: freq-ctr: Don't report overshoot for long inactivity period
    * BUG/MINOR: mux-h1: Properly handle http-request and http-keep-alive timeouts
    * BUG/MINOR: stick-table/cli: Check for invalid ipv4 key
    * BUG/MEDIUM: quic: fix sslconns on quic_conn alloc failure
    * BUG/MEDIUM: quic: fix actconn on quic_conn alloc failure
    * CLEANUP: htx: Properly indent htx_reserve_max_data() function
    * BUG/MINOR: stconn: Sanitize report for read activity
    * BUG/MEDIUM: Don't apply a max value on room_needed in sc_need_room()
    * BUG/MEDIUM: stconn: Don't report rcv/snd expiration date if SC cannot epxire
    * BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range()
    * BUG/MINOR: cfgparse/stktable: fix error message on stktable_init() failure
    * BUG/MINOR: stktable: missing free in parse_stick_table()
    * BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure
    * BUG/MEDIUM: ssl: segfault when cipher is NULL
    * BUG/MINOR: mux-quic: fix early close if unset client timeout
    * BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3 and dual ECDSA/RSA
    * MEDIUM: quic: count quic_conn for global sslconns
    * MEDIUM: quic: count quic_conn instance for maxconn
    * MINOR: frontend: implement a dedicated actconn increment function
    * BUG/MINOR: ssl: use a thread-safe sslconns increment
    * BUG/MINOR: quic: do not consider idle timeout on CLOSING state
    * BUG/MEDIUM: server: "proto" not working for dynamic servers
    * MINOR: connection: add conn_pr_mode_to_proto_mode() helper func
    * DEBUG: mux-h2/flags: fix list of h2c flags used by the flags decoder
    * MINOR: lua: Add flags to configure logging behaviour
    * BUG/MINOR: ssl: load correctly @system-ca when ca-base is define
    * DOC: internal: filters: fix reference to entities.pdf
    * BUG/MINOR: mux-h2: update tracked counters with req cnt/req err
    * BUG/MINOR: mux-h2: commit the current stream ID even on reject
    * BUG/MEDIUM: peers: Fix synchro for huge number of tables
    * BUG/MEDIUM: peers: Be sure to always refresh recconnect timer in sync task
    * BUG/MINOR: trace: fix trace parser error reporting
    * BUG/MINOR: mux-h2: fix http-request and http-keep-alive timeouts again
    * BUG/MEDIUM: mux-h2: Don't report an error on shutr if a shutw is pending
    * BUG/MINOR: mux-h2: make up other blocked streams upon removal from list
    * BUG/MINOR: mux-h1: Send a 400-bad-request on shutdown before the first request
    * BUG/MEDIUM: quic-conn: free unsent frames on retransmit to prevent crash
    * BUG/MINOR: mux-quic: fix free on qcs-new fail alloc
    * BUG/MINOR: h3: strengthen host/authority header parsing
    * BUG/MINOR: mux-quic: support initial 0 max-stream-data
    * BUG/MEDIUM: mux-quic: fix RESET_STREAM on send-only stream
    * BUG/MINOR: quic: reject packet with no frame
    * BUG/MINOR: quic: Avoid crashing with unsupported cryptographic algos
    * BUG/MEDIUM: stconn: Fix comparison sign in sc_need_room()
    * BUG/MINOR: hq-interop: simplify parser requirement
    * BUG/MEDIUM: h1: Ignore C-L value in the H1 parser if T-E is also set
    * BUG/MINOR: mux-h1: Ignore C-L when sending H1 messages if T-E is also set
    * BUG/MINOR: mux-h1: Handle read0 in rcv_pipe() only when data receipt was tried
    * BUG/MEDIUM: hlua: Initialize appctx used by a lua socket on connect only
    * MINOR: hlua: Test the hlua struct first when the lua socket is connecting
    * MINOR: hlua: Save the lua socket's server in its context
    * MINOR: hlua: Save the lua socket's timeout in its context
    * MINOR: hlua: Don't preform operations on a not connected socket
    * MINOR: hlua: Set context's appctx when the lua socket is created
    * BUG/MEDIUM: http-ana: Try to handle response before handling server abort
    * BUG/MEDIUM: quic_conn: let the scheduler kill the task when needed
    * BUG/MEDIUM: actions: always apply a longest match on prefix lookup
    * BUG/MINOR: mux-quic: remove full demux flag on ncbuf release
    * BUG/MEDIUM: server/cli: don't delete a dynamic server that has streams
    * MINOR: pattern: fix pat_{parse,match}_ip() function comments
    * BUG/MINOR: server: add missing free for server->rdr_pfx
    * BUG/MAJOR: mux-h2: Report a protocol error for any DATA frame before headers
    * BUG/MINOR: freq_ctr: fix possible negative rate with the scaled API
    * BUG/MEDIUM: master/cli: Pin the master CLI on the first thread of the group 1
    * BUG/MINOR: promex: fix backend_agg_check_status
    * BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
    * BUG/MINOR: hlua/init: coroutine may not resume itself
    * BUG/MEDIUM: hlua: don't pass stale nargs argument to lua_resume()
    * CI: musl: drop shopt in workflow invocation
    * CI: musl: highlight section if there are coredumps
    * Revert "BUG/MEDIUM: quic: missing check of dcid for init pkt including a token"
    * BUG/MEDIUM: hlua: streams don't support mixing lua-load with lua-load-per-thread
    * MINOR: hlua: add hlua_stream_ctx_prepare helper function
    * BUILD: quic: fix build on centos 8 and USE_QUIC_OPENSSL_COMPAT
    * BUG/MINOR: quic: ssl_quic_initial_ctx() uses error count not error code
    * BUG/MINOR: quic: allow-0rtt warning must only be emitted with quic bind
    * BUILD: Makefile: add USE_QUIC_OPENSSL_COMPAT to make help
    * MINOR: quic+openssl_compat: Emit an alert for "allow-0rtt" option
    * MINOR: quic+openssl_compat: Do not start without "limited-quic"
    * MINOR: quic: Warning for OpenSSL wrapper QUIC bindings without "limited-quic"
    * BUG/MINOR: quic+openssl_compat: Non initialized TLS encryption levels
    * DOC: quic: Add "limited-quic" new tuning setting
    * MINOR: quic: Add "limited-quic" new tuning setting
    * MINOR: quic: SSL context initialization with QUIC OpenSSL wrapper.
    * MINOR: quic: Add a quic_openssl_compat struct to quic_conn struct
    * MINOR: quic: Call the keylog callback for QUIC openssl wrapper from SSL_CTX_keylog()
    * MINOR: quic: Initialize TLS contexts for QUIC openssl wrapper
    * MINOR: quic: Export some KDF functions (QUIC-TLS)
    * MINOR: quic: Add a compilation option for the QUIC OpenSSL wrapper
    * MINOR: quic: Do not enable 0RTT with SSL_set_quic_early_data_enabled()
    * MINOR: quic: Set the QUIC connection as extra data before calling SSL_set_quic_method()
    * MINOR: quic: Do not enable O-RTT with USE_QUIC_OPENSSL_COMPAT
    * MINOR: quic: Include QUIC opensssl wrapper header from TLS stacks compatibility header
    * MINOR: quic: QUIC openssl wrapper implementation
    * BUG/MINOR: quic: Wrong cluster secret initialization
    * BUG/MINOR: quic: Leak of frames to send.
    * BUILD: bug: make BUG_ON() void to avoid a rare warning
  - VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server
    (bsc#1233973)
    Add upsream patch: 0001-MINOR-h3-Add-HTTP-3-definitions.patch

++++ haproxy:

  - Update to version 2.8.11+git0.01c1056a4:
    VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server
    (bsc#1233973)
    * [RELEASE] Released version 2.8.11
    * BUG/MINOR: cfgparse-listen: fix option httpslog override warning message
    * BUG/MEDIUM: promex: Wait to have the request before sending the response
    * BUG/MEDIUM: cache/stats: Wait to have the request before sending the response
    * BUG/MEDIUM: queue: implement a flag to check for the dequeuing
    * BUG/MINOR: clock: validate that now_offset still applies to the current date
    * BUG/MINOR: clock: make time jump corrections a bit more accurate
    * BUG/MINOR: polling: fix time reporting when using busy polling
    * BUG/MAJOR: mux-h1: Wake SC to perform 0-copy forwarding in CLOSING state
    * BUG/MEDIUM: pattern: prevent UAF on reused pattern expr
    * BUG/MINOR: pattern: prevent const sample from being tampered in pat_match_beg()
    * BUG/MEDIUM: clock: detect and cover jumps during execution
    * REGTESTS: fix random failures with wrong_ip_port_logging.vtc under load
    * DOC: configuration: place the HAPROXY_HTTP_LOG_FMT example on the correct line
    * BUG/MINOR: pattern: do not leave a leading comma on "set" error messages
    * BUG/MINOR: pattern: pat_ref_set: return 0 if err was found
    * BUG/MINOR: pattern: pat_ref_set: fix UAF reported by coverity
    * BUG/MINOR: stconn: Request to send something to be woken up when the pipe is full
    * BUG/MEDIUM: mux-pt/mux-h1: Release the pipe on connection error on sending path
    * BUG/MEDIUM: clock: also update the date offset on time jumps
    * DOC: config: correct the table for option tcplog
    * BUG/MINOR: h3: properly reject too long header responses
    * BUG/MINOR: proto_uxst: delete fd from fdtab if listen() fails
    * BUG/MINOR: mux-quic: do not send too big MAX_STREAMS ID
    * REGTESTS: mcli: test the pipelined commands on master CLI
    * BUG/MEDIUM: mworker/cli: fix pipelined modes on master CLI
    * MINOR: channel: implement ci_insert() function
    * BUG/MINOR: proto_tcp: keep error msg if listen() fails
    * BUG/MINOR: proto_tcp: delete fd from fdtab if listen() fails
    * BUG/MINOR: quic/trace: make quic_conn_enc_level_init() emit NEW not CLOSE
    * BUG/MINOR: trace/quic: make "qconn" selectable as a lockon criterion
    * BUG/MINOR: trace: automatically start in waiting mode with "start <evt>"
    * BUG/MEDIUM: trace: fix null deref in lockon mechanism since TRACE_ENABLED()
    * BUG/MINOR: trace/quic: permit to lock on frontend/connect/session etc
    * BUG/MINOR: trace/quic: enable conn/session pointer recovery from quic_conn
    * BUG/MINOR: fcgi-app: handle a possible strdup() failure
    * BUG/MEDIUM: mux-h2: Propagate term flags to SE on error in h2s_wake_one_stream
    * BUG/MEDIUM: h2: Only report early HTX EOM for tunneled streams
    * BUG/MEDIUM: http-ana: Report error on write error waiting for the response
    * BUG/MEDIUM: quic: prevent conn freeze on 0RTT undeciphered content
    * BUG/MEDIUM: stconn: Report error on SC on send if a previous SE error was set
    * BUG/MEDIUM: mux-h1: Properly handle empty message when an error is triggered
    * BUG/MEDIUM: cli: Always release back endpoint between two commands on the mcli
    * BUG/MEDIUM: stream: Prevent mux upgrades if client connection is no longer ready
    * BUG/MEDIUM: init: fix fd_hard_limit default in compute_ideal_maxconn
    * MEDIUM: init: set default for fd_hard_limit via DEFAULT_MAXFD (take #2)
    * BUG/MEDIUM: queue: deal with a rare TOCTOU in assign_server_and_queue()
    * MINOR: queue: add a function to check for TOCTOU after queueing
    * BUG/MEDIUM: jwt: Clear SSL error queue on error when checking the signature
    * BUG/MINOR: quic: Lack of precision when computing K (cubic only cc)
    * BUG/MINOR: cli: Atomically inc the global request counter between CLI commands
    * BUG/MINOR: server: Don't warn fallback IP is used during init-addr resolution
    * BUG/MINOR: stick-table: fix crash for src_inc_gpc() without stkcounter
    * DOC: config: improve the http-keep-alive section
    * DOC: configuration: issuers-chain-path not compatible with OCSP
    * BUG/MEDIUM: ssl_sock: fix deadlock in ssl_sock_load_ocsp() on error path
    * BUG/MEDIUM: debug/cli: fix "show threads" crashing with low thread counts
    * BUG/MINOR: session: Eval L4/L5 rules defined in the default section
    * BUG/MEDIUM: bwlim: Be sure to never set the analyze expiration date in past
    * BUG/MEDIUM: spoe: Be sure to create a SPOE applet if none on the current thread
    * BUG/MEDIUM: h1: Reject empty Transfer-encoding header
    * BUG/MINOR: h1: Reject empty coding name as last transfer-encoding value
    * BUG/MINOR: h1: Fail to parse empty transfer coding names
    * BUG/MINOR: jwt: fix variable initialisation
    * DOC: configuration: update maxconn description
    * BUG/MINOR: jwt: don't try to load files with HMAC algorithm
    * MEDIUM: ssl: initialize the SSL stack explicitely
    * DOC: configuration: more details about the master-worker mode
    * BUG/MEDIUM: quic: fix possible exit from qc_check_dcid() without unlocking
    * BUG/MINOR: quic: fix race-condition on trace for CID retrieval
    * BUG/MINOR: quic: fix race condition in qc_check_dcid()
    * BUG/MEDIUM: quic: fix race-condition in quic_get_cid_tid()
    * BUG/MEDIUM: h3: ensure the ":scheme" pseudo header is totally valid
    * BUG/MEDIUM: h3: ensure the ":method" pseudo header is totally valid
    * MINOR: activity: make the memory profiling hash size configurable at build time
    * BUG/MINOR: hlua: report proper context upon error in hlua_cli_io_handler_fct()
    * BUG/MINOR: quic: fix BUG_ON() on Tx pkt alloc failure
    * BUG/MINOR: mux-quic: fix crash on qcs SD alloc failure
    * BUG/MINOR: h3: fix crash on STOP_SENDING receive after GOAWAY emission
    * DOC: api/event_hdl: small updates, fix an example and add some precisions
    * SCRIPTS: git-show-backports: do not truncate git-show output
    * DOC: configuration: fix alphabetical order of bind options
    * DOC: management: rename show stats domain cli "dns" to "resolvers"
    * DOC/MINOR: management: add missed -dR and -dv options
    * BUG/MINOR: proxy: fix header_unique_id leak on deinit()
    * BUG/MINOR: proxy: fix source interface and usesrc leaks on deinit()
    * BUG/MINOR: proxy: fix dyncookie_key leak on deinit()
    * BUG/MINOR: proxy: fix check_{command,path} leak on deinit()
    * BUG/MINOR: proxy: fix log_tag leak on deinit()
    * BUG/MINOR: proxy: fix server_id_hdr_name leak on deinit()
    * BUG/MINOR: quic: fix computed length of emitted STREAM frames
    * [RELEASE] Released version 2.8.10
    * BUG/MEDIUM: quic: don't blindly rely on unaligned accesses
    * BUG/MAJOR: connection: fix server used_conns with H2 + reuse safe
    * BUG/MEDIUM: http_ana: ignore NTLM for reuse aggressive/always and no H1
    * BUG/MAJOR: server: do not delete srv referenced by session
    * MINOR: session: rename private conns elements
    * BUG/MEDIUM: quic: fix connection freeze on post handshake
    * BUG/MEDIUM: server: fix dynamic servers initial settings
    * BUG/MEDIUM: ssl: wrong priority whem limiting ECDSA ciphers in ECDSA+RSA configuration
    * CLEANUP: hlua: simplify ambiguous lua_insert() usage in hlua_ctx_resume()
    * BUG/MINOR: hlua: fix leak in hlua_ckch_set() error path
    * BUG/MINOR: hlua: prevent LJMP in hlua_traceback()
    * BUG/MINOR: hlua: fix unsafe hlua_pusherror() usage
    * BUG/MINOR: hlua: don't use lua_pushfstring() when we don't expect LJMP
    * CLEANUP: hlua: use hlua_pusherror() where relevant
    * BUG/MINOR: quic: prevent crash on qc_kill_conn()
    * BUG/MINOR: hlua: use CertCache.set() from various hlua contexts
    * BUG/MINOR: tools: fix possible null-deref in env_expand() on out-of-memory
    * BUG/MINOR: tcpcheck: report correct error in tcp-check rule parser
    * BUG/MINOR: cfgparse: remove the correct option on httpcheck send-state warning
    * BUG/MINOR: activity: fix Delta_calls and Delta_bytes count
    * BUG/MINOR: ssl/ocsp: init callback func ptr as NULL
    * CLEANUP: ssl/ocsp: readable ifdef in ssl_sock_load_ocsp
    * BUILD: fd: errno is also needed without poll()
    * CI: scripts: fix build of vtest regarding option -C
    * REGTESTS: acl_cli_spaces: avoid a warning caused by undefined logs
    * DOC: config: fix incorrect section reference about custom log format
    * DOC: quic: specify that connection migration is not supported
    * BUG/MINOR: server: Don't reset resolver options on a new default-server line
    * BUG/MINOR: http-htx: Support default path during scheme based normalization
    * BUG/MINOR: quic: adjust restriction for stateless reset emission
    * MEDIUM: config: prevent communication with privileged ports
    * BUILD: quic: fix unused variable warning when threads are disabled
    * BUG/MEDIUM: mux-quic: Create sedesc in same time of the QUIC stream
    * BUG/MEDIUM: quic_tls: prevent LibreSSL < 4.0 from negotiating CHACHA20_POLY1305
    * BUG/MAJOR: quic: Crash with TLS_AES_128_CCM_SHA256 (libressl only)
    * BUG/MINOR: connection: parse PROXY TLV for LOCAL mode
    * DOC: configuration: update the crt-list documentation
    * CLEANUP: ssl/cli: remove unused code in dump_crtlist_conf
    * BUG/MINOR: stats: Don't state the 303 redirect response is chunked
    * BUG/MINOR: htpp-ana/stats: Specify that HTX redirect messages have a C-L header
    * BUG/MEDIUM: fd: prevent memory waste in fdtab array
    * BUILD: stick-tables: better mark the stktable_data as 32-bit aligned
    * BUG/MEDIUM: h1: Reject CONNECT request if the target has a scheme
    * BUG/MINOR: h1: Check authority for non-CONNECT methods only if a scheme is found
    * BUG/MEDIUM: stick-tables: properly mark stktable_data as packed
    * BUG/MEDIUM: htx: mark htx_sl as packed since it may be realigned
    * BUG/MINOR: qpack: fix error code reported on QPACK decoding failure
    * BUG/MINOR: mux-quic: fix error code on shutdown for non HTTP/3
    * BUG/MINOR: log: smp_rgs array issues with inherited global log directives
    * BUG/MINOR: log: keep the ref in dup_logger()
    * MINOR: log: add dup_logsrv() helper function
    * DOC: lua: fix filters.txt file location
    * BUG/MINOR: haproxy: only tid 0 must not sleep if got signal
    * BUILD: clock: improve check for pthread_getcpuclockid()
    * BUG/MINOR: mworker: reintroduce way to disable seamless reload with -x /dev/null
    * BUG/MINOR: h1: fix detection of upper bytes in the URI
    * BUG/MINOR: backend: use cum_sess counters instead of cum_conn
    * BUG/MINOR: fd: my_closefrom() on Linux could skip contiguous series of sockets
    * BUG/MINOR: sock: handle a weird condition with connect()
    * BUG/MINOR: stconn: Fix sc_mux_strm() return value
    * BUG/MEDIUM: cache: Vary not working properly on anything other than accept-encoding
    * BUG/MINOR: server: fix slowstart behavior
    * BUG/MEDIUM: peers: Fix exit condition when max-updates-at-once is reached
    * BUG/MEDIUM: spoe: Always retry when an applet fails to send a frame
    * BUG/MEDIUM: applet: Fix applet API to put input data in a buffer
    * BUG/MEDIUM: evports: do not clear returned events list on signal
    * BUG/MEDIUM: stconn: Don't forward channel data if input data must be filtered
    * BUG/MEDIUM: grpc: Fix several unaligned 32/64 bits accesses
    * MINOR: net_helper: Add support for floats/doubles.
    * CI: revert kernel addr randomization introduced in 3a0fc864
    * BUG/MEDIUM: peers/trace: fix crash when listing event types
    * BUG/MINOR: debug: make sure DEBUG_STRICT=0 does work as documented
    * BUG/MINOR: http-ana: Fix TX_L7_RETRY and TX_D_L7_RETRY values
    * BUG/MEDIUM: http-ana: Deliver 502 on keep-alive for fressh server connection
    * CLEANUP: log: lf_text_len() returns a pointer not an integer
    * BUG/MINOR: log: invalid snprintf() usage in sess_build_logline()
    * BUG/MINOR: tools/log: invalid encode_{chunk,string} usage
    * BUG/MINOR: log: fix lf_text_len() truncate inconsistency
    * BUG/MINOR: listener: always assign distinct IDs to shards
    * BUG/MINOR: cli: Report an error to user if command or payload is too big
    * [RELEASE] Released version 2.8.9
    * BUILD: proxy: Replace free_logformat_list() to manually release log-format
    * [RELEASE] Released version 2.8.8
    * BUG/MINOR: proxy: fix logformat expression leak in use_backend rules
    * BUG/MINOR: backend: properly handle redispatch 0
    * BUG/MINOR: server: ignore 'enabled' for dynamic servers
    * BUG/MEDIUM: cli: Warn if pipelined commands are delimited by a \n
    * MINOR: cli: Remove useless loop on commands to find unescaped semi-colon
    * MINOR: server: allow cookie for dynamic servers
    * BUG/MINOR: server: fix persistence cookie for dynamic servers
    * BUG/MINOR: ssl: Detect more 'ocsp-update' incompatibilities
    * BUG/MINOR: ssl: Wrong ocsp-update "incompatibility" error message
    * BUG/MINOR: server: 'source' interface ignored from 'default-server' directive
    * OPTIM: http_ext: avoid useless copy in http_7239_extract_{ipv4,ipv6}
    * BUG/MEDIUM: mux-fcgi: Properly handle EOM flag on end-of-trailers HTX block
    * BUG/MINOR: mux-quic: close all QCS before freeing QCC tasklet
    * BUG/MEDIUM: ssl: Fix crash in ocsp-update log function
    * BUG/MINOR: session: ensure conn owner is set after insert into session
    * BUG/MEDIUM: spoe: Return an invalid frame on recv if size is too small
    * CI: temporarily adjust kernel entropy to work with ASAN/clang
    * BUG/MINOR: spoe: Be sure to be able to quickly close IDLE applets on soft-stop
    * BUG/MEDIUM: spoe: Don't rely on stream's expiration to detect processing timeout
    * BUG/MINOR: listener: Don't schedule frontend without task in listener_release()
    * BUG/MINOR: listener: Wake proxy's mngmt task up if necessary on session release
    * BUG/MEDIUM: hlua: streams don't support mixing lua-load with lua-load-per-thread (2nd try)
    * MINOR: hlua: use accessors for stream hlua ctx
    * DEBUG: lua: precisely identify if stream is stuck inside lua or not
    * BUG/MINOR: hlua: fix missing lock in hlua_filter_delete()
    * BUG/MINOR: hlua: missing lock in hlua_filter_new()
    * BUG/MINOR: hlua: segfault when loading the same filter from different contexts
    * BUG/MINOR: ssl: fix possible ctx memory leak in sample_conv_aes_gcm()
    * DOC: configuration: clarify ciphersuites usage (V2)
    * BUILD: solaris: fix compilation errors
    * BUG/MINOR: cfgparse: report proper location for log-format-sd errors
    * BUG/MINOR: ssl/cli: typo in new ssl crl-file CLI description
    * CI: skip scheduled builds on forks
    * BUG/MINOR: sink: fix a race condition in the TCP log forwarding code
    * BUG/MINOR: hlua: don't call ha_alert() in hlua_event_subscribe()
    * BUG/MAJOR: hlua: improper lock usage with hlua_ctx_resume()
    * BUG/MEDIUM: hlua: improper lock usage with SET_SAFE_LJMP()
    * BUG/MINOR: hlua: improper lock usage in hlua_filter_new()
    * BUG/MINOR: hlua: improper lock usage in hlua_filter_callback()
    * BUG/MINOR: hlua: fix possible crash in hlua_filter_new() under load
    * BUG/MINOR: hlua: don't use lua_tostring() from unprotected contexts
    * BUG/MINOR: hlua: fix unsafe lua_tostring() usage with empty stack
    * BUG/MINOR: tools: seed the statistical PRNG slightly better
    * MINOR: hlua: Be able to disable logging from lua
    * BUG/MINOR: hlua: Fix log level to the right value when set via TXN:set_loglevel
    * BUG/MINOR: config/quic: Alert about PROXY protocol use on a QUIC listener
    * DOC: configuration: clarify ciphersuites usage
    * LICENSE: http_ext: fix GPL license version
    * LICENSE: event_hdl: fix GPL license version
    * BUG/MINOR: ssl/cli: duplicate cleaning code in cli_parse_del_crtlist
    * BUG/MINOR: ist: only store NUL byte on succeeded alloc
    * BUG/MINOR: quic: fix output of show quic
    * BUG/MAJOR: server: fix stream crash due to deleted server
    * BUG/MINOR: stats: drop srv refcount on early release
    * BUG/MINOR: ist: allocate nul byte on istdup
    * MINOR: quic: warn on bind on multiple addresses if no IP_PKTINFO support
    * DOC: quic: fix recommandation for bind on multiple address
    * BUG/MEDIUM: quic: fix transient send error with listener socket
    * BUG/MEDIUM: hlua: Don't loop if a lua socket does not consume received data
    * BUG/MEDIUM: hlua: Be able to garbage collect uninitialized lua sockets
    * BUG/MEDIUM: applet: Immediately free appctx on early error
    * DOC: quic: Missing tuning setting in "Global parameters"
    * BUG/MINOR: qpack: reject invalid dynamic table capacity
    * BUG/MINOR: qpack: reject invalid increment count decoding
    * BUG/MINOR: quic: reject HANDSHAKE_DONE as server
    * BUG/MINOR: quic: reject unknown frame type
    * BUG/MAJOR: promex: fix crash on deleted server
    * MINOR: connection: add sample fetches to report per-connection glitches
    * MINOR: mux-h2: implement MUX_CTL_GET_GLITCHES
    * MINOR: connection: add a new mux_ctl to report number of connection glitches
    * MEDIUM: mux-h2: allow to set the glitches threshold to kill a connection
    * MINOR: mux-h2: always use h2c_report_glitch()
    * MINOR: mux-h2: count late reduction of INITIAL_WINDOW_SIZE as a glitch
    * MINOR: mux-h2: count excess of CONTINUATION frames as a glitch
    * BUG/MINOR: mux-h2: count rejected DATA frames against the connection's flow control
    * MINOR: mux-h2: add a counter of "glitches" on a connection
    * [RELEASE] Released version 2.8.7
    * BUG/MAJOR: ssl/ocsp: crash with ocsp when old process exit or using ocsp CLI
    * [RELEASE] Released version 2.8.6
    * DEV: makefile: fix POSIX compatibility for "range" target
    * DEV: makefile: add a new "range" target to iteratively build all commits
    * CI: Update to actions/cache@v4
    * DOC: internal: update missing data types in peers-v2.0.txt
    * DOC: install: recommend pcre2
    * DOC: httpclient: add dedicated httpclient section
    * DOC: configuration: clarify http-request wait-for-body
    * BUILD: address a few remaining calloc(size, n) cases
    * BUG/MINOR: ext-check: cannot use without preserve-env
    * MINOR: ext-check: add an option to preserve environment variables
    * BUG/MINOR: diag: run the final diags before quitting when using -c
    * BUG/MINOR: diag: always show the version before dumping a diag warning
    * MINOR: errors: ha_alert() and ha_warning() uses warn_exec_path()
    * MINOR: quic: Add a counter for reordered packets
    * MINOR: quic: Dynamic packet reordering threshold
    * MINOR: quic: Update K CUBIC calculation (RFC 9438)
    * BUG/MEDIUM: quic: Wrong K CUBIC calculation.
    * MINOR: quic: Stop using 1024th of a second.
    * BUG/MINOR: quic: fix possible integer wrap around in cubic window calculation
    * CLEANUP: quic: Code clarifications for QUIC CUBIC (RFC 9438)
    * BUG/MINOR: quic: Wrong ack ranges handling when reaching the limit.
    * BUG/MEDIUM: quic: fix crash on invalid qc_stream_buf_free() BUG_ON
    * BUG/MEDIUM: qpack: allow 6xx..9xx status codes
    * BUG/MEDIUM: h3: do not crash on invalid response status code
    * MINOR: h3: add traces for stream sending function
    * BUG/MEDIUM: quic: remove unsent data from qc_stream_desc buf
    * MINOR: quic: extract qc_stream_buf free in a dedicated function
    * MINOR: quic: Stop hardcoding a scale shifting value (CUBIC_BETA_SCALE_FACTOR_SHIFT)
    * CLEANUP: quic: Remove unused CUBIC_BETA_SCALE_FACTOR_SHIFT macro.
    * BUG/MEDIUM: mux-quic: report early error on stream
    * BUG/MINOR: h3: fix checking on NULL Tx buffer
    * BUG/MEDIUM: ssl: Fix crash when calling "update ssl ocsp-response" when an update is ongoing
    * REGTESTS: ssl: Add OCSP related tests
    * REGTESTS: ssl: Fix empty line in cli command input
    * BUG/MINOR: ssl: Reenable ocsp auto-update after an "add ssl crt-list"
    * BUG/MINOR: ssl: Destroy ckch instances before the store during deinit
    * BUG/MEDIUM: ocsp: Separate refcount per instance and per store
    * MINOR: ssl: Use OCSP_CERTID instead of ckch_store in ckch_store_build_certid
    * BUG/MINOR: ssl: Clear the ckch instance when deleting a crt-list line
    * BUG/MINOR: ssl: Duplicate ocsp update mode when dup'ing ckch
    * BUG/MINOR: ssl: Fix error message after ssl_sock_load_ocsp call
    * BUG/MAJOR: ssl_sock: Always clear retry flags in read/write functions
    * BUG/MEDIUM: h1: always reject the NUL character in header values
    * BUG/MINOR: h1-htx: properly initialize the err_pos field
    * BUG/MEDIUM: h1: Don't support LF only to mark the end of a chunk size
    * BUG/MINOR: h1: Don't support LF only at the end of chunks
    * BUG/MEDIUM: stconn: Don't check pending shutdown to wake an applet up
    * BUG/MEDIUM: stconn: Allow expiration update when READ/WRITE event is pending
    * BUG/MEDIUM: pool: fix rare risk of deadlock in pool_flush()
    * BUG/MINOR: jwt: fix jwt_verify crash on 32-bit archs
    * BUG/MEDIUM: cli: fix once for all the problem of missing trailing LFs
    * BUG/MINOR: vars/cli: fix missing LF after "get var" output
    * BUG/MEDIUM: cli: some err/warn msg dumps add LR into CSV output on stat's CLI
    * REGTESTS: add a test to ensure map-ordering is preserved
    * MINOR: mux-h2/traces: add a missing trace on connection WU with negative inc
    * BUG/MEDIUM: mux-h2: refine connection vs stream error on headers
    * MINOR: mux-h2/traces: clarify the "rejected H2 request" event
    * MINOR: mux-h2/traces: explicitly show the error/refused stream states
    * MINOR: mux-h2/traces: also suggest invalid header upon parsing error
    * MINOR: debug: make BUG_ON() catch build errors even without DEBUG_STRICT
    * MINOR: debug: make ABORT_NOW() store the caller's line number when using abort
    * MINOR: debug: make sure calls to ha_crash_now() are never merged
    * MINOR: compiler: add a new DO_NOT_FOLD() macro to prevent code folding
    * BUG/MEDIUM: quic: keylog callback not called (USE_OPENSSL_COMPAT)
    * BUG/MINOR: mux-h2: also count streams for refused ones
    * BUG/MINOR: mux-quic: do not prevent non-STREAM sending on flow control
    * DOC: configuration: corrected description of keyword tune.ssl.ocsp-update.mindelay
    * MINOR: mux-h2: support limiting the total number of H2 streams per connection
    * BUG/MEDIUM: spoe: Never create new spoe applet if there is no server up
    * BUG/MEDIUM: stconn: Forward shutdown on write timeout only if it is forwardable
    * BUG/MEDIUM: h3: fix incorrect snd_buf return value
    * CLEANUP: quic: Remaining useless code into server part
    * BUG/MINOR: h3: close connection on sending alloc errors
    * BUG/MINOR: h3: properly handle alloc failure on finalize
    * BUG/MINOR: h3: close connection on header list too big
    * MINOR: h3: check connection error during sending
    * BUG/MINOR: quic: Missing call to TLS message callbacks
    * BUG/MINOR: quic: Wrong keylog callback setting.
    * BUG/MINOR: mux-quic: always report error to SC on RESET_STREAM emission
    * BUG/MEDIUM: stats: unhandled switching rules with TCP frontend
    * MINOR: stats: store the parent proxy in stats ctx (http)
    * DOC: config: Update documentation about local haproxy response
    * BUG/MINOR: resolvers: default resolvers fails when network not configured
    * BUG/MEDIUM: mux-h2: Report too large HEADERS frame only when rxbuf is empty
    * BUG/MEDIUM: quic: QUIC CID removed from tree without locking
    * BUG/MEDIUM: quic: Possible buffer overflow when building TLS records
    * BUG/MINOR: mworker/cli: fix set severity-output support
    * DOC: configuration: typo req.ssl_hello_type
    * [RELEASE] Released version 2.8.5
    * BUG/MEDIUM: proxy: always initialize the default settings after init
    * BUG/MINOR: lua: Wrong OCSP CID after modifying an SSL certficate (LUA)
    * BUG/MINOR: ssl: Wrong OCSP CID after modifying an SSL certficate
    * MINOR: ssl/cli: Add ha_(warning|alert) msgs to CLI ckch callback
    * BUG/MINOR: ssl: Double free of OCSP Certificate ID
    * BUG/MINOR: quic: Packet number spaces too lately initialized
    * BUG/MINOR: quic: Missing QUIC connection path member initialization
    * BUG/MINOR: quic: Possible leak of TX packets under heavy load
    * BUG/MEDIUM: quic: Possible crash during retransmissions and heavy load
    * BUG/MINOR: cache: Remove incomplete entries from the cache when stream is closed
    * BUG/MEDIUM: peers: fix partial message decoding
    * DOC: Clarify the differences between field() and word()
    * BUG/MINOR: sample: Make the `word` converter compatible with `-m found`
    * REGTESTS: sample: Test the behavior of consecutive delimiters for the field converter
    * DOC: config: fix monitor-fail typo
    * DOC: config: add matrix entry for "max-session-srv-conns"
    * DOC: config: specify supported sections for "max-session-srv-conns"
    * BUG/MINOR: cfgparse-listen: fix warning being reported as an alert
    * BUG/MINOR: config: Stopped parsing upon unmatched environment variables
    * BUG/MINOR: quic_tp: fix preferred_address decoding
    * DOC: config: fix missing characters in set-spoe-group action
    * BUG/MINOR: h3: always reject PUSH_PROMISE
    * BUG/MINOR: h3: fix TRAILERS encoding
    * BUG/MEDIUM: master/cli: Properly pin the master CLI on thread 1 / group 1
    * BUG/MINOR: compression: possible NULL dereferences in comp_prepare_compress_request()
    * BUG/MINOR: quic: fix CONNECTION_CLOSE_APP encoding
    * DOC: lua: fix Proxy.get_mode() output
    * DOC: lua: add sticktable class reference from Proxy.stktable
    * REGTESTS: connection: disable http_reuse_be_transparent.vtc if !TPROXY
    * DOC: config: fix timeout check inheritance restrictions
    * DOC: 51d: updated 51Degrees repo URL for v3.2.10
    * BUG/MINOR: server: do not leak default-server in defaults sections
    * BUG/MINOR: quic: Possible RX packet memory leak under heavy load
    * BUG/MEDIUM: quic: Possible crash for connections to be killed
    * BUG/MINOR: sock: mark abns sockets as non-suspendable and always unbind them
    * BUG/MINOR: startup: set GTUNE_SOCKET_TRANSFER correctly
    * REGTESTS: http: add a test to validate chunked responses delivery
    * BUG/MINOR: proxy/stktable: missing frees on proxy cleanup
    * MINOR: stktable: add stktable_deinit function
    * BUG/MINOR: stream/cli: report correct stream age in "show sess"
    * BUG/MEDIUM: mux-fcgi: fail earlier on malloc in takeover()
    * BUG/MEDIUM: mux-h1: fail earlier on malloc in takeover()
    * BUG/MEDIUM: mux-h2: fail earlier on malloc in takeover()
    * BUG/MAJOR: quic: complete thread migration before tcp-rules
    * [RELEASE] Released version 2.8.4
    * BUG/MINOR: stconn: Report read activity on non-indep streams for partial sends
    * BUG/MINOR: stconn/applet: Report send activity only if there was output data
    * BUG/MINOR: stconn: Use HTX-aware channel's functions to get info on buffer
    * BUG/MINOR: stconn: Fix streamer detection for HTX streams
    * MINOR: channel: Add functions to get info on buffers and deal with HTX streams
    * MINOR: htx: Use a macro for overhead induced by HTX
    * BUG/MEDIUM: stconn: Update fsb date on partial sends
    * BUG/MEDIUM: stream: Don't call mux .ctl() callback if not implemented
    * BUG/MEDIUM: mworker: set the master variable earlier
    * BUG/MEDIUM: applet: Report a send activity everytime data were sent
    * BUG/MEDIUM: stconn: Report a send activity everytime data were sent
    * REGTESTS: http: Improve script testing abortonclose option
    * BUG/MEDIUM: stream: Properly handle abortonclose when set on backend only
    * MEDIUM: mux-h1: Handle MUX_SUBS_RECV flag in h1_ctl() and susbscribe for reads
    * MINOR: connection: Add a CTL flag to notify mux it should wait for reads again
    * BUG/MINOR: stconn: Handle abortonclose if backend connection was already set up
    * BUG/MEDIUM: connection: report connection errors even when no mux is installed
    * DOC: quic: Wrong syntax for "quic-cc-algo" keyword.
    * BUG/MINOR: sink: don't learn srv port from srv addr
    * BUG/MEDIUM: applet: Remove appctx from buffer wait list on release
    * DOC: config: use the word 'backend' instead of 'proxy' in 'track' description
    * BUG/MINOR: quic: fix retry token check inconsistency
    * DOC: management: -q is quiet all the time
    * BUG/MEDIUM: stconn: Don't update stream expiration date if already expired
    * BUG/MEDIUM: quic: Avoid some crashes upon TX packet allocation failures
    * BUG/MEDIUM: quic: Possible crashes when sending too short Initial packets
    * BUG/MEDIUM: quic: Avoid trying to send ACK frames from an empty ack ranges tree
    * BUG/MINOR: quic: idle timer task requeued in the past
    * BUG/MEDIUM: pool: fix releasable pool calculation when overloaded
    * BUG/MEDIUM: freq-ctr: Don't report overshoot for long inactivity period
    * BUG/MINOR: mux-h1: Properly handle http-request and http-keep-alive timeouts
    * BUG/MINOR: stick-table/cli: Check for invalid ipv4 key
    * BUG/MEDIUM: quic: fix sslconns on quic_conn alloc failure
    * BUG/MEDIUM: quic: fix actconn on quic_conn alloc failure
    * CLEANUP: htx: Properly indent htx_reserve_max_data() function
    * BUG/MINOR: stconn: Sanitize report for read activity
    * BUG/MEDIUM: Don't apply a max value on room_needed in sc_need_room()
    * BUG/MEDIUM: stconn: Don't report rcv/snd expiration date if SC cannot epxire
    * BUG/MEDIUM: pattern: don't trim pools under lock in pat_ref_purge_range()
    * BUG/MINOR: cfgparse/stktable: fix error message on stktable_init() failure
    * BUG/MINOR: stktable: missing free in parse_stick_table()
    * BUG/MINOR: tcpcheck: Report hexstring instead of binary one on check failure
    * BUG/MEDIUM: ssl: segfault when cipher is NULL
    * BUG/MINOR: mux-quic: fix early close if unset client timeout
    * BUG/MINOR: ssl: suboptimal certificate selection with TLSv1.3 and dual ECDSA/RSA
    * MEDIUM: quic: count quic_conn for global sslconns
    * MEDIUM: quic: count quic_conn instance for maxconn
    * MINOR: frontend: implement a dedicated actconn increment function
    * BUG/MINOR: ssl: use a thread-safe sslconns increment
    * BUG/MINOR: quic: do not consider idle timeout on CLOSING state
    * BUG/MEDIUM: server: "proto" not working for dynamic servers
    * MINOR: connection: add conn_pr_mode_to_proto_mode() helper func
    * DEBUG: mux-h2/flags: fix list of h2c flags used by the flags decoder
    * MINOR: lua: Add flags to configure logging behaviour
    * BUG/MINOR: ssl: load correctly @system-ca when ca-base is define
    * DOC: internal: filters: fix reference to entities.pdf
    * BUG/MINOR: mux-h2: update tracked counters with req cnt/req err
    * BUG/MINOR: mux-h2: commit the current stream ID even on reject
    * BUG/MEDIUM: peers: Fix synchro for huge number of tables
    * BUG/MEDIUM: peers: Be sure to always refresh recconnect timer in sync task
    * BUG/MINOR: trace: fix trace parser error reporting
    * BUG/MINOR: mux-h2: fix http-request and http-keep-alive timeouts again
    * BUG/MEDIUM: mux-h2: Don't report an error on shutr if a shutw is pending
    * BUG/MINOR: mux-h2: make up other blocked streams upon removal from list
    * BUG/MINOR: mux-h1: Send a 400-bad-request on shutdown before the first request
    * BUG/MEDIUM: quic-conn: free unsent frames on retransmit to prevent crash
    * BUG/MINOR: mux-quic: fix free on qcs-new fail alloc
    * BUG/MINOR: h3: strengthen host/authority header parsing
    * BUG/MINOR: mux-quic: support initial 0 max-stream-data
    * BUG/MEDIUM: mux-quic: fix RESET_STREAM on send-only stream
    * BUG/MINOR: quic: reject packet with no frame
    * BUG/MINOR: quic: Avoid crashing with unsupported cryptographic algos
    * BUG/MEDIUM: stconn: Fix comparison sign in sc_need_room()
    * BUG/MINOR: hq-interop: simplify parser requirement
    * BUG/MEDIUM: h1: Ignore C-L value in the H1 parser if T-E is also set
    * BUG/MINOR: mux-h1: Ignore C-L when sending H1 messages if T-E is also set
    * BUG/MINOR: mux-h1: Handle read0 in rcv_pipe() only when data receipt was tried
    * BUG/MEDIUM: hlua: Initialize appctx used by a lua socket on connect only
    * MINOR: hlua: Test the hlua struct first when the lua socket is connecting
    * MINOR: hlua: Save the lua socket's server in its context
    * MINOR: hlua: Save the lua socket's timeout in its context
    * MINOR: hlua: Don't preform operations on a not connected socket
    * MINOR: hlua: Set context's appctx when the lua socket is created
    * BUG/MEDIUM: http-ana: Try to handle response before handling server abort
    * BUG/MEDIUM: quic_conn: let the scheduler kill the task when needed
    * BUG/MEDIUM: actions: always apply a longest match on prefix lookup
    * BUG/MINOR: mux-quic: remove full demux flag on ncbuf release
    * BUG/MEDIUM: server/cli: don't delete a dynamic server that has streams
    * MINOR: pattern: fix pat_{parse,match}_ip() function comments
    * BUG/MINOR: server: add missing free for server->rdr_pfx
    * BUG/MAJOR: mux-h2: Report a protocol error for any DATA frame before headers
    * BUG/MINOR: freq_ctr: fix possible negative rate with the scaled API
    * BUG/MEDIUM: master/cli: Pin the master CLI on the first thread of the group 1
    * BUG/MINOR: promex: fix backend_agg_check_status
    * BUG/MEDIUM: mux-fcgi: Don't swap trash and dbuf when handling STDERR records
    * BUG/MINOR: hlua/init: coroutine may not resume itself
    * BUG/MEDIUM: hlua: don't pass stale nargs argument to lua_resume()
    * CI: musl: drop shopt in workflow invocation
    * CI: musl: highlight section if there are coredumps
    * Revert "BUG/MEDIUM: quic: missing check of dcid for init pkt including a token"
    * BUG/MEDIUM: hlua: streams don't support mixing lua-load with lua-load-per-thread
    * MINOR: hlua: add hlua_stream_ctx_prepare helper function
    * BUILD: quic: fix build on centos 8 and USE_QUIC_OPENSSL_COMPAT
    * BUG/MINOR: quic: ssl_quic_initial_ctx() uses error count not error code
    * BUG/MINOR: quic: allow-0rtt warning must only be emitted with quic bind
    * BUILD: Makefile: add USE_QUIC_OPENSSL_COMPAT to make help
    * MINOR: quic+openssl_compat: Emit an alert for "allow-0rtt" option
    * MINOR: quic+openssl_compat: Do not start without "limited-quic"
    * MINOR: quic: Warning for OpenSSL wrapper QUIC bindings without "limited-quic"
    * BUG/MINOR: quic+openssl_compat: Non initialized TLS encryption levels
    * DOC: quic: Add "limited-quic" new tuning setting
    * MINOR: quic: Add "limited-quic" new tuning setting
    * MINOR: quic: SSL context initialization with QUIC OpenSSL wrapper.
    * MINOR: quic: Add a quic_openssl_compat struct to quic_conn struct
    * MINOR: quic: Call the keylog callback for QUIC openssl wrapper from SSL_CTX_keylog()
    * MINOR: quic: Initialize TLS contexts for QUIC openssl wrapper
    * MINOR: quic: Export some KDF functions (QUIC-TLS)
    * MINOR: quic: Add a compilation option for the QUIC OpenSSL wrapper
    * MINOR: quic: Do not enable 0RTT with SSL_set_quic_early_data_enabled()
    * MINOR: quic: Set the QUIC connection as extra data before calling SSL_set_quic_method()
    * MINOR: quic: Do not enable O-RTT with USE_QUIC_OPENSSL_COMPAT
    * MINOR: quic: Include QUIC opensssl wrapper header from TLS stacks compatibility header
    * MINOR: quic: QUIC openssl wrapper implementation
    * BUG/MINOR: quic: Wrong cluster secret initialization
    * BUG/MINOR: quic: Leak of frames to send.
    * BUILD: bug: make BUG_ON() void to avoid a rare warning
  - VUL-0: CVE-2024-53008: haproxy: HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non-compliant back-end server
    (bsc#1233973)
    Add upsream patch: 0001-MINOR-h3-Add-HTTP-3-definitions.patch

++++ nvidia-open-driver-G06-signed:

  - obsolete <=560.35.03 -cuda KMPs; mistakenly we released
    560.35.03 for SP4 ...

++++ pam:

  - pam_access: rework resolving of tokens as hostname
  - separate resolving of IP addresses from hostnames. Don't resolve TTYs or
    display variables as hostname.
  - Add "nodns" option to disallow resolving of tokens as hostname.
  - [pam_access-rework-resolving-of-tokens-as-hostname.patch, bsc#1233078,
    CVE-2024-10963]

++++ pam:

  - pam_access: rework resolving of tokens as hostname
  - separate resolving of IP addresses from hostnames. Don't resolve TTYs or
    display variables as hostname.
  - Add "nodns" option to disallow resolving of tokens as hostname.
  - [pam_access-rework-resolving-of-tokens-as-hostname.patch, bsc#1233078,
    CVE-2024-10963]

------------------------------------------------------------------
------------------  2024-12-4  -  Dec 4 2024  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311-core:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ nvidia-open-driver-G06-signed:

  - Make sure the correct FW package is installed on non-CUDA.

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

++++ python311:

  - Update to 3.11.11:
  - Tools/Demos
  - gh-123418: Update GitHub CI workflows to use OpenSSL 3.0.15
    and multissltests to use 3.0.15, 3.1.7, and 3.2.3.
  - Tests
  - gh-125041: Re-enable skipped tests for zlib on the
    s390x architecture: only skip checks of the compressed
    bytes, which can be different between zlib’s software
    implementation and the hardware-accelerated implementation.
  - Security
  - gh-126623: Upgrade libexpat to 2.6.4
  - gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to
    consistently use the mapped IPv4 address value for deciding
    properties. Properties which have their behavior fixed are
    is_multicast, is_reserved, is_link_local, is_global, and
    is_unspecified.
  - Library
  - gh-124651: Properly quote template strings in venv
    activation scripts (bsc#1232241, CVE-2024-9287).
  - Removed upstreamed patches:
  - CVE-2024-9287-venv_path_unquoted.patch

------------------------------------------------------------------
------------------  2024-12-3  -  Dec 3 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to 10.3.11 (bsc#1234050)
    + Send registration code for the extensions, not only base product

++++ cloud-regionsrv-client:

  - Update to 10.3.11 (bsc#1234050)
    + Send registration code for the extensions, not only base product

++++ cloud-regionsrv-client:

  - Update to 10.3.11 (bsc#1234050)
    + Send registration code for the extensions, not only base product

++++ cloud-regionsrv-client:

  - Update to 10.3.11 (bsc#1234050)
    + Send registration code for the extensions, not only base product

++++ cloud-regionsrv-client:

  - Update to 10.3.11 (bsc#1234050)
    + Send registration code for the extensions, not only base product

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ curl:

  - Security fix: [bsc#1234068, CVE-2024-11053]
    * curl could leak the password used for the first host to the
    followed-to host under certain circumstances.
    * netrc: address several netrc parser flaws
    * Add curl-CVE-2024-11053.patch

++++ python-kiwi:

  - Bump version: 10.2.2 → 10.2.3
  - Update STYLEROOT to SUSE 2022

++++ python-kiwi:

  - Bump version: 10.2.2 → 10.2.3
  - Update STYLEROOT to SUSE 2022

++++ python-kiwi:

  - Bump version: 10.2.2 → 10.2.3
  - Update STYLEROOT to SUSE 2022

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311-core:

  - Add add-loongarch64-support.patch to support loongarch64

++++ systemd:

  - Add 0003-Drop-support-for-efivar-SystemdOptions.patch (bsc#1220338)
    Upstream deprecated it and plan to drop it in the future.
    Let's get ahead and drop it now as this feature is unlikely to be used on SUSE
    distros and it might be used to gain access to encrypted SLEM systems with
    unattended disk unlock and with secure boot disabled.
  - Import commit e107182cb3dd1702b291d0455bdabcb7db28e537 (merge of v254.21)
    This merge includes the following fix:
    a467a411f pid1: make clear that $WATCHDOG_USEC is set for the shutdown binary, noone else (bsc#1232227)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a3aa27ac6649cb096b3c87c8ac61a6950bfa3567...e107182cb3dd1702b291d0455bdabcb7db28e537

++++ systemd:

  - Add 0003-Drop-support-for-efivar-SystemdOptions.patch (bsc#1220338)
    Upstream deprecated it and plan to drop it in the future.
    Let's get ahead and drop it now as this feature is unlikely to be used on SUSE
    distros and it might be used to gain access to encrypted SLEM systems with
    unattended disk unlock and with secure boot disabled.
  - Import commit e107182cb3dd1702b291d0455bdabcb7db28e537 (merge of v254.21)
    This merge includes the following fix:
    a467a411f pid1: make clear that $WATCHDOG_USEC is set for the shutdown binary, noone else (bsc#1232227)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a3aa27ac6649cb096b3c87c8ac61a6950bfa3567...e107182cb3dd1702b291d0455bdabcb7db28e537

++++ systemd:

  - Add 0003-Drop-support-for-efivar-SystemdOptions.patch (bsc#1220338)
    Upstream deprecated it and plan to drop it in the future.
    Let's get ahead and drop it now as this feature is unlikely to be used on SUSE
    distros and it might be used to gain access to encrypted SLEM systems with
    unattended disk unlock and with secure boot disabled.
  - Import commit e107182cb3dd1702b291d0455bdabcb7db28e537 (merge of v254.21)
    This merge includes the following fix:
    a467a411f pid1: make clear that $WATCHDOG_USEC is set for the shutdown binary, noone else (bsc#1232227)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a3aa27ac6649cb096b3c87c8ac61a6950bfa3567...e107182cb3dd1702b291d0455bdabcb7db28e537

++++ systemd:

  - Add 0003-Drop-support-for-efivar-SystemdOptions.patch (bsc#1220338)
    Upstream deprecated it and plan to drop it in the future.
    Let's get ahead and drop it now as this feature is unlikely to be used on SUSE
    distros and it might be used to gain access to encrypted SLEM systems with
    unattended disk unlock and with secure boot disabled.
  - Import commit e107182cb3dd1702b291d0455bdabcb7db28e537 (merge of v254.21)
    This merge includes the following fix:
    a467a411f pid1: make clear that $WATCHDOG_USEC is set for the shutdown binary, noone else (bsc#1232227)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a3aa27ac6649cb096b3c87c8ac61a6950bfa3567...e107182cb3dd1702b291d0455bdabcb7db28e537

++++ systemd:

  - Add 0003-Drop-support-for-efivar-SystemdOptions.patch (bsc#1220338)
    Upstream deprecated it and plan to drop it in the future.
    Let's get ahead and drop it now as this feature is unlikely to be used on SUSE
    distros and it might be used to gain access to encrypted SLEM systems with
    unattended disk unlock and with secure boot disabled.
  - Import commit e107182cb3dd1702b291d0455bdabcb7db28e537 (merge of v254.21)
    This merge includes the following fix:
    a467a411f pid1: make clear that $WATCHDOG_USEC is set for the shutdown binary, noone else (bsc#1232227)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a3aa27ac6649cb096b3c87c8ac61a6950bfa3567...e107182cb3dd1702b291d0455bdabcb7db28e537

++++ systemd:

  - Add 0003-Drop-support-for-efivar-SystemdOptions.patch (bsc#1220338)
    Upstream deprecated it and plan to drop it in the future.
    Let's get ahead and drop it now as this feature is unlikely to be used on SUSE
    distros and it might be used to gain access to encrypted SLEM systems with
    unattended disk unlock and with secure boot disabled.
  - Import commit e107182cb3dd1702b291d0455bdabcb7db28e537 (merge of v254.21)
    This merge includes the following fix:
    a467a411f pid1: make clear that $WATCHDOG_USEC is set for the shutdown binary, noone else (bsc#1232227)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/a3aa27ac6649cb096b3c87c8ac61a6950bfa3567...e107182cb3dd1702b291d0455bdabcb7db28e537

++++ nvidia-open-driver-G06-signed:

  - kmp-trigger.sh:
    * avoid to return with exit code != 0 if modules could not be
    unloaded for some reason

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ python311:

  - Add add-loongarch64-support.patch to support loongarch64

++++ supportutils:

  - Changes to version 3.2.9
    + Map running PIDs to RPM package owner aiding BPF program detection (bsc#1222896, bsc#1213291, PED-8221)
    + Supportconfig available in current distro (PED-7131)
    + Corrected display issues (bsc#1231396)
    + NFS takes too long, showmount times out (bsc#1231423)
    + Merged sle15 and master branches (bsc#1233726, PED-11669)

++++ supportutils:

  - Changes to version 3.2.9
    + Map running PIDs to RPM package owner aiding BPF program detection (bsc#1222896, bsc#1213291, PED-8221)
    + Supportconfig available in current distro (PED-7131)
    + Corrected display issues (bsc#1231396)
    + NFS takes too long, showmount times out (bsc#1231423)
    + Merged sle15 and master branches (bsc#1233726, PED-11669)

++++ supportutils:

  - Changes to version 3.2.9
    + Map running PIDs to RPM package owner aiding BPF program detection (bsc#1222896, bsc#1213291, PED-8221)
    + Supportconfig available in current distro (PED-7131)
    + Corrected display issues (bsc#1231396)
    + NFS takes too long, showmount times out (bsc#1231423)
    + Merged sle15 and master branches (bsc#1233726, PED-11669)

------------------------------------------------------------------
------------------  2024-12-2  -  Dec 2 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix broken links in the documentation
  - Fix legacy_bios_mode detection
    The code in this method does not work correctly if the
    firmware is set to 'bios'. In bios only mode the method
    returned a false value which is incorrect as it should
    return a true value in this case. Without this patch
    ISO images will fail to boot because no loader gets
    configured.
  - Added /dev/pts to bind mount locations
    During runtime several kernel filesystems are bind mounted into
    the image root system such that programs expecting it can work.
    /dev/pts was not needed so far but seems to be a good addition
    to the list to make tools like sudo to work properly when called
    e.g. from a config.sh script. This Fixes #2686

++++ python-kiwi:

  - Add support for loongarch64
    This Fixes #2684
  - Fix broken links in the documentation
  - Fix legacy_bios_mode detection
    The code in this method does not work correctly if the
    firmware is set to 'bios'. In bios only mode the method
    returned a false value which is incorrect as it should
    return a true value in this case. Without this patch
    ISO images will fail to boot because no loader gets
    configured.
  - Added /dev/pts to bind mount locations
    During runtime several kernel filesystems are bind mounted into
    the image root system such that programs expecting it can work.
    /dev/pts was not needed so far but seems to be a good addition
    to the list to make tools like sudo to work properly when called
    e.g. from a config.sh script. This Fixes #2686

++++ python-kiwi:

  - Add support for loongarch64
    This Fixes #2684
  - Fix broken links in the documentation
  - Fix legacy_bios_mode detection
    The code in this method does not work correctly if the
    firmware is set to 'bios'. In bios only mode the method
    returned a false value which is incorrect as it should
    return a true value in this case. Without this patch
    ISO images will fail to boot because no loader gets
    configured.
  - Added /dev/pts to bind mount locations
    During runtime several kernel filesystems are bind mounted into
    the image root system such that programs expecting it can work.
    /dev/pts was not needed so far but seems to be a good addition
    to the list to make tools like sudo to work properly when called
    e.g. from a config.sh script. This Fixes #2686

++++ glibc:

  - Remove nss-systemd from default nsswitch.conf (bsc#1233699)

++++ glibc:

  - Remove nss-systemd from default nsswitch.conf (bsc#1233699)

++++ glibc:

  - Remove nss-systemd from default nsswitch.conf (bsc#1233699)

++++ glibc:

  - Remove nss-systemd from default nsswitch.conf (bsc#1233699)

++++ kernel-firmware:

  - Update to version 20241128 (git commit ea71da6f0690):
    * i915: Update Xe2LPD DMC to v2.24
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops
    * iwlwifi: add Bz-gf FW for core89-91 release
    * amdgpu: update smu 13.0.10 firmware
    * amdgpu: update sdma 6.0.3 firmware
    * amdgpu: update psp 13.0.10 firmware
    * amdgpu: update gc 11.0.3 firmware
    * amdgpu: add smu 13.0.14 firmware
    * amdgpu: add sdma 4.4.5 firmware
    * amdgpu: add psp 13.0.14 firmware
    * amdgpu: add gc 9.4.4 firmware
    * amdgpu: update vcn 3.1.2 firmware
    * amdgpu: update psp 13.0.5 firmware
    * amdgpu: update psp 13.0.8 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update psp 14.0.4 firmware
    * amdgpu: update gc 11.5.2 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update vcn 4.0.0 firmware
    * amdgpu: update smu 13.0.0 firmware
    * amdgpu: update psp 13.0.0 firmware
    * amdgpu: update gc 11.0.0 firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update psp 13.0.11 firmware
    * amdgpu: update gc 11.0.4 firmware
    * amdgpu: update vcn 4.0.2 firmware
    * amdgpu: update psp 13.0.4 firmware
    * amdgpu: update gc 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update vpe 6.1.1 firmware
    * amdgpu: update vcn 4.0.6 firmware
    * amdgpu: update psp 14.0.1 firmware
    * amdgpu: update gc 11.5.1 firmware
    * amdgpu: update vcn 4.0.5 firmware
    * amdgpu: update psp 14.0.0 firmware
    * amdgpu: update gc 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update arcturus firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update sdma 4.4.2 firmware
    * amdgpu: update psp 13.0.6 firmware
    * amdgpu: update gc 9.4.3 firmware
    * amdgpu: update vcn 4.0.4 firmware
    * amdgpu: update psp 13.0.7 firmware
    * amdgpu: update gc 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update aldebaran firmware
  - Update aliases from 6.13-rc1

++++ kernel-firmware:

  - Update to version 20241128 (git commit ea71da6f0690):
    * i915: Update Xe2LPD DMC to v2.24
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops
    * iwlwifi: add Bz-gf FW for core89-91 release
    * amdgpu: update smu 13.0.10 firmware
    * amdgpu: update sdma 6.0.3 firmware
    * amdgpu: update psp 13.0.10 firmware
    * amdgpu: update gc 11.0.3 firmware
    * amdgpu: add smu 13.0.14 firmware
    * amdgpu: add sdma 4.4.5 firmware
    * amdgpu: add psp 13.0.14 firmware
    * amdgpu: add gc 9.4.4 firmware
    * amdgpu: update vcn 3.1.2 firmware
    * amdgpu: update psp 13.0.5 firmware
    * amdgpu: update psp 13.0.8 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update psp 14.0.4 firmware
    * amdgpu: update gc 11.5.2 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update vcn 4.0.0 firmware
    * amdgpu: update smu 13.0.0 firmware
    * amdgpu: update psp 13.0.0 firmware
    * amdgpu: update gc 11.0.0 firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update psp 13.0.11 firmware
    * amdgpu: update gc 11.0.4 firmware
    * amdgpu: update vcn 4.0.2 firmware
    * amdgpu: update psp 13.0.4 firmware
    * amdgpu: update gc 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update vpe 6.1.1 firmware
    * amdgpu: update vcn 4.0.6 firmware
    * amdgpu: update psp 14.0.1 firmware
    * amdgpu: update gc 11.5.1 firmware
    * amdgpu: update vcn 4.0.5 firmware
    * amdgpu: update psp 14.0.0 firmware
    * amdgpu: update gc 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update arcturus firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update sdma 4.4.2 firmware
    * amdgpu: update psp 13.0.6 firmware
    * amdgpu: update gc 9.4.3 firmware
    * amdgpu: update vcn 4.0.4 firmware
    * amdgpu: update psp 13.0.7 firmware
    * amdgpu: update gc 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update aldebaran firmware
  - Update aliases from 6.13-rc1

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311-core:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

++++ python311:

  - Fix changelog

------------------------------------------------------------------
------------------  2024-11-30  -  Nov 30 2024  -------------------
------------------------------------------------------------------

++++ nvidia-open-driver-G06-signed:

  - only obsolete 555 CUDA driver/firmware packages
  - preamble:
    no longer need to provide nvidia-open-driver-G06-kmp because
    since 565.57.01 to the list of requires of nvidia-compute-G06
    the -signed packages has been added
  - For CUDA update version to 565.57.01

------------------------------------------------------------------
------------------  2024-11-29  -  Nov 29 2024  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.31.0:
    * bump containerd to v1.7,24
    * bump google.golang.org/grpc to v1.68.0
    * build(deps): bump github.com/moby/buildkit from 0.17.1 to
    0.17.2
    * build(deps): bump github.com/compose-spec/compose-go/v2
    * only stop dependent containers ... if there's some
    * disable TestNetworkConfigChanged which is unstable on CI
    * only check attached networks on running containers
    * fix: commit tests
    * feat: add commit command
    * run build tests against bake
    * delegate build to buildx bake
    * build(deps): bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
    * use service.stop to stop dependent containers
    * Update wait-timeout flag usage to include the unit
    * go.mod: github.com/docker/cli v27.4.0-rc.2
    * go.mod: github.com/docker/docker v27.4.0-rc.2
    * go.mod: github.com/docker/cli 8d1bacae3e49 (v27.4.0-rc.2-dev)
    * go.mod: github.com/docker/cli v27.4.0-rc.1
    * go.mod: github.com/docker/docker v27.4.0-rc.1
    * Update pkg/compose/convergence.go
    * detect network config changes and recreate if needed
    * go.mod: github.com/docker/buildx v0.18.0
    * go.mod: github.com/moby/buildkit v0.17.1
    * gha: test against docker engine v27.4.0
    * push empty descriptor layer when using OCI version 1.1 for
    Compose artifact it fixes a repository creation issue when
    pushing the 1st time a Compose OCI artifact on the Hub
    * remove ddev e2e tests
    * implement remove-orphans on run
    * ci: enable testifylint linter
    * Emit events for building images
    * Fix compose images that reutn a different image with the same
    ID
    * remove obsolete containers first on scale down
    * pass stal bot inactivity limit from 6 to 3 months
    * fix(config): Print service names with --no-interpolate
    * build(deps): bump golang.org/x/sys from 0.26.0 to 0.27.0
    * build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0

++++ docker-compose:

  - Update to version 2.31.0:
    * bump containerd to v1.7,24
    * bump google.golang.org/grpc to v1.68.0
    * build(deps): bump github.com/moby/buildkit from 0.17.1 to
    0.17.2
    * build(deps): bump github.com/compose-spec/compose-go/v2
    * only stop dependent containers ... if there's some
    * disable TestNetworkConfigChanged which is unstable on CI
    * only check attached networks on running containers
    * fix: commit tests
    * feat: add commit command
    * run build tests against bake
    * delegate build to buildx bake
    * build(deps): bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
    * use service.stop to stop dependent containers
    * Update wait-timeout flag usage to include the unit
    * go.mod: github.com/docker/cli v27.4.0-rc.2
    * go.mod: github.com/docker/docker v27.4.0-rc.2
    * go.mod: github.com/docker/cli 8d1bacae3e49 (v27.4.0-rc.2-dev)
    * go.mod: github.com/docker/cli v27.4.0-rc.1
    * go.mod: github.com/docker/docker v27.4.0-rc.1
    * Update pkg/compose/convergence.go
    * detect network config changes and recreate if needed
    * go.mod: github.com/docker/buildx v0.18.0
    * go.mod: github.com/moby/buildkit v0.17.1
    * gha: test against docker engine v27.4.0
    * push empty descriptor layer when using OCI version 1.1 for
    Compose artifact it fixes a repository creation issue when
    pushing the 1st time a Compose OCI artifact on the Hub
    * remove ddev e2e tests
    * implement remove-orphans on run
    * ci: enable testifylint linter
    * Emit events for building images
    * Fix compose images that reutn a different image with the same
    ID
    * remove obsolete containers first on scale down
    * pass stal bot inactivity limit from 6 to 3 months
    * fix(config): Print service names with --no-interpolate
    * build(deps): bump golang.org/x/sys from 0.26.0 to 0.27.0
    * build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0

++++ docker-compose:

  - Update to version 2.31.0:
    * bump containerd to v1.7,24
    * bump google.golang.org/grpc to v1.68.0
    * build(deps): bump github.com/moby/buildkit from 0.17.1 to
    0.17.2
    * build(deps): bump github.com/compose-spec/compose-go/v2
    * only stop dependent containers ... if there's some
    * disable TestNetworkConfigChanged which is unstable on CI
    * only check attached networks on running containers
    * fix: commit tests
    * feat: add commit command
    * run build tests against bake
    * delegate build to buildx bake
    * build(deps): bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
    * use service.stop to stop dependent containers
    * Update wait-timeout flag usage to include the unit
    * go.mod: github.com/docker/cli v27.4.0-rc.2
    * go.mod: github.com/docker/docker v27.4.0-rc.2
    * go.mod: github.com/docker/cli 8d1bacae3e49 (v27.4.0-rc.2-dev)
    * go.mod: github.com/docker/cli v27.4.0-rc.1
    * go.mod: github.com/docker/docker v27.4.0-rc.1
    * Update pkg/compose/convergence.go
    * detect network config changes and recreate if needed
    * go.mod: github.com/docker/buildx v0.18.0
    * go.mod: github.com/moby/buildkit v0.17.1
    * gha: test against docker engine v27.4.0
    * push empty descriptor layer when using OCI version 1.1 for
    Compose artifact it fixes a repository creation issue when
    pushing the 1st time a Compose OCI artifact on the Hub
    * remove ddev e2e tests
    * implement remove-orphans on run
    * ci: enable testifylint linter
    * Emit events for building images
    * Fix compose images that reutn a different image with the same
    ID
    * remove obsolete containers first on scale down
    * pass stal bot inactivity limit from 6 to 3 months
    * fix(config): Print service names with --no-interpolate
    * build(deps): bump golang.org/x/sys from 0.26.0 to 0.27.0
    * build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0

++++ python-kiwi:

  - xorriso: respect efiparttable and gpt_hybrid_mbr
    This should make the xorriso-based ISO build path respect the
    'efiparttable' and 'gpt_hybrid_mbr' settings when building a
    UEFI-compatible image, making it write a GPT disk label by default
    instead of an MBR (msdos) one. If it's building an image that is not
    UEFI-compatible it will always write an MBR label, regardless of
    this setting.
    If 'gpt_hybrid_mbr' is set, xorriso will write an Ubuntu-style
    MBR/GPT hybrid partition table, where the MBR partition table
    includes a partition with type 00 and the bootable flag, as well
    as the partition with type ee required by the UEFI spec. This
    mildly violates the UEFI spec but may make the image bootable on
    native BIOS or CSM firmwares which refuse to boot from a disk with
    no partition marked 'bootable' in the MBR. If 'gpt_hybrid_mbr' is
    not set, xorriso will write a strictly UEFI-spec compliant label,
    with just the 'protective MBR' required by the UEFI spec (no
    bootable partition) and the correct GPT partition table. Note
    this is somewhat different from what gpt_hybrid_mbr does for
    disk images.
    Also, we now pass -compliance no_emul_toc when building ISOs, as
    recommended by upstream in
    https://lists.gnu.org/archive/html/bug-xorriso/2024-11/msg00012.html
    This tool is generally always going to be building ISOs intended
    for write-once use, not multi-session use (and which are rarely,
    these days, written to physical discs at all anyway).
    Signed-off-by: Adam Williamson <awilliam@redhat.com>

++++ python-kiwi:

  - xorriso: respect efiparttable and gpt_hybrid_mbr
    This should make the xorriso-based ISO build path respect the
    'efiparttable' and 'gpt_hybrid_mbr' settings when building a
    UEFI-compatible image, making it write a GPT disk label by default
    instead of an MBR (msdos) one. If it's building an image that is not
    UEFI-compatible it will always write an MBR label, regardless of
    this setting.
    If 'gpt_hybrid_mbr' is set, xorriso will write an Ubuntu-style
    MBR/GPT hybrid partition table, where the MBR partition table
    includes a partition with type 00 and the bootable flag, as well
    as the partition with type ee required by the UEFI spec. This
    mildly violates the UEFI spec but may make the image bootable on
    native BIOS or CSM firmwares which refuse to boot from a disk with
    no partition marked 'bootable' in the MBR. If 'gpt_hybrid_mbr' is
    not set, xorriso will write a strictly UEFI-spec compliant label,
    with just the 'protective MBR' required by the UEFI spec (no
    bootable partition) and the correct GPT partition table. Note
    this is somewhat different from what gpt_hybrid_mbr does for
    disk images.
    Also, we now pass -compliance no_emul_toc when building ISOs, as
    recommended by upstream in
    https://lists.gnu.org/archive/html/bug-xorriso/2024-11/msg00012.html
    This tool is generally always going to be building ISOs intended
    for write-once use, not multi-session use (and which are rarely,
    these days, written to physical discs at all anyway).
    Signed-off-by: Adam Williamson <awilliam@redhat.com>

++++ python-kiwi:

  - xorriso: respect efiparttable and gpt_hybrid_mbr
    This should make the xorriso-based ISO build path respect the
    'efiparttable' and 'gpt_hybrid_mbr' settings when building a
    UEFI-compatible image, making it write a GPT disk label by default
    instead of an MBR (msdos) one. If it's building an image that is not
    UEFI-compatible it will always write an MBR label, regardless of
    this setting.
    If 'gpt_hybrid_mbr' is set, xorriso will write an Ubuntu-style
    MBR/GPT hybrid partition table, where the MBR partition table
    includes a partition with type 00 and the bootable flag, as well
    as the partition with type ee required by the UEFI spec. This
    mildly violates the UEFI spec but may make the image bootable on
    native BIOS or CSM firmwares which refuse to boot from a disk with
    no partition marked 'bootable' in the MBR. If 'gpt_hybrid_mbr' is
    not set, xorriso will write a strictly UEFI-spec compliant label,
    with just the 'protective MBR' required by the UEFI spec (no
    bootable partition) and the correct GPT partition table. Note
    this is somewhat different from what gpt_hybrid_mbr does for
    disk images.
    Also, we now pass -compliance no_emul_toc when building ISOs, as
    recommended by upstream in
    https://lists.gnu.org/archive/html/bug-xorriso/2024-11/msg00012.html
    This tool is generally always going to be building ISOs intended
    for write-once use, not multi-session use (and which are rarely,
    these days, written to physical discs at all anyway).
    Signed-off-by: Adam Williamson <awilliam@redhat.com>

++++ nvidia-open-driver-G06-signed:

  - Add 'dummy' firmware package on SLE to work around update
    issues. On SLE, the firmware is installed directly from
    an NVIDIA-hosted repo.

++++ selinux-policy:

  - Update macros.selinux-policy to trigger a full relabel on transactional
    systems upon module installation. This is rather expensive and will
    hopefully be replaced by a more fine grained solution later on (bsc#1232753)

++++ selinux-policy:

  - Update macros.selinux-policy to trigger a full relabel on transactional
    systems upon module installation. This is rather expensive and will
    hopefully be replaced by a more fine grained solution later on (bsc#1232753)

++++ selinux-policy:

  - Update macros.selinux-policy to trigger a full relabel on transactional
    systems upon module installation. This is rather expensive and will
    hopefully be replaced by a more fine grained solution later on (bsc#1232753)

++++ selinux-policy:

  - Update macros.selinux-policy to trigger a full relabel on transactional
    systems upon module installation. This is rather expensive and will
    hopefully be replaced by a more fine grained solution later on (bsc#1232753)

++++ selinux-policy:

  - Update macros.selinux-policy to trigger a full relabel on transactional
    systems upon module installation. This is rather expensive and will
    hopefully be replaced by a more fine grained solution later on (bsc#1232753)

------------------------------------------------------------------
------------------  2024-11-28  -  Nov 28 2024  -------------------
------------------------------------------------------------------

++++ nvidia-open-driver-G06-signed:

  - preamble
    * resolve self conflicts of -cuda KMP during update by adding
    obsoletes to older versions (boo#1233332)

++++ vim:

  - Fix for bsc#1231373 / CVE-2024-47814.
  - Fix for bsc#1229238 / CVE-2024-43374.
  - update to 9.1.0836
    * 9.1.0836: The vimtutor can be improved
    * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu'
    * 9.1.0834: tests: 2html test fails
    * 9.1.0833: CI: recent ASAN changes do not work for indent tests
    * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal
    * runtime(doc): update help-toc description
    * runtime(2html): Make links use color scheme colors in TOhtml
    * 9.1.0831: 'findexpr' can't be used as lambad or Funcref
    * Filelist: include helptoc package
    * runtime(doc): include a TOC Vim9 plugin
    * Filelist: ignore .git-blame-ignore-revs
    * 9.1.0830: using wrong highlight group for spaces for popupmenu
    * runtime(typst): synchronize updates from the upstream typst.vim
    * git: ignore reformatting commit for git-blame (after v9.1.0829)
    * 9.1.0829: Vim source code uses a mix of tabs and spaces
    * 9.1.0828: string_T struct could be used more often
    * 9.1.0827: CI: tests can be improved
    * runtime(doc): remove stray sentence in pi_netrw.txt
    * 9.1.0826: filetype: sway files are not recognized
    * runtime(doc): Include netrw-gp in TOC
    * runtime(doc): mention 'iskeyword' at :h charclass()
    * runtime(doc): update help tags
    * 9.1.0825: compile error for non-diff builds
    * runtime(netrw): fix E874 when browsing remote directory which contains `~` character
    * runtime(doc): update coding style documentation
    * runtime(debversions): Add plucky (25.04) as Ubuntu release name
    * 9.1.0824: too many strlen() calls in register.c
    * 9.1.0823: filetype: Zephyr overlay files not recognized
    * runtime(doc): Clean up minor formatting issues for builtin functions
    * runtime(netrw): make :Launch/Open autoloadable
    * runtime(netrw): fix regression with x mapping on Cygwin
    * runtime(netrw): fix filetype detection for remote files
    * 9.1.0822: topline might be changed in diff mode unexpectedly
    * CI: huge linux builds should also run syntax & indent tests
    * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument
    * 9.1.0820: tests: Mac OS tests are too flaky
    * runtime(awk): Highlight more awk comments in syntax script
    * runtime(netrw): add missing change for s:redir()
    * 9.1.0819: tests: using findexpr and imported func not tested
    * runtime(netrw): improve netrw's open-handling further
    * runtime(netrw): fix syntax error in netrwPlugin.vim
    * runtime(netrw): simplify gx file handling
    * 9.1.0818: some global functions are only used in single files
    * 9.1.0817: termdebug: cannot evaluate expr in a popup
    * runtime(defaults): Detect putty terminal and switch to dark background
    * 9.1.0816: tests: not clear what tests cause asan failures
    * runtime(doc): Remove some completed items from todo.txt
    * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position
    * runtime(syntax-tests): tiny vim fails because of line-continuation
    * 9.1.0814: mapset() may remove unrelated mapping
    * 9.1.0813: no error handling with setglobal and number types
    * 9.1.0812: Coverity warns about dereferencing NULL ptr
    * 9.1.0811: :find expansion does not consider 'findexpr'
    * 9.1.0810: cannot easily adjust the |:find| command
    * 9.1.0809: filetype: petalinux config files not recognized
    * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll'
    * 9.1.0807: tests: having 'nolist' in modelines isn't always desired
    * 9.1.0806: tests: no error check when setting global 'briopt'
    * 9.1.0805: tests: minor issues in gen_opt_test.vim
    * 9.1.0804: tests: no error check when setting global 'cc'
    * 9.1.0803: tests: no error check when setting global 'isk'
    * 9.1.0802: tests: no error check when setting global 'fdm' to empty value
    * 9.1.0801: tests: no error check when setting global 'termwinkey'
    * 9.1.0800: tests: no error check when setting global 'termwinsize'
    * runtime(doc): :ownsyntax also resets 'spelloptions'
    * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive
    * runtime(doc): Fix wrong Mac default options
    * 9.1.0798: too many strlen() calls in cmdhist.c
    * 9.1.0797: testing of options can be further improved
    * 9.1.0796: filetype: libtool files are not recognized
    * (typst): add folding to typst ftplugin
    * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke()
    * 9.1.0795: filetype: Vivado memory info file are not recognized
    * 9.1.0794: tests: tests may fail on Windows environment
    * runtime(doc): improve the :colorscheme documentation
    * 9.1.0793: xxd: -e does add one extra space
    * 9.1.0792: tests: Test_set_values() is not comprehensive enough
    * runtime(swayconfig): add flag for bindsym/bindcode to syntax script
    * 9.1.0791: tests: errors in gen_opt_test.vim are not shown
    * runtime(compiler): check for compile_commands in build dirs for cppcheck
    * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib)
    * runtime(help): Update help syntax
    * runtime(help): fix end of sentence highlight in code examples
    * runtime(jinja): Support jinja syntax as secondary filetype
    * 9.1.0789: tests: ':resize + 5' has invalid space after '+'
    * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot
    * 9.1.0787: cursor position changed when using hidden terminal
    * 9.1.0786: tests: quickfix update test does not test location list
    * runtime(doc): add some docs for file-watcher programs
    * CI: uploading failed screendumps still fails on Cirrus CI
    * 9.1.0785: cannot preserve error position when setting quickfix list
    * 9.1.0784: there are several problems with python 3.13
    * 9.1.0783: 'spell' option setting has problems
    * 9.1.0782: tests: using wrong neomuttlog file name
    * runtime(doc): add preview flag to statusline example
    * 9.1.0781: tests: test_filetype fails
    * 9.1.0780: MS-Windows: incorrect Win32 error checking
    * 9.1.0779: filetype: neomuttlog files are not recognized
    * 9.1.0778: filetype: lf config files are not recognized
    * runtime(comment): fix commment toggle with mixed tabs & spaces
    * runtime(misc): Use consistent "Vim script" spelling
    * runtime(gleam): add ftplugin for gleam files
    * runtime(doc): link help-writing from write-local-help
    * 9.1.0777: filetype: Some upstream php files are not recognized
    * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups
    * runtime(doc): mention conversion rules for remote_expr()
    * runtime(tutor): Fix missing :s command in spanish translation section 4.4
    * 9.1.0776: test_strftime may fail because of missing TZ data
    * translation(am): Add Armenian language translation
    * 9.1.0775: tests: not enough tests for setting options
    * 9.1.0774: "shellcmdline" doesn't work with getcompletion()
    * 9.1.0773: filetype: some Apache files are not recognized
    * 9.1.0772: some missing changes from v9.1.0771
    * 9.1.0771: completion attribute hl_group is confusing
    * 9.1.0770: current command line completion is a bit limited
    * 9.1.0769: filetype: MLIR files are not recognized
    * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen
    * runtime(nasm): Update nasm syntax script
    * 9.1.0767: A condition is always true in ex_getln.c
    * runtime(skill): Update syntax file to fix string escapes
    * runtime(help): highlight CTRL-<Key> correctly
    * runtime(doc): add missing usr_52 entry to toc
    * 9.1.0766: too many strlen() calls in ex_getln.c
    * runtime(doc): correct `vi` registers 1-9 documentation error
    * 9.1.0765: No test for patches 6.2.418 and 7.3.489
    * runtime(spec): set comments and commentstring options
    * NSIS: Include libgcc_s_sjlj-1.dll again
    * runtime(doc): clarify the effect of 'startofline' option
    * 9.1.0764: [security]: use-after-free when closing a buffer
    * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting
    * 9.1.0763: tests: cannot run single syntax tests
    * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly
    * 9.1.0761: :cd completion fails on Windows with backslash in path
    * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails
    * 9.1.0759: screenpos() may return invalid position
    * runtime(misc): unset compiler in various ftplugins
    * runtime(doc): update formatting and syntax
    * runtime(compiler): add cppcheck linter compiler plugin
    * runtime(doc): Fix style in documents
    * runtime(doc): Fix to two-space convention in user manual
    * runtime(comment): consider &tabstop in lines after whitespace indent
    * 9.1.0758: it's possible to set an invalid key to 'wildcharm'
    * runtime(java): Manage circularity for every :syn-included syntax file
    * 9.1.0757: tests: messages files contains ANSI escape sequences
    * 9.1.0756: missing change from patch v9.1.0754
    * 9.1.0755: quickfix list does not handle hardlinks well
    * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters
    * runtime(systemd): small fixes to &keywordprg in ftplugin
    * CI: macos-12 runner is being sunset, switch to 13
    * 9.1.0754: fixed order of items in insert-mode completion menu
    * runtime(comment): commenting might be off by one column
    * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll'
    * 9.1.0752: can set 'cedit' to an invalid value
    * runtime(doc): add `usr` tag to usr_toc.txt
    * 9.1.0751: Error callback for term_start() not used
    * 9.1.0750: there are some Win9x legacy references
    * runtime(java): Recognise the CommonMark form (///) of Javadoc comments
    * 9.1.0749: filetype: http files not recognized
    * runtime(comment): fix syntax error
    * CI: uploading failed screendump tests does not work Cirrus
    * 9.1.0748: :keep* commmands are sometimes misidentified as :k
    * runtime(indent): allow matching negative numbers for gnu indent config file
    * runtime(comment): add gC mapping to (un)comment rest of line
    * 9.1.0747: various typos in repo found
    * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals
    * runtime(doc): reformat gnat example
    * runtime(doc): reformat ada_standard_types section
    * 9.1.0745: filetype: bun and deno history files not recognized
    * runtime(glvs): Correct the tag name of glvs-autoinstal
    * runtime(doc): include short form for :earlier/:later
    * runtime(doc): remove completed TODO
    * 9.1.0744: filetype: notmuch configs are not recognised
    * 9.1.0743: diff mode does not handle overlapping diffs correctly
    * runtime(glvs): fix a few issues
    * runtime(doc): Fix typo in :help :command-modifiers
    * 9.1.0742: getcmdprompt() implementation can be improved
    * runtime(docs): update `:set?` command behavior table
    * runtime(doc): update vim90 to vim91 in docs
    * runtime(doc): fix typo in :h dos-colors
    * 9.1.0741: No way to get prompt for input()/confirm()
    * runtime(doc): fix typo in version9.txt nrformat -> nrformats
    * runtime(rmd,rrst): 'fex' option not properly restored
    * runtime(netrw): remove extraneous closing bracket
    * 9.1.0740: incorrect internal diff with empty file
    * 9.1.0739: [security]: use-after-free in ex_getln.c
    * runtime(filetype): tests: Test_filetype_detection() fails
    * runtime(dist): do not output a message if executable is not found
    * 9.1.0738: filetype: rapid files are not recognized
    * runtime(modconf): remove erroneous :endif in ftplugin
    * runtime(lyrics): support multiple timestamps in syntax script
    * runtime(java): Optionally recognise _module_ import declarations
    * runtime(vim): Update base-syntax, improve folding function matches
    * CI: upload failed screendump tests also for Cirrus
    * 9.1.0737: tests: screendump tests may require a bit more time
    * runtime(misc): simplify keywordprg in various ftplugins
    * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels
    * runtime(zsh,sh): set and unset compiler in ftplugin
    * runtime(netrw): using inefficient highlight pattern for 'mf'
    * 9.1.0736: Unicode tables are outdated
    * 9.1.0735: filetype: salt files are not recognized
    * 9.1.0734: filetype: jinja files are not recognized
    * runtime(zathurarc): add double-click-follow to syntax script
    * translation(ru): Updated messages translation
    * translation(it): updated xxd man page
    * translation(ru): updated xxd man page
    * 9.1.0733: keyword completion does not work with fuzzy
    * 9.1.0732: xxd: cannot use -b and -i together
    * runtime(java): Highlight javaConceptKind modifiers with StorageClass
    * runtime(doc): reword and reformat how to use defaults.vim
    * 9.1.0731: inconsistent case sensitive extension matching
    * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return
    * runtime(netrw): delete confirmation not strict enough
    * 9.1.0730: Crash with cursor-screenline and narrow window
    * 9.1.0729: Wrong cursor-screenline when resizing window
    * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
    * runtime(doc): clarify the effect of the timeout for search()-functions
    * runtime(idlang): update syntax script
    * runtime(spec): Recognize epoch when making spec changelog in ftplugin
    * runtime(spec): add file triggers to syntax script
    * 9.1.0727: too many strlen() calls in option.c
    * runtime(make): add compiler/make.vim to reset compiler plugin settings
    * runtime(java): Recognise all available standard doclet tags
    * 9.1.0726: not using correct python3 API with dynamic linking
    * runtime(dosini): Update syntax script, spellcheck comments only
    * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation
    * 9.1.0725: filetype: swiftinterface files are not recognized
    * runtime(pandoc): Update compiler plugin to use actual 'spelllang'
    * runtime(groff): Add compiler plugin for groff
    * 9.1.0724: if_python: link error with python 3.13 and stable ABI
    * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13
    * 9.1.0722: crash with large id in text_prop interface
    * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME
    * runtime(glvs): update GetLatestVimScripts plugin
    * runtime(doc): Fix typo in :help :hide text
    * runtime(doc): buffers can be re-used
    * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs
    * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid
    * runtime(doc): Update version9.txt and mention $MYVIMDIR
  - Update to 9.1.0718:
    * v9.1.0718: hard to know the users personal Vim Runtime Directory
    * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers()
    Maintainers: fix typo in author name
    * v9.1.0716: resetting setcellwidth( doesn't update the screen
    runtime(hcl,terraform): Add runtime files for HCL and Terraform
    runtime(tmux): Update syntax script
    * v9.1.0715: Not correctly parsing color names (after v9.1.0709)
    * v9.1.0714: GuiEnter_Turkish test may fail
    * v9.1.0713: Newline causes E749 in Ex mode
    * v9.1.0712: missing dependency of Test_gettext_makefile
    * v9.1.0711: test_xxd may file when using different xxd
    * v9.1.0710: popup window may hide part of Command line
    runtime(vim): Update syntax, improve user-command matching
    * v9.1.0709: GUIEnter event not found in Turkish locale
    runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items
    * v9.1.0708: Recursive window update does not account for reset skipcol
    runtime(nu): include filetype plugin
    * v9.1.0707: invalid cursor position may cause a crash
    * v9.1.0706: test_gettext fails when using shadow dir
    CI: Install locales-all package
    * v9.1.0705: Sorting of fuzzy filename completion is not stable
    translation(pt): update Portuguese/Brazilian menu translation
    runtime(vim): Update base-syntax, match bracket mark ranges
    runtime(doc): Update :help :command-complete list
    * v9.1.0704: inserting with a count is inefficient
    runtime(doc): use mkdir -p to save a command
    * v9.1.0703: crash with 2byte encoding and glob2regpat()
    runtime(hollywood): update syn highlight for If-Then statements
    and For-In-Loops
    * v9.1.0702: Patch 9.1.0700 broke CI
    * v9.1.0701: crash with NFA regex engine when searching for
    composing chars
    * v9.1.0700: crash with 2byte encoding and glob2regpat()
    * v9.1.0699: "dvgo" is not always an inclusive motion
    runtime(java): Provide support for syntax preview features
    * v9.1.0698: "Untitled" file not removed when running Test_crash1_3
    alone
    * v9.1.0697: heap-buffer-overflow in ins_typebuf
    * v9.1.0696: installing runtime files fails when using SHADOWDIR
    runtime(doc): fix typo
    * v9.1.0695: test_crash leaves Untitled file around
    translation(br): Update Brazilian translation
    translation(pt): Update menu_pt_br
    * v9.1.0694: matchparen is slow on a long line
    * v9.1.0693: Configure doesn't show result when not using python3
    stable abi
    * v9.1.0692: Wrong patlen value in ex_substitute()
    * v9.1.0691: stable-abi may cause segfault on Python 3.11
    runtime(vim): Update base-syntax, match :loadkeymap after colon and bar
    runtime(mane): Improve <Plug>ManBS mapping
    * v9.1.0690: cannot set special highlight kind in popupmenu
    translation(pt): Revert and fix wrong Portuguese menu translation
    files
    translation(pt): revert Portuguese menu translation
    translation(br): Update Brazilian translations
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    * v9.1.0689: buffer-overflow in do_search( with 'rightleft'
    runtime(vim): Improve heredoc handling for all embedded scripts
    * v9.1.0688: dereferences NULL pointer in check_type_is_value()
    * v9.1.0687: Makefile may not install desktop files
    runtime(man): Fix <Plug>ManBS
    runtime(java): Make the bundled &foldtext function optional
    runtime(netrw): Change line on `mx` if command output exists
    runtime(netrw): Fix `mf`-selected entry highlighting
    runtime(htmlangular): add html syntax highlighting
    translation(it): Fix filemode of Italian manpages
    runtime(doc): Update outdated man.vim plugin information
    runtime(zip): simplify condition to detect MS-Windows
    * v9.1.0686: zip-plugin has problems with special characters
    runtime(pandoc): escape quotes in &errorformat for pandoc
    translation(it): updated Italian manpage
    * v9.1.0685: too many strlen( calls in usercmd.c
    runtime(doc): fix grammar in :h :keeppatterns
    runtime(pandoc): refine pandoc compiler settings
    * v9.1.0684: completion is inserted on Enter with "noselect"
    translation(ru): update man pages
    * v9.1.0683: mode( returns wrong value with <Cmd> mapping
    runtime(doc): remove trailing whitespace in cmdline.txt
    * v9.1.0682: Segfault with uninitialized funcref
    * v9.1.0681: Analyzing failed screendumps is hard
    runtime(doc): more clarification for the :keeppatterns needed
    * v9.1.0680: VMS does not have defined uintptr_t
    runtime(doc): improve typedchar documentation for KeyInputPre autocmd
    runtime(dist): verify that executable is in $PATH
    translation(it): update Italian manpages
    runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677
    runtime(doc): update Makefile and make it portable between GNU and BSD
    * v9.1.0679: Rename from w_closing to w_locked is incomplete
    runtime(colors): update colorschemes
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    runtime(doc): Updating the examples in the xxd manpage
    translation(ru): Updated uganda.rux
    runtime(yaml): do not re-indent when commenting out lines
    * v9.1.0678: use-after-free in alist_add()
    * v9.1.0677 :keepp does not retain the substitute pattern
    translation(ja): Update Japanese translations to latest release
    runtime(netrw): Drop committed trace lines
    runtime(netrw): Error popup not always used
    runtime(netrw): ErrorMsg( may throw E121
    runtime(tutor): update Makefile and make it portable between GNU and BSD
    translation: improve the po/cleanup.vim script
    runtime(lang): update Makefile and make it portable between GNU and BSD
    * v9.1.0676: style issues with man pages
    * v9.1.0675: Patch v9.1.0674 causes problems
    runtime(dosbatch): Show %%i as an argument in syntax file
    runtime(dosbatch): Add syn-sync to syntax file
    runtime(sql, mysql): fix E169: Command too recursive with
    sql_type_default = "mysql"
    * v9.1.0674: compiling abstract method fails because of missing return
    runtime(javascript): fix a few issues with syntax higlighting
    runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var
    runtime(termdebug): Fix wrong test for balloon feature
    runtime(doc): Remove mentioning of the voting feature
    runtime(doc): add help tags for json + markdown global variables
    * v9.1.0673: too recursive func calls when calling super-class method
    runtime(syntax-tests): Facilitate the viewing of rendered screendumps
    runtime(doc): fix a few style issues
    * v9.1.0672: marker folds may get corrupted on undo
    * v9.1.0671 Problem:  crash with WinNewPre autocommand
    * v9.1.0670: po file encoding fails on *BSD during make
    translation(it): Update Italian translation
    translation: Stop using msgconv
    * v9.1.0669: stable python ABI not used by default
    Update .gitignore and .hgignore files
    * v9.1.0668: build-error with python3.12 and stable ABI
    translations: Update generated po files
    * v9.1.0667: Some other options reset curswant unnecessarily when set
    * v9.1.0666: assert_equal( doesn't show multibyte string correctly
    runtime(doc): clarify directory of Vim's executable vs CWD
    * v9.1.0665 :for loop
    runtime(proto): Add indent script for protobuf filetype
    * v9.1.0664: console vim did not switch back to main screen on exit
    runtime(zip): zip plugin does not work with Vim 9.0
    * v9.1.0663: zip test still resets 'shellslash' option
    runtime(zip): use defer to restore old settings
    runtime(zip): add a generic Message function
    runtime(zip): increment base version of zip plugin
    runtime(zip): raise minimum Vim version to * v9.0
    runtime(zip): refactor save and restore of options
    runtime(zip): remove test for fnameescape
    runtime(zip): use :echomsg instead of :echo
    runtime(zip): clean up and remove comments
    * v9.1.0662: filecopy( may return wrong value when readlink( fails
    * v9.1.0661: the zip plugin is not tested.
    runtime(zip): Fix for FreeBSD's unzip command
    runtime(doc): capitalize correctly
    * v9.1.0660: Shift-Insert does work on old conhost
    translation(it): update Italian manpage
    runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr
    runtime(zip): escape '[' on Unix as well
    * v9.1.0659: MSVC Makefile is a bit hard to read
    runtime(doc): fix typo in syntax.txt
    runtime(doc): -x is only available when compiled with crypt feature
    * v9.1.0658: Coverity warns about dereferencing NULL pointer.
    runtime(colors): update Todo highlight in habamax colorscheme
    * v9.1.0657: MSVC build time can be optimized
    * v9.1.0656: MSVC Makefile CPU handling can be improved
    * v9.1.0655: goaccess config file not recognized
    CI: update clang compiler to version 20
    runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore`
    * v9.1.0654: completion does not respect completeslash with fuzzy
    * v9.1.0653: Patch v9.1.0648 not completely right
    * v9.1.0652: too many strlen( calls in syntax.c
    * v9.1.0651 :append
    * v9.1.0650: Coverity warning in cstrncmp()
    * v9.1.0649: Wrong comment for "len" argument of call_simple_func()
    * v9.1.0648: [security] double-free in dialog_changed()
    * v9.1.0647: [security] use-after-free in tagstack_clear_entry
    runtime(doc): re-format tag example lines, mention ctags --list-kinds
    * v9.1.0646: imported function may not be found
    runtime(java): Document "g:java_space_errors" and "g:java_comment_strings"
    runtime(java): Cluster optional group definitions and their group links
    runtime(java): Tidy up the syntax file
    runtime(java): Tidy up the documentation for "ft-java-syntax"
    runtime(colors): update habamax scheme - tweak diff/search/todo colors
    runtime(nohlsearch): add missing loaded_hlsearch guard
    runtime(kivy): Updated maintainer info for syntax script
    Maintainers: Add maintainer for ondir ftplugin + syntax files
    runtime(netrw): removing trailing slash when copying files in same
    directory
    * v9.1.0645: wrong match when searching multi-byte char case-insensitive
    runtime(html): update syntax script to sync by 250 minlines by default
    * v9.1.0644: Unnecessary STRLEN( when applying mapping
    runtime(zip): Opening a remote zipfile don't work
    runtime(cuda): source c and cpp ftplugins
    * v9.1.0643: cursor may end up on invalid position
    * v9.1.0642: Check that mapping rhs starts with lhs fails if not
    simplified
    * v9.1.0641: OLE enabled in console version
    runtime(thrift): add ftplugin, indent and syntax scripts
    * v9.1.0640: Makefile can be improved
    * v9.1.0639: channel timeout may wrap around
    * v9.1.0638: E1510 may happen when formatting a message for smsg()
    * v9.1.0637: Style issues in MSVC Makefile
  - Update apparmor.vim to latest version (from AppArmor 4.0.2)
  - add support for "all" and "userns" rules, and new profile flags
  - Update to 9.1.0636:
    * 9.1.0636: filetype: ziggy files are not recognized
    * 9.1.0635: filetype: SuperHTML template files not recognized
    * 9.1.0634: Ctrl-P not working by default
    * 9.1.0633: Compilation warnings with `-Wunused-parameter`
    * 9.1.0632: MS-Windows: Compiler Warnings
    Add support for Files-Included in syntax script
    tweak documentation style a bit
    * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion
    * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme
    * 9.1.0629: Rename of pum hl_group is incomplete
    * 9.1.0628: MinGW: coverage files are not cleaned up
    * 9.1.0627: MinGW: build-error when COVERAGE is enabled
    * 9.1.0626: Vim9: need more tests with null objects
    include initial filetype plugin
    * 9.1.0625: tests: test output all translated messages for all translations
    * 9.1.0624: ex command modifiers not found
    * 9.1.0623: Mingw: errors when trying to delete non-existing files
    * 9.1.0622: MS-Windows: mingw-build can be optimized
    * 9.1.0621: MS-Windows: startup code can be improved
    * 9.1.0620: Vim9: segfauls with null objects
    * 9.1.0619: tests: test_popup fails
    * 9.1.0618: cannot mark deprecated attributes in completion menu
    * 9.1.0617: Cursor moves beyond first line of folded end of buffer
    * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles
    * 9.1.0615: Unnecessary STRLEN() in make_percent_swname()
    Add single-line comment syntax
    Add syntax test for comments
    Update maintainer info
    * 9.1.0614: tests: screendump tests fail due to recent syntax changes
    * 9.1.0613: tests: termdebug test may fail and leave file around
    Update base-syntax, improve :set highlighting
    Optionally highlight the :: token for method references
    * 9.1.0612: filetype: deno.lock file not recognized
    Use delete() for deleting directory
    escape filename before trying to delete it
    * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys
    correctly extract file from zip browser
    * 9.1.0610: filetype: OpenGL Shading Language files are not detected
    Fix endless recursion in netrw#Explore()
    * 9.1.0609: outdated comments in Makefile
    update syntax script
    Fix flow mapping key detection
    Remove orphaned YAML syntax dump files
    * 9.1.0608: Coverity warns about a few potential issues
    Update syntax script and remove syn sync
    * 9.1.0607: termdebug: uses inconsistent style
    * 9.1.0606: tests: generated files may cause failure in test_codestyle
    * 9.1.0605: internal error with fuzzy completion
    * 9.1.0604: popup_filter during Press Enter prompt seems to hang
    translation: Update Serbian messages translation
    * 9.1.0603: filetype: use correct extension for Dracula
    * 9.1.0602: filetype: Prolog detection can be improved
    fix more inconsistencies in assert function docs
    * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit
    Update base-syntax, improve :map highlighting
    * 9.1.0600: Unused function and unused error constants
    * 9.1.0599: Termdebug: still get E1023 when specifying arguments
    correct wrong comment options
    fix typo "a xterm" -> "an xterm"
    * 9.1.0598: fuzzy completion does not work with default completion
    * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key
    * 9.1.0596: filetype: devscripts config files are not recognized
    gdb file/folder check is now performed only in CWD.
    quote filename arguments using double quotes
    update syntax to SDC-standard 2.1
    minor updates.
    Cleanup :match and :loadkeymap syntax test files
    Update base-syntax, match types in Vim9 variable declarations
    * 9.1.0595: make errors out with the po Makefile
    * 9.1.0594: Unnecessary redraw when setting 'winfixbuf'
    using wrong highlight for UTF-8
    include simple syntax plugin
    * 9.1.0593: filetype: Asymptote files are not recognized
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    * 9.1.0592: filetype: Mediawiki files are not recognized
    * 9.1.0591: filetype: *.wl files are not recognized
    * 9.1.0590: Vim9: crash when accessing getregionpos() return value
    'cpoptions': Include "z" in the documented default
    * 9.1.0589: vi: d{motion} and cw work differently than expected
    update included colorschemes
    grammar fixes in options.txt
  - Add "Keywords" to gvim.desktop to make searching for gvim easier
  - Removed patches, as they're no longer required (refreshing them
    deleted their contents):
    * vim-7.3-help_tags.patch
    * vim-7.4-highlight_fstab.patch
  - Reorganise all applied patches in the spec file.
  - Update to 9.1.0588:
    * 9.1.0588: The maze program no longer compiles on newer clang
    runtime(typst): Add typst runtime files
    * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky
    * 9.1.0586: ocaml runtime files are outdated
    runtime(termdebug): fix a few issues
    * 9.1.0585: tests: test_cpoptions leaves swapfiles around
    * 9.1.0584: Warning about redeclaring f_id() non-static
    runtime(doc): Add hint how to load termdebug from vimrc
    runtime(doc): document global insert behavior
    * 9.1.0583: filetype: *.pdf_tex files are not recognized
    * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode
    * 9.1.0581: Various lines are indented inconsistently
    * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode
    * 9.1.0579: Ex command is still executed after giving E1247
    * 9.1.0578: no tests for :Tohtml
    * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim
    * 9.1.0576: tests: still an issue with test_gettext_make
    * 9.1.0575: Wrong comments in alt_tabpage()
    * 9.1.0574: ex: wrong handling of commands after bar
    runtime(doc): add a note for netrw bug reports
    * 9.1.0573: ex: no implicit print for single addresses
    runtime(vim): make &indentexpr available from the outside
    * 9.1.0572: cannot specify tab page closing behaviour
    runtime(doc): remove obsolete Ex insert behavior
    * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky
    runtime(logindefs): update syntax with new keywords
    * 9.1.0570: tests: test_gettext_make can be improved
    runtime(filetype): Fix Prolog file detection regex
    * 9.1.0569: fnamemodify() treats ".." and "../" differently
    runtime(mojo): include mojo ftplugin and indent script
    * 9.1.0568: Cannot expand paths from 'cdpath' setting
    * 9.1.0567: Cannot use relative paths as findfile() stop directories
    * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash
    * 9.1.0565: Stop directory doesn't work properly in 'tags'
    * 9.1.0564: id() can be faster
    * 9.1.0563: Cannot process any Key event
    * 9.1.0562: tests: inconsistency in test_findfile.vim
    runtime(fstab): Add missing keywords to fstab syntax
    * 9.1.0561: netbeans: variable used un-initialized (Coverity)
    * 9.1.0560: bindtextdomain() does not indicate an error
    * 9.1.0559: translation of vim scripts can be improved
    * 9.1.0558: filetype: prolog detection can be improved
    * 9.1.0557: moving in the buffer list doesn't work as documented
    runtime(doc): fix inconsistencies in :h file-searching
    * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages
    runtime(htmlangular): correct comment
    * 9.1.0555: filetype: angular ft detection is still problematic
    * 9.1.0554: :bw leaves jumplist and tagstack data around
    * 9.1.0553: filetype: *.mcmeta files are not recognized
    * 9.1.0552: No test for antlr4 filetype
    * 9.1.0551: filetype: htmlangular files are not properly detected
    * 9.1.0550: filetype: antlr4 files are not recognized
    * 9.1.0549: fuzzycollect regex based completion not working as expected
    runtime(doc): autocmd_add() accepts a list not a dict
    * 9.1.0548: it's not possible to get a unique id for some vars
    runtime(tmux): Update syntax script
    * 9.1.0547: No way to get the arity of a Vim function
    * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A
    runtime(hlsplaylist): include hlsplaylist ftplugin file
    runtime(doc): fix typo in :h ft-csv-syntax
    runtime(doc): Correct shell command to get $VIMRUNTIME into
    shell
    * 9.1.0545: MSVC conversion warning
    * 9.1.0544: filetype: ldapconf files are not recognized
    runtime(cmakecache): include cmakecache ftplugin file
    runtime(lex): include lex ftplugin file
    runtime(yacc): include yacc ftplugin file
    runtime(squirrel): include squirrel ftplugin file
    runtime(objcpp): include objcpp ftplugin file
    runtime(tf): include tf ftplugin file
    runtime(mysql): include mysql ftplugin file
    runtime(javacc): include javacc ftplugin file
    runtime(cabal): include cabal ftplugin file
    runtime(cuda): include CUDA ftplugin file
    runtime(editorconfig): include editorconfig ftplugin file
    runtime(kivy): update kivy syntax, include ftplugin
    runtime(syntax-tests): Stop generating redundant "*_* 99.dump"
    files
    * 9.1.0543: Behavior of CursorMovedC is strange
    runtime(vim): Update base-syntax, improve :match command
    highlighting
    * 9.1.0542: Vim9: confusing string() output for object functions
    * 9.1.0541: failing test with Vim configured without channel
    * 9.1.0540: Unused assignment in sign_define_cmd()
    runtime(doc): add page-scrolling keys to index.txt
    runtime(doc): add reference to xterm-focus-event from
    FocusGained/Lost
    * 9.1.0539: Not enough tests for what v9.1.0535 fixed
    runtime(doc): clarify how to re-init csv syntax file
    * 9.1.0538: not possible to assign priority when defining a sign
    * 9.1.0537: signed number detection for CTRL-X/A can be improved
    * 9.1.0536: filetype: zone files are not recognized
    * 9.1.0535: newline escape wrong in ex mode
    runtime(man): honor cmd modifiers before `g:ft_man_open_mode`
    runtime(man): use `nnoremap` to map to Ex commands
    * 9.1.0534: completion wrong with fuzzy when cycling back to original
    runtime(syntax-tests): Abort and report failed cursor progress
    runtime(syntax-tests): Introduce self tests for screen dumping
    runtime(syntax-tests): Clear and redraw the ruler line with
    the shell info
    runtime(syntax-tests): Allow for folded and wrapped lines in
    syntax test files
    * 9.1.0533: Vim9: need more tests for nested objects equality
    CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries
    runtime(doc): Remove wrong help tag CTRL-SHIFT-CR
    * 9.1.0532: filetype: Cedar files not recognized
    runtime(doc): document further keys that scroll page up/down
    * 9.1.0531: resource leak in mch_get_random()
    runtime(tutor): Fix wrong spanish translation
    runtime(netrw): fix remaining case of register clobber
    * 9.1.0530: xxd: MSVC warning about non-ASCII character
    * 9.1.0529: silent! causes following try/catch to not work
    runtime(rust): use shiftwidth() in indent script
    * 9.1.0528: spell completion message still wrong in translations
    * 9.1.0527: inconsistent parameter in Makefiles for Vim executable
    * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer
    runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config
    * 9.1.0525: Right release selects immediately when pum is truncated.
    * 9.1.0524: the recursive parameter in the *_equal functions can be removed
    runtime(termdebug): Add Deprecation warnings
    * 9.1.0523: Vim9: cannot downcast an object
    * 9.1.0522: Vim9: string(object) hangs for recursive references
    * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13
    * 9.1.0520: Vim9: incorrect type checking for modifying lists
    runtime(manpager): avoid readonly prompt
    * 9.1.0519: MS-Windows: libvterm compilation can be optimized
    * 9.1.0518: initialize the random buffer can be improved
    * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak
    runtime(terraform): Add filetype plugin for terraform
    runtime(dockerfile): enable spellchecking of comments in
    syntax script
    runtime(doc): rename variable for pandoc markdown support
    runtime(doc): In builtin overview use {buf} as param for
    appendbufline/setbufline
    runtime(doc): clarify, that register 1-* 9 will always be shifted
    runtime(netrw): save and restore register 0-* 9, a and unnamed
    runtime(termdebug): Refactored StartDebug_term and EndDebug
    functions
    runtime(java): Compose "g:java_highlight_signature" and
    "g:java_highlight_functions"
    * 9.1.0516: need more tests for nested dicts and list comparision
    * 9.1.0515: Vim9: segfault in object_equal()
    * 9.1.0514: Vim9: issue with comparing objects recursively
    runtime(termdebug): Change some variables to Enums
    runtime(vim): Update base-syntax, fix function tail comments
    * 9.1.0513: Vim9: segfault with object comparison
  - Update to 9.1.0512:
    * Mode message for spell completion doesn't match allowed keys
    * CursorMovedC triggered wrongly with setcmdpos()
    * update runtime files
    * CI: test_gettext fails on MacOS14 + MSVC Win
    * not possible to translate Vim script messages
    * termdebug plugin can be further improved
    * add gomod filetype plugin
    * hard to detect cursor movement in the command line
    * Optionally highlight parameterised types
    * filetype: .envrc & .prettierignore not recognized
    * filetype: Faust files are not recognized
    * inner-tag textobject confused about ">" in attributes
    * cannot use fuzzy keyword completion
    * Remove the group exclusion list from @javaTop
    * wrong return type for execute() function
    * MS-Windows: too much legacy code
    * too complicated mapping restore in termdebug
    * simplify mapping
    * cannot switch buffer in a popup
    * MS-Windows: doesn't handle symlinks properly
    * getcmdcompltype() interferes with cmdline completion
    * termdebug can be further improved
    * update htmldjango detection
    * Improve Turkish documentation
    * include a simple csv filetype and syntax plugin
    * include the the simple nohlsearch package
    * matched text is highlighted case-sensitively
    * Matched text isn't highlighted in cmdline pum
    * Fix typos in several documents
    * clarify when text properties are cleared
    * improve the vim-shebang example
    * revert unintended formatting changes for termdebug
    * Add a config variable for commonly used compiler options
    * Wrong matched text highlighted in pum with 'rightleft'
    * bump length of character references in syntax script
    * properly check mapping variables using null_dict
    * fix KdlIndent and kdlComment in indent script
    * Test for patch 9.1.0489 doesn't fail without the fix
    * Fold multi-line comments with the syntax kind of &fdm
    * using wrong type for PlaceSign()
    * filetype: Vim-script files not detected by shebang line
    * revert unintended change to zip#Write()
    * add another tag for vim-shebang feature
    * Cmdline pum doesn't work properly with 'rightleft'
    * minor style problems with patch 9.1.0487
    * default completion may break with fuzzy
    * Wrong padding for pum "kind" with 'rightleft'
    * Update base-syntax, match shebang lines
    * MS-Windows: handle files with spaces properly
    * Restore HTML syntax file tests
    * completed item not update on fuzzy completion
    * filetype: Snakemake files are not recognized
    * make TermDebugSendCommand() a global function again
    * close all buffers in the same way
    * Matched text shouldn't be highlighted in "kind" and "menu"
    * fix wrong helptag for :defer
    * Update base-syntax, match :sleep arg
    * include Georgian keymap
    * Sorting of completeopt+=fuzzy is not stable
    * correctly test for windows in NetrwGlob()
    * glob() on windows fails with [] in directory name
    * rewrite mkdir() doc and simplify {flags} meaning
    * glob() not sufficiently tested
    * update return type for job_info()
    * termdebug plugin needs more love
    * correct return types for job_start() and job_status()
    * Update base-syntax, match :catch and :throw args
    * Include element values in non-marker annotations
    * Vim9: term_getjob() throws an exception on error
    * fuzzy string matching executed when not needed
    * fuzzy_match_str_with_pos() does unnecessary list operations
    * restore description of "$" in col() and virtcol()
    * deduplicate getpos(), line(), col(), virtcol()
    * Update g:vimsyn_comment_strings dump file tests
    * Use string interpolation instead of string concat
    * potential deref of NULL pointer in fuzzy_match_str_with_pos
    * block_editing errors out when using <enter>
    * Update base-syntax, configurable comment string highlighting
    * fix typos in syntax.txt
    * Cannot see matched text in popup menu
    * Update base-syntax, match multiline continued comments
    * clarify documentation for "v" position at line()
    * cmod_split modifier is always reset in term_start()
    * remove line-continuation characters
    * use shiftwidth() instead of &tabstop in indent script
    * Remove orphaned screen dump files
    * include syntax, indent and ftplugin files
    * CI: Test_ColonEight() fails on github runners
    * add missing Enabled field in syntax script
    * basic svelte ftplugin file
    * term_start() does not clear vertical modifier
    * fix mousemodel restoration by comparing against null_string
    * Added definitions of Vim scripts and plugins
    * Exclude lambda expressions from _when_ _switch-case_ label clauses
    * Fix saved_mousemodel check
    * Inconsistencies between functions for option flags
    * Crash when using autocmd_get() after removing event inside autocmd
    * Fix small style issues
    * add return type info for Vim function descriptions
    * Update Italian Vim manpage
    * disable the q mapping
    * Change 'cms' for C++ to '// %s'
    * fix type mismatch error
    * Fix wrong email address
    * convert termdebug plugin to Vim9 script
  - Update to 9.1.0470:
    * tests Test_ColonEight_MultiByte() fails sporadically
    * Cannot have buffer-local value for 'completeopt'
    * GvimExt does not consult HKEY_CURRENT_USER
    * typos in some comments
    * runtime(vim): Update base-syntax, allow whitespace before
    :substitute pattern
    * Missing comments for fuzzy completion
    * runtime(man): update Vim manpage
    * runtime(comment): clarify the usage of 'commentstring' option
    value
    * runtime(doc): clarify how fuzzy 'completeopt' should work
    * runtime(netrw): prevent accidental data loss
    * missing filecopy() function
    * no whitespace padding in commentstring option in ftplugins
    * no fuzzy-matching support for insert-completion
    * eval5() and eval7 are too complex
    * too many strlen() calls in drawline.c
    * filetype lintstagedrc files are not recognized
    * Vim9 import autoload does not work with symlink
    * Coverity complains about division by zero
    * tests test_gui fails on Wayland
    * Left shift is incorrect with vartabstop and shiftwidth=0
    * runtime(doc): clarify 'shortmess' flag "S"
    * MS-Windows compiler warning for size_t to int conversion
    * runtime(doc): include some vim9 script examples in the help
    * minor issues in test_filetype with rasi test
    * filetype rasi files are not recognized
    * runtime(java): Improve the matching of lambda expressions
    * Configure checks for libelf unnecessarily
    * No test for escaping '<' with shellescape()
    * check.vim complains about overlong comment lines
    * translation(it): Update Italian translation
    * evalc. code too complex
    * MS-Windows Compiler warnings
  - Update to 9.1.0448:
    * compiler warning in eval.c
    * remove remaining css code
    * Add ft_hare.txt to Reference Manual TOC
    * re-generate vim syntax from generator
    * fix syntax vim bug
    * completion may be wrong when deleting all chars
    * getregionpos() inconsistent for partly-selected multibyte char
    * fix highlighting nested and escaped quotes in string props
    * remove the indent plugin since it has too many issues
    * update Debian runtime files
    * Coverity warning after 9.1.0440
    * Not enough tests for getregion() with multibyte chars
    * Can't use blockwise selection with width for getregion()
    * update outdated syntax files
    * fix floating_modifier highlight
    * hare runtime files outdated
    * getregionpos() can't properly indicate positions beyond eol
    * function get_lval() is too long
    * Cannot filter the history
    * Wrong Ex command executed when :g uses '?' as delimiter
    * support floating_modifier none; revert broken highlighting
    * Motif requires non-const char pointer for XPM  data
    * Crash when using '?' as separator for :s
    * filetype: cygport files are not recognized
    * make errors trying to access autoload/zig
    * Wrong yanking with exclusive selection and ve=all
    * add missing help tags file
    * Ancient XPM preprocessor hack may cause build errors
    * include basic rescript ftplugin file
    * eval.c is too long
    * getregionpos() doesn't handle one char selection
    * check for gdb file/dir before using as buffer name
    * refactor zig ftplugin, remove auto format
    * Coverity complains about eval.c refactor
    * Tag guessing leaves wrong search history with very short names
    * some issues with termdebug mapping test
    * update matchit plugin to v1.20
    * too many strlen() calls in search.c
    * set commentstring option
    * update vb indent plugin as vim9script
    * filetype: purescript files are not recognized
    * filetype: slint files are not recognized
    * basic nim ftplugin file for comments
    * Add Arduino ftplugin and indent files
    * include basic typst ftplugin file
    * include basic prisma ftplugin file
    * include basic v ftplugin for comment support
    * getregionpos() wrong with blockwise mode and multibyte
    * function echo_string_core() is too long
    * hyprlang files are not recognized
    * add basic dart ftplugin file
    * basic ftplugin file for graphql
    * mention comment plugin at :h 'commentstring'
    * set commentstring for sql files in ftplugin
    * :browse oldfiles prompts even with single entry
    * eval.c not sufficiently tested
    * clarify why E195 is returned
    * clarify temporary file clean up
    * fix :NoMatchParen not working
    * Cannot move to previous/next rare word
    * add basic ftplugin file for sshdconfig
    * if_py: find_module has been removed in Python 3.12.0a7
    * some screen dump tests can be improved
    * Some functions are not tested
    * clarify instal instructions for comment package
    * Unable to leave long line with 'smoothscroll' and 'scrolloff'
    * fix typo in vim9script help file
    * Remove trailing spaces
    * clarify {special} argument for shellescape()
  - update to 9.1.0413
    * smoothscroll may cause infinite loop
    * add missing entries for the keys CTRL-W g<Tab> and <C-Tab>
    * update vi_diff.txt: add default value for 'flash'
    * typo in regexp_bt.c in DEBUG code
    * allow indented commands
    * Fix wrong define regex in ftplugin
    * Filter out non-Latin-1 characters for syntax tests
    * prefer scp over pscp
    * fix typo in usr_52.txt
    * too long functions in eval.c
    * warning about uninitialized variable
    * too many strlen() calls in the regexp engine
    * E16 fix, async keyword support for define
    * Stuck with long line and half-page scrolling
    * Divide by zero with getmousepos() and 'smoothscroll'
    * update and remove  some invalid links
    * update translation of xxd manpage
    * Recursively delete directories by default with netrw delete command
    * Strive to remain compatible for at least Vim 7.0
    * tests: xxd buffer overflow fails on 32-bit
    * Stop handpicking syntax groups for @javaTop
    * [security] xxd: buffer-overflow with specific flags
    * Vim9: not able to import file from start dir
    * filetype: mdd files detected as zsh filetype
    * filetype: zsh module files are not recognized
    * Remove hardcoded private.ppk logic from netrw
    * Vim9: confusing error message for unknown type
    * block_editing errors out when using del
    * add new items to scripts section in syntax plugin
    * Vim9: imported vars are not properly type checked
    * Wrong display with 'smoothscroll' when changing quickfix list
    * filetype: jj files are not recognized
    * getregionpos() may leak memory on error
    * The CODEOWNERS File is not useful
    * Remove and cleanup Win9x legacy from netrw
    * add MsgArea to 'highlight' option description
    * Cannot get a list of positions describing a region
    * Fix digit separator in syntax script for octals and floats
    * Update link to Wikipedia Vi page
    * clear $MANPAGER in ftplugin before shelling out
    * Fix typos in help documents
    * 'viewdir' not respecting $XDG_CONFIG_HOME
    * tests: Vim9 debug tests may be flaky
    * correct getscriptinfo() example
    * Vim9: could improve testing
    * test_sound fails on macos-12
    * update Serbian menu
    * update Slovak menu
    * update Slovenian menu
    * update Portuguese menu
    * update Dutch menu
    * update Korean menu
    * update Icelandic menu
    * update Czech menu
    * update Afrikaans menu
    * update German menu
    * filetype: inko files are not recognized
    * filetype: templ files are not recognized
    * cursor() and getregion() don't handle v:maxcol well
    * Vim9: null value tests not sufficient
    * update Catalan menu
    * filetype: stylus files not recognized
    * update spanish menu localization
    * regenerate helptags
    * Vim9: crash with null_class and null_object
    * Add tags about lazyloading of menu
    * tests: vt420 terminfo entry may not be found
    * filetype: .out files recognized as tex files
    * filetype: Kbuild files are not recognized
    * cbuffer and similar commands don't accept a range
    * Improve the recognition of the "indent" method declarations
    * Fix a typo in usr_30.txt
    * remove undefined var s:save_cpoptions and add include setting
    * missing setlocal in indent plugin
    * Calculating line height for unnecessary amount of lines
    * improve syntax file performance
    * There are a few typos
    * Vim9: no comments allowed after class vars
    * CI: remove trailing white space in documentation
    * Formatting text wrong when 'breakindent' is set
    * Add oracular (24.10) as Ubuntu release name
    * Vim9: Trailing commands after class/enum keywords ignored
    * tests: 1-second delay after Test_BufEnter_botline()
    * update helptags for jq syntax
    * include syntax, ftplugin and compiler plugin
    * fix typo synconcealend -> synconcealed
    * include a simple comment toggling plugin
    * wrong botline in BufEnter
    * clarify syntax vs matching mechanism
    * fix undefined variable in indent plugin
    * ops.c code uses too many strlen() calls
    * Calling CLEAR_FIELD() on the same struct twice
    * Vim9: compile_def_function() still too long
    * Update Serbian messages
    * clarify the effect of setting the shell to powershell
    * Improve the recognition of the "style" method declarations
    * Vim9: problem when importing autoloaded scripts
    * compile_def_function is too long
    * filetype: ondir files are not recognized
    * Crash when typing many keys with D- modifier
    * tests: test_vim9_builtin is a bit slow
    * update documentation
    * change the download URL of "libsodium"
    * tests: test_winfixbuf is a bit slow
    * Add filetype, syntax and indent plugin for Astro
    * expanding rc config files does not work well
    * Vim9: vim9type.c is too complicated
    * Vim9: does not handle autoloaded variables well
    * minor spell fix in starting.txt
    * wrong drawing in GUI with setcellwidth()
    * Add include and suffixesadd
    * Page scrolling should place cursor at window boundaries
    * align command line table
    * minor fixes to starting.txt
    * fix comment definition in filetype plugin
    * filetype: flake.lock files are not recognized
    * runtime(uci): No support for uci file types
    * Support "g:ftplugin_java_source_path" with archived files
    * tests: Test_autoload_import_relative_compiled fails on Windows
    * Finding cmd modifiers and cmdline-specials is inefficient
    * No test that completing a partial mapping clears 'showcmd'
    * tests: test_vim9_dissamble may fail
    * Vim9: need static type for typealias
    * X11 does not ignore smooth scroll event
    * A few typos in test_xdg when testing gvimrc
    * Patch v9.1.0338 fixed sourcing a script with import
    * Problem: gvimrc not sourced from XDG_CONFIG_HOME
    * Cursor wrong after using setcellwidth() in terminal
    * 'showcmd' wrong for partial mapping with multibyte
    * tests: test_taglist fails when 'helplang' contains non-english
    * Problem: a few memory leaks are found
    * Problem: Error with matchaddpos() and empty list
    * tests: xdg test uses screen dumps
    * Vim9: import through symlinks not correctly handled
    * Missing entry for XDG vimrc file in :version
    * tests: typo in test_xdg
    * runtime(i3config/swayconfig): update syntax scripts
    * document pandoc compiler and enable configuring arguments
    * String interpolation fails for List type
    * No test for highlight behavior with 'ambiwidth'
    * tests: test_xdg fails on the appimage repo
    * tests: some assert_equal() calls have wrong order of args
    * make install does not install all files
    * runtime(doc): fix typos in starting.txt
  - Updated to version 9.1 with patch level 0330, fixes the following problems
    * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1
  - refreshed vim-7.3-filetype_spec.patch
  - refreshed vim-7.3-filetype_ftl.patch
  - Update spec.skeleton to use autosetup in place of setup macro.
  - for the complete list of changes see
    https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330

++++ vim:

  - Fix for bsc#1231373 / CVE-2024-47814.
  - Fix for bsc#1229238 / CVE-2024-43374.
  - update to 9.1.0836
    * 9.1.0836: The vimtutor can be improved
    * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu'
    * 9.1.0834: tests: 2html test fails
    * 9.1.0833: CI: recent ASAN changes do not work for indent tests
    * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal
    * runtime(doc): update help-toc description
    * runtime(2html): Make links use color scheme colors in TOhtml
    * 9.1.0831: 'findexpr' can't be used as lambad or Funcref
    * Filelist: include helptoc package
    * runtime(doc): include a TOC Vim9 plugin
    * Filelist: ignore .git-blame-ignore-revs
    * 9.1.0830: using wrong highlight group for spaces for popupmenu
    * runtime(typst): synchronize updates from the upstream typst.vim
    * git: ignore reformatting commit for git-blame (after v9.1.0829)
    * 9.1.0829: Vim source code uses a mix of tabs and spaces
    * 9.1.0828: string_T struct could be used more often
    * 9.1.0827: CI: tests can be improved
    * runtime(doc): remove stray sentence in pi_netrw.txt
    * 9.1.0826: filetype: sway files are not recognized
    * runtime(doc): Include netrw-gp in TOC
    * runtime(doc): mention 'iskeyword' at :h charclass()
    * runtime(doc): update help tags
    * 9.1.0825: compile error for non-diff builds
    * runtime(netrw): fix E874 when browsing remote directory which contains `~` character
    * runtime(doc): update coding style documentation
    * runtime(debversions): Add plucky (25.04) as Ubuntu release name
    * 9.1.0824: too many strlen() calls in register.c
    * 9.1.0823: filetype: Zephyr overlay files not recognized
    * runtime(doc): Clean up minor formatting issues for builtin functions
    * runtime(netrw): make :Launch/Open autoloadable
    * runtime(netrw): fix regression with x mapping on Cygwin
    * runtime(netrw): fix filetype detection for remote files
    * 9.1.0822: topline might be changed in diff mode unexpectedly
    * CI: huge linux builds should also run syntax & indent tests
    * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument
    * 9.1.0820: tests: Mac OS tests are too flaky
    * runtime(awk): Highlight more awk comments in syntax script
    * runtime(netrw): add missing change for s:redir()
    * 9.1.0819: tests: using findexpr and imported func not tested
    * runtime(netrw): improve netrw's open-handling further
    * runtime(netrw): fix syntax error in netrwPlugin.vim
    * runtime(netrw): simplify gx file handling
    * 9.1.0818: some global functions are only used in single files
    * 9.1.0817: termdebug: cannot evaluate expr in a popup
    * runtime(defaults): Detect putty terminal and switch to dark background
    * 9.1.0816: tests: not clear what tests cause asan failures
    * runtime(doc): Remove some completed items from todo.txt
    * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position
    * runtime(syntax-tests): tiny vim fails because of line-continuation
    * 9.1.0814: mapset() may remove unrelated mapping
    * 9.1.0813: no error handling with setglobal and number types
    * 9.1.0812: Coverity warns about dereferencing NULL ptr
    * 9.1.0811: :find expansion does not consider 'findexpr'
    * 9.1.0810: cannot easily adjust the |:find| command
    * 9.1.0809: filetype: petalinux config files not recognized
    * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll'
    * 9.1.0807: tests: having 'nolist' in modelines isn't always desired
    * 9.1.0806: tests: no error check when setting global 'briopt'
    * 9.1.0805: tests: minor issues in gen_opt_test.vim
    * 9.1.0804: tests: no error check when setting global 'cc'
    * 9.1.0803: tests: no error check when setting global 'isk'
    * 9.1.0802: tests: no error check when setting global 'fdm' to empty value
    * 9.1.0801: tests: no error check when setting global 'termwinkey'
    * 9.1.0800: tests: no error check when setting global 'termwinsize'
    * runtime(doc): :ownsyntax also resets 'spelloptions'
    * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive
    * runtime(doc): Fix wrong Mac default options
    * 9.1.0798: too many strlen() calls in cmdhist.c
    * 9.1.0797: testing of options can be further improved
    * 9.1.0796: filetype: libtool files are not recognized
    * (typst): add folding to typst ftplugin
    * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke()
    * 9.1.0795: filetype: Vivado memory info file are not recognized
    * 9.1.0794: tests: tests may fail on Windows environment
    * runtime(doc): improve the :colorscheme documentation
    * 9.1.0793: xxd: -e does add one extra space
    * 9.1.0792: tests: Test_set_values() is not comprehensive enough
    * runtime(swayconfig): add flag for bindsym/bindcode to syntax script
    * 9.1.0791: tests: errors in gen_opt_test.vim are not shown
    * runtime(compiler): check for compile_commands in build dirs for cppcheck
    * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib)
    * runtime(help): Update help syntax
    * runtime(help): fix end of sentence highlight in code examples
    * runtime(jinja): Support jinja syntax as secondary filetype
    * 9.1.0789: tests: ':resize + 5' has invalid space after '+'
    * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot
    * 9.1.0787: cursor position changed when using hidden terminal
    * 9.1.0786: tests: quickfix update test does not test location list
    * runtime(doc): add some docs for file-watcher programs
    * CI: uploading failed screendumps still fails on Cirrus CI
    * 9.1.0785: cannot preserve error position when setting quickfix list
    * 9.1.0784: there are several problems with python 3.13
    * 9.1.0783: 'spell' option setting has problems
    * 9.1.0782: tests: using wrong neomuttlog file name
    * runtime(doc): add preview flag to statusline example
    * 9.1.0781: tests: test_filetype fails
    * 9.1.0780: MS-Windows: incorrect Win32 error checking
    * 9.1.0779: filetype: neomuttlog files are not recognized
    * 9.1.0778: filetype: lf config files are not recognized
    * runtime(comment): fix commment toggle with mixed tabs & spaces
    * runtime(misc): Use consistent "Vim script" spelling
    * runtime(gleam): add ftplugin for gleam files
    * runtime(doc): link help-writing from write-local-help
    * 9.1.0777: filetype: Some upstream php files are not recognized
    * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups
    * runtime(doc): mention conversion rules for remote_expr()
    * runtime(tutor): Fix missing :s command in spanish translation section 4.4
    * 9.1.0776: test_strftime may fail because of missing TZ data
    * translation(am): Add Armenian language translation
    * 9.1.0775: tests: not enough tests for setting options
    * 9.1.0774: "shellcmdline" doesn't work with getcompletion()
    * 9.1.0773: filetype: some Apache files are not recognized
    * 9.1.0772: some missing changes from v9.1.0771
    * 9.1.0771: completion attribute hl_group is confusing
    * 9.1.0770: current command line completion is a bit limited
    * 9.1.0769: filetype: MLIR files are not recognized
    * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen
    * runtime(nasm): Update nasm syntax script
    * 9.1.0767: A condition is always true in ex_getln.c
    * runtime(skill): Update syntax file to fix string escapes
    * runtime(help): highlight CTRL-<Key> correctly
    * runtime(doc): add missing usr_52 entry to toc
    * 9.1.0766: too many strlen() calls in ex_getln.c
    * runtime(doc): correct `vi` registers 1-9 documentation error
    * 9.1.0765: No test for patches 6.2.418 and 7.3.489
    * runtime(spec): set comments and commentstring options
    * NSIS: Include libgcc_s_sjlj-1.dll again
    * runtime(doc): clarify the effect of 'startofline' option
    * 9.1.0764: [security]: use-after-free when closing a buffer
    * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting
    * 9.1.0763: tests: cannot run single syntax tests
    * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly
    * 9.1.0761: :cd completion fails on Windows with backslash in path
    * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails
    * 9.1.0759: screenpos() may return invalid position
    * runtime(misc): unset compiler in various ftplugins
    * runtime(doc): update formatting and syntax
    * runtime(compiler): add cppcheck linter compiler plugin
    * runtime(doc): Fix style in documents
    * runtime(doc): Fix to two-space convention in user manual
    * runtime(comment): consider &tabstop in lines after whitespace indent
    * 9.1.0758: it's possible to set an invalid key to 'wildcharm'
    * runtime(java): Manage circularity for every :syn-included syntax file
    * 9.1.0757: tests: messages files contains ANSI escape sequences
    * 9.1.0756: missing change from patch v9.1.0754
    * 9.1.0755: quickfix list does not handle hardlinks well
    * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters
    * runtime(systemd): small fixes to &keywordprg in ftplugin
    * CI: macos-12 runner is being sunset, switch to 13
    * 9.1.0754: fixed order of items in insert-mode completion menu
    * runtime(comment): commenting might be off by one column
    * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll'
    * 9.1.0752: can set 'cedit' to an invalid value
    * runtime(doc): add `usr` tag to usr_toc.txt
    * 9.1.0751: Error callback for term_start() not used
    * 9.1.0750: there are some Win9x legacy references
    * runtime(java): Recognise the CommonMark form (///) of Javadoc comments
    * 9.1.0749: filetype: http files not recognized
    * runtime(comment): fix syntax error
    * CI: uploading failed screendump tests does not work Cirrus
    * 9.1.0748: :keep* commmands are sometimes misidentified as :k
    * runtime(indent): allow matching negative numbers for gnu indent config file
    * runtime(comment): add gC mapping to (un)comment rest of line
    * 9.1.0747: various typos in repo found
    * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals
    * runtime(doc): reformat gnat example
    * runtime(doc): reformat ada_standard_types section
    * 9.1.0745: filetype: bun and deno history files not recognized
    * runtime(glvs): Correct the tag name of glvs-autoinstal
    * runtime(doc): include short form for :earlier/:later
    * runtime(doc): remove completed TODO
    * 9.1.0744: filetype: notmuch configs are not recognised
    * 9.1.0743: diff mode does not handle overlapping diffs correctly
    * runtime(glvs): fix a few issues
    * runtime(doc): Fix typo in :help :command-modifiers
    * 9.1.0742: getcmdprompt() implementation can be improved
    * runtime(docs): update `:set?` command behavior table
    * runtime(doc): update vim90 to vim91 in docs
    * runtime(doc): fix typo in :h dos-colors
    * 9.1.0741: No way to get prompt for input()/confirm()
    * runtime(doc): fix typo in version9.txt nrformat -> nrformats
    * runtime(rmd,rrst): 'fex' option not properly restored
    * runtime(netrw): remove extraneous closing bracket
    * 9.1.0740: incorrect internal diff with empty file
    * 9.1.0739: [security]: use-after-free in ex_getln.c
    * runtime(filetype): tests: Test_filetype_detection() fails
    * runtime(dist): do not output a message if executable is not found
    * 9.1.0738: filetype: rapid files are not recognized
    * runtime(modconf): remove erroneous :endif in ftplugin
    * runtime(lyrics): support multiple timestamps in syntax script
    * runtime(java): Optionally recognise _module_ import declarations
    * runtime(vim): Update base-syntax, improve folding function matches
    * CI: upload failed screendump tests also for Cirrus
    * 9.1.0737: tests: screendump tests may require a bit more time
    * runtime(misc): simplify keywordprg in various ftplugins
    * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels
    * runtime(zsh,sh): set and unset compiler in ftplugin
    * runtime(netrw): using inefficient highlight pattern for 'mf'
    * 9.1.0736: Unicode tables are outdated
    * 9.1.0735: filetype: salt files are not recognized
    * 9.1.0734: filetype: jinja files are not recognized
    * runtime(zathurarc): add double-click-follow to syntax script
    * translation(ru): Updated messages translation
    * translation(it): updated xxd man page
    * translation(ru): updated xxd man page
    * 9.1.0733: keyword completion does not work with fuzzy
    * 9.1.0732: xxd: cannot use -b and -i together
    * runtime(java): Highlight javaConceptKind modifiers with StorageClass
    * runtime(doc): reword and reformat how to use defaults.vim
    * 9.1.0731: inconsistent case sensitive extension matching
    * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return
    * runtime(netrw): delete confirmation not strict enough
    * 9.1.0730: Crash with cursor-screenline and narrow window
    * 9.1.0729: Wrong cursor-screenline when resizing window
    * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
    * runtime(doc): clarify the effect of the timeout for search()-functions
    * runtime(idlang): update syntax script
    * runtime(spec): Recognize epoch when making spec changelog in ftplugin
    * runtime(spec): add file triggers to syntax script
    * 9.1.0727: too many strlen() calls in option.c
    * runtime(make): add compiler/make.vim to reset compiler plugin settings
    * runtime(java): Recognise all available standard doclet tags
    * 9.1.0726: not using correct python3 API with dynamic linking
    * runtime(dosini): Update syntax script, spellcheck comments only
    * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation
    * 9.1.0725: filetype: swiftinterface files are not recognized
    * runtime(pandoc): Update compiler plugin to use actual 'spelllang'
    * runtime(groff): Add compiler plugin for groff
    * 9.1.0724: if_python: link error with python 3.13 and stable ABI
    * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13
    * 9.1.0722: crash with large id in text_prop interface
    * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME
    * runtime(glvs): update GetLatestVimScripts plugin
    * runtime(doc): Fix typo in :help :hide text
    * runtime(doc): buffers can be re-used
    * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs
    * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid
    * runtime(doc): Update version9.txt and mention $MYVIMDIR
  - Update to 9.1.0718:
    * v9.1.0718: hard to know the users personal Vim Runtime Directory
    * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers()
    Maintainers: fix typo in author name
    * v9.1.0716: resetting setcellwidth( doesn't update the screen
    runtime(hcl,terraform): Add runtime files for HCL and Terraform
    runtime(tmux): Update syntax script
    * v9.1.0715: Not correctly parsing color names (after v9.1.0709)
    * v9.1.0714: GuiEnter_Turkish test may fail
    * v9.1.0713: Newline causes E749 in Ex mode
    * v9.1.0712: missing dependency of Test_gettext_makefile
    * v9.1.0711: test_xxd may file when using different xxd
    * v9.1.0710: popup window may hide part of Command line
    runtime(vim): Update syntax, improve user-command matching
    * v9.1.0709: GUIEnter event not found in Turkish locale
    runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items
    * v9.1.0708: Recursive window update does not account for reset skipcol
    runtime(nu): include filetype plugin
    * v9.1.0707: invalid cursor position may cause a crash
    * v9.1.0706: test_gettext fails when using shadow dir
    CI: Install locales-all package
    * v9.1.0705: Sorting of fuzzy filename completion is not stable
    translation(pt): update Portuguese/Brazilian menu translation
    runtime(vim): Update base-syntax, match bracket mark ranges
    runtime(doc): Update :help :command-complete list
    * v9.1.0704: inserting with a count is inefficient
    runtime(doc): use mkdir -p to save a command
    * v9.1.0703: crash with 2byte encoding and glob2regpat()
    runtime(hollywood): update syn highlight for If-Then statements
    and For-In-Loops
    * v9.1.0702: Patch 9.1.0700 broke CI
    * v9.1.0701: crash with NFA regex engine when searching for
    composing chars
    * v9.1.0700: crash with 2byte encoding and glob2regpat()
    * v9.1.0699: "dvgo" is not always an inclusive motion
    runtime(java): Provide support for syntax preview features
    * v9.1.0698: "Untitled" file not removed when running Test_crash1_3
    alone
    * v9.1.0697: heap-buffer-overflow in ins_typebuf
    * v9.1.0696: installing runtime files fails when using SHADOWDIR
    runtime(doc): fix typo
    * v9.1.0695: test_crash leaves Untitled file around
    translation(br): Update Brazilian translation
    translation(pt): Update menu_pt_br
    * v9.1.0694: matchparen is slow on a long line
    * v9.1.0693: Configure doesn't show result when not using python3
    stable abi
    * v9.1.0692: Wrong patlen value in ex_substitute()
    * v9.1.0691: stable-abi may cause segfault on Python 3.11
    runtime(vim): Update base-syntax, match :loadkeymap after colon and bar
    runtime(mane): Improve <Plug>ManBS mapping
    * v9.1.0690: cannot set special highlight kind in popupmenu
    translation(pt): Revert and fix wrong Portuguese menu translation
    files
    translation(pt): revert Portuguese menu translation
    translation(br): Update Brazilian translations
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    * v9.1.0689: buffer-overflow in do_search( with 'rightleft'
    runtime(vim): Improve heredoc handling for all embedded scripts
    * v9.1.0688: dereferences NULL pointer in check_type_is_value()
    * v9.1.0687: Makefile may not install desktop files
    runtime(man): Fix <Plug>ManBS
    runtime(java): Make the bundled &foldtext function optional
    runtime(netrw): Change line on `mx` if command output exists
    runtime(netrw): Fix `mf`-selected entry highlighting
    runtime(htmlangular): add html syntax highlighting
    translation(it): Fix filemode of Italian manpages
    runtime(doc): Update outdated man.vim plugin information
    runtime(zip): simplify condition to detect MS-Windows
    * v9.1.0686: zip-plugin has problems with special characters
    runtime(pandoc): escape quotes in &errorformat for pandoc
    translation(it): updated Italian manpage
    * v9.1.0685: too many strlen( calls in usercmd.c
    runtime(doc): fix grammar in :h :keeppatterns
    runtime(pandoc): refine pandoc compiler settings
    * v9.1.0684: completion is inserted on Enter with "noselect"
    translation(ru): update man pages
    * v9.1.0683: mode( returns wrong value with <Cmd> mapping
    runtime(doc): remove trailing whitespace in cmdline.txt
    * v9.1.0682: Segfault with uninitialized funcref
    * v9.1.0681: Analyzing failed screendumps is hard
    runtime(doc): more clarification for the :keeppatterns needed
    * v9.1.0680: VMS does not have defined uintptr_t
    runtime(doc): improve typedchar documentation for KeyInputPre autocmd
    runtime(dist): verify that executable is in $PATH
    translation(it): update Italian manpages
    runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677
    runtime(doc): update Makefile and make it portable between GNU and BSD
    * v9.1.0679: Rename from w_closing to w_locked is incomplete
    runtime(colors): update colorschemes
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    runtime(doc): Updating the examples in the xxd manpage
    translation(ru): Updated uganda.rux
    runtime(yaml): do not re-indent when commenting out lines
    * v9.1.0678: use-after-free in alist_add()
    * v9.1.0677 :keepp does not retain the substitute pattern
    translation(ja): Update Japanese translations to latest release
    runtime(netrw): Drop committed trace lines
    runtime(netrw): Error popup not always used
    runtime(netrw): ErrorMsg( may throw E121
    runtime(tutor): update Makefile and make it portable between GNU and BSD
    translation: improve the po/cleanup.vim script
    runtime(lang): update Makefile and make it portable between GNU and BSD
    * v9.1.0676: style issues with man pages
    * v9.1.0675: Patch v9.1.0674 causes problems
    runtime(dosbatch): Show %%i as an argument in syntax file
    runtime(dosbatch): Add syn-sync to syntax file
    runtime(sql, mysql): fix E169: Command too recursive with
    sql_type_default = "mysql"
    * v9.1.0674: compiling abstract method fails because of missing return
    runtime(javascript): fix a few issues with syntax higlighting
    runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var
    runtime(termdebug): Fix wrong test for balloon feature
    runtime(doc): Remove mentioning of the voting feature
    runtime(doc): add help tags for json + markdown global variables
    * v9.1.0673: too recursive func calls when calling super-class method
    runtime(syntax-tests): Facilitate the viewing of rendered screendumps
    runtime(doc): fix a few style issues
    * v9.1.0672: marker folds may get corrupted on undo
    * v9.1.0671 Problem:  crash with WinNewPre autocommand
    * v9.1.0670: po file encoding fails on *BSD during make
    translation(it): Update Italian translation
    translation: Stop using msgconv
    * v9.1.0669: stable python ABI not used by default
    Update .gitignore and .hgignore files
    * v9.1.0668: build-error with python3.12 and stable ABI
    translations: Update generated po files
    * v9.1.0667: Some other options reset curswant unnecessarily when set
    * v9.1.0666: assert_equal( doesn't show multibyte string correctly
    runtime(doc): clarify directory of Vim's executable vs CWD
    * v9.1.0665 :for loop
    runtime(proto): Add indent script for protobuf filetype
    * v9.1.0664: console vim did not switch back to main screen on exit
    runtime(zip): zip plugin does not work with Vim 9.0
    * v9.1.0663: zip test still resets 'shellslash' option
    runtime(zip): use defer to restore old settings
    runtime(zip): add a generic Message function
    runtime(zip): increment base version of zip plugin
    runtime(zip): raise minimum Vim version to * v9.0
    runtime(zip): refactor save and restore of options
    runtime(zip): remove test for fnameescape
    runtime(zip): use :echomsg instead of :echo
    runtime(zip): clean up and remove comments
    * v9.1.0662: filecopy( may return wrong value when readlink( fails
    * v9.1.0661: the zip plugin is not tested.
    runtime(zip): Fix for FreeBSD's unzip command
    runtime(doc): capitalize correctly
    * v9.1.0660: Shift-Insert does work on old conhost
    translation(it): update Italian manpage
    runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr
    runtime(zip): escape '[' on Unix as well
    * v9.1.0659: MSVC Makefile is a bit hard to read
    runtime(doc): fix typo in syntax.txt
    runtime(doc): -x is only available when compiled with crypt feature
    * v9.1.0658: Coverity warns about dereferencing NULL pointer.
    runtime(colors): update Todo highlight in habamax colorscheme
    * v9.1.0657: MSVC build time can be optimized
    * v9.1.0656: MSVC Makefile CPU handling can be improved
    * v9.1.0655: goaccess config file not recognized
    CI: update clang compiler to version 20
    runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore`
    * v9.1.0654: completion does not respect completeslash with fuzzy
    * v9.1.0653: Patch v9.1.0648 not completely right
    * v9.1.0652: too many strlen( calls in syntax.c
    * v9.1.0651 :append
    * v9.1.0650: Coverity warning in cstrncmp()
    * v9.1.0649: Wrong comment for "len" argument of call_simple_func()
    * v9.1.0648: [security] double-free in dialog_changed()
    * v9.1.0647: [security] use-after-free in tagstack_clear_entry
    runtime(doc): re-format tag example lines, mention ctags --list-kinds
    * v9.1.0646: imported function may not be found
    runtime(java): Document "g:java_space_errors" and "g:java_comment_strings"
    runtime(java): Cluster optional group definitions and their group links
    runtime(java): Tidy up the syntax file
    runtime(java): Tidy up the documentation for "ft-java-syntax"
    runtime(colors): update habamax scheme - tweak diff/search/todo colors
    runtime(nohlsearch): add missing loaded_hlsearch guard
    runtime(kivy): Updated maintainer info for syntax script
    Maintainers: Add maintainer for ondir ftplugin + syntax files
    runtime(netrw): removing trailing slash when copying files in same
    directory
    * v9.1.0645: wrong match when searching multi-byte char case-insensitive
    runtime(html): update syntax script to sync by 250 minlines by default
    * v9.1.0644: Unnecessary STRLEN( when applying mapping
    runtime(zip): Opening a remote zipfile don't work
    runtime(cuda): source c and cpp ftplugins
    * v9.1.0643: cursor may end up on invalid position
    * v9.1.0642: Check that mapping rhs starts with lhs fails if not
    simplified
    * v9.1.0641: OLE enabled in console version
    runtime(thrift): add ftplugin, indent and syntax scripts
    * v9.1.0640: Makefile can be improved
    * v9.1.0639: channel timeout may wrap around
    * v9.1.0638: E1510 may happen when formatting a message for smsg()
    * v9.1.0637: Style issues in MSVC Makefile
  - Update apparmor.vim to latest version (from AppArmor 4.0.2)
  - add support for "all" and "userns" rules, and new profile flags
  - Update to 9.1.0636:
    * 9.1.0636: filetype: ziggy files are not recognized
    * 9.1.0635: filetype: SuperHTML template files not recognized
    * 9.1.0634: Ctrl-P not working by default
    * 9.1.0633: Compilation warnings with `-Wunused-parameter`
    * 9.1.0632: MS-Windows: Compiler Warnings
    Add support for Files-Included in syntax script
    tweak documentation style a bit
    * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion
    * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme
    * 9.1.0629: Rename of pum hl_group is incomplete
    * 9.1.0628: MinGW: coverage files are not cleaned up
    * 9.1.0627: MinGW: build-error when COVERAGE is enabled
    * 9.1.0626: Vim9: need more tests with null objects
    include initial filetype plugin
    * 9.1.0625: tests: test output all translated messages for all translations
    * 9.1.0624: ex command modifiers not found
    * 9.1.0623: Mingw: errors when trying to delete non-existing files
    * 9.1.0622: MS-Windows: mingw-build can be optimized
    * 9.1.0621: MS-Windows: startup code can be improved
    * 9.1.0620: Vim9: segfauls with null objects
    * 9.1.0619: tests: test_popup fails
    * 9.1.0618: cannot mark deprecated attributes in completion menu
    * 9.1.0617: Cursor moves beyond first line of folded end of buffer
    * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles
    * 9.1.0615: Unnecessary STRLEN() in make_percent_swname()
    Add single-line comment syntax
    Add syntax test for comments
    Update maintainer info
    * 9.1.0614: tests: screendump tests fail due to recent syntax changes
    * 9.1.0613: tests: termdebug test may fail and leave file around
    Update base-syntax, improve :set highlighting
    Optionally highlight the :: token for method references
    * 9.1.0612: filetype: deno.lock file not recognized
    Use delete() for deleting directory
    escape filename before trying to delete it
    * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys
    correctly extract file from zip browser
    * 9.1.0610: filetype: OpenGL Shading Language files are not detected
    Fix endless recursion in netrw#Explore()
    * 9.1.0609: outdated comments in Makefile
    update syntax script
    Fix flow mapping key detection
    Remove orphaned YAML syntax dump files
    * 9.1.0608: Coverity warns about a few potential issues
    Update syntax script and remove syn sync
    * 9.1.0607: termdebug: uses inconsistent style
    * 9.1.0606: tests: generated files may cause failure in test_codestyle
    * 9.1.0605: internal error with fuzzy completion
    * 9.1.0604: popup_filter during Press Enter prompt seems to hang
    translation: Update Serbian messages translation
    * 9.1.0603: filetype: use correct extension for Dracula
    * 9.1.0602: filetype: Prolog detection can be improved
    fix more inconsistencies in assert function docs
    * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit
    Update base-syntax, improve :map highlighting
    * 9.1.0600: Unused function and unused error constants
    * 9.1.0599: Termdebug: still get E1023 when specifying arguments
    correct wrong comment options
    fix typo "a xterm" -> "an xterm"
    * 9.1.0598: fuzzy completion does not work with default completion
    * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key
    * 9.1.0596: filetype: devscripts config files are not recognized
    gdb file/folder check is now performed only in CWD.
    quote filename arguments using double quotes
    update syntax to SDC-standard 2.1
    minor updates.
    Cleanup :match and :loadkeymap syntax test files
    Update base-syntax, match types in Vim9 variable declarations
    * 9.1.0595: make errors out with the po Makefile
    * 9.1.0594: Unnecessary redraw when setting 'winfixbuf'
    using wrong highlight for UTF-8
    include simple syntax plugin
    * 9.1.0593: filetype: Asymptote files are not recognized
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    * 9.1.0592: filetype: Mediawiki files are not recognized
    * 9.1.0591: filetype: *.wl files are not recognized
    * 9.1.0590: Vim9: crash when accessing getregionpos() return value
    'cpoptions': Include "z" in the documented default
    * 9.1.0589: vi: d{motion} and cw work differently than expected
    update included colorschemes
    grammar fixes in options.txt
  - Add "Keywords" to gvim.desktop to make searching for gvim easier
  - Removed patches, as they're no longer required (refreshing them
    deleted their contents):
    * vim-7.3-help_tags.patch
    * vim-7.4-highlight_fstab.patch
  - Reorganise all applied patches in the spec file.
  - Update to 9.1.0588:
    * 9.1.0588: The maze program no longer compiles on newer clang
    runtime(typst): Add typst runtime files
    * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky
    * 9.1.0586: ocaml runtime files are outdated
    runtime(termdebug): fix a few issues
    * 9.1.0585: tests: test_cpoptions leaves swapfiles around
    * 9.1.0584: Warning about redeclaring f_id() non-static
    runtime(doc): Add hint how to load termdebug from vimrc
    runtime(doc): document global insert behavior
    * 9.1.0583: filetype: *.pdf_tex files are not recognized
    * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode
    * 9.1.0581: Various lines are indented inconsistently
    * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode
    * 9.1.0579: Ex command is still executed after giving E1247
    * 9.1.0578: no tests for :Tohtml
    * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim
    * 9.1.0576: tests: still an issue with test_gettext_make
    * 9.1.0575: Wrong comments in alt_tabpage()
    * 9.1.0574: ex: wrong handling of commands after bar
    runtime(doc): add a note for netrw bug reports
    * 9.1.0573: ex: no implicit print for single addresses
    runtime(vim): make &indentexpr available from the outside
    * 9.1.0572: cannot specify tab page closing behaviour
    runtime(doc): remove obsolete Ex insert behavior
    * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky
    runtime(logindefs): update syntax with new keywords
    * 9.1.0570: tests: test_gettext_make can be improved
    runtime(filetype): Fix Prolog file detection regex
    * 9.1.0569: fnamemodify() treats ".." and "../" differently
    runtime(mojo): include mojo ftplugin and indent script
    * 9.1.0568: Cannot expand paths from 'cdpath' setting
    * 9.1.0567: Cannot use relative paths as findfile() stop directories
    * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash
    * 9.1.0565: Stop directory doesn't work properly in 'tags'
    * 9.1.0564: id() can be faster
    * 9.1.0563: Cannot process any Key event
    * 9.1.0562: tests: inconsistency in test_findfile.vim
    runtime(fstab): Add missing keywords to fstab syntax
    * 9.1.0561: netbeans: variable used un-initialized (Coverity)
    * 9.1.0560: bindtextdomain() does not indicate an error
    * 9.1.0559: translation of vim scripts can be improved
    * 9.1.0558: filetype: prolog detection can be improved
    * 9.1.0557: moving in the buffer list doesn't work as documented
    runtime(doc): fix inconsistencies in :h file-searching
    * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages
    runtime(htmlangular): correct comment
    * 9.1.0555: filetype: angular ft detection is still problematic
    * 9.1.0554: :bw leaves jumplist and tagstack data around
    * 9.1.0553: filetype: *.mcmeta files are not recognized
    * 9.1.0552: No test for antlr4 filetype
    * 9.1.0551: filetype: htmlangular files are not properly detected
    * 9.1.0550: filetype: antlr4 files are not recognized
    * 9.1.0549: fuzzycollect regex based completion not working as expected
    runtime(doc): autocmd_add() accepts a list not a dict
    * 9.1.0548: it's not possible to get a unique id for some vars
    runtime(tmux): Update syntax script
    * 9.1.0547: No way to get the arity of a Vim function
    * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A
    runtime(hlsplaylist): include hlsplaylist ftplugin file
    runtime(doc): fix typo in :h ft-csv-syntax
    runtime(doc): Correct shell command to get $VIMRUNTIME into
    shell
    * 9.1.0545: MSVC conversion warning
    * 9.1.0544: filetype: ldapconf files are not recognized
    runtime(cmakecache): include cmakecache ftplugin file
    runtime(lex): include lex ftplugin file
    runtime(yacc): include yacc ftplugin file
    runtime(squirrel): include squirrel ftplugin file
    runtime(objcpp): include objcpp ftplugin file
    runtime(tf): include tf ftplugin file
    runtime(mysql): include mysql ftplugin file
    runtime(javacc): include javacc ftplugin file
    runtime(cabal): include cabal ftplugin file
    runtime(cuda): include CUDA ftplugin file
    runtime(editorconfig): include editorconfig ftplugin file
    runtime(kivy): update kivy syntax, include ftplugin
    runtime(syntax-tests): Stop generating redundant "*_* 99.dump"
    files
    * 9.1.0543: Behavior of CursorMovedC is strange
    runtime(vim): Update base-syntax, improve :match command
    highlighting
    * 9.1.0542: Vim9: confusing string() output for object functions
    * 9.1.0541: failing test with Vim configured without channel
    * 9.1.0540: Unused assignment in sign_define_cmd()
    runtime(doc): add page-scrolling keys to index.txt
    runtime(doc): add reference to xterm-focus-event from
    FocusGained/Lost
    * 9.1.0539: Not enough tests for what v9.1.0535 fixed
    runtime(doc): clarify how to re-init csv syntax file
    * 9.1.0538: not possible to assign priority when defining a sign
    * 9.1.0537: signed number detection for CTRL-X/A can be improved
    * 9.1.0536: filetype: zone files are not recognized
    * 9.1.0535: newline escape wrong in ex mode
    runtime(man): honor cmd modifiers before `g:ft_man_open_mode`
    runtime(man): use `nnoremap` to map to Ex commands
    * 9.1.0534: completion wrong with fuzzy when cycling back to original
    runtime(syntax-tests): Abort and report failed cursor progress
    runtime(syntax-tests): Introduce self tests for screen dumping
    runtime(syntax-tests): Clear and redraw the ruler line with
    the shell info
    runtime(syntax-tests): Allow for folded and wrapped lines in
    syntax test files
    * 9.1.0533: Vim9: need more tests for nested objects equality
    CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries
    runtime(doc): Remove wrong help tag CTRL-SHIFT-CR
    * 9.1.0532: filetype: Cedar files not recognized
    runtime(doc): document further keys that scroll page up/down
    * 9.1.0531: resource leak in mch_get_random()
    runtime(tutor): Fix wrong spanish translation
    runtime(netrw): fix remaining case of register clobber
    * 9.1.0530: xxd: MSVC warning about non-ASCII character
    * 9.1.0529: silent! causes following try/catch to not work
    runtime(rust): use shiftwidth() in indent script
    * 9.1.0528: spell completion message still wrong in translations
    * 9.1.0527: inconsistent parameter in Makefiles for Vim executable
    * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer
    runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config
    * 9.1.0525: Right release selects immediately when pum is truncated.
    * 9.1.0524: the recursive parameter in the *_equal functions can be removed
    runtime(termdebug): Add Deprecation warnings
    * 9.1.0523: Vim9: cannot downcast an object
    * 9.1.0522: Vim9: string(object) hangs for recursive references
    * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13
    * 9.1.0520: Vim9: incorrect type checking for modifying lists
    runtime(manpager): avoid readonly prompt
    * 9.1.0519: MS-Windows: libvterm compilation can be optimized
    * 9.1.0518: initialize the random buffer can be improved
    * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak
    runtime(terraform): Add filetype plugin for terraform
    runtime(dockerfile): enable spellchecking of comments in
    syntax script
    runtime(doc): rename variable for pandoc markdown support
    runtime(doc): In builtin overview use {buf} as param for
    appendbufline/setbufline
    runtime(doc): clarify, that register 1-* 9 will always be shifted
    runtime(netrw): save and restore register 0-* 9, a and unnamed
    runtime(termdebug): Refactored StartDebug_term and EndDebug
    functions
    runtime(java): Compose "g:java_highlight_signature" and
    "g:java_highlight_functions"
    * 9.1.0516: need more tests for nested dicts and list comparision
    * 9.1.0515: Vim9: segfault in object_equal()
    * 9.1.0514: Vim9: issue with comparing objects recursively
    runtime(termdebug): Change some variables to Enums
    runtime(vim): Update base-syntax, fix function tail comments
    * 9.1.0513: Vim9: segfault with object comparison
  - Update to 9.1.0512:
    * Mode message for spell completion doesn't match allowed keys
    * CursorMovedC triggered wrongly with setcmdpos()
    * update runtime files
    * CI: test_gettext fails on MacOS14 + MSVC Win
    * not possible to translate Vim script messages
    * termdebug plugin can be further improved
    * add gomod filetype plugin
    * hard to detect cursor movement in the command line
    * Optionally highlight parameterised types
    * filetype: .envrc & .prettierignore not recognized
    * filetype: Faust files are not recognized
    * inner-tag textobject confused about ">" in attributes
    * cannot use fuzzy keyword completion
    * Remove the group exclusion list from @javaTop
    * wrong return type for execute() function
    * MS-Windows: too much legacy code
    * too complicated mapping restore in termdebug
    * simplify mapping
    * cannot switch buffer in a popup
    * MS-Windows: doesn't handle symlinks properly
    * getcmdcompltype() interferes with cmdline completion
    * termdebug can be further improved
    * update htmldjango detection
    * Improve Turkish documentation
    * include a simple csv filetype and syntax plugin
    * include the the simple nohlsearch package
    * matched text is highlighted case-sensitively
    * Matched text isn't highlighted in cmdline pum
    * Fix typos in several documents
    * clarify when text properties are cleared
    * improve the vim-shebang example
    * revert unintended formatting changes for termdebug
    * Add a config variable for commonly used compiler options
    * Wrong matched text highlighted in pum with 'rightleft'
    * bump length of character references in syntax script
    * properly check mapping variables using null_dict
    * fix KdlIndent and kdlComment in indent script
    * Test for patch 9.1.0489 doesn't fail without the fix
    * Fold multi-line comments with the syntax kind of &fdm
    * using wrong type for PlaceSign()
    * filetype: Vim-script files not detected by shebang line
    * revert unintended change to zip#Write()
    * add another tag for vim-shebang feature
    * Cmdline pum doesn't work properly with 'rightleft'
    * minor style problems with patch 9.1.0487
    * default completion may break with fuzzy
    * Wrong padding for pum "kind" with 'rightleft'
    * Update base-syntax, match shebang lines
    * MS-Windows: handle files with spaces properly
    * Restore HTML syntax file tests
    * completed item not update on fuzzy completion
    * filetype: Snakemake files are not recognized
    * make TermDebugSendCommand() a global function again
    * close all buffers in the same way
    * Matched text shouldn't be highlighted in "kind" and "menu"
    * fix wrong helptag for :defer
    * Update base-syntax, match :sleep arg
    * include Georgian keymap
    * Sorting of completeopt+=fuzzy is not stable
    * correctly test for windows in NetrwGlob()
    * glob() on windows fails with [] in directory name
    * rewrite mkdir() doc and simplify {flags} meaning
    * glob() not sufficiently tested
    * update return type for job_info()
    * termdebug plugin needs more love
    * correct return types for job_start() and job_status()
    * Update base-syntax, match :catch and :throw args
    * Include element values in non-marker annotations
    * Vim9: term_getjob() throws an exception on error
    * fuzzy string matching executed when not needed
    * fuzzy_match_str_with_pos() does unnecessary list operations
    * restore description of "$" in col() and virtcol()
    * deduplicate getpos(), line(), col(), virtcol()
    * Update g:vimsyn_comment_strings dump file tests
    * Use string interpolation instead of string concat
    * potential deref of NULL pointer in fuzzy_match_str_with_pos
    * block_editing errors out when using <enter>
    * Update base-syntax, configurable comment string highlighting
    * fix typos in syntax.txt
    * Cannot see matched text in popup menu
    * Update base-syntax, match multiline continued comments
    * clarify documentation for "v" position at line()
    * cmod_split modifier is always reset in term_start()
    * remove line-continuation characters
    * use shiftwidth() instead of &tabstop in indent script
    * Remove orphaned screen dump files
    * include syntax, indent and ftplugin files
    * CI: Test_ColonEight() fails on github runners
    * add missing Enabled field in syntax script
    * basic svelte ftplugin file
    * term_start() does not clear vertical modifier
    * fix mousemodel restoration by comparing against null_string
    * Added definitions of Vim scripts and plugins
    * Exclude lambda expressions from _when_ _switch-case_ label clauses
    * Fix saved_mousemodel check
    * Inconsistencies between functions for option flags
    * Crash when using autocmd_get() after removing event inside autocmd
    * Fix small style issues
    * add return type info for Vim function descriptions
    * Update Italian Vim manpage
    * disable the q mapping
    * Change 'cms' for C++ to '// %s'
    * fix type mismatch error
    * Fix wrong email address
    * convert termdebug plugin to Vim9 script
  - Update to 9.1.0470:
    * tests Test_ColonEight_MultiByte() fails sporadically
    * Cannot have buffer-local value for 'completeopt'
    * GvimExt does not consult HKEY_CURRENT_USER
    * typos in some comments
    * runtime(vim): Update base-syntax, allow whitespace before
    :substitute pattern
    * Missing comments for fuzzy completion
    * runtime(man): update Vim manpage
    * runtime(comment): clarify the usage of 'commentstring' option
    value
    * runtime(doc): clarify how fuzzy 'completeopt' should work
    * runtime(netrw): prevent accidental data loss
    * missing filecopy() function
    * no whitespace padding in commentstring option in ftplugins
    * no fuzzy-matching support for insert-completion
    * eval5() and eval7 are too complex
    * too many strlen() calls in drawline.c
    * filetype lintstagedrc files are not recognized
    * Vim9 import autoload does not work with symlink
    * Coverity complains about division by zero
    * tests test_gui fails on Wayland
    * Left shift is incorrect with vartabstop and shiftwidth=0
    * runtime(doc): clarify 'shortmess' flag "S"
    * MS-Windows compiler warning for size_t to int conversion
    * runtime(doc): include some vim9 script examples in the help
    * minor issues in test_filetype with rasi test
    * filetype rasi files are not recognized
    * runtime(java): Improve the matching of lambda expressions
    * Configure checks for libelf unnecessarily
    * No test for escaping '<' with shellescape()
    * check.vim complains about overlong comment lines
    * translation(it): Update Italian translation
    * evalc. code too complex
    * MS-Windows Compiler warnings
  - Update to 9.1.0448:
    * compiler warning in eval.c
    * remove remaining css code
    * Add ft_hare.txt to Reference Manual TOC
    * re-generate vim syntax from generator
    * fix syntax vim bug
    * completion may be wrong when deleting all chars
    * getregionpos() inconsistent for partly-selected multibyte char
    * fix highlighting nested and escaped quotes in string props
    * remove the indent plugin since it has too many issues
    * update Debian runtime files
    * Coverity warning after 9.1.0440
    * Not enough tests for getregion() with multibyte chars
    * Can't use blockwise selection with width for getregion()
    * update outdated syntax files
    * fix floating_modifier highlight
    * hare runtime files outdated
    * getregionpos() can't properly indicate positions beyond eol
    * function get_lval() is too long
    * Cannot filter the history
    * Wrong Ex command executed when :g uses '?' as delimiter
    * support floating_modifier none; revert broken highlighting
    * Motif requires non-const char pointer for XPM  data
    * Crash when using '?' as separator for :s
    * filetype: cygport files are not recognized
    * make errors trying to access autoload/zig
    * Wrong yanking with exclusive selection and ve=all
    * add missing help tags file
    * Ancient XPM preprocessor hack may cause build errors
    * include basic rescript ftplugin file
    * eval.c is too long
    * getregionpos() doesn't handle one char selection
    * check for gdb file/dir before using as buffer name
    * refactor zig ftplugin, remove auto format
    * Coverity complains about eval.c refactor
    * Tag guessing leaves wrong search history with very short names
    * some issues with termdebug mapping test
    * update matchit plugin to v1.20
    * too many strlen() calls in search.c
    * set commentstring option
    * update vb indent plugin as vim9script
    * filetype: purescript files are not recognized
    * filetype: slint files are not recognized
    * basic nim ftplugin file for comments
    * Add Arduino ftplugin and indent files
    * include basic typst ftplugin file
    * include basic prisma ftplugin file
    * include basic v ftplugin for comment support
    * getregionpos() wrong with blockwise mode and multibyte
    * function echo_string_core() is too long
    * hyprlang files are not recognized
    * add basic dart ftplugin file
    * basic ftplugin file for graphql
    * mention comment plugin at :h 'commentstring'
    * set commentstring for sql files in ftplugin
    * :browse oldfiles prompts even with single entry
    * eval.c not sufficiently tested
    * clarify why E195 is returned
    * clarify temporary file clean up
    * fix :NoMatchParen not working
    * Cannot move to previous/next rare word
    * add basic ftplugin file for sshdconfig
    * if_py: find_module has been removed in Python 3.12.0a7
    * some screen dump tests can be improved
    * Some functions are not tested
    * clarify instal instructions for comment package
    * Unable to leave long line with 'smoothscroll' and 'scrolloff'
    * fix typo in vim9script help file
    * Remove trailing spaces
    * clarify {special} argument for shellescape()
  - update to 9.1.0413
    * smoothscroll may cause infinite loop
    * add missing entries for the keys CTRL-W g<Tab> and <C-Tab>
    * update vi_diff.txt: add default value for 'flash'
    * typo in regexp_bt.c in DEBUG code
    * allow indented commands
    * Fix wrong define regex in ftplugin
    * Filter out non-Latin-1 characters for syntax tests
    * prefer scp over pscp
    * fix typo in usr_52.txt
    * too long functions in eval.c
    * warning about uninitialized variable
    * too many strlen() calls in the regexp engine
    * E16 fix, async keyword support for define
    * Stuck with long line and half-page scrolling
    * Divide by zero with getmousepos() and 'smoothscroll'
    * update and remove  some invalid links
    * update translation of xxd manpage
    * Recursively delete directories by default with netrw delete command
    * Strive to remain compatible for at least Vim 7.0
    * tests: xxd buffer overflow fails on 32-bit
    * Stop handpicking syntax groups for @javaTop
    * [security] xxd: buffer-overflow with specific flags
    * Vim9: not able to import file from start dir
    * filetype: mdd files detected as zsh filetype
    * filetype: zsh module files are not recognized
    * Remove hardcoded private.ppk logic from netrw
    * Vim9: confusing error message for unknown type
    * block_editing errors out when using del
    * add new items to scripts section in syntax plugin
    * Vim9: imported vars are not properly type checked
    * Wrong display with 'smoothscroll' when changing quickfix list
    * filetype: jj files are not recognized
    * getregionpos() may leak memory on error
    * The CODEOWNERS File is not useful
    * Remove and cleanup Win9x legacy from netrw
    * add MsgArea to 'highlight' option description
    * Cannot get a list of positions describing a region
    * Fix digit separator in syntax script for octals and floats
    * Update link to Wikipedia Vi page
    * clear $MANPAGER in ftplugin before shelling out
    * Fix typos in help documents
    * 'viewdir' not respecting $XDG_CONFIG_HOME
    * tests: Vim9 debug tests may be flaky
    * correct getscriptinfo() example
    * Vim9: could improve testing
    * test_sound fails on macos-12
    * update Serbian menu
    * update Slovak menu
    * update Slovenian menu
    * update Portuguese menu
    * update Dutch menu
    * update Korean menu
    * update Icelandic menu
    * update Czech menu
    * update Afrikaans menu
    * update German menu
    * filetype: inko files are not recognized
    * filetype: templ files are not recognized
    * cursor() and getregion() don't handle v:maxcol well
    * Vim9: null value tests not sufficient
    * update Catalan menu
    * filetype: stylus files not recognized
    * update spanish menu localization
    * regenerate helptags
    * Vim9: crash with null_class and null_object
    * Add tags about lazyloading of menu
    * tests: vt420 terminfo entry may not be found
    * filetype: .out files recognized as tex files
    * filetype: Kbuild files are not recognized
    * cbuffer and similar commands don't accept a range
    * Improve the recognition of the "indent" method declarations
    * Fix a typo in usr_30.txt
    * remove undefined var s:save_cpoptions and add include setting
    * missing setlocal in indent plugin
    * Calculating line height for unnecessary amount of lines
    * improve syntax file performance
    * There are a few typos
    * Vim9: no comments allowed after class vars
    * CI: remove trailing white space in documentation
    * Formatting text wrong when 'breakindent' is set
    * Add oracular (24.10) as Ubuntu release name
    * Vim9: Trailing commands after class/enum keywords ignored
    * tests: 1-second delay after Test_BufEnter_botline()
    * update helptags for jq syntax
    * include syntax, ftplugin and compiler plugin
    * fix typo synconcealend -> synconcealed
    * include a simple comment toggling plugin
    * wrong botline in BufEnter
    * clarify syntax vs matching mechanism
    * fix undefined variable in indent plugin
    * ops.c code uses too many strlen() calls
    * Calling CLEAR_FIELD() on the same struct twice
    * Vim9: compile_def_function() still too long
    * Update Serbian messages
    * clarify the effect of setting the shell to powershell
    * Improve the recognition of the "style" method declarations
    * Vim9: problem when importing autoloaded scripts
    * compile_def_function is too long
    * filetype: ondir files are not recognized
    * Crash when typing many keys with D- modifier
    * tests: test_vim9_builtin is a bit slow
    * update documentation
    * change the download URL of "libsodium"
    * tests: test_winfixbuf is a bit slow
    * Add filetype, syntax and indent plugin for Astro
    * expanding rc config files does not work well
    * Vim9: vim9type.c is too complicated
    * Vim9: does not handle autoloaded variables well
    * minor spell fix in starting.txt
    * wrong drawing in GUI with setcellwidth()
    * Add include and suffixesadd
    * Page scrolling should place cursor at window boundaries
    * align command line table
    * minor fixes to starting.txt
    * fix comment definition in filetype plugin
    * filetype: flake.lock files are not recognized
    * runtime(uci): No support for uci file types
    * Support "g:ftplugin_java_source_path" with archived files
    * tests: Test_autoload_import_relative_compiled fails on Windows
    * Finding cmd modifiers and cmdline-specials is inefficient
    * No test that completing a partial mapping clears 'showcmd'
    * tests: test_vim9_dissamble may fail
    * Vim9: need static type for typealias
    * X11 does not ignore smooth scroll event
    * A few typos in test_xdg when testing gvimrc
    * Patch v9.1.0338 fixed sourcing a script with import
    * Problem: gvimrc not sourced from XDG_CONFIG_HOME
    * Cursor wrong after using setcellwidth() in terminal
    * 'showcmd' wrong for partial mapping with multibyte
    * tests: test_taglist fails when 'helplang' contains non-english
    * Problem: a few memory leaks are found
    * Problem: Error with matchaddpos() and empty list
    * tests: xdg test uses screen dumps
    * Vim9: import through symlinks not correctly handled
    * Missing entry for XDG vimrc file in :version
    * tests: typo in test_xdg
    * runtime(i3config/swayconfig): update syntax scripts
    * document pandoc compiler and enable configuring arguments
    * String interpolation fails for List type
    * No test for highlight behavior with 'ambiwidth'
    * tests: test_xdg fails on the appimage repo
    * tests: some assert_equal() calls have wrong order of args
    * make install does not install all files
    * runtime(doc): fix typos in starting.txt
  - Updated to version 9.1 with patch level 0330, fixes the following problems
    * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1
  - refreshed vim-7.3-filetype_spec.patch
  - refreshed vim-7.3-filetype_ftl.patch
  - Update spec.skeleton to use autosetup in place of setup macro.
  - for the complete list of changes see
    https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330

++++ vim:

  - Fix for bsc#1231373 / CVE-2024-47814.
  - Fix for bsc#1229238 / CVE-2024-43374.
  - update to 9.1.0836
    * 9.1.0836: The vimtutor can be improved
    * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu'
    * 9.1.0834: tests: 2html test fails
    * 9.1.0833: CI: recent ASAN changes do not work for indent tests
    * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal
    * runtime(doc): update help-toc description
    * runtime(2html): Make links use color scheme colors in TOhtml
    * 9.1.0831: 'findexpr' can't be used as lambad or Funcref
    * Filelist: include helptoc package
    * runtime(doc): include a TOC Vim9 plugin
    * Filelist: ignore .git-blame-ignore-revs
    * 9.1.0830: using wrong highlight group for spaces for popupmenu
    * runtime(typst): synchronize updates from the upstream typst.vim
    * git: ignore reformatting commit for git-blame (after v9.1.0829)
    * 9.1.0829: Vim source code uses a mix of tabs and spaces
    * 9.1.0828: string_T struct could be used more often
    * 9.1.0827: CI: tests can be improved
    * runtime(doc): remove stray sentence in pi_netrw.txt
    * 9.1.0826: filetype: sway files are not recognized
    * runtime(doc): Include netrw-gp in TOC
    * runtime(doc): mention 'iskeyword' at :h charclass()
    * runtime(doc): update help tags
    * 9.1.0825: compile error for non-diff builds
    * runtime(netrw): fix E874 when browsing remote directory which contains `~` character
    * runtime(doc): update coding style documentation
    * runtime(debversions): Add plucky (25.04) as Ubuntu release name
    * 9.1.0824: too many strlen() calls in register.c
    * 9.1.0823: filetype: Zephyr overlay files not recognized
    * runtime(doc): Clean up minor formatting issues for builtin functions
    * runtime(netrw): make :Launch/Open autoloadable
    * runtime(netrw): fix regression with x mapping on Cygwin
    * runtime(netrw): fix filetype detection for remote files
    * 9.1.0822: topline might be changed in diff mode unexpectedly
    * CI: huge linux builds should also run syntax & indent tests
    * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument
    * 9.1.0820: tests: Mac OS tests are too flaky
    * runtime(awk): Highlight more awk comments in syntax script
    * runtime(netrw): add missing change for s:redir()
    * 9.1.0819: tests: using findexpr and imported func not tested
    * runtime(netrw): improve netrw's open-handling further
    * runtime(netrw): fix syntax error in netrwPlugin.vim
    * runtime(netrw): simplify gx file handling
    * 9.1.0818: some global functions are only used in single files
    * 9.1.0817: termdebug: cannot evaluate expr in a popup
    * runtime(defaults): Detect putty terminal and switch to dark background
    * 9.1.0816: tests: not clear what tests cause asan failures
    * runtime(doc): Remove some completed items from todo.txt
    * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position
    * runtime(syntax-tests): tiny vim fails because of line-continuation
    * 9.1.0814: mapset() may remove unrelated mapping
    * 9.1.0813: no error handling with setglobal and number types
    * 9.1.0812: Coverity warns about dereferencing NULL ptr
    * 9.1.0811: :find expansion does not consider 'findexpr'
    * 9.1.0810: cannot easily adjust the |:find| command
    * 9.1.0809: filetype: petalinux config files not recognized
    * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll'
    * 9.1.0807: tests: having 'nolist' in modelines isn't always desired
    * 9.1.0806: tests: no error check when setting global 'briopt'
    * 9.1.0805: tests: minor issues in gen_opt_test.vim
    * 9.1.0804: tests: no error check when setting global 'cc'
    * 9.1.0803: tests: no error check when setting global 'isk'
    * 9.1.0802: tests: no error check when setting global 'fdm' to empty value
    * 9.1.0801: tests: no error check when setting global 'termwinkey'
    * 9.1.0800: tests: no error check when setting global 'termwinsize'
    * runtime(doc): :ownsyntax also resets 'spelloptions'
    * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive
    * runtime(doc): Fix wrong Mac default options
    * 9.1.0798: too many strlen() calls in cmdhist.c
    * 9.1.0797: testing of options can be further improved
    * 9.1.0796: filetype: libtool files are not recognized
    * (typst): add folding to typst ftplugin
    * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke()
    * 9.1.0795: filetype: Vivado memory info file are not recognized
    * 9.1.0794: tests: tests may fail on Windows environment
    * runtime(doc): improve the :colorscheme documentation
    * 9.1.0793: xxd: -e does add one extra space
    * 9.1.0792: tests: Test_set_values() is not comprehensive enough
    * runtime(swayconfig): add flag for bindsym/bindcode to syntax script
    * 9.1.0791: tests: errors in gen_opt_test.vim are not shown
    * runtime(compiler): check for compile_commands in build dirs for cppcheck
    * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib)
    * runtime(help): Update help syntax
    * runtime(help): fix end of sentence highlight in code examples
    * runtime(jinja): Support jinja syntax as secondary filetype
    * 9.1.0789: tests: ':resize + 5' has invalid space after '+'
    * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot
    * 9.1.0787: cursor position changed when using hidden terminal
    * 9.1.0786: tests: quickfix update test does not test location list
    * runtime(doc): add some docs for file-watcher programs
    * CI: uploading failed screendumps still fails on Cirrus CI
    * 9.1.0785: cannot preserve error position when setting quickfix list
    * 9.1.0784: there are several problems with python 3.13
    * 9.1.0783: 'spell' option setting has problems
    * 9.1.0782: tests: using wrong neomuttlog file name
    * runtime(doc): add preview flag to statusline example
    * 9.1.0781: tests: test_filetype fails
    * 9.1.0780: MS-Windows: incorrect Win32 error checking
    * 9.1.0779: filetype: neomuttlog files are not recognized
    * 9.1.0778: filetype: lf config files are not recognized
    * runtime(comment): fix commment toggle with mixed tabs & spaces
    * runtime(misc): Use consistent "Vim script" spelling
    * runtime(gleam): add ftplugin for gleam files
    * runtime(doc): link help-writing from write-local-help
    * 9.1.0777: filetype: Some upstream php files are not recognized
    * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups
    * runtime(doc): mention conversion rules for remote_expr()
    * runtime(tutor): Fix missing :s command in spanish translation section 4.4
    * 9.1.0776: test_strftime may fail because of missing TZ data
    * translation(am): Add Armenian language translation
    * 9.1.0775: tests: not enough tests for setting options
    * 9.1.0774: "shellcmdline" doesn't work with getcompletion()
    * 9.1.0773: filetype: some Apache files are not recognized
    * 9.1.0772: some missing changes from v9.1.0771
    * 9.1.0771: completion attribute hl_group is confusing
    * 9.1.0770: current command line completion is a bit limited
    * 9.1.0769: filetype: MLIR files are not recognized
    * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen
    * runtime(nasm): Update nasm syntax script
    * 9.1.0767: A condition is always true in ex_getln.c
    * runtime(skill): Update syntax file to fix string escapes
    * runtime(help): highlight CTRL-<Key> correctly
    * runtime(doc): add missing usr_52 entry to toc
    * 9.1.0766: too many strlen() calls in ex_getln.c
    * runtime(doc): correct `vi` registers 1-9 documentation error
    * 9.1.0765: No test for patches 6.2.418 and 7.3.489
    * runtime(spec): set comments and commentstring options
    * NSIS: Include libgcc_s_sjlj-1.dll again
    * runtime(doc): clarify the effect of 'startofline' option
    * 9.1.0764: [security]: use-after-free when closing a buffer
    * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting
    * 9.1.0763: tests: cannot run single syntax tests
    * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly
    * 9.1.0761: :cd completion fails on Windows with backslash in path
    * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails
    * 9.1.0759: screenpos() may return invalid position
    * runtime(misc): unset compiler in various ftplugins
    * runtime(doc): update formatting and syntax
    * runtime(compiler): add cppcheck linter compiler plugin
    * runtime(doc): Fix style in documents
    * runtime(doc): Fix to two-space convention in user manual
    * runtime(comment): consider &tabstop in lines after whitespace indent
    * 9.1.0758: it's possible to set an invalid key to 'wildcharm'
    * runtime(java): Manage circularity for every :syn-included syntax file
    * 9.1.0757: tests: messages files contains ANSI escape sequences
    * 9.1.0756: missing change from patch v9.1.0754
    * 9.1.0755: quickfix list does not handle hardlinks well
    * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters
    * runtime(systemd): small fixes to &keywordprg in ftplugin
    * CI: macos-12 runner is being sunset, switch to 13
    * 9.1.0754: fixed order of items in insert-mode completion menu
    * runtime(comment): commenting might be off by one column
    * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll'
    * 9.1.0752: can set 'cedit' to an invalid value
    * runtime(doc): add `usr` tag to usr_toc.txt
    * 9.1.0751: Error callback for term_start() not used
    * 9.1.0750: there are some Win9x legacy references
    * runtime(java): Recognise the CommonMark form (///) of Javadoc comments
    * 9.1.0749: filetype: http files not recognized
    * runtime(comment): fix syntax error
    * CI: uploading failed screendump tests does not work Cirrus
    * 9.1.0748: :keep* commmands are sometimes misidentified as :k
    * runtime(indent): allow matching negative numbers for gnu indent config file
    * runtime(comment): add gC mapping to (un)comment rest of line
    * 9.1.0747: various typos in repo found
    * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals
    * runtime(doc): reformat gnat example
    * runtime(doc): reformat ada_standard_types section
    * 9.1.0745: filetype: bun and deno history files not recognized
    * runtime(glvs): Correct the tag name of glvs-autoinstal
    * runtime(doc): include short form for :earlier/:later
    * runtime(doc): remove completed TODO
    * 9.1.0744: filetype: notmuch configs are not recognised
    * 9.1.0743: diff mode does not handle overlapping diffs correctly
    * runtime(glvs): fix a few issues
    * runtime(doc): Fix typo in :help :command-modifiers
    * 9.1.0742: getcmdprompt() implementation can be improved
    * runtime(docs): update `:set?` command behavior table
    * runtime(doc): update vim90 to vim91 in docs
    * runtime(doc): fix typo in :h dos-colors
    * 9.1.0741: No way to get prompt for input()/confirm()
    * runtime(doc): fix typo in version9.txt nrformat -> nrformats
    * runtime(rmd,rrst): 'fex' option not properly restored
    * runtime(netrw): remove extraneous closing bracket
    * 9.1.0740: incorrect internal diff with empty file
    * 9.1.0739: [security]: use-after-free in ex_getln.c
    * runtime(filetype): tests: Test_filetype_detection() fails
    * runtime(dist): do not output a message if executable is not found
    * 9.1.0738: filetype: rapid files are not recognized
    * runtime(modconf): remove erroneous :endif in ftplugin
    * runtime(lyrics): support multiple timestamps in syntax script
    * runtime(java): Optionally recognise _module_ import declarations
    * runtime(vim): Update base-syntax, improve folding function matches
    * CI: upload failed screendump tests also for Cirrus
    * 9.1.0737: tests: screendump tests may require a bit more time
    * runtime(misc): simplify keywordprg in various ftplugins
    * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels
    * runtime(zsh,sh): set and unset compiler in ftplugin
    * runtime(netrw): using inefficient highlight pattern for 'mf'
    * 9.1.0736: Unicode tables are outdated
    * 9.1.0735: filetype: salt files are not recognized
    * 9.1.0734: filetype: jinja files are not recognized
    * runtime(zathurarc): add double-click-follow to syntax script
    * translation(ru): Updated messages translation
    * translation(it): updated xxd man page
    * translation(ru): updated xxd man page
    * 9.1.0733: keyword completion does not work with fuzzy
    * 9.1.0732: xxd: cannot use -b and -i together
    * runtime(java): Highlight javaConceptKind modifiers with StorageClass
    * runtime(doc): reword and reformat how to use defaults.vim
    * 9.1.0731: inconsistent case sensitive extension matching
    * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return
    * runtime(netrw): delete confirmation not strict enough
    * 9.1.0730: Crash with cursor-screenline and narrow window
    * 9.1.0729: Wrong cursor-screenline when resizing window
    * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
    * runtime(doc): clarify the effect of the timeout for search()-functions
    * runtime(idlang): update syntax script
    * runtime(spec): Recognize epoch when making spec changelog in ftplugin
    * runtime(spec): add file triggers to syntax script
    * 9.1.0727: too many strlen() calls in option.c
    * runtime(make): add compiler/make.vim to reset compiler plugin settings
    * runtime(java): Recognise all available standard doclet tags
    * 9.1.0726: not using correct python3 API with dynamic linking
    * runtime(dosini): Update syntax script, spellcheck comments only
    * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation
    * 9.1.0725: filetype: swiftinterface files are not recognized
    * runtime(pandoc): Update compiler plugin to use actual 'spelllang'
    * runtime(groff): Add compiler plugin for groff
    * 9.1.0724: if_python: link error with python 3.13 and stable ABI
    * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13
    * 9.1.0722: crash with large id in text_prop interface
    * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME
    * runtime(glvs): update GetLatestVimScripts plugin
    * runtime(doc): Fix typo in :help :hide text
    * runtime(doc): buffers can be re-used
    * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs
    * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid
    * runtime(doc): Update version9.txt and mention $MYVIMDIR
  - Update to 9.1.0718:
    * v9.1.0718: hard to know the users personal Vim Runtime Directory
    * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers()
    Maintainers: fix typo in author name
    * v9.1.0716: resetting setcellwidth( doesn't update the screen
    runtime(hcl,terraform): Add runtime files for HCL and Terraform
    runtime(tmux): Update syntax script
    * v9.1.0715: Not correctly parsing color names (after v9.1.0709)
    * v9.1.0714: GuiEnter_Turkish test may fail
    * v9.1.0713: Newline causes E749 in Ex mode
    * v9.1.0712: missing dependency of Test_gettext_makefile
    * v9.1.0711: test_xxd may file when using different xxd
    * v9.1.0710: popup window may hide part of Command line
    runtime(vim): Update syntax, improve user-command matching
    * v9.1.0709: GUIEnter event not found in Turkish locale
    runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items
    * v9.1.0708: Recursive window update does not account for reset skipcol
    runtime(nu): include filetype plugin
    * v9.1.0707: invalid cursor position may cause a crash
    * v9.1.0706: test_gettext fails when using shadow dir
    CI: Install locales-all package
    * v9.1.0705: Sorting of fuzzy filename completion is not stable
    translation(pt): update Portuguese/Brazilian menu translation
    runtime(vim): Update base-syntax, match bracket mark ranges
    runtime(doc): Update :help :command-complete list
    * v9.1.0704: inserting with a count is inefficient
    runtime(doc): use mkdir -p to save a command
    * v9.1.0703: crash with 2byte encoding and glob2regpat()
    runtime(hollywood): update syn highlight for If-Then statements
    and For-In-Loops
    * v9.1.0702: Patch 9.1.0700 broke CI
    * v9.1.0701: crash with NFA regex engine when searching for
    composing chars
    * v9.1.0700: crash with 2byte encoding and glob2regpat()
    * v9.1.0699: "dvgo" is not always an inclusive motion
    runtime(java): Provide support for syntax preview features
    * v9.1.0698: "Untitled" file not removed when running Test_crash1_3
    alone
    * v9.1.0697: heap-buffer-overflow in ins_typebuf
    * v9.1.0696: installing runtime files fails when using SHADOWDIR
    runtime(doc): fix typo
    * v9.1.0695: test_crash leaves Untitled file around
    translation(br): Update Brazilian translation
    translation(pt): Update menu_pt_br
    * v9.1.0694: matchparen is slow on a long line
    * v9.1.0693: Configure doesn't show result when not using python3
    stable abi
    * v9.1.0692: Wrong patlen value in ex_substitute()
    * v9.1.0691: stable-abi may cause segfault on Python 3.11
    runtime(vim): Update base-syntax, match :loadkeymap after colon and bar
    runtime(mane): Improve <Plug>ManBS mapping
    * v9.1.0690: cannot set special highlight kind in popupmenu
    translation(pt): Revert and fix wrong Portuguese menu translation
    files
    translation(pt): revert Portuguese menu translation
    translation(br): Update Brazilian translations
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    * v9.1.0689: buffer-overflow in do_search( with 'rightleft'
    runtime(vim): Improve heredoc handling for all embedded scripts
    * v9.1.0688: dereferences NULL pointer in check_type_is_value()
    * v9.1.0687: Makefile may not install desktop files
    runtime(man): Fix <Plug>ManBS
    runtime(java): Make the bundled &foldtext function optional
    runtime(netrw): Change line on `mx` if command output exists
    runtime(netrw): Fix `mf`-selected entry highlighting
    runtime(htmlangular): add html syntax highlighting
    translation(it): Fix filemode of Italian manpages
    runtime(doc): Update outdated man.vim plugin information
    runtime(zip): simplify condition to detect MS-Windows
    * v9.1.0686: zip-plugin has problems with special characters
    runtime(pandoc): escape quotes in &errorformat for pandoc
    translation(it): updated Italian manpage
    * v9.1.0685: too many strlen( calls in usercmd.c
    runtime(doc): fix grammar in :h :keeppatterns
    runtime(pandoc): refine pandoc compiler settings
    * v9.1.0684: completion is inserted on Enter with "noselect"
    translation(ru): update man pages
    * v9.1.0683: mode( returns wrong value with <Cmd> mapping
    runtime(doc): remove trailing whitespace in cmdline.txt
    * v9.1.0682: Segfault with uninitialized funcref
    * v9.1.0681: Analyzing failed screendumps is hard
    runtime(doc): more clarification for the :keeppatterns needed
    * v9.1.0680: VMS does not have defined uintptr_t
    runtime(doc): improve typedchar documentation for KeyInputPre autocmd
    runtime(dist): verify that executable is in $PATH
    translation(it): update Italian manpages
    runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677
    runtime(doc): update Makefile and make it portable between GNU and BSD
    * v9.1.0679: Rename from w_closing to w_locked is incomplete
    runtime(colors): update colorschemes
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    runtime(doc): Updating the examples in the xxd manpage
    translation(ru): Updated uganda.rux
    runtime(yaml): do not re-indent when commenting out lines
    * v9.1.0678: use-after-free in alist_add()
    * v9.1.0677 :keepp does not retain the substitute pattern
    translation(ja): Update Japanese translations to latest release
    runtime(netrw): Drop committed trace lines
    runtime(netrw): Error popup not always used
    runtime(netrw): ErrorMsg( may throw E121
    runtime(tutor): update Makefile and make it portable between GNU and BSD
    translation: improve the po/cleanup.vim script
    runtime(lang): update Makefile and make it portable between GNU and BSD
    * v9.1.0676: style issues with man pages
    * v9.1.0675: Patch v9.1.0674 causes problems
    runtime(dosbatch): Show %%i as an argument in syntax file
    runtime(dosbatch): Add syn-sync to syntax file
    runtime(sql, mysql): fix E169: Command too recursive with
    sql_type_default = "mysql"
    * v9.1.0674: compiling abstract method fails because of missing return
    runtime(javascript): fix a few issues with syntax higlighting
    runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var
    runtime(termdebug): Fix wrong test for balloon feature
    runtime(doc): Remove mentioning of the voting feature
    runtime(doc): add help tags for json + markdown global variables
    * v9.1.0673: too recursive func calls when calling super-class method
    runtime(syntax-tests): Facilitate the viewing of rendered screendumps
    runtime(doc): fix a few style issues
    * v9.1.0672: marker folds may get corrupted on undo
    * v9.1.0671 Problem:  crash with WinNewPre autocommand
    * v9.1.0670: po file encoding fails on *BSD during make
    translation(it): Update Italian translation
    translation: Stop using msgconv
    * v9.1.0669: stable python ABI not used by default
    Update .gitignore and .hgignore files
    * v9.1.0668: build-error with python3.12 and stable ABI
    translations: Update generated po files
    * v9.1.0667: Some other options reset curswant unnecessarily when set
    * v9.1.0666: assert_equal( doesn't show multibyte string correctly
    runtime(doc): clarify directory of Vim's executable vs CWD
    * v9.1.0665 :for loop
    runtime(proto): Add indent script for protobuf filetype
    * v9.1.0664: console vim did not switch back to main screen on exit
    runtime(zip): zip plugin does not work with Vim 9.0
    * v9.1.0663: zip test still resets 'shellslash' option
    runtime(zip): use defer to restore old settings
    runtime(zip): add a generic Message function
    runtime(zip): increment base version of zip plugin
    runtime(zip): raise minimum Vim version to * v9.0
    runtime(zip): refactor save and restore of options
    runtime(zip): remove test for fnameescape
    runtime(zip): use :echomsg instead of :echo
    runtime(zip): clean up and remove comments
    * v9.1.0662: filecopy( may return wrong value when readlink( fails
    * v9.1.0661: the zip plugin is not tested.
    runtime(zip): Fix for FreeBSD's unzip command
    runtime(doc): capitalize correctly
    * v9.1.0660: Shift-Insert does work on old conhost
    translation(it): update Italian manpage
    runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr
    runtime(zip): escape '[' on Unix as well
    * v9.1.0659: MSVC Makefile is a bit hard to read
    runtime(doc): fix typo in syntax.txt
    runtime(doc): -x is only available when compiled with crypt feature
    * v9.1.0658: Coverity warns about dereferencing NULL pointer.
    runtime(colors): update Todo highlight in habamax colorscheme
    * v9.1.0657: MSVC build time can be optimized
    * v9.1.0656: MSVC Makefile CPU handling can be improved
    * v9.1.0655: goaccess config file not recognized
    CI: update clang compiler to version 20
    runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore`
    * v9.1.0654: completion does not respect completeslash with fuzzy
    * v9.1.0653: Patch v9.1.0648 not completely right
    * v9.1.0652: too many strlen( calls in syntax.c
    * v9.1.0651 :append
    * v9.1.0650: Coverity warning in cstrncmp()
    * v9.1.0649: Wrong comment for "len" argument of call_simple_func()
    * v9.1.0648: [security] double-free in dialog_changed()
    * v9.1.0647: [security] use-after-free in tagstack_clear_entry
    runtime(doc): re-format tag example lines, mention ctags --list-kinds
    * v9.1.0646: imported function may not be found
    runtime(java): Document "g:java_space_errors" and "g:java_comment_strings"
    runtime(java): Cluster optional group definitions and their group links
    runtime(java): Tidy up the syntax file
    runtime(java): Tidy up the documentation for "ft-java-syntax"
    runtime(colors): update habamax scheme - tweak diff/search/todo colors
    runtime(nohlsearch): add missing loaded_hlsearch guard
    runtime(kivy): Updated maintainer info for syntax script
    Maintainers: Add maintainer for ondir ftplugin + syntax files
    runtime(netrw): removing trailing slash when copying files in same
    directory
    * v9.1.0645: wrong match when searching multi-byte char case-insensitive
    runtime(html): update syntax script to sync by 250 minlines by default
    * v9.1.0644: Unnecessary STRLEN( when applying mapping
    runtime(zip): Opening a remote zipfile don't work
    runtime(cuda): source c and cpp ftplugins
    * v9.1.0643: cursor may end up on invalid position
    * v9.1.0642: Check that mapping rhs starts with lhs fails if not
    simplified
    * v9.1.0641: OLE enabled in console version
    runtime(thrift): add ftplugin, indent and syntax scripts
    * v9.1.0640: Makefile can be improved
    * v9.1.0639: channel timeout may wrap around
    * v9.1.0638: E1510 may happen when formatting a message for smsg()
    * v9.1.0637: Style issues in MSVC Makefile
  - Update apparmor.vim to latest version (from AppArmor 4.0.2)
  - add support for "all" and "userns" rules, and new profile flags
  - Update to 9.1.0636:
    * 9.1.0636: filetype: ziggy files are not recognized
    * 9.1.0635: filetype: SuperHTML template files not recognized
    * 9.1.0634: Ctrl-P not working by default
    * 9.1.0633: Compilation warnings with `-Wunused-parameter`
    * 9.1.0632: MS-Windows: Compiler Warnings
    Add support for Files-Included in syntax script
    tweak documentation style a bit
    * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion
    * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme
    * 9.1.0629: Rename of pum hl_group is incomplete
    * 9.1.0628: MinGW: coverage files are not cleaned up
    * 9.1.0627: MinGW: build-error when COVERAGE is enabled
    * 9.1.0626: Vim9: need more tests with null objects
    include initial filetype plugin
    * 9.1.0625: tests: test output all translated messages for all translations
    * 9.1.0624: ex command modifiers not found
    * 9.1.0623: Mingw: errors when trying to delete non-existing files
    * 9.1.0622: MS-Windows: mingw-build can be optimized
    * 9.1.0621: MS-Windows: startup code can be improved
    * 9.1.0620: Vim9: segfauls with null objects
    * 9.1.0619: tests: test_popup fails
    * 9.1.0618: cannot mark deprecated attributes in completion menu
    * 9.1.0617: Cursor moves beyond first line of folded end of buffer
    * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles
    * 9.1.0615: Unnecessary STRLEN() in make_percent_swname()
    Add single-line comment syntax
    Add syntax test for comments
    Update maintainer info
    * 9.1.0614: tests: screendump tests fail due to recent syntax changes
    * 9.1.0613: tests: termdebug test may fail and leave file around
    Update base-syntax, improve :set highlighting
    Optionally highlight the :: token for method references
    * 9.1.0612: filetype: deno.lock file not recognized
    Use delete() for deleting directory
    escape filename before trying to delete it
    * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys
    correctly extract file from zip browser
    * 9.1.0610: filetype: OpenGL Shading Language files are not detected
    Fix endless recursion in netrw#Explore()
    * 9.1.0609: outdated comments in Makefile
    update syntax script
    Fix flow mapping key detection
    Remove orphaned YAML syntax dump files
    * 9.1.0608: Coverity warns about a few potential issues
    Update syntax script and remove syn sync
    * 9.1.0607: termdebug: uses inconsistent style
    * 9.1.0606: tests: generated files may cause failure in test_codestyle
    * 9.1.0605: internal error with fuzzy completion
    * 9.1.0604: popup_filter during Press Enter prompt seems to hang
    translation: Update Serbian messages translation
    * 9.1.0603: filetype: use correct extension for Dracula
    * 9.1.0602: filetype: Prolog detection can be improved
    fix more inconsistencies in assert function docs
    * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit
    Update base-syntax, improve :map highlighting
    * 9.1.0600: Unused function and unused error constants
    * 9.1.0599: Termdebug: still get E1023 when specifying arguments
    correct wrong comment options
    fix typo "a xterm" -> "an xterm"
    * 9.1.0598: fuzzy completion does not work with default completion
    * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key
    * 9.1.0596: filetype: devscripts config files are not recognized
    gdb file/folder check is now performed only in CWD.
    quote filename arguments using double quotes
    update syntax to SDC-standard 2.1
    minor updates.
    Cleanup :match and :loadkeymap syntax test files
    Update base-syntax, match types in Vim9 variable declarations
    * 9.1.0595: make errors out with the po Makefile
    * 9.1.0594: Unnecessary redraw when setting 'winfixbuf'
    using wrong highlight for UTF-8
    include simple syntax plugin
    * 9.1.0593: filetype: Asymptote files are not recognized
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    * 9.1.0592: filetype: Mediawiki files are not recognized
    * 9.1.0591: filetype: *.wl files are not recognized
    * 9.1.0590: Vim9: crash when accessing getregionpos() return value
    'cpoptions': Include "z" in the documented default
    * 9.1.0589: vi: d{motion} and cw work differently than expected
    update included colorschemes
    grammar fixes in options.txt
  - Add "Keywords" to gvim.desktop to make searching for gvim easier
  - Removed patches, as they're no longer required (refreshing them
    deleted their contents):
    * vim-7.3-help_tags.patch
    * vim-7.4-highlight_fstab.patch
  - Reorganise all applied patches in the spec file.
  - Update to 9.1.0588:
    * 9.1.0588: The maze program no longer compiles on newer clang
    runtime(typst): Add typst runtime files
    * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky
    * 9.1.0586: ocaml runtime files are outdated
    runtime(termdebug): fix a few issues
    * 9.1.0585: tests: test_cpoptions leaves swapfiles around
    * 9.1.0584: Warning about redeclaring f_id() non-static
    runtime(doc): Add hint how to load termdebug from vimrc
    runtime(doc): document global insert behavior
    * 9.1.0583: filetype: *.pdf_tex files are not recognized
    * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode
    * 9.1.0581: Various lines are indented inconsistently
    * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode
    * 9.1.0579: Ex command is still executed after giving E1247
    * 9.1.0578: no tests for :Tohtml
    * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim
    * 9.1.0576: tests: still an issue with test_gettext_make
    * 9.1.0575: Wrong comments in alt_tabpage()
    * 9.1.0574: ex: wrong handling of commands after bar
    runtime(doc): add a note for netrw bug reports
    * 9.1.0573: ex: no implicit print for single addresses
    runtime(vim): make &indentexpr available from the outside
    * 9.1.0572: cannot specify tab page closing behaviour
    runtime(doc): remove obsolete Ex insert behavior
    * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky
    runtime(logindefs): update syntax with new keywords
    * 9.1.0570: tests: test_gettext_make can be improved
    runtime(filetype): Fix Prolog file detection regex
    * 9.1.0569: fnamemodify() treats ".." and "../" differently
    runtime(mojo): include mojo ftplugin and indent script
    * 9.1.0568: Cannot expand paths from 'cdpath' setting
    * 9.1.0567: Cannot use relative paths as findfile() stop directories
    * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash
    * 9.1.0565: Stop directory doesn't work properly in 'tags'
    * 9.1.0564: id() can be faster
    * 9.1.0563: Cannot process any Key event
    * 9.1.0562: tests: inconsistency in test_findfile.vim
    runtime(fstab): Add missing keywords to fstab syntax
    * 9.1.0561: netbeans: variable used un-initialized (Coverity)
    * 9.1.0560: bindtextdomain() does not indicate an error
    * 9.1.0559: translation of vim scripts can be improved
    * 9.1.0558: filetype: prolog detection can be improved
    * 9.1.0557: moving in the buffer list doesn't work as documented
    runtime(doc): fix inconsistencies in :h file-searching
    * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages
    runtime(htmlangular): correct comment
    * 9.1.0555: filetype: angular ft detection is still problematic
    * 9.1.0554: :bw leaves jumplist and tagstack data around
    * 9.1.0553: filetype: *.mcmeta files are not recognized
    * 9.1.0552: No test for antlr4 filetype
    * 9.1.0551: filetype: htmlangular files are not properly detected
    * 9.1.0550: filetype: antlr4 files are not recognized
    * 9.1.0549: fuzzycollect regex based completion not working as expected
    runtime(doc): autocmd_add() accepts a list not a dict
    * 9.1.0548: it's not possible to get a unique id for some vars
    runtime(tmux): Update syntax script
    * 9.1.0547: No way to get the arity of a Vim function
    * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A
    runtime(hlsplaylist): include hlsplaylist ftplugin file
    runtime(doc): fix typo in :h ft-csv-syntax
    runtime(doc): Correct shell command to get $VIMRUNTIME into
    shell
    * 9.1.0545: MSVC conversion warning
    * 9.1.0544: filetype: ldapconf files are not recognized
    runtime(cmakecache): include cmakecache ftplugin file
    runtime(lex): include lex ftplugin file
    runtime(yacc): include yacc ftplugin file
    runtime(squirrel): include squirrel ftplugin file
    runtime(objcpp): include objcpp ftplugin file
    runtime(tf): include tf ftplugin file
    runtime(mysql): include mysql ftplugin file
    runtime(javacc): include javacc ftplugin file
    runtime(cabal): include cabal ftplugin file
    runtime(cuda): include CUDA ftplugin file
    runtime(editorconfig): include editorconfig ftplugin file
    runtime(kivy): update kivy syntax, include ftplugin
    runtime(syntax-tests): Stop generating redundant "*_* 99.dump"
    files
    * 9.1.0543: Behavior of CursorMovedC is strange
    runtime(vim): Update base-syntax, improve :match command
    highlighting
    * 9.1.0542: Vim9: confusing string() output for object functions
    * 9.1.0541: failing test with Vim configured without channel
    * 9.1.0540: Unused assignment in sign_define_cmd()
    runtime(doc): add page-scrolling keys to index.txt
    runtime(doc): add reference to xterm-focus-event from
    FocusGained/Lost
    * 9.1.0539: Not enough tests for what v9.1.0535 fixed
    runtime(doc): clarify how to re-init csv syntax file
    * 9.1.0538: not possible to assign priority when defining a sign
    * 9.1.0537: signed number detection for CTRL-X/A can be improved
    * 9.1.0536: filetype: zone files are not recognized
    * 9.1.0535: newline escape wrong in ex mode
    runtime(man): honor cmd modifiers before `g:ft_man_open_mode`
    runtime(man): use `nnoremap` to map to Ex commands
    * 9.1.0534: completion wrong with fuzzy when cycling back to original
    runtime(syntax-tests): Abort and report failed cursor progress
    runtime(syntax-tests): Introduce self tests for screen dumping
    runtime(syntax-tests): Clear and redraw the ruler line with
    the shell info
    runtime(syntax-tests): Allow for folded and wrapped lines in
    syntax test files
    * 9.1.0533: Vim9: need more tests for nested objects equality
    CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries
    runtime(doc): Remove wrong help tag CTRL-SHIFT-CR
    * 9.1.0532: filetype: Cedar files not recognized
    runtime(doc): document further keys that scroll page up/down
    * 9.1.0531: resource leak in mch_get_random()
    runtime(tutor): Fix wrong spanish translation
    runtime(netrw): fix remaining case of register clobber
    * 9.1.0530: xxd: MSVC warning about non-ASCII character
    * 9.1.0529: silent! causes following try/catch to not work
    runtime(rust): use shiftwidth() in indent script
    * 9.1.0528: spell completion message still wrong in translations
    * 9.1.0527: inconsistent parameter in Makefiles for Vim executable
    * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer
    runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config
    * 9.1.0525: Right release selects immediately when pum is truncated.
    * 9.1.0524: the recursive parameter in the *_equal functions can be removed
    runtime(termdebug): Add Deprecation warnings
    * 9.1.0523: Vim9: cannot downcast an object
    * 9.1.0522: Vim9: string(object) hangs for recursive references
    * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13
    * 9.1.0520: Vim9: incorrect type checking for modifying lists
    runtime(manpager): avoid readonly prompt
    * 9.1.0519: MS-Windows: libvterm compilation can be optimized
    * 9.1.0518: initialize the random buffer can be improved
    * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak
    runtime(terraform): Add filetype plugin for terraform
    runtime(dockerfile): enable spellchecking of comments in
    syntax script
    runtime(doc): rename variable for pandoc markdown support
    runtime(doc): In builtin overview use {buf} as param for
    appendbufline/setbufline
    runtime(doc): clarify, that register 1-* 9 will always be shifted
    runtime(netrw): save and restore register 0-* 9, a and unnamed
    runtime(termdebug): Refactored StartDebug_term and EndDebug
    functions
    runtime(java): Compose "g:java_highlight_signature" and
    "g:java_highlight_functions"
    * 9.1.0516: need more tests for nested dicts and list comparision
    * 9.1.0515: Vim9: segfault in object_equal()
    * 9.1.0514: Vim9: issue with comparing objects recursively
    runtime(termdebug): Change some variables to Enums
    runtime(vim): Update base-syntax, fix function tail comments
    * 9.1.0513: Vim9: segfault with object comparison
  - Update to 9.1.0512:
    * Mode message for spell completion doesn't match allowed keys
    * CursorMovedC triggered wrongly with setcmdpos()
    * update runtime files
    * CI: test_gettext fails on MacOS14 + MSVC Win
    * not possible to translate Vim script messages
    * termdebug plugin can be further improved
    * add gomod filetype plugin
    * hard to detect cursor movement in the command line
    * Optionally highlight parameterised types
    * filetype: .envrc & .prettierignore not recognized
    * filetype: Faust files are not recognized
    * inner-tag textobject confused about ">" in attributes
    * cannot use fuzzy keyword completion
    * Remove the group exclusion list from @javaTop
    * wrong return type for execute() function
    * MS-Windows: too much legacy code
    * too complicated mapping restore in termdebug
    * simplify mapping
    * cannot switch buffer in a popup
    * MS-Windows: doesn't handle symlinks properly
    * getcmdcompltype() interferes with cmdline completion
    * termdebug can be further improved
    * update htmldjango detection
    * Improve Turkish documentation
    * include a simple csv filetype and syntax plugin
    * include the the simple nohlsearch package
    * matched text is highlighted case-sensitively
    * Matched text isn't highlighted in cmdline pum
    * Fix typos in several documents
    * clarify when text properties are cleared
    * improve the vim-shebang example
    * revert unintended formatting changes for termdebug
    * Add a config variable for commonly used compiler options
    * Wrong matched text highlighted in pum with 'rightleft'
    * bump length of character references in syntax script
    * properly check mapping variables using null_dict
    * fix KdlIndent and kdlComment in indent script
    * Test for patch 9.1.0489 doesn't fail without the fix
    * Fold multi-line comments with the syntax kind of &fdm
    * using wrong type for PlaceSign()
    * filetype: Vim-script files not detected by shebang line
    * revert unintended change to zip#Write()
    * add another tag for vim-shebang feature
    * Cmdline pum doesn't work properly with 'rightleft'
    * minor style problems with patch 9.1.0487
    * default completion may break with fuzzy
    * Wrong padding for pum "kind" with 'rightleft'
    * Update base-syntax, match shebang lines
    * MS-Windows: handle files with spaces properly
    * Restore HTML syntax file tests
    * completed item not update on fuzzy completion
    * filetype: Snakemake files are not recognized
    * make TermDebugSendCommand() a global function again
    * close all buffers in the same way
    * Matched text shouldn't be highlighted in "kind" and "menu"
    * fix wrong helptag for :defer
    * Update base-syntax, match :sleep arg
    * include Georgian keymap
    * Sorting of completeopt+=fuzzy is not stable
    * correctly test for windows in NetrwGlob()
    * glob() on windows fails with [] in directory name
    * rewrite mkdir() doc and simplify {flags} meaning
    * glob() not sufficiently tested
    * update return type for job_info()
    * termdebug plugin needs more love
    * correct return types for job_start() and job_status()
    * Update base-syntax, match :catch and :throw args
    * Include element values in non-marker annotations
    * Vim9: term_getjob() throws an exception on error
    * fuzzy string matching executed when not needed
    * fuzzy_match_str_with_pos() does unnecessary list operations
    * restore description of "$" in col() and virtcol()
    * deduplicate getpos(), line(), col(), virtcol()
    * Update g:vimsyn_comment_strings dump file tests
    * Use string interpolation instead of string concat
    * potential deref of NULL pointer in fuzzy_match_str_with_pos
    * block_editing errors out when using <enter>
    * Update base-syntax, configurable comment string highlighting
    * fix typos in syntax.txt
    * Cannot see matched text in popup menu
    * Update base-syntax, match multiline continued comments
    * clarify documentation for "v" position at line()
    * cmod_split modifier is always reset in term_start()
    * remove line-continuation characters
    * use shiftwidth() instead of &tabstop in indent script
    * Remove orphaned screen dump files
    * include syntax, indent and ftplugin files
    * CI: Test_ColonEight() fails on github runners
    * add missing Enabled field in syntax script
    * basic svelte ftplugin file
    * term_start() does not clear vertical modifier
    * fix mousemodel restoration by comparing against null_string
    * Added definitions of Vim scripts and plugins
    * Exclude lambda expressions from _when_ _switch-case_ label clauses
    * Fix saved_mousemodel check
    * Inconsistencies between functions for option flags
    * Crash when using autocmd_get() after removing event inside autocmd
    * Fix small style issues
    * add return type info for Vim function descriptions
    * Update Italian Vim manpage
    * disable the q mapping
    * Change 'cms' for C++ to '// %s'
    * fix type mismatch error
    * Fix wrong email address
    * convert termdebug plugin to Vim9 script
  - Update to 9.1.0470:
    * tests Test_ColonEight_MultiByte() fails sporadically
    * Cannot have buffer-local value for 'completeopt'
    * GvimExt does not consult HKEY_CURRENT_USER
    * typos in some comments
    * runtime(vim): Update base-syntax, allow whitespace before
    :substitute pattern
    * Missing comments for fuzzy completion
    * runtime(man): update Vim manpage
    * runtime(comment): clarify the usage of 'commentstring' option
    value
    * runtime(doc): clarify how fuzzy 'completeopt' should work
    * runtime(netrw): prevent accidental data loss
    * missing filecopy() function
    * no whitespace padding in commentstring option in ftplugins
    * no fuzzy-matching support for insert-completion
    * eval5() and eval7 are too complex
    * too many strlen() calls in drawline.c
    * filetype lintstagedrc files are not recognized
    * Vim9 import autoload does not work with symlink
    * Coverity complains about division by zero
    * tests test_gui fails on Wayland
    * Left shift is incorrect with vartabstop and shiftwidth=0
    * runtime(doc): clarify 'shortmess' flag "S"
    * MS-Windows compiler warning for size_t to int conversion
    * runtime(doc): include some vim9 script examples in the help
    * minor issues in test_filetype with rasi test
    * filetype rasi files are not recognized
    * runtime(java): Improve the matching of lambda expressions
    * Configure checks for libelf unnecessarily
    * No test for escaping '<' with shellescape()
    * check.vim complains about overlong comment lines
    * translation(it): Update Italian translation
    * evalc. code too complex
    * MS-Windows Compiler warnings
  - Update to 9.1.0448:
    * compiler warning in eval.c
    * remove remaining css code
    * Add ft_hare.txt to Reference Manual TOC
    * re-generate vim syntax from generator
    * fix syntax vim bug
    * completion may be wrong when deleting all chars
    * getregionpos() inconsistent for partly-selected multibyte char
    * fix highlighting nested and escaped quotes in string props
    * remove the indent plugin since it has too many issues
    * update Debian runtime files
    * Coverity warning after 9.1.0440
    * Not enough tests for getregion() with multibyte chars
    * Can't use blockwise selection with width for getregion()
    * update outdated syntax files
    * fix floating_modifier highlight
    * hare runtime files outdated
    * getregionpos() can't properly indicate positions beyond eol
    * function get_lval() is too long
    * Cannot filter the history
    * Wrong Ex command executed when :g uses '?' as delimiter
    * support floating_modifier none; revert broken highlighting
    * Motif requires non-const char pointer for XPM  data
    * Crash when using '?' as separator for :s
    * filetype: cygport files are not recognized
    * make errors trying to access autoload/zig
    * Wrong yanking with exclusive selection and ve=all
    * add missing help tags file
    * Ancient XPM preprocessor hack may cause build errors
    * include basic rescript ftplugin file
    * eval.c is too long
    * getregionpos() doesn't handle one char selection
    * check for gdb file/dir before using as buffer name
    * refactor zig ftplugin, remove auto format
    * Coverity complains about eval.c refactor
    * Tag guessing leaves wrong search history with very short names
    * some issues with termdebug mapping test
    * update matchit plugin to v1.20
    * too many strlen() calls in search.c
    * set commentstring option
    * update vb indent plugin as vim9script
    * filetype: purescript files are not recognized
    * filetype: slint files are not recognized
    * basic nim ftplugin file for comments
    * Add Arduino ftplugin and indent files
    * include basic typst ftplugin file
    * include basic prisma ftplugin file
    * include basic v ftplugin for comment support
    * getregionpos() wrong with blockwise mode and multibyte
    * function echo_string_core() is too long
    * hyprlang files are not recognized
    * add basic dart ftplugin file
    * basic ftplugin file for graphql
    * mention comment plugin at :h 'commentstring'
    * set commentstring for sql files in ftplugin
    * :browse oldfiles prompts even with single entry
    * eval.c not sufficiently tested
    * clarify why E195 is returned
    * clarify temporary file clean up
    * fix :NoMatchParen not working
    * Cannot move to previous/next rare word
    * add basic ftplugin file for sshdconfig
    * if_py: find_module has been removed in Python 3.12.0a7
    * some screen dump tests can be improved
    * Some functions are not tested
    * clarify instal instructions for comment package
    * Unable to leave long line with 'smoothscroll' and 'scrolloff'
    * fix typo in vim9script help file
    * Remove trailing spaces
    * clarify {special} argument for shellescape()
  - update to 9.1.0413
    * smoothscroll may cause infinite loop
    * add missing entries for the keys CTRL-W g<Tab> and <C-Tab>
    * update vi_diff.txt: add default value for 'flash'
    * typo in regexp_bt.c in DEBUG code
    * allow indented commands
    * Fix wrong define regex in ftplugin
    * Filter out non-Latin-1 characters for syntax tests
    * prefer scp over pscp
    * fix typo in usr_52.txt
    * too long functions in eval.c
    * warning about uninitialized variable
    * too many strlen() calls in the regexp engine
    * E16 fix, async keyword support for define
    * Stuck with long line and half-page scrolling
    * Divide by zero with getmousepos() and 'smoothscroll'
    * update and remove  some invalid links
    * update translation of xxd manpage
    * Recursively delete directories by default with netrw delete command
    * Strive to remain compatible for at least Vim 7.0
    * tests: xxd buffer overflow fails on 32-bit
    * Stop handpicking syntax groups for @javaTop
    * [security] xxd: buffer-overflow with specific flags
    * Vim9: not able to import file from start dir
    * filetype: mdd files detected as zsh filetype
    * filetype: zsh module files are not recognized
    * Remove hardcoded private.ppk logic from netrw
    * Vim9: confusing error message for unknown type
    * block_editing errors out when using del
    * add new items to scripts section in syntax plugin
    * Vim9: imported vars are not properly type checked
    * Wrong display with 'smoothscroll' when changing quickfix list
    * filetype: jj files are not recognized
    * getregionpos() may leak memory on error
    * The CODEOWNERS File is not useful
    * Remove and cleanup Win9x legacy from netrw
    * add MsgArea to 'highlight' option description
    * Cannot get a list of positions describing a region
    * Fix digit separator in syntax script for octals and floats
    * Update link to Wikipedia Vi page
    * clear $MANPAGER in ftplugin before shelling out
    * Fix typos in help documents
    * 'viewdir' not respecting $XDG_CONFIG_HOME
    * tests: Vim9 debug tests may be flaky
    * correct getscriptinfo() example
    * Vim9: could improve testing
    * test_sound fails on macos-12
    * update Serbian menu
    * update Slovak menu
    * update Slovenian menu
    * update Portuguese menu
    * update Dutch menu
    * update Korean menu
    * update Icelandic menu
    * update Czech menu
    * update Afrikaans menu
    * update German menu
    * filetype: inko files are not recognized
    * filetype: templ files are not recognized
    * cursor() and getregion() don't handle v:maxcol well
    * Vim9: null value tests not sufficient
    * update Catalan menu
    * filetype: stylus files not recognized
    * update spanish menu localization
    * regenerate helptags
    * Vim9: crash with null_class and null_object
    * Add tags about lazyloading of menu
    * tests: vt420 terminfo entry may not be found
    * filetype: .out files recognized as tex files
    * filetype: Kbuild files are not recognized
    * cbuffer and similar commands don't accept a range
    * Improve the recognition of the "indent" method declarations
    * Fix a typo in usr_30.txt
    * remove undefined var s:save_cpoptions and add include setting
    * missing setlocal in indent plugin
    * Calculating line height for unnecessary amount of lines
    * improve syntax file performance
    * There are a few typos
    * Vim9: no comments allowed after class vars
    * CI: remove trailing white space in documentation
    * Formatting text wrong when 'breakindent' is set
    * Add oracular (24.10) as Ubuntu release name
    * Vim9: Trailing commands after class/enum keywords ignored
    * tests: 1-second delay after Test_BufEnter_botline()
    * update helptags for jq syntax
    * include syntax, ftplugin and compiler plugin
    * fix typo synconcealend -> synconcealed
    * include a simple comment toggling plugin
    * wrong botline in BufEnter
    * clarify syntax vs matching mechanism
    * fix undefined variable in indent plugin
    * ops.c code uses too many strlen() calls
    * Calling CLEAR_FIELD() on the same struct twice
    * Vim9: compile_def_function() still too long
    * Update Serbian messages
    * clarify the effect of setting the shell to powershell
    * Improve the recognition of the "style" method declarations
    * Vim9: problem when importing autoloaded scripts
    * compile_def_function is too long
    * filetype: ondir files are not recognized
    * Crash when typing many keys with D- modifier
    * tests: test_vim9_builtin is a bit slow
    * update documentation
    * change the download URL of "libsodium"
    * tests: test_winfixbuf is a bit slow
    * Add filetype, syntax and indent plugin for Astro
    * expanding rc config files does not work well
    * Vim9: vim9type.c is too complicated
    * Vim9: does not handle autoloaded variables well
    * minor spell fix in starting.txt
    * wrong drawing in GUI with setcellwidth()
    * Add include and suffixesadd
    * Page scrolling should place cursor at window boundaries
    * align command line table
    * minor fixes to starting.txt
    * fix comment definition in filetype plugin
    * filetype: flake.lock files are not recognized
    * runtime(uci): No support for uci file types
    * Support "g:ftplugin_java_source_path" with archived files
    * tests: Test_autoload_import_relative_compiled fails on Windows
    * Finding cmd modifiers and cmdline-specials is inefficient
    * No test that completing a partial mapping clears 'showcmd'
    * tests: test_vim9_dissamble may fail
    * Vim9: need static type for typealias
    * X11 does not ignore smooth scroll event
    * A few typos in test_xdg when testing gvimrc
    * Patch v9.1.0338 fixed sourcing a script with import
    * Problem: gvimrc not sourced from XDG_CONFIG_HOME
    * Cursor wrong after using setcellwidth() in terminal
    * 'showcmd' wrong for partial mapping with multibyte
    * tests: test_taglist fails when 'helplang' contains non-english
    * Problem: a few memory leaks are found
    * Problem: Error with matchaddpos() and empty list
    * tests: xdg test uses screen dumps
    * Vim9: import through symlinks not correctly handled
    * Missing entry for XDG vimrc file in :version
    * tests: typo in test_xdg
    * runtime(i3config/swayconfig): update syntax scripts
    * document pandoc compiler and enable configuring arguments
    * String interpolation fails for List type
    * No test for highlight behavior with 'ambiwidth'
    * tests: test_xdg fails on the appimage repo
    * tests: some assert_equal() calls have wrong order of args
    * make install does not install all files
    * runtime(doc): fix typos in starting.txt
  - Updated to version 9.1 with patch level 0330, fixes the following problems
    * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1
  - refreshed vim-7.3-filetype_spec.patch
  - refreshed vim-7.3-filetype_ftl.patch
  - Update spec.skeleton to use autosetup in place of setup macro.
  - for the complete list of changes see
    https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330

++++ vim:

  - Fix for bsc#1231373 / CVE-2024-47814.
  - Fix for bsc#1229238 / CVE-2024-43374.
  - update to 9.1.0836
    * 9.1.0836: The vimtutor can be improved
    * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu'
    * 9.1.0834: tests: 2html test fails
    * 9.1.0833: CI: recent ASAN changes do not work for indent tests
    * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal
    * runtime(doc): update help-toc description
    * runtime(2html): Make links use color scheme colors in TOhtml
    * 9.1.0831: 'findexpr' can't be used as lambad or Funcref
    * Filelist: include helptoc package
    * runtime(doc): include a TOC Vim9 plugin
    * Filelist: ignore .git-blame-ignore-revs
    * 9.1.0830: using wrong highlight group for spaces for popupmenu
    * runtime(typst): synchronize updates from the upstream typst.vim
    * git: ignore reformatting commit for git-blame (after v9.1.0829)
    * 9.1.0829: Vim source code uses a mix of tabs and spaces
    * 9.1.0828: string_T struct could be used more often
    * 9.1.0827: CI: tests can be improved
    * runtime(doc): remove stray sentence in pi_netrw.txt
    * 9.1.0826: filetype: sway files are not recognized
    * runtime(doc): Include netrw-gp in TOC
    * runtime(doc): mention 'iskeyword' at :h charclass()
    * runtime(doc): update help tags
    * 9.1.0825: compile error for non-diff builds
    * runtime(netrw): fix E874 when browsing remote directory which contains `~` character
    * runtime(doc): update coding style documentation
    * runtime(debversions): Add plucky (25.04) as Ubuntu release name
    * 9.1.0824: too many strlen() calls in register.c
    * 9.1.0823: filetype: Zephyr overlay files not recognized
    * runtime(doc): Clean up minor formatting issues for builtin functions
    * runtime(netrw): make :Launch/Open autoloadable
    * runtime(netrw): fix regression with x mapping on Cygwin
    * runtime(netrw): fix filetype detection for remote files
    * 9.1.0822: topline might be changed in diff mode unexpectedly
    * CI: huge linux builds should also run syntax & indent tests
    * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument
    * 9.1.0820: tests: Mac OS tests are too flaky
    * runtime(awk): Highlight more awk comments in syntax script
    * runtime(netrw): add missing change for s:redir()
    * 9.1.0819: tests: using findexpr and imported func not tested
    * runtime(netrw): improve netrw's open-handling further
    * runtime(netrw): fix syntax error in netrwPlugin.vim
    * runtime(netrw): simplify gx file handling
    * 9.1.0818: some global functions are only used in single files
    * 9.1.0817: termdebug: cannot evaluate expr in a popup
    * runtime(defaults): Detect putty terminal and switch to dark background
    * 9.1.0816: tests: not clear what tests cause asan failures
    * runtime(doc): Remove some completed items from todo.txt
    * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position
    * runtime(syntax-tests): tiny vim fails because of line-continuation
    * 9.1.0814: mapset() may remove unrelated mapping
    * 9.1.0813: no error handling with setglobal and number types
    * 9.1.0812: Coverity warns about dereferencing NULL ptr
    * 9.1.0811: :find expansion does not consider 'findexpr'
    * 9.1.0810: cannot easily adjust the |:find| command
    * 9.1.0809: filetype: petalinux config files not recognized
    * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll'
    * 9.1.0807: tests: having 'nolist' in modelines isn't always desired
    * 9.1.0806: tests: no error check when setting global 'briopt'
    * 9.1.0805: tests: minor issues in gen_opt_test.vim
    * 9.1.0804: tests: no error check when setting global 'cc'
    * 9.1.0803: tests: no error check when setting global 'isk'
    * 9.1.0802: tests: no error check when setting global 'fdm' to empty value
    * 9.1.0801: tests: no error check when setting global 'termwinkey'
    * 9.1.0800: tests: no error check when setting global 'termwinsize'
    * runtime(doc): :ownsyntax also resets 'spelloptions'
    * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive
    * runtime(doc): Fix wrong Mac default options
    * 9.1.0798: too many strlen() calls in cmdhist.c
    * 9.1.0797: testing of options can be further improved
    * 9.1.0796: filetype: libtool files are not recognized
    * (typst): add folding to typst ftplugin
    * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke()
    * 9.1.0795: filetype: Vivado memory info file are not recognized
    * 9.1.0794: tests: tests may fail on Windows environment
    * runtime(doc): improve the :colorscheme documentation
    * 9.1.0793: xxd: -e does add one extra space
    * 9.1.0792: tests: Test_set_values() is not comprehensive enough
    * runtime(swayconfig): add flag for bindsym/bindcode to syntax script
    * 9.1.0791: tests: errors in gen_opt_test.vim are not shown
    * runtime(compiler): check for compile_commands in build dirs for cppcheck
    * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib)
    * runtime(help): Update help syntax
    * runtime(help): fix end of sentence highlight in code examples
    * runtime(jinja): Support jinja syntax as secondary filetype
    * 9.1.0789: tests: ':resize + 5' has invalid space after '+'
    * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot
    * 9.1.0787: cursor position changed when using hidden terminal
    * 9.1.0786: tests: quickfix update test does not test location list
    * runtime(doc): add some docs for file-watcher programs
    * CI: uploading failed screendumps still fails on Cirrus CI
    * 9.1.0785: cannot preserve error position when setting quickfix list
    * 9.1.0784: there are several problems with python 3.13
    * 9.1.0783: 'spell' option setting has problems
    * 9.1.0782: tests: using wrong neomuttlog file name
    * runtime(doc): add preview flag to statusline example
    * 9.1.0781: tests: test_filetype fails
    * 9.1.0780: MS-Windows: incorrect Win32 error checking
    * 9.1.0779: filetype: neomuttlog files are not recognized
    * 9.1.0778: filetype: lf config files are not recognized
    * runtime(comment): fix commment toggle with mixed tabs & spaces
    * runtime(misc): Use consistent "Vim script" spelling
    * runtime(gleam): add ftplugin for gleam files
    * runtime(doc): link help-writing from write-local-help
    * 9.1.0777: filetype: Some upstream php files are not recognized
    * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups
    * runtime(doc): mention conversion rules for remote_expr()
    * runtime(tutor): Fix missing :s command in spanish translation section 4.4
    * 9.1.0776: test_strftime may fail because of missing TZ data
    * translation(am): Add Armenian language translation
    * 9.1.0775: tests: not enough tests for setting options
    * 9.1.0774: "shellcmdline" doesn't work with getcompletion()
    * 9.1.0773: filetype: some Apache files are not recognized
    * 9.1.0772: some missing changes from v9.1.0771
    * 9.1.0771: completion attribute hl_group is confusing
    * 9.1.0770: current command line completion is a bit limited
    * 9.1.0769: filetype: MLIR files are not recognized
    * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen
    * runtime(nasm): Update nasm syntax script
    * 9.1.0767: A condition is always true in ex_getln.c
    * runtime(skill): Update syntax file to fix string escapes
    * runtime(help): highlight CTRL-<Key> correctly
    * runtime(doc): add missing usr_52 entry to toc
    * 9.1.0766: too many strlen() calls in ex_getln.c
    * runtime(doc): correct `vi` registers 1-9 documentation error
    * 9.1.0765: No test for patches 6.2.418 and 7.3.489
    * runtime(spec): set comments and commentstring options
    * NSIS: Include libgcc_s_sjlj-1.dll again
    * runtime(doc): clarify the effect of 'startofline' option
    * 9.1.0764: [security]: use-after-free when closing a buffer
    * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting
    * 9.1.0763: tests: cannot run single syntax tests
    * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly
    * 9.1.0761: :cd completion fails on Windows with backslash in path
    * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails
    * 9.1.0759: screenpos() may return invalid position
    * runtime(misc): unset compiler in various ftplugins
    * runtime(doc): update formatting and syntax
    * runtime(compiler): add cppcheck linter compiler plugin
    * runtime(doc): Fix style in documents
    * runtime(doc): Fix to two-space convention in user manual
    * runtime(comment): consider &tabstop in lines after whitespace indent
    * 9.1.0758: it's possible to set an invalid key to 'wildcharm'
    * runtime(java): Manage circularity for every :syn-included syntax file
    * 9.1.0757: tests: messages files contains ANSI escape sequences
    * 9.1.0756: missing change from patch v9.1.0754
    * 9.1.0755: quickfix list does not handle hardlinks well
    * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters
    * runtime(systemd): small fixes to &keywordprg in ftplugin
    * CI: macos-12 runner is being sunset, switch to 13
    * 9.1.0754: fixed order of items in insert-mode completion menu
    * runtime(comment): commenting might be off by one column
    * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll'
    * 9.1.0752: can set 'cedit' to an invalid value
    * runtime(doc): add `usr` tag to usr_toc.txt
    * 9.1.0751: Error callback for term_start() not used
    * 9.1.0750: there are some Win9x legacy references
    * runtime(java): Recognise the CommonMark form (///) of Javadoc comments
    * 9.1.0749: filetype: http files not recognized
    * runtime(comment): fix syntax error
    * CI: uploading failed screendump tests does not work Cirrus
    * 9.1.0748: :keep* commmands are sometimes misidentified as :k
    * runtime(indent): allow matching negative numbers for gnu indent config file
    * runtime(comment): add gC mapping to (un)comment rest of line
    * 9.1.0747: various typos in repo found
    * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals
    * runtime(doc): reformat gnat example
    * runtime(doc): reformat ada_standard_types section
    * 9.1.0745: filetype: bun and deno history files not recognized
    * runtime(glvs): Correct the tag name of glvs-autoinstal
    * runtime(doc): include short form for :earlier/:later
    * runtime(doc): remove completed TODO
    * 9.1.0744: filetype: notmuch configs are not recognised
    * 9.1.0743: diff mode does not handle overlapping diffs correctly
    * runtime(glvs): fix a few issues
    * runtime(doc): Fix typo in :help :command-modifiers
    * 9.1.0742: getcmdprompt() implementation can be improved
    * runtime(docs): update `:set?` command behavior table
    * runtime(doc): update vim90 to vim91 in docs
    * runtime(doc): fix typo in :h dos-colors
    * 9.1.0741: No way to get prompt for input()/confirm()
    * runtime(doc): fix typo in version9.txt nrformat -> nrformats
    * runtime(rmd,rrst): 'fex' option not properly restored
    * runtime(netrw): remove extraneous closing bracket
    * 9.1.0740: incorrect internal diff with empty file
    * 9.1.0739: [security]: use-after-free in ex_getln.c
    * runtime(filetype): tests: Test_filetype_detection() fails
    * runtime(dist): do not output a message if executable is not found
    * 9.1.0738: filetype: rapid files are not recognized
    * runtime(modconf): remove erroneous :endif in ftplugin
    * runtime(lyrics): support multiple timestamps in syntax script
    * runtime(java): Optionally recognise _module_ import declarations
    * runtime(vim): Update base-syntax, improve folding function matches
    * CI: upload failed screendump tests also for Cirrus
    * 9.1.0737: tests: screendump tests may require a bit more time
    * runtime(misc): simplify keywordprg in various ftplugins
    * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels
    * runtime(zsh,sh): set and unset compiler in ftplugin
    * runtime(netrw): using inefficient highlight pattern for 'mf'
    * 9.1.0736: Unicode tables are outdated
    * 9.1.0735: filetype: salt files are not recognized
    * 9.1.0734: filetype: jinja files are not recognized
    * runtime(zathurarc): add double-click-follow to syntax script
    * translation(ru): Updated messages translation
    * translation(it): updated xxd man page
    * translation(ru): updated xxd man page
    * 9.1.0733: keyword completion does not work with fuzzy
    * 9.1.0732: xxd: cannot use -b and -i together
    * runtime(java): Highlight javaConceptKind modifiers with StorageClass
    * runtime(doc): reword and reformat how to use defaults.vim
    * 9.1.0731: inconsistent case sensitive extension matching
    * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return
    * runtime(netrw): delete confirmation not strict enough
    * 9.1.0730: Crash with cursor-screenline and narrow window
    * 9.1.0729: Wrong cursor-screenline when resizing window
    * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
    * runtime(doc): clarify the effect of the timeout for search()-functions
    * runtime(idlang): update syntax script
    * runtime(spec): Recognize epoch when making spec changelog in ftplugin
    * runtime(spec): add file triggers to syntax script
    * 9.1.0727: too many strlen() calls in option.c
    * runtime(make): add compiler/make.vim to reset compiler plugin settings
    * runtime(java): Recognise all available standard doclet tags
    * 9.1.0726: not using correct python3 API with dynamic linking
    * runtime(dosini): Update syntax script, spellcheck comments only
    * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation
    * 9.1.0725: filetype: swiftinterface files are not recognized
    * runtime(pandoc): Update compiler plugin to use actual 'spelllang'
    * runtime(groff): Add compiler plugin for groff
    * 9.1.0724: if_python: link error with python 3.13 and stable ABI
    * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13
    * 9.1.0722: crash with large id in text_prop interface
    * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME
    * runtime(glvs): update GetLatestVimScripts plugin
    * runtime(doc): Fix typo in :help :hide text
    * runtime(doc): buffers can be re-used
    * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs
    * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid
    * runtime(doc): Update version9.txt and mention $MYVIMDIR
  - Update to 9.1.0718:
    * v9.1.0718: hard to know the users personal Vim Runtime Directory
    * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers()
    Maintainers: fix typo in author name
    * v9.1.0716: resetting setcellwidth( doesn't update the screen
    runtime(hcl,terraform): Add runtime files for HCL and Terraform
    runtime(tmux): Update syntax script
    * v9.1.0715: Not correctly parsing color names (after v9.1.0709)
    * v9.1.0714: GuiEnter_Turkish test may fail
    * v9.1.0713: Newline causes E749 in Ex mode
    * v9.1.0712: missing dependency of Test_gettext_makefile
    * v9.1.0711: test_xxd may file when using different xxd
    * v9.1.0710: popup window may hide part of Command line
    runtime(vim): Update syntax, improve user-command matching
    * v9.1.0709: GUIEnter event not found in Turkish locale
    runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items
    * v9.1.0708: Recursive window update does not account for reset skipcol
    runtime(nu): include filetype plugin
    * v9.1.0707: invalid cursor position may cause a crash
    * v9.1.0706: test_gettext fails when using shadow dir
    CI: Install locales-all package
    * v9.1.0705: Sorting of fuzzy filename completion is not stable
    translation(pt): update Portuguese/Brazilian menu translation
    runtime(vim): Update base-syntax, match bracket mark ranges
    runtime(doc): Update :help :command-complete list
    * v9.1.0704: inserting with a count is inefficient
    runtime(doc): use mkdir -p to save a command
    * v9.1.0703: crash with 2byte encoding and glob2regpat()
    runtime(hollywood): update syn highlight for If-Then statements
    and For-In-Loops
    * v9.1.0702: Patch 9.1.0700 broke CI
    * v9.1.0701: crash with NFA regex engine when searching for
    composing chars
    * v9.1.0700: crash with 2byte encoding and glob2regpat()
    * v9.1.0699: "dvgo" is not always an inclusive motion
    runtime(java): Provide support for syntax preview features
    * v9.1.0698: "Untitled" file not removed when running Test_crash1_3
    alone
    * v9.1.0697: heap-buffer-overflow in ins_typebuf
    * v9.1.0696: installing runtime files fails when using SHADOWDIR
    runtime(doc): fix typo
    * v9.1.0695: test_crash leaves Untitled file around
    translation(br): Update Brazilian translation
    translation(pt): Update menu_pt_br
    * v9.1.0694: matchparen is slow on a long line
    * v9.1.0693: Configure doesn't show result when not using python3
    stable abi
    * v9.1.0692: Wrong patlen value in ex_substitute()
    * v9.1.0691: stable-abi may cause segfault on Python 3.11
    runtime(vim): Update base-syntax, match :loadkeymap after colon and bar
    runtime(mane): Improve <Plug>ManBS mapping
    * v9.1.0690: cannot set special highlight kind in popupmenu
    translation(pt): Revert and fix wrong Portuguese menu translation
    files
    translation(pt): revert Portuguese menu translation
    translation(br): Update Brazilian translations
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    * v9.1.0689: buffer-overflow in do_search( with 'rightleft'
    runtime(vim): Improve heredoc handling for all embedded scripts
    * v9.1.0688: dereferences NULL pointer in check_type_is_value()
    * v9.1.0687: Makefile may not install desktop files
    runtime(man): Fix <Plug>ManBS
    runtime(java): Make the bundled &foldtext function optional
    runtime(netrw): Change line on `mx` if command output exists
    runtime(netrw): Fix `mf`-selected entry highlighting
    runtime(htmlangular): add html syntax highlighting
    translation(it): Fix filemode of Italian manpages
    runtime(doc): Update outdated man.vim plugin information
    runtime(zip): simplify condition to detect MS-Windows
    * v9.1.0686: zip-plugin has problems with special characters
    runtime(pandoc): escape quotes in &errorformat for pandoc
    translation(it): updated Italian manpage
    * v9.1.0685: too many strlen( calls in usercmd.c
    runtime(doc): fix grammar in :h :keeppatterns
    runtime(pandoc): refine pandoc compiler settings
    * v9.1.0684: completion is inserted on Enter with "noselect"
    translation(ru): update man pages
    * v9.1.0683: mode( returns wrong value with <Cmd> mapping
    runtime(doc): remove trailing whitespace in cmdline.txt
    * v9.1.0682: Segfault with uninitialized funcref
    * v9.1.0681: Analyzing failed screendumps is hard
    runtime(doc): more clarification for the :keeppatterns needed
    * v9.1.0680: VMS does not have defined uintptr_t
    runtime(doc): improve typedchar documentation for KeyInputPre autocmd
    runtime(dist): verify that executable is in $PATH
    translation(it): update Italian manpages
    runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677
    runtime(doc): update Makefile and make it portable between GNU and BSD
    * v9.1.0679: Rename from w_closing to w_locked is incomplete
    runtime(colors): update colorschemes
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    runtime(doc): Updating the examples in the xxd manpage
    translation(ru): Updated uganda.rux
    runtime(yaml): do not re-indent when commenting out lines
    * v9.1.0678: use-after-free in alist_add()
    * v9.1.0677 :keepp does not retain the substitute pattern
    translation(ja): Update Japanese translations to latest release
    runtime(netrw): Drop committed trace lines
    runtime(netrw): Error popup not always used
    runtime(netrw): ErrorMsg( may throw E121
    runtime(tutor): update Makefile and make it portable between GNU and BSD
    translation: improve the po/cleanup.vim script
    runtime(lang): update Makefile and make it portable between GNU and BSD
    * v9.1.0676: style issues with man pages
    * v9.1.0675: Patch v9.1.0674 causes problems
    runtime(dosbatch): Show %%i as an argument in syntax file
    runtime(dosbatch): Add syn-sync to syntax file
    runtime(sql, mysql): fix E169: Command too recursive with
    sql_type_default = "mysql"
    * v9.1.0674: compiling abstract method fails because of missing return
    runtime(javascript): fix a few issues with syntax higlighting
    runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var
    runtime(termdebug): Fix wrong test for balloon feature
    runtime(doc): Remove mentioning of the voting feature
    runtime(doc): add help tags for json + markdown global variables
    * v9.1.0673: too recursive func calls when calling super-class method
    runtime(syntax-tests): Facilitate the viewing of rendered screendumps
    runtime(doc): fix a few style issues
    * v9.1.0672: marker folds may get corrupted on undo
    * v9.1.0671 Problem:  crash with WinNewPre autocommand
    * v9.1.0670: po file encoding fails on *BSD during make
    translation(it): Update Italian translation
    translation: Stop using msgconv
    * v9.1.0669: stable python ABI not used by default
    Update .gitignore and .hgignore files
    * v9.1.0668: build-error with python3.12 and stable ABI
    translations: Update generated po files
    * v9.1.0667: Some other options reset curswant unnecessarily when set
    * v9.1.0666: assert_equal( doesn't show multibyte string correctly
    runtime(doc): clarify directory of Vim's executable vs CWD
    * v9.1.0665 :for loop
    runtime(proto): Add indent script for protobuf filetype
    * v9.1.0664: console vim did not switch back to main screen on exit
    runtime(zip): zip plugin does not work with Vim 9.0
    * v9.1.0663: zip test still resets 'shellslash' option
    runtime(zip): use defer to restore old settings
    runtime(zip): add a generic Message function
    runtime(zip): increment base version of zip plugin
    runtime(zip): raise minimum Vim version to * v9.0
    runtime(zip): refactor save and restore of options
    runtime(zip): remove test for fnameescape
    runtime(zip): use :echomsg instead of :echo
    runtime(zip): clean up and remove comments
    * v9.1.0662: filecopy( may return wrong value when readlink( fails
    * v9.1.0661: the zip plugin is not tested.
    runtime(zip): Fix for FreeBSD's unzip command
    runtime(doc): capitalize correctly
    * v9.1.0660: Shift-Insert does work on old conhost
    translation(it): update Italian manpage
    runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr
    runtime(zip): escape '[' on Unix as well
    * v9.1.0659: MSVC Makefile is a bit hard to read
    runtime(doc): fix typo in syntax.txt
    runtime(doc): -x is only available when compiled with crypt feature
    * v9.1.0658: Coverity warns about dereferencing NULL pointer.
    runtime(colors): update Todo highlight in habamax colorscheme
    * v9.1.0657: MSVC build time can be optimized
    * v9.1.0656: MSVC Makefile CPU handling can be improved
    * v9.1.0655: goaccess config file not recognized
    CI: update clang compiler to version 20
    runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore`
    * v9.1.0654: completion does not respect completeslash with fuzzy
    * v9.1.0653: Patch v9.1.0648 not completely right
    * v9.1.0652: too many strlen( calls in syntax.c
    * v9.1.0651 :append
    * v9.1.0650: Coverity warning in cstrncmp()
    * v9.1.0649: Wrong comment for "len" argument of call_simple_func()
    * v9.1.0648: [security] double-free in dialog_changed()
    * v9.1.0647: [security] use-after-free in tagstack_clear_entry
    runtime(doc): re-format tag example lines, mention ctags --list-kinds
    * v9.1.0646: imported function may not be found
    runtime(java): Document "g:java_space_errors" and "g:java_comment_strings"
    runtime(java): Cluster optional group definitions and their group links
    runtime(java): Tidy up the syntax file
    runtime(java): Tidy up the documentation for "ft-java-syntax"
    runtime(colors): update habamax scheme - tweak diff/search/todo colors
    runtime(nohlsearch): add missing loaded_hlsearch guard
    runtime(kivy): Updated maintainer info for syntax script
    Maintainers: Add maintainer for ondir ftplugin + syntax files
    runtime(netrw): removing trailing slash when copying files in same
    directory
    * v9.1.0645: wrong match when searching multi-byte char case-insensitive
    runtime(html): update syntax script to sync by 250 minlines by default
    * v9.1.0644: Unnecessary STRLEN( when applying mapping
    runtime(zip): Opening a remote zipfile don't work
    runtime(cuda): source c and cpp ftplugins
    * v9.1.0643: cursor may end up on invalid position
    * v9.1.0642: Check that mapping rhs starts with lhs fails if not
    simplified
    * v9.1.0641: OLE enabled in console version
    runtime(thrift): add ftplugin, indent and syntax scripts
    * v9.1.0640: Makefile can be improved
    * v9.1.0639: channel timeout may wrap around
    * v9.1.0638: E1510 may happen when formatting a message for smsg()
    * v9.1.0637: Style issues in MSVC Makefile
  - Update apparmor.vim to latest version (from AppArmor 4.0.2)
  - add support for "all" and "userns" rules, and new profile flags
  - Update to 9.1.0636:
    * 9.1.0636: filetype: ziggy files are not recognized
    * 9.1.0635: filetype: SuperHTML template files not recognized
    * 9.1.0634: Ctrl-P not working by default
    * 9.1.0633: Compilation warnings with `-Wunused-parameter`
    * 9.1.0632: MS-Windows: Compiler Warnings
    Add support for Files-Included in syntax script
    tweak documentation style a bit
    * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion
    * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme
    * 9.1.0629: Rename of pum hl_group is incomplete
    * 9.1.0628: MinGW: coverage files are not cleaned up
    * 9.1.0627: MinGW: build-error when COVERAGE is enabled
    * 9.1.0626: Vim9: need more tests with null objects
    include initial filetype plugin
    * 9.1.0625: tests: test output all translated messages for all translations
    * 9.1.0624: ex command modifiers not found
    * 9.1.0623: Mingw: errors when trying to delete non-existing files
    * 9.1.0622: MS-Windows: mingw-build can be optimized
    * 9.1.0621: MS-Windows: startup code can be improved
    * 9.1.0620: Vim9: segfauls with null objects
    * 9.1.0619: tests: test_popup fails
    * 9.1.0618: cannot mark deprecated attributes in completion menu
    * 9.1.0617: Cursor moves beyond first line of folded end of buffer
    * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles
    * 9.1.0615: Unnecessary STRLEN() in make_percent_swname()
    Add single-line comment syntax
    Add syntax test for comments
    Update maintainer info
    * 9.1.0614: tests: screendump tests fail due to recent syntax changes
    * 9.1.0613: tests: termdebug test may fail and leave file around
    Update base-syntax, improve :set highlighting
    Optionally highlight the :: token for method references
    * 9.1.0612: filetype: deno.lock file not recognized
    Use delete() for deleting directory
    escape filename before trying to delete it
    * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys
    correctly extract file from zip browser
    * 9.1.0610: filetype: OpenGL Shading Language files are not detected
    Fix endless recursion in netrw#Explore()
    * 9.1.0609: outdated comments in Makefile
    update syntax script
    Fix flow mapping key detection
    Remove orphaned YAML syntax dump files
    * 9.1.0608: Coverity warns about a few potential issues
    Update syntax script and remove syn sync
    * 9.1.0607: termdebug: uses inconsistent style
    * 9.1.0606: tests: generated files may cause failure in test_codestyle
    * 9.1.0605: internal error with fuzzy completion
    * 9.1.0604: popup_filter during Press Enter prompt seems to hang
    translation: Update Serbian messages translation
    * 9.1.0603: filetype: use correct extension for Dracula
    * 9.1.0602: filetype: Prolog detection can be improved
    fix more inconsistencies in assert function docs
    * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit
    Update base-syntax, improve :map highlighting
    * 9.1.0600: Unused function and unused error constants
    * 9.1.0599: Termdebug: still get E1023 when specifying arguments
    correct wrong comment options
    fix typo "a xterm" -> "an xterm"
    * 9.1.0598: fuzzy completion does not work with default completion
    * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key
    * 9.1.0596: filetype: devscripts config files are not recognized
    gdb file/folder check is now performed only in CWD.
    quote filename arguments using double quotes
    update syntax to SDC-standard 2.1
    minor updates.
    Cleanup :match and :loadkeymap syntax test files
    Update base-syntax, match types in Vim9 variable declarations
    * 9.1.0595: make errors out with the po Makefile
    * 9.1.0594: Unnecessary redraw when setting 'winfixbuf'
    using wrong highlight for UTF-8
    include simple syntax plugin
    * 9.1.0593: filetype: Asymptote files are not recognized
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    * 9.1.0592: filetype: Mediawiki files are not recognized
    * 9.1.0591: filetype: *.wl files are not recognized
    * 9.1.0590: Vim9: crash when accessing getregionpos() return value
    'cpoptions': Include "z" in the documented default
    * 9.1.0589: vi: d{motion} and cw work differently than expected
    update included colorschemes
    grammar fixes in options.txt
  - Add "Keywords" to gvim.desktop to make searching for gvim easier
  - Removed patches, as they're no longer required (refreshing them
    deleted their contents):
    * vim-7.3-help_tags.patch
    * vim-7.4-highlight_fstab.patch
  - Reorganise all applied patches in the spec file.
  - Update to 9.1.0588:
    * 9.1.0588: The maze program no longer compiles on newer clang
    runtime(typst): Add typst runtime files
    * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky
    * 9.1.0586: ocaml runtime files are outdated
    runtime(termdebug): fix a few issues
    * 9.1.0585: tests: test_cpoptions leaves swapfiles around
    * 9.1.0584: Warning about redeclaring f_id() non-static
    runtime(doc): Add hint how to load termdebug from vimrc
    runtime(doc): document global insert behavior
    * 9.1.0583: filetype: *.pdf_tex files are not recognized
    * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode
    * 9.1.0581: Various lines are indented inconsistently
    * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode
    * 9.1.0579: Ex command is still executed after giving E1247
    * 9.1.0578: no tests for :Tohtml
    * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim
    * 9.1.0576: tests: still an issue with test_gettext_make
    * 9.1.0575: Wrong comments in alt_tabpage()
    * 9.1.0574: ex: wrong handling of commands after bar
    runtime(doc): add a note for netrw bug reports
    * 9.1.0573: ex: no implicit print for single addresses
    runtime(vim): make &indentexpr available from the outside
    * 9.1.0572: cannot specify tab page closing behaviour
    runtime(doc): remove obsolete Ex insert behavior
    * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky
    runtime(logindefs): update syntax with new keywords
    * 9.1.0570: tests: test_gettext_make can be improved
    runtime(filetype): Fix Prolog file detection regex
    * 9.1.0569: fnamemodify() treats ".." and "../" differently
    runtime(mojo): include mojo ftplugin and indent script
    * 9.1.0568: Cannot expand paths from 'cdpath' setting
    * 9.1.0567: Cannot use relative paths as findfile() stop directories
    * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash
    * 9.1.0565: Stop directory doesn't work properly in 'tags'
    * 9.1.0564: id() can be faster
    * 9.1.0563: Cannot process any Key event
    * 9.1.0562: tests: inconsistency in test_findfile.vim
    runtime(fstab): Add missing keywords to fstab syntax
    * 9.1.0561: netbeans: variable used un-initialized (Coverity)
    * 9.1.0560: bindtextdomain() does not indicate an error
    * 9.1.0559: translation of vim scripts can be improved
    * 9.1.0558: filetype: prolog detection can be improved
    * 9.1.0557: moving in the buffer list doesn't work as documented
    runtime(doc): fix inconsistencies in :h file-searching
    * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages
    runtime(htmlangular): correct comment
    * 9.1.0555: filetype: angular ft detection is still problematic
    * 9.1.0554: :bw leaves jumplist and tagstack data around
    * 9.1.0553: filetype: *.mcmeta files are not recognized
    * 9.1.0552: No test for antlr4 filetype
    * 9.1.0551: filetype: htmlangular files are not properly detected
    * 9.1.0550: filetype: antlr4 files are not recognized
    * 9.1.0549: fuzzycollect regex based completion not working as expected
    runtime(doc): autocmd_add() accepts a list not a dict
    * 9.1.0548: it's not possible to get a unique id for some vars
    runtime(tmux): Update syntax script
    * 9.1.0547: No way to get the arity of a Vim function
    * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A
    runtime(hlsplaylist): include hlsplaylist ftplugin file
    runtime(doc): fix typo in :h ft-csv-syntax
    runtime(doc): Correct shell command to get $VIMRUNTIME into
    shell
    * 9.1.0545: MSVC conversion warning
    * 9.1.0544: filetype: ldapconf files are not recognized
    runtime(cmakecache): include cmakecache ftplugin file
    runtime(lex): include lex ftplugin file
    runtime(yacc): include yacc ftplugin file
    runtime(squirrel): include squirrel ftplugin file
    runtime(objcpp): include objcpp ftplugin file
    runtime(tf): include tf ftplugin file
    runtime(mysql): include mysql ftplugin file
    runtime(javacc): include javacc ftplugin file
    runtime(cabal): include cabal ftplugin file
    runtime(cuda): include CUDA ftplugin file
    runtime(editorconfig): include editorconfig ftplugin file
    runtime(kivy): update kivy syntax, include ftplugin
    runtime(syntax-tests): Stop generating redundant "*_* 99.dump"
    files
    * 9.1.0543: Behavior of CursorMovedC is strange
    runtime(vim): Update base-syntax, improve :match command
    highlighting
    * 9.1.0542: Vim9: confusing string() output for object functions
    * 9.1.0541: failing test with Vim configured without channel
    * 9.1.0540: Unused assignment in sign_define_cmd()
    runtime(doc): add page-scrolling keys to index.txt
    runtime(doc): add reference to xterm-focus-event from
    FocusGained/Lost
    * 9.1.0539: Not enough tests for what v9.1.0535 fixed
    runtime(doc): clarify how to re-init csv syntax file
    * 9.1.0538: not possible to assign priority when defining a sign
    * 9.1.0537: signed number detection for CTRL-X/A can be improved
    * 9.1.0536: filetype: zone files are not recognized
    * 9.1.0535: newline escape wrong in ex mode
    runtime(man): honor cmd modifiers before `g:ft_man_open_mode`
    runtime(man): use `nnoremap` to map to Ex commands
    * 9.1.0534: completion wrong with fuzzy when cycling back to original
    runtime(syntax-tests): Abort and report failed cursor progress
    runtime(syntax-tests): Introduce self tests for screen dumping
    runtime(syntax-tests): Clear and redraw the ruler line with
    the shell info
    runtime(syntax-tests): Allow for folded and wrapped lines in
    syntax test files
    * 9.1.0533: Vim9: need more tests for nested objects equality
    CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries
    runtime(doc): Remove wrong help tag CTRL-SHIFT-CR
    * 9.1.0532: filetype: Cedar files not recognized
    runtime(doc): document further keys that scroll page up/down
    * 9.1.0531: resource leak in mch_get_random()
    runtime(tutor): Fix wrong spanish translation
    runtime(netrw): fix remaining case of register clobber
    * 9.1.0530: xxd: MSVC warning about non-ASCII character
    * 9.1.0529: silent! causes following try/catch to not work
    runtime(rust): use shiftwidth() in indent script
    * 9.1.0528: spell completion message still wrong in translations
    * 9.1.0527: inconsistent parameter in Makefiles for Vim executable
    * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer
    runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config
    * 9.1.0525: Right release selects immediately when pum is truncated.
    * 9.1.0524: the recursive parameter in the *_equal functions can be removed
    runtime(termdebug): Add Deprecation warnings
    * 9.1.0523: Vim9: cannot downcast an object
    * 9.1.0522: Vim9: string(object) hangs for recursive references
    * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13
    * 9.1.0520: Vim9: incorrect type checking for modifying lists
    runtime(manpager): avoid readonly prompt
    * 9.1.0519: MS-Windows: libvterm compilation can be optimized
    * 9.1.0518: initialize the random buffer can be improved
    * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak
    runtime(terraform): Add filetype plugin for terraform
    runtime(dockerfile): enable spellchecking of comments in
    syntax script
    runtime(doc): rename variable for pandoc markdown support
    runtime(doc): In builtin overview use {buf} as param for
    appendbufline/setbufline
    runtime(doc): clarify, that register 1-* 9 will always be shifted
    runtime(netrw): save and restore register 0-* 9, a and unnamed
    runtime(termdebug): Refactored StartDebug_term and EndDebug
    functions
    runtime(java): Compose "g:java_highlight_signature" and
    "g:java_highlight_functions"
    * 9.1.0516: need more tests for nested dicts and list comparision
    * 9.1.0515: Vim9: segfault in object_equal()
    * 9.1.0514: Vim9: issue with comparing objects recursively
    runtime(termdebug): Change some variables to Enums
    runtime(vim): Update base-syntax, fix function tail comments
    * 9.1.0513: Vim9: segfault with object comparison
  - Update to 9.1.0512:
    * Mode message for spell completion doesn't match allowed keys
    * CursorMovedC triggered wrongly with setcmdpos()
    * update runtime files
    * CI: test_gettext fails on MacOS14 + MSVC Win
    * not possible to translate Vim script messages
    * termdebug plugin can be further improved
    * add gomod filetype plugin
    * hard to detect cursor movement in the command line
    * Optionally highlight parameterised types
    * filetype: .envrc & .prettierignore not recognized
    * filetype: Faust files are not recognized
    * inner-tag textobject confused about ">" in attributes
    * cannot use fuzzy keyword completion
    * Remove the group exclusion list from @javaTop
    * wrong return type for execute() function
    * MS-Windows: too much legacy code
    * too complicated mapping restore in termdebug
    * simplify mapping
    * cannot switch buffer in a popup
    * MS-Windows: doesn't handle symlinks properly
    * getcmdcompltype() interferes with cmdline completion
    * termdebug can be further improved
    * update htmldjango detection
    * Improve Turkish documentation
    * include a simple csv filetype and syntax plugin
    * include the the simple nohlsearch package
    * matched text is highlighted case-sensitively
    * Matched text isn't highlighted in cmdline pum
    * Fix typos in several documents
    * clarify when text properties are cleared
    * improve the vim-shebang example
    * revert unintended formatting changes for termdebug
    * Add a config variable for commonly used compiler options
    * Wrong matched text highlighted in pum with 'rightleft'
    * bump length of character references in syntax script
    * properly check mapping variables using null_dict
    * fix KdlIndent and kdlComment in indent script
    * Test for patch 9.1.0489 doesn't fail without the fix
    * Fold multi-line comments with the syntax kind of &fdm
    * using wrong type for PlaceSign()
    * filetype: Vim-script files not detected by shebang line
    * revert unintended change to zip#Write()
    * add another tag for vim-shebang feature
    * Cmdline pum doesn't work properly with 'rightleft'
    * minor style problems with patch 9.1.0487
    * default completion may break with fuzzy
    * Wrong padding for pum "kind" with 'rightleft'
    * Update base-syntax, match shebang lines
    * MS-Windows: handle files with spaces properly
    * Restore HTML syntax file tests
    * completed item not update on fuzzy completion
    * filetype: Snakemake files are not recognized
    * make TermDebugSendCommand() a global function again
    * close all buffers in the same way
    * Matched text shouldn't be highlighted in "kind" and "menu"
    * fix wrong helptag for :defer
    * Update base-syntax, match :sleep arg
    * include Georgian keymap
    * Sorting of completeopt+=fuzzy is not stable
    * correctly test for windows in NetrwGlob()
    * glob() on windows fails with [] in directory name
    * rewrite mkdir() doc and simplify {flags} meaning
    * glob() not sufficiently tested
    * update return type for job_info()
    * termdebug plugin needs more love
    * correct return types for job_start() and job_status()
    * Update base-syntax, match :catch and :throw args
    * Include element values in non-marker annotations
    * Vim9: term_getjob() throws an exception on error
    * fuzzy string matching executed when not needed
    * fuzzy_match_str_with_pos() does unnecessary list operations
    * restore description of "$" in col() and virtcol()
    * deduplicate getpos(), line(), col(), virtcol()
    * Update g:vimsyn_comment_strings dump file tests
    * Use string interpolation instead of string concat
    * potential deref of NULL pointer in fuzzy_match_str_with_pos
    * block_editing errors out when using <enter>
    * Update base-syntax, configurable comment string highlighting
    * fix typos in syntax.txt
    * Cannot see matched text in popup menu
    * Update base-syntax, match multiline continued comments
    * clarify documentation for "v" position at line()
    * cmod_split modifier is always reset in term_start()
    * remove line-continuation characters
    * use shiftwidth() instead of &tabstop in indent script
    * Remove orphaned screen dump files
    * include syntax, indent and ftplugin files
    * CI: Test_ColonEight() fails on github runners
    * add missing Enabled field in syntax script
    * basic svelte ftplugin file
    * term_start() does not clear vertical modifier
    * fix mousemodel restoration by comparing against null_string
    * Added definitions of Vim scripts and plugins
    * Exclude lambda expressions from _when_ _switch-case_ label clauses
    * Fix saved_mousemodel check
    * Inconsistencies between functions for option flags
    * Crash when using autocmd_get() after removing event inside autocmd
    * Fix small style issues
    * add return type info for Vim function descriptions
    * Update Italian Vim manpage
    * disable the q mapping
    * Change 'cms' for C++ to '// %s'
    * fix type mismatch error
    * Fix wrong email address
    * convert termdebug plugin to Vim9 script
  - Update to 9.1.0470:
    * tests Test_ColonEight_MultiByte() fails sporadically
    * Cannot have buffer-local value for 'completeopt'
    * GvimExt does not consult HKEY_CURRENT_USER
    * typos in some comments
    * runtime(vim): Update base-syntax, allow whitespace before
    :substitute pattern
    * Missing comments for fuzzy completion
    * runtime(man): update Vim manpage
    * runtime(comment): clarify the usage of 'commentstring' option
    value
    * runtime(doc): clarify how fuzzy 'completeopt' should work
    * runtime(netrw): prevent accidental data loss
    * missing filecopy() function
    * no whitespace padding in commentstring option in ftplugins
    * no fuzzy-matching support for insert-completion
    * eval5() and eval7 are too complex
    * too many strlen() calls in drawline.c
    * filetype lintstagedrc files are not recognized
    * Vim9 import autoload does not work with symlink
    * Coverity complains about division by zero
    * tests test_gui fails on Wayland
    * Left shift is incorrect with vartabstop and shiftwidth=0
    * runtime(doc): clarify 'shortmess' flag "S"
    * MS-Windows compiler warning for size_t to int conversion
    * runtime(doc): include some vim9 script examples in the help
    * minor issues in test_filetype with rasi test
    * filetype rasi files are not recognized
    * runtime(java): Improve the matching of lambda expressions
    * Configure checks for libelf unnecessarily
    * No test for escaping '<' with shellescape()
    * check.vim complains about overlong comment lines
    * translation(it): Update Italian translation
    * evalc. code too complex
    * MS-Windows Compiler warnings
  - Update to 9.1.0448:
    * compiler warning in eval.c
    * remove remaining css code
    * Add ft_hare.txt to Reference Manual TOC
    * re-generate vim syntax from generator
    * fix syntax vim bug
    * completion may be wrong when deleting all chars
    * getregionpos() inconsistent for partly-selected multibyte char
    * fix highlighting nested and escaped quotes in string props
    * remove the indent plugin since it has too many issues
    * update Debian runtime files
    * Coverity warning after 9.1.0440
    * Not enough tests for getregion() with multibyte chars
    * Can't use blockwise selection with width for getregion()
    * update outdated syntax files
    * fix floating_modifier highlight
    * hare runtime files outdated
    * getregionpos() can't properly indicate positions beyond eol
    * function get_lval() is too long
    * Cannot filter the history
    * Wrong Ex command executed when :g uses '?' as delimiter
    * support floating_modifier none; revert broken highlighting
    * Motif requires non-const char pointer for XPM  data
    * Crash when using '?' as separator for :s
    * filetype: cygport files are not recognized
    * make errors trying to access autoload/zig
    * Wrong yanking with exclusive selection and ve=all
    * add missing help tags file
    * Ancient XPM preprocessor hack may cause build errors
    * include basic rescript ftplugin file
    * eval.c is too long
    * getregionpos() doesn't handle one char selection
    * check for gdb file/dir before using as buffer name
    * refactor zig ftplugin, remove auto format
    * Coverity complains about eval.c refactor
    * Tag guessing leaves wrong search history with very short names
    * some issues with termdebug mapping test
    * update matchit plugin to v1.20
    * too many strlen() calls in search.c
    * set commentstring option
    * update vb indent plugin as vim9script
    * filetype: purescript files are not recognized
    * filetype: slint files are not recognized
    * basic nim ftplugin file for comments
    * Add Arduino ftplugin and indent files
    * include basic typst ftplugin file
    * include basic prisma ftplugin file
    * include basic v ftplugin for comment support
    * getregionpos() wrong with blockwise mode and multibyte
    * function echo_string_core() is too long
    * hyprlang files are not recognized
    * add basic dart ftplugin file
    * basic ftplugin file for graphql
    * mention comment plugin at :h 'commentstring'
    * set commentstring for sql files in ftplugin
    * :browse oldfiles prompts even with single entry
    * eval.c not sufficiently tested
    * clarify why E195 is returned
    * clarify temporary file clean up
    * fix :NoMatchParen not working
    * Cannot move to previous/next rare word
    * add basic ftplugin file for sshdconfig
    * if_py: find_module has been removed in Python 3.12.0a7
    * some screen dump tests can be improved
    * Some functions are not tested
    * clarify instal instructions for comment package
    * Unable to leave long line with 'smoothscroll' and 'scrolloff'
    * fix typo in vim9script help file
    * Remove trailing spaces
    * clarify {special} argument for shellescape()
  - update to 9.1.0413
    * smoothscroll may cause infinite loop
    * add missing entries for the keys CTRL-W g<Tab> and <C-Tab>
    * update vi_diff.txt: add default value for 'flash'
    * typo in regexp_bt.c in DEBUG code
    * allow indented commands
    * Fix wrong define regex in ftplugin
    * Filter out non-Latin-1 characters for syntax tests
    * prefer scp over pscp
    * fix typo in usr_52.txt
    * too long functions in eval.c
    * warning about uninitialized variable
    * too many strlen() calls in the regexp engine
    * E16 fix, async keyword support for define
    * Stuck with long line and half-page scrolling
    * Divide by zero with getmousepos() and 'smoothscroll'
    * update and remove  some invalid links
    * update translation of xxd manpage
    * Recursively delete directories by default with netrw delete command
    * Strive to remain compatible for at least Vim 7.0
    * tests: xxd buffer overflow fails on 32-bit
    * Stop handpicking syntax groups for @javaTop
    * [security] xxd: buffer-overflow with specific flags
    * Vim9: not able to import file from start dir
    * filetype: mdd files detected as zsh filetype
    * filetype: zsh module files are not recognized
    * Remove hardcoded private.ppk logic from netrw
    * Vim9: confusing error message for unknown type
    * block_editing errors out when using del
    * add new items to scripts section in syntax plugin
    * Vim9: imported vars are not properly type checked
    * Wrong display with 'smoothscroll' when changing quickfix list
    * filetype: jj files are not recognized
    * getregionpos() may leak memory on error
    * The CODEOWNERS File is not useful
    * Remove and cleanup Win9x legacy from netrw
    * add MsgArea to 'highlight' option description
    * Cannot get a list of positions describing a region
    * Fix digit separator in syntax script for octals and floats
    * Update link to Wikipedia Vi page
    * clear $MANPAGER in ftplugin before shelling out
    * Fix typos in help documents
    * 'viewdir' not respecting $XDG_CONFIG_HOME
    * tests: Vim9 debug tests may be flaky
    * correct getscriptinfo() example
    * Vim9: could improve testing
    * test_sound fails on macos-12
    * update Serbian menu
    * update Slovak menu
    * update Slovenian menu
    * update Portuguese menu
    * update Dutch menu
    * update Korean menu
    * update Icelandic menu
    * update Czech menu
    * update Afrikaans menu
    * update German menu
    * filetype: inko files are not recognized
    * filetype: templ files are not recognized
    * cursor() and getregion() don't handle v:maxcol well
    * Vim9: null value tests not sufficient
    * update Catalan menu
    * filetype: stylus files not recognized
    * update spanish menu localization
    * regenerate helptags
    * Vim9: crash with null_class and null_object
    * Add tags about lazyloading of menu
    * tests: vt420 terminfo entry may not be found
    * filetype: .out files recognized as tex files
    * filetype: Kbuild files are not recognized
    * cbuffer and similar commands don't accept a range
    * Improve the recognition of the "indent" method declarations
    * Fix a typo in usr_30.txt
    * remove undefined var s:save_cpoptions and add include setting
    * missing setlocal in indent plugin
    * Calculating line height for unnecessary amount of lines
    * improve syntax file performance
    * There are a few typos
    * Vim9: no comments allowed after class vars
    * CI: remove trailing white space in documentation
    * Formatting text wrong when 'breakindent' is set
    * Add oracular (24.10) as Ubuntu release name
    * Vim9: Trailing commands after class/enum keywords ignored
    * tests: 1-second delay after Test_BufEnter_botline()
    * update helptags for jq syntax
    * include syntax, ftplugin and compiler plugin
    * fix typo synconcealend -> synconcealed
    * include a simple comment toggling plugin
    * wrong botline in BufEnter
    * clarify syntax vs matching mechanism
    * fix undefined variable in indent plugin
    * ops.c code uses too many strlen() calls
    * Calling CLEAR_FIELD() on the same struct twice
    * Vim9: compile_def_function() still too long
    * Update Serbian messages
    * clarify the effect of setting the shell to powershell
    * Improve the recognition of the "style" method declarations
    * Vim9: problem when importing autoloaded scripts
    * compile_def_function is too long
    * filetype: ondir files are not recognized
    * Crash when typing many keys with D- modifier
    * tests: test_vim9_builtin is a bit slow
    * update documentation
    * change the download URL of "libsodium"
    * tests: test_winfixbuf is a bit slow
    * Add filetype, syntax and indent plugin for Astro
    * expanding rc config files does not work well
    * Vim9: vim9type.c is too complicated
    * Vim9: does not handle autoloaded variables well
    * minor spell fix in starting.txt
    * wrong drawing in GUI with setcellwidth()
    * Add include and suffixesadd
    * Page scrolling should place cursor at window boundaries
    * align command line table
    * minor fixes to starting.txt
    * fix comment definition in filetype plugin
    * filetype: flake.lock files are not recognized
    * runtime(uci): No support for uci file types
    * Support "g:ftplugin_java_source_path" with archived files
    * tests: Test_autoload_import_relative_compiled fails on Windows
    * Finding cmd modifiers and cmdline-specials is inefficient
    * No test that completing a partial mapping clears 'showcmd'
    * tests: test_vim9_dissamble may fail
    * Vim9: need static type for typealias
    * X11 does not ignore smooth scroll event
    * A few typos in test_xdg when testing gvimrc
    * Patch v9.1.0338 fixed sourcing a script with import
    * Problem: gvimrc not sourced from XDG_CONFIG_HOME
    * Cursor wrong after using setcellwidth() in terminal
    * 'showcmd' wrong for partial mapping with multibyte
    * tests: test_taglist fails when 'helplang' contains non-english
    * Problem: a few memory leaks are found
    * Problem: Error with matchaddpos() and empty list
    * tests: xdg test uses screen dumps
    * Vim9: import through symlinks not correctly handled
    * Missing entry for XDG vimrc file in :version
    * tests: typo in test_xdg
    * runtime(i3config/swayconfig): update syntax scripts
    * document pandoc compiler and enable configuring arguments
    * String interpolation fails for List type
    * No test for highlight behavior with 'ambiwidth'
    * tests: test_xdg fails on the appimage repo
    * tests: some assert_equal() calls have wrong order of args
    * make install does not install all files
    * runtime(doc): fix typos in starting.txt
  - Updated to version 9.1 with patch level 0330, fixes the following problems
    * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1
  - refreshed vim-7.3-filetype_spec.patch
  - refreshed vim-7.3-filetype_ftl.patch
  - Update spec.skeleton to use autosetup in place of setup macro.
  - for the complete list of changes see
    https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330

++++ vim:

  - Fix for bsc#1231373 / CVE-2024-47814.
  - Fix for bsc#1229238 / CVE-2024-43374.
  - update to 9.1.0836
    * 9.1.0836: The vimtutor can be improved
    * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu'
    * 9.1.0834: tests: 2html test fails
    * 9.1.0833: CI: recent ASAN changes do not work for indent tests
    * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal
    * runtime(doc): update help-toc description
    * runtime(2html): Make links use color scheme colors in TOhtml
    * 9.1.0831: 'findexpr' can't be used as lambad or Funcref
    * Filelist: include helptoc package
    * runtime(doc): include a TOC Vim9 plugin
    * Filelist: ignore .git-blame-ignore-revs
    * 9.1.0830: using wrong highlight group for spaces for popupmenu
    * runtime(typst): synchronize updates from the upstream typst.vim
    * git: ignore reformatting commit for git-blame (after v9.1.0829)
    * 9.1.0829: Vim source code uses a mix of tabs and spaces
    * 9.1.0828: string_T struct could be used more often
    * 9.1.0827: CI: tests can be improved
    * runtime(doc): remove stray sentence in pi_netrw.txt
    * 9.1.0826: filetype: sway files are not recognized
    * runtime(doc): Include netrw-gp in TOC
    * runtime(doc): mention 'iskeyword' at :h charclass()
    * runtime(doc): update help tags
    * 9.1.0825: compile error for non-diff builds
    * runtime(netrw): fix E874 when browsing remote directory which contains `~` character
    * runtime(doc): update coding style documentation
    * runtime(debversions): Add plucky (25.04) as Ubuntu release name
    * 9.1.0824: too many strlen() calls in register.c
    * 9.1.0823: filetype: Zephyr overlay files not recognized
    * runtime(doc): Clean up minor formatting issues for builtin functions
    * runtime(netrw): make :Launch/Open autoloadable
    * runtime(netrw): fix regression with x mapping on Cygwin
    * runtime(netrw): fix filetype detection for remote files
    * 9.1.0822: topline might be changed in diff mode unexpectedly
    * CI: huge linux builds should also run syntax & indent tests
    * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument
    * 9.1.0820: tests: Mac OS tests are too flaky
    * runtime(awk): Highlight more awk comments in syntax script
    * runtime(netrw): add missing change for s:redir()
    * 9.1.0819: tests: using findexpr and imported func not tested
    * runtime(netrw): improve netrw's open-handling further
    * runtime(netrw): fix syntax error in netrwPlugin.vim
    * runtime(netrw): simplify gx file handling
    * 9.1.0818: some global functions are only used in single files
    * 9.1.0817: termdebug: cannot evaluate expr in a popup
    * runtime(defaults): Detect putty terminal and switch to dark background
    * 9.1.0816: tests: not clear what tests cause asan failures
    * runtime(doc): Remove some completed items from todo.txt
    * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position
    * runtime(syntax-tests): tiny vim fails because of line-continuation
    * 9.1.0814: mapset() may remove unrelated mapping
    * 9.1.0813: no error handling with setglobal and number types
    * 9.1.0812: Coverity warns about dereferencing NULL ptr
    * 9.1.0811: :find expansion does not consider 'findexpr'
    * 9.1.0810: cannot easily adjust the |:find| command
    * 9.1.0809: filetype: petalinux config files not recognized
    * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll'
    * 9.1.0807: tests: having 'nolist' in modelines isn't always desired
    * 9.1.0806: tests: no error check when setting global 'briopt'
    * 9.1.0805: tests: minor issues in gen_opt_test.vim
    * 9.1.0804: tests: no error check when setting global 'cc'
    * 9.1.0803: tests: no error check when setting global 'isk'
    * 9.1.0802: tests: no error check when setting global 'fdm' to empty value
    * 9.1.0801: tests: no error check when setting global 'termwinkey'
    * 9.1.0800: tests: no error check when setting global 'termwinsize'
    * runtime(doc): :ownsyntax also resets 'spelloptions'
    * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive
    * runtime(doc): Fix wrong Mac default options
    * 9.1.0798: too many strlen() calls in cmdhist.c
    * 9.1.0797: testing of options can be further improved
    * 9.1.0796: filetype: libtool files are not recognized
    * (typst): add folding to typst ftplugin
    * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke()
    * 9.1.0795: filetype: Vivado memory info file are not recognized
    * 9.1.0794: tests: tests may fail on Windows environment
    * runtime(doc): improve the :colorscheme documentation
    * 9.1.0793: xxd: -e does add one extra space
    * 9.1.0792: tests: Test_set_values() is not comprehensive enough
    * runtime(swayconfig): add flag for bindsym/bindcode to syntax script
    * 9.1.0791: tests: errors in gen_opt_test.vim are not shown
    * runtime(compiler): check for compile_commands in build dirs for cppcheck
    * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib)
    * runtime(help): Update help syntax
    * runtime(help): fix end of sentence highlight in code examples
    * runtime(jinja): Support jinja syntax as secondary filetype
    * 9.1.0789: tests: ':resize + 5' has invalid space after '+'
    * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot
    * 9.1.0787: cursor position changed when using hidden terminal
    * 9.1.0786: tests: quickfix update test does not test location list
    * runtime(doc): add some docs for file-watcher programs
    * CI: uploading failed screendumps still fails on Cirrus CI
    * 9.1.0785: cannot preserve error position when setting quickfix list
    * 9.1.0784: there are several problems with python 3.13
    * 9.1.0783: 'spell' option setting has problems
    * 9.1.0782: tests: using wrong neomuttlog file name
    * runtime(doc): add preview flag to statusline example
    * 9.1.0781: tests: test_filetype fails
    * 9.1.0780: MS-Windows: incorrect Win32 error checking
    * 9.1.0779: filetype: neomuttlog files are not recognized
    * 9.1.0778: filetype: lf config files are not recognized
    * runtime(comment): fix commment toggle with mixed tabs & spaces
    * runtime(misc): Use consistent "Vim script" spelling
    * runtime(gleam): add ftplugin for gleam files
    * runtime(doc): link help-writing from write-local-help
    * 9.1.0777: filetype: Some upstream php files are not recognized
    * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups
    * runtime(doc): mention conversion rules for remote_expr()
    * runtime(tutor): Fix missing :s command in spanish translation section 4.4
    * 9.1.0776: test_strftime may fail because of missing TZ data
    * translation(am): Add Armenian language translation
    * 9.1.0775: tests: not enough tests for setting options
    * 9.1.0774: "shellcmdline" doesn't work with getcompletion()
    * 9.1.0773: filetype: some Apache files are not recognized
    * 9.1.0772: some missing changes from v9.1.0771
    * 9.1.0771: completion attribute hl_group is confusing
    * 9.1.0770: current command line completion is a bit limited
    * 9.1.0769: filetype: MLIR files are not recognized
    * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen
    * runtime(nasm): Update nasm syntax script
    * 9.1.0767: A condition is always true in ex_getln.c
    * runtime(skill): Update syntax file to fix string escapes
    * runtime(help): highlight CTRL-<Key> correctly
    * runtime(doc): add missing usr_52 entry to toc
    * 9.1.0766: too many strlen() calls in ex_getln.c
    * runtime(doc): correct `vi` registers 1-9 documentation error
    * 9.1.0765: No test for patches 6.2.418 and 7.3.489
    * runtime(spec): set comments and commentstring options
    * NSIS: Include libgcc_s_sjlj-1.dll again
    * runtime(doc): clarify the effect of 'startofline' option
    * 9.1.0764: [security]: use-after-free when closing a buffer
    * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting
    * 9.1.0763: tests: cannot run single syntax tests
    * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly
    * 9.1.0761: :cd completion fails on Windows with backslash in path
    * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails
    * 9.1.0759: screenpos() may return invalid position
    * runtime(misc): unset compiler in various ftplugins
    * runtime(doc): update formatting and syntax
    * runtime(compiler): add cppcheck linter compiler plugin
    * runtime(doc): Fix style in documents
    * runtime(doc): Fix to two-space convention in user manual
    * runtime(comment): consider &tabstop in lines after whitespace indent
    * 9.1.0758: it's possible to set an invalid key to 'wildcharm'
    * runtime(java): Manage circularity for every :syn-included syntax file
    * 9.1.0757: tests: messages files contains ANSI escape sequences
    * 9.1.0756: missing change from patch v9.1.0754
    * 9.1.0755: quickfix list does not handle hardlinks well
    * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters
    * runtime(systemd): small fixes to &keywordprg in ftplugin
    * CI: macos-12 runner is being sunset, switch to 13
    * 9.1.0754: fixed order of items in insert-mode completion menu
    * runtime(comment): commenting might be off by one column
    * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll'
    * 9.1.0752: can set 'cedit' to an invalid value
    * runtime(doc): add `usr` tag to usr_toc.txt
    * 9.1.0751: Error callback for term_start() not used
    * 9.1.0750: there are some Win9x legacy references
    * runtime(java): Recognise the CommonMark form (///) of Javadoc comments
    * 9.1.0749: filetype: http files not recognized
    * runtime(comment): fix syntax error
    * CI: uploading failed screendump tests does not work Cirrus
    * 9.1.0748: :keep* commmands are sometimes misidentified as :k
    * runtime(indent): allow matching negative numbers for gnu indent config file
    * runtime(comment): add gC mapping to (un)comment rest of line
    * 9.1.0747: various typos in repo found
    * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals
    * runtime(doc): reformat gnat example
    * runtime(doc): reformat ada_standard_types section
    * 9.1.0745: filetype: bun and deno history files not recognized
    * runtime(glvs): Correct the tag name of glvs-autoinstal
    * runtime(doc): include short form for :earlier/:later
    * runtime(doc): remove completed TODO
    * 9.1.0744: filetype: notmuch configs are not recognised
    * 9.1.0743: diff mode does not handle overlapping diffs correctly
    * runtime(glvs): fix a few issues
    * runtime(doc): Fix typo in :help :command-modifiers
    * 9.1.0742: getcmdprompt() implementation can be improved
    * runtime(docs): update `:set?` command behavior table
    * runtime(doc): update vim90 to vim91 in docs
    * runtime(doc): fix typo in :h dos-colors
    * 9.1.0741: No way to get prompt for input()/confirm()
    * runtime(doc): fix typo in version9.txt nrformat -> nrformats
    * runtime(rmd,rrst): 'fex' option not properly restored
    * runtime(netrw): remove extraneous closing bracket
    * 9.1.0740: incorrect internal diff with empty file
    * 9.1.0739: [security]: use-after-free in ex_getln.c
    * runtime(filetype): tests: Test_filetype_detection() fails
    * runtime(dist): do not output a message if executable is not found
    * 9.1.0738: filetype: rapid files are not recognized
    * runtime(modconf): remove erroneous :endif in ftplugin
    * runtime(lyrics): support multiple timestamps in syntax script
    * runtime(java): Optionally recognise _module_ import declarations
    * runtime(vim): Update base-syntax, improve folding function matches
    * CI: upload failed screendump tests also for Cirrus
    * 9.1.0737: tests: screendump tests may require a bit more time
    * runtime(misc): simplify keywordprg in various ftplugins
    * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels
    * runtime(zsh,sh): set and unset compiler in ftplugin
    * runtime(netrw): using inefficient highlight pattern for 'mf'
    * 9.1.0736: Unicode tables are outdated
    * 9.1.0735: filetype: salt files are not recognized
    * 9.1.0734: filetype: jinja files are not recognized
    * runtime(zathurarc): add double-click-follow to syntax script
    * translation(ru): Updated messages translation
    * translation(it): updated xxd man page
    * translation(ru): updated xxd man page
    * 9.1.0733: keyword completion does not work with fuzzy
    * 9.1.0732: xxd: cannot use -b and -i together
    * runtime(java): Highlight javaConceptKind modifiers with StorageClass
    * runtime(doc): reword and reformat how to use defaults.vim
    * 9.1.0731: inconsistent case sensitive extension matching
    * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return
    * runtime(netrw): delete confirmation not strict enough
    * 9.1.0730: Crash with cursor-screenline and narrow window
    * 9.1.0729: Wrong cursor-screenline when resizing window
    * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
    * runtime(doc): clarify the effect of the timeout for search()-functions
    * runtime(idlang): update syntax script
    * runtime(spec): Recognize epoch when making spec changelog in ftplugin
    * runtime(spec): add file triggers to syntax script
    * 9.1.0727: too many strlen() calls in option.c
    * runtime(make): add compiler/make.vim to reset compiler plugin settings
    * runtime(java): Recognise all available standard doclet tags
    * 9.1.0726: not using correct python3 API with dynamic linking
    * runtime(dosini): Update syntax script, spellcheck comments only
    * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation
    * 9.1.0725: filetype: swiftinterface files are not recognized
    * runtime(pandoc): Update compiler plugin to use actual 'spelllang'
    * runtime(groff): Add compiler plugin for groff
    * 9.1.0724: if_python: link error with python 3.13 and stable ABI
    * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13
    * 9.1.0722: crash with large id in text_prop interface
    * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME
    * runtime(glvs): update GetLatestVimScripts plugin
    * runtime(doc): Fix typo in :help :hide text
    * runtime(doc): buffers can be re-used
    * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs
    * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid
    * runtime(doc): Update version9.txt and mention $MYVIMDIR
  - Update to 9.1.0718:
    * v9.1.0718: hard to know the users personal Vim Runtime Directory
    * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers()
    Maintainers: fix typo in author name
    * v9.1.0716: resetting setcellwidth( doesn't update the screen
    runtime(hcl,terraform): Add runtime files for HCL and Terraform
    runtime(tmux): Update syntax script
    * v9.1.0715: Not correctly parsing color names (after v9.1.0709)
    * v9.1.0714: GuiEnter_Turkish test may fail
    * v9.1.0713: Newline causes E749 in Ex mode
    * v9.1.0712: missing dependency of Test_gettext_makefile
    * v9.1.0711: test_xxd may file when using different xxd
    * v9.1.0710: popup window may hide part of Command line
    runtime(vim): Update syntax, improve user-command matching
    * v9.1.0709: GUIEnter event not found in Turkish locale
    runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items
    * v9.1.0708: Recursive window update does not account for reset skipcol
    runtime(nu): include filetype plugin
    * v9.1.0707: invalid cursor position may cause a crash
    * v9.1.0706: test_gettext fails when using shadow dir
    CI: Install locales-all package
    * v9.1.0705: Sorting of fuzzy filename completion is not stable
    translation(pt): update Portuguese/Brazilian menu translation
    runtime(vim): Update base-syntax, match bracket mark ranges
    runtime(doc): Update :help :command-complete list
    * v9.1.0704: inserting with a count is inefficient
    runtime(doc): use mkdir -p to save a command
    * v9.1.0703: crash with 2byte encoding and glob2regpat()
    runtime(hollywood): update syn highlight for If-Then statements
    and For-In-Loops
    * v9.1.0702: Patch 9.1.0700 broke CI
    * v9.1.0701: crash with NFA regex engine when searching for
    composing chars
    * v9.1.0700: crash with 2byte encoding and glob2regpat()
    * v9.1.0699: "dvgo" is not always an inclusive motion
    runtime(java): Provide support for syntax preview features
    * v9.1.0698: "Untitled" file not removed when running Test_crash1_3
    alone
    * v9.1.0697: heap-buffer-overflow in ins_typebuf
    * v9.1.0696: installing runtime files fails when using SHADOWDIR
    runtime(doc): fix typo
    * v9.1.0695: test_crash leaves Untitled file around
    translation(br): Update Brazilian translation
    translation(pt): Update menu_pt_br
    * v9.1.0694: matchparen is slow on a long line
    * v9.1.0693: Configure doesn't show result when not using python3
    stable abi
    * v9.1.0692: Wrong patlen value in ex_substitute()
    * v9.1.0691: stable-abi may cause segfault on Python 3.11
    runtime(vim): Update base-syntax, match :loadkeymap after colon and bar
    runtime(mane): Improve <Plug>ManBS mapping
    * v9.1.0690: cannot set special highlight kind in popupmenu
    translation(pt): Revert and fix wrong Portuguese menu translation
    files
    translation(pt): revert Portuguese menu translation
    translation(br): Update Brazilian translations
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    * v9.1.0689: buffer-overflow in do_search( with 'rightleft'
    runtime(vim): Improve heredoc handling for all embedded scripts
    * v9.1.0688: dereferences NULL pointer in check_type_is_value()
    * v9.1.0687: Makefile may not install desktop files
    runtime(man): Fix <Plug>ManBS
    runtime(java): Make the bundled &foldtext function optional
    runtime(netrw): Change line on `mx` if command output exists
    runtime(netrw): Fix `mf`-selected entry highlighting
    runtime(htmlangular): add html syntax highlighting
    translation(it): Fix filemode of Italian manpages
    runtime(doc): Update outdated man.vim plugin information
    runtime(zip): simplify condition to detect MS-Windows
    * v9.1.0686: zip-plugin has problems with special characters
    runtime(pandoc): escape quotes in &errorformat for pandoc
    translation(it): updated Italian manpage
    * v9.1.0685: too many strlen( calls in usercmd.c
    runtime(doc): fix grammar in :h :keeppatterns
    runtime(pandoc): refine pandoc compiler settings
    * v9.1.0684: completion is inserted on Enter with "noselect"
    translation(ru): update man pages
    * v9.1.0683: mode( returns wrong value with <Cmd> mapping
    runtime(doc): remove trailing whitespace in cmdline.txt
    * v9.1.0682: Segfault with uninitialized funcref
    * v9.1.0681: Analyzing failed screendumps is hard
    runtime(doc): more clarification for the :keeppatterns needed
    * v9.1.0680: VMS does not have defined uintptr_t
    runtime(doc): improve typedchar documentation for KeyInputPre autocmd
    runtime(dist): verify that executable is in $PATH
    translation(it): update Italian manpages
    runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677
    runtime(doc): update Makefile and make it portable between GNU and BSD
    * v9.1.0679: Rename from w_closing to w_locked is incomplete
    runtime(colors): update colorschemes
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    runtime(doc): Updating the examples in the xxd manpage
    translation(ru): Updated uganda.rux
    runtime(yaml): do not re-indent when commenting out lines
    * v9.1.0678: use-after-free in alist_add()
    * v9.1.0677 :keepp does not retain the substitute pattern
    translation(ja): Update Japanese translations to latest release
    runtime(netrw): Drop committed trace lines
    runtime(netrw): Error popup not always used
    runtime(netrw): ErrorMsg( may throw E121
    runtime(tutor): update Makefile and make it portable between GNU and BSD
    translation: improve the po/cleanup.vim script
    runtime(lang): update Makefile and make it portable between GNU and BSD
    * v9.1.0676: style issues with man pages
    * v9.1.0675: Patch v9.1.0674 causes problems
    runtime(dosbatch): Show %%i as an argument in syntax file
    runtime(dosbatch): Add syn-sync to syntax file
    runtime(sql, mysql): fix E169: Command too recursive with
    sql_type_default = "mysql"
    * v9.1.0674: compiling abstract method fails because of missing return
    runtime(javascript): fix a few issues with syntax higlighting
    runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var
    runtime(termdebug): Fix wrong test for balloon feature
    runtime(doc): Remove mentioning of the voting feature
    runtime(doc): add help tags for json + markdown global variables
    * v9.1.0673: too recursive func calls when calling super-class method
    runtime(syntax-tests): Facilitate the viewing of rendered screendumps
    runtime(doc): fix a few style issues
    * v9.1.0672: marker folds may get corrupted on undo
    * v9.1.0671 Problem:  crash with WinNewPre autocommand
    * v9.1.0670: po file encoding fails on *BSD during make
    translation(it): Update Italian translation
    translation: Stop using msgconv
    * v9.1.0669: stable python ABI not used by default
    Update .gitignore and .hgignore files
    * v9.1.0668: build-error with python3.12 and stable ABI
    translations: Update generated po files
    * v9.1.0667: Some other options reset curswant unnecessarily when set
    * v9.1.0666: assert_equal( doesn't show multibyte string correctly
    runtime(doc): clarify directory of Vim's executable vs CWD
    * v9.1.0665 :for loop
    runtime(proto): Add indent script for protobuf filetype
    * v9.1.0664: console vim did not switch back to main screen on exit
    runtime(zip): zip plugin does not work with Vim 9.0
    * v9.1.0663: zip test still resets 'shellslash' option
    runtime(zip): use defer to restore old settings
    runtime(zip): add a generic Message function
    runtime(zip): increment base version of zip plugin
    runtime(zip): raise minimum Vim version to * v9.0
    runtime(zip): refactor save and restore of options
    runtime(zip): remove test for fnameescape
    runtime(zip): use :echomsg instead of :echo
    runtime(zip): clean up and remove comments
    * v9.1.0662: filecopy( may return wrong value when readlink( fails
    * v9.1.0661: the zip plugin is not tested.
    runtime(zip): Fix for FreeBSD's unzip command
    runtime(doc): capitalize correctly
    * v9.1.0660: Shift-Insert does work on old conhost
    translation(it): update Italian manpage
    runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr
    runtime(zip): escape '[' on Unix as well
    * v9.1.0659: MSVC Makefile is a bit hard to read
    runtime(doc): fix typo in syntax.txt
    runtime(doc): -x is only available when compiled with crypt feature
    * v9.1.0658: Coverity warns about dereferencing NULL pointer.
    runtime(colors): update Todo highlight in habamax colorscheme
    * v9.1.0657: MSVC build time can be optimized
    * v9.1.0656: MSVC Makefile CPU handling can be improved
    * v9.1.0655: goaccess config file not recognized
    CI: update clang compiler to version 20
    runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore`
    * v9.1.0654: completion does not respect completeslash with fuzzy
    * v9.1.0653: Patch v9.1.0648 not completely right
    * v9.1.0652: too many strlen( calls in syntax.c
    * v9.1.0651 :append
    * v9.1.0650: Coverity warning in cstrncmp()
    * v9.1.0649: Wrong comment for "len" argument of call_simple_func()
    * v9.1.0648: [security] double-free in dialog_changed()
    * v9.1.0647: [security] use-after-free in tagstack_clear_entry
    runtime(doc): re-format tag example lines, mention ctags --list-kinds
    * v9.1.0646: imported function may not be found
    runtime(java): Document "g:java_space_errors" and "g:java_comment_strings"
    runtime(java): Cluster optional group definitions and their group links
    runtime(java): Tidy up the syntax file
    runtime(java): Tidy up the documentation for "ft-java-syntax"
    runtime(colors): update habamax scheme - tweak diff/search/todo colors
    runtime(nohlsearch): add missing loaded_hlsearch guard
    runtime(kivy): Updated maintainer info for syntax script
    Maintainers: Add maintainer for ondir ftplugin + syntax files
    runtime(netrw): removing trailing slash when copying files in same
    directory
    * v9.1.0645: wrong match when searching multi-byte char case-insensitive
    runtime(html): update syntax script to sync by 250 minlines by default
    * v9.1.0644: Unnecessary STRLEN( when applying mapping
    runtime(zip): Opening a remote zipfile don't work
    runtime(cuda): source c and cpp ftplugins
    * v9.1.0643: cursor may end up on invalid position
    * v9.1.0642: Check that mapping rhs starts with lhs fails if not
    simplified
    * v9.1.0641: OLE enabled in console version
    runtime(thrift): add ftplugin, indent and syntax scripts
    * v9.1.0640: Makefile can be improved
    * v9.1.0639: channel timeout may wrap around
    * v9.1.0638: E1510 may happen when formatting a message for smsg()
    * v9.1.0637: Style issues in MSVC Makefile
  - Update apparmor.vim to latest version (from AppArmor 4.0.2)
  - add support for "all" and "userns" rules, and new profile flags
  - Update to 9.1.0636:
    * 9.1.0636: filetype: ziggy files are not recognized
    * 9.1.0635: filetype: SuperHTML template files not recognized
    * 9.1.0634: Ctrl-P not working by default
    * 9.1.0633: Compilation warnings with `-Wunused-parameter`
    * 9.1.0632: MS-Windows: Compiler Warnings
    Add support for Files-Included in syntax script
    tweak documentation style a bit
    * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion
    * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme
    * 9.1.0629: Rename of pum hl_group is incomplete
    * 9.1.0628: MinGW: coverage files are not cleaned up
    * 9.1.0627: MinGW: build-error when COVERAGE is enabled
    * 9.1.0626: Vim9: need more tests with null objects
    include initial filetype plugin
    * 9.1.0625: tests: test output all translated messages for all translations
    * 9.1.0624: ex command modifiers not found
    * 9.1.0623: Mingw: errors when trying to delete non-existing files
    * 9.1.0622: MS-Windows: mingw-build can be optimized
    * 9.1.0621: MS-Windows: startup code can be improved
    * 9.1.0620: Vim9: segfauls with null objects
    * 9.1.0619: tests: test_popup fails
    * 9.1.0618: cannot mark deprecated attributes in completion menu
    * 9.1.0617: Cursor moves beyond first line of folded end of buffer
    * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles
    * 9.1.0615: Unnecessary STRLEN() in make_percent_swname()
    Add single-line comment syntax
    Add syntax test for comments
    Update maintainer info
    * 9.1.0614: tests: screendump tests fail due to recent syntax changes
    * 9.1.0613: tests: termdebug test may fail and leave file around
    Update base-syntax, improve :set highlighting
    Optionally highlight the :: token for method references
    * 9.1.0612: filetype: deno.lock file not recognized
    Use delete() for deleting directory
    escape filename before trying to delete it
    * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys
    correctly extract file from zip browser
    * 9.1.0610: filetype: OpenGL Shading Language files are not detected
    Fix endless recursion in netrw#Explore()
    * 9.1.0609: outdated comments in Makefile
    update syntax script
    Fix flow mapping key detection
    Remove orphaned YAML syntax dump files
    * 9.1.0608: Coverity warns about a few potential issues
    Update syntax script and remove syn sync
    * 9.1.0607: termdebug: uses inconsistent style
    * 9.1.0606: tests: generated files may cause failure in test_codestyle
    * 9.1.0605: internal error with fuzzy completion
    * 9.1.0604: popup_filter during Press Enter prompt seems to hang
    translation: Update Serbian messages translation
    * 9.1.0603: filetype: use correct extension for Dracula
    * 9.1.0602: filetype: Prolog detection can be improved
    fix more inconsistencies in assert function docs
    * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit
    Update base-syntax, improve :map highlighting
    * 9.1.0600: Unused function and unused error constants
    * 9.1.0599: Termdebug: still get E1023 when specifying arguments
    correct wrong comment options
    fix typo "a xterm" -> "an xterm"
    * 9.1.0598: fuzzy completion does not work with default completion
    * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key
    * 9.1.0596: filetype: devscripts config files are not recognized
    gdb file/folder check is now performed only in CWD.
    quote filename arguments using double quotes
    update syntax to SDC-standard 2.1
    minor updates.
    Cleanup :match and :loadkeymap syntax test files
    Update base-syntax, match types in Vim9 variable declarations
    * 9.1.0595: make errors out with the po Makefile
    * 9.1.0594: Unnecessary redraw when setting 'winfixbuf'
    using wrong highlight for UTF-8
    include simple syntax plugin
    * 9.1.0593: filetype: Asymptote files are not recognized
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    * 9.1.0592: filetype: Mediawiki files are not recognized
    * 9.1.0591: filetype: *.wl files are not recognized
    * 9.1.0590: Vim9: crash when accessing getregionpos() return value
    'cpoptions': Include "z" in the documented default
    * 9.1.0589: vi: d{motion} and cw work differently than expected
    update included colorschemes
    grammar fixes in options.txt
  - Add "Keywords" to gvim.desktop to make searching for gvim easier
  - Removed patches, as they're no longer required (refreshing them
    deleted their contents):
    * vim-7.3-help_tags.patch
    * vim-7.4-highlight_fstab.patch
  - Reorganise all applied patches in the spec file.
  - Update to 9.1.0588:
    * 9.1.0588: The maze program no longer compiles on newer clang
    runtime(typst): Add typst runtime files
    * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky
    * 9.1.0586: ocaml runtime files are outdated
    runtime(termdebug): fix a few issues
    * 9.1.0585: tests: test_cpoptions leaves swapfiles around
    * 9.1.0584: Warning about redeclaring f_id() non-static
    runtime(doc): Add hint how to load termdebug from vimrc
    runtime(doc): document global insert behavior
    * 9.1.0583: filetype: *.pdf_tex files are not recognized
    * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode
    * 9.1.0581: Various lines are indented inconsistently
    * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode
    * 9.1.0579: Ex command is still executed after giving E1247
    * 9.1.0578: no tests for :Tohtml
    * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim
    * 9.1.0576: tests: still an issue with test_gettext_make
    * 9.1.0575: Wrong comments in alt_tabpage()
    * 9.1.0574: ex: wrong handling of commands after bar
    runtime(doc): add a note for netrw bug reports
    * 9.1.0573: ex: no implicit print for single addresses
    runtime(vim): make &indentexpr available from the outside
    * 9.1.0572: cannot specify tab page closing behaviour
    runtime(doc): remove obsolete Ex insert behavior
    * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky
    runtime(logindefs): update syntax with new keywords
    * 9.1.0570: tests: test_gettext_make can be improved
    runtime(filetype): Fix Prolog file detection regex
    * 9.1.0569: fnamemodify() treats ".." and "../" differently
    runtime(mojo): include mojo ftplugin and indent script
    * 9.1.0568: Cannot expand paths from 'cdpath' setting
    * 9.1.0567: Cannot use relative paths as findfile() stop directories
    * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash
    * 9.1.0565: Stop directory doesn't work properly in 'tags'
    * 9.1.0564: id() can be faster
    * 9.1.0563: Cannot process any Key event
    * 9.1.0562: tests: inconsistency in test_findfile.vim
    runtime(fstab): Add missing keywords to fstab syntax
    * 9.1.0561: netbeans: variable used un-initialized (Coverity)
    * 9.1.0560: bindtextdomain() does not indicate an error
    * 9.1.0559: translation of vim scripts can be improved
    * 9.1.0558: filetype: prolog detection can be improved
    * 9.1.0557: moving in the buffer list doesn't work as documented
    runtime(doc): fix inconsistencies in :h file-searching
    * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages
    runtime(htmlangular): correct comment
    * 9.1.0555: filetype: angular ft detection is still problematic
    * 9.1.0554: :bw leaves jumplist and tagstack data around
    * 9.1.0553: filetype: *.mcmeta files are not recognized
    * 9.1.0552: No test for antlr4 filetype
    * 9.1.0551: filetype: htmlangular files are not properly detected
    * 9.1.0550: filetype: antlr4 files are not recognized
    * 9.1.0549: fuzzycollect regex based completion not working as expected
    runtime(doc): autocmd_add() accepts a list not a dict
    * 9.1.0548: it's not possible to get a unique id for some vars
    runtime(tmux): Update syntax script
    * 9.1.0547: No way to get the arity of a Vim function
    * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A
    runtime(hlsplaylist): include hlsplaylist ftplugin file
    runtime(doc): fix typo in :h ft-csv-syntax
    runtime(doc): Correct shell command to get $VIMRUNTIME into
    shell
    * 9.1.0545: MSVC conversion warning
    * 9.1.0544: filetype: ldapconf files are not recognized
    runtime(cmakecache): include cmakecache ftplugin file
    runtime(lex): include lex ftplugin file
    runtime(yacc): include yacc ftplugin file
    runtime(squirrel): include squirrel ftplugin file
    runtime(objcpp): include objcpp ftplugin file
    runtime(tf): include tf ftplugin file
    runtime(mysql): include mysql ftplugin file
    runtime(javacc): include javacc ftplugin file
    runtime(cabal): include cabal ftplugin file
    runtime(cuda): include CUDA ftplugin file
    runtime(editorconfig): include editorconfig ftplugin file
    runtime(kivy): update kivy syntax, include ftplugin
    runtime(syntax-tests): Stop generating redundant "*_* 99.dump"
    files
    * 9.1.0543: Behavior of CursorMovedC is strange
    runtime(vim): Update base-syntax, improve :match command
    highlighting
    * 9.1.0542: Vim9: confusing string() output for object functions
    * 9.1.0541: failing test with Vim configured without channel
    * 9.1.0540: Unused assignment in sign_define_cmd()
    runtime(doc): add page-scrolling keys to index.txt
    runtime(doc): add reference to xterm-focus-event from
    FocusGained/Lost
    * 9.1.0539: Not enough tests for what v9.1.0535 fixed
    runtime(doc): clarify how to re-init csv syntax file
    * 9.1.0538: not possible to assign priority when defining a sign
    * 9.1.0537: signed number detection for CTRL-X/A can be improved
    * 9.1.0536: filetype: zone files are not recognized
    * 9.1.0535: newline escape wrong in ex mode
    runtime(man): honor cmd modifiers before `g:ft_man_open_mode`
    runtime(man): use `nnoremap` to map to Ex commands
    * 9.1.0534: completion wrong with fuzzy when cycling back to original
    runtime(syntax-tests): Abort and report failed cursor progress
    runtime(syntax-tests): Introduce self tests for screen dumping
    runtime(syntax-tests): Clear and redraw the ruler line with
    the shell info
    runtime(syntax-tests): Allow for folded and wrapped lines in
    syntax test files
    * 9.1.0533: Vim9: need more tests for nested objects equality
    CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries
    runtime(doc): Remove wrong help tag CTRL-SHIFT-CR
    * 9.1.0532: filetype: Cedar files not recognized
    runtime(doc): document further keys that scroll page up/down
    * 9.1.0531: resource leak in mch_get_random()
    runtime(tutor): Fix wrong spanish translation
    runtime(netrw): fix remaining case of register clobber
    * 9.1.0530: xxd: MSVC warning about non-ASCII character
    * 9.1.0529: silent! causes following try/catch to not work
    runtime(rust): use shiftwidth() in indent script
    * 9.1.0528: spell completion message still wrong in translations
    * 9.1.0527: inconsistent parameter in Makefiles for Vim executable
    * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer
    runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config
    * 9.1.0525: Right release selects immediately when pum is truncated.
    * 9.1.0524: the recursive parameter in the *_equal functions can be removed
    runtime(termdebug): Add Deprecation warnings
    * 9.1.0523: Vim9: cannot downcast an object
    * 9.1.0522: Vim9: string(object) hangs for recursive references
    * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13
    * 9.1.0520: Vim9: incorrect type checking for modifying lists
    runtime(manpager): avoid readonly prompt
    * 9.1.0519: MS-Windows: libvterm compilation can be optimized
    * 9.1.0518: initialize the random buffer can be improved
    * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak
    runtime(terraform): Add filetype plugin for terraform
    runtime(dockerfile): enable spellchecking of comments in
    syntax script
    runtime(doc): rename variable for pandoc markdown support
    runtime(doc): In builtin overview use {buf} as param for
    appendbufline/setbufline
    runtime(doc): clarify, that register 1-* 9 will always be shifted
    runtime(netrw): save and restore register 0-* 9, a and unnamed
    runtime(termdebug): Refactored StartDebug_term and EndDebug
    functions
    runtime(java): Compose "g:java_highlight_signature" and
    "g:java_highlight_functions"
    * 9.1.0516: need more tests for nested dicts and list comparision
    * 9.1.0515: Vim9: segfault in object_equal()
    * 9.1.0514: Vim9: issue with comparing objects recursively
    runtime(termdebug): Change some variables to Enums
    runtime(vim): Update base-syntax, fix function tail comments
    * 9.1.0513: Vim9: segfault with object comparison
  - Update to 9.1.0512:
    * Mode message for spell completion doesn't match allowed keys
    * CursorMovedC triggered wrongly with setcmdpos()
    * update runtime files
    * CI: test_gettext fails on MacOS14 + MSVC Win
    * not possible to translate Vim script messages
    * termdebug plugin can be further improved
    * add gomod filetype plugin
    * hard to detect cursor movement in the command line
    * Optionally highlight parameterised types
    * filetype: .envrc & .prettierignore not recognized
    * filetype: Faust files are not recognized
    * inner-tag textobject confused about ">" in attributes
    * cannot use fuzzy keyword completion
    * Remove the group exclusion list from @javaTop
    * wrong return type for execute() function
    * MS-Windows: too much legacy code
    * too complicated mapping restore in termdebug
    * simplify mapping
    * cannot switch buffer in a popup
    * MS-Windows: doesn't handle symlinks properly
    * getcmdcompltype() interferes with cmdline completion
    * termdebug can be further improved
    * update htmldjango detection
    * Improve Turkish documentation
    * include a simple csv filetype and syntax plugin
    * include the the simple nohlsearch package
    * matched text is highlighted case-sensitively
    * Matched text isn't highlighted in cmdline pum
    * Fix typos in several documents
    * clarify when text properties are cleared
    * improve the vim-shebang example
    * revert unintended formatting changes for termdebug
    * Add a config variable for commonly used compiler options
    * Wrong matched text highlighted in pum with 'rightleft'
    * bump length of character references in syntax script
    * properly check mapping variables using null_dict
    * fix KdlIndent and kdlComment in indent script
    * Test for patch 9.1.0489 doesn't fail without the fix
    * Fold multi-line comments with the syntax kind of &fdm
    * using wrong type for PlaceSign()
    * filetype: Vim-script files not detected by shebang line
    * revert unintended change to zip#Write()
    * add another tag for vim-shebang feature
    * Cmdline pum doesn't work properly with 'rightleft'
    * minor style problems with patch 9.1.0487
    * default completion may break with fuzzy
    * Wrong padding for pum "kind" with 'rightleft'
    * Update base-syntax, match shebang lines
    * MS-Windows: handle files with spaces properly
    * Restore HTML syntax file tests
    * completed item not update on fuzzy completion
    * filetype: Snakemake files are not recognized
    * make TermDebugSendCommand() a global function again
    * close all buffers in the same way
    * Matched text shouldn't be highlighted in "kind" and "menu"
    * fix wrong helptag for :defer
    * Update base-syntax, match :sleep arg
    * include Georgian keymap
    * Sorting of completeopt+=fuzzy is not stable
    * correctly test for windows in NetrwGlob()
    * glob() on windows fails with [] in directory name
    * rewrite mkdir() doc and simplify {flags} meaning
    * glob() not sufficiently tested
    * update return type for job_info()
    * termdebug plugin needs more love
    * correct return types for job_start() and job_status()
    * Update base-syntax, match :catch and :throw args
    * Include element values in non-marker annotations
    * Vim9: term_getjob() throws an exception on error
    * fuzzy string matching executed when not needed
    * fuzzy_match_str_with_pos() does unnecessary list operations
    * restore description of "$" in col() and virtcol()
    * deduplicate getpos(), line(), col(), virtcol()
    * Update g:vimsyn_comment_strings dump file tests
    * Use string interpolation instead of string concat
    * potential deref of NULL pointer in fuzzy_match_str_with_pos
    * block_editing errors out when using <enter>
    * Update base-syntax, configurable comment string highlighting
    * fix typos in syntax.txt
    * Cannot see matched text in popup menu
    * Update base-syntax, match multiline continued comments
    * clarify documentation for "v" position at line()
    * cmod_split modifier is always reset in term_start()
    * remove line-continuation characters
    * use shiftwidth() instead of &tabstop in indent script
    * Remove orphaned screen dump files
    * include syntax, indent and ftplugin files
    * CI: Test_ColonEight() fails on github runners
    * add missing Enabled field in syntax script
    * basic svelte ftplugin file
    * term_start() does not clear vertical modifier
    * fix mousemodel restoration by comparing against null_string
    * Added definitions of Vim scripts and plugins
    * Exclude lambda expressions from _when_ _switch-case_ label clauses
    * Fix saved_mousemodel check
    * Inconsistencies between functions for option flags
    * Crash when using autocmd_get() after removing event inside autocmd
    * Fix small style issues
    * add return type info for Vim function descriptions
    * Update Italian Vim manpage
    * disable the q mapping
    * Change 'cms' for C++ to '// %s'
    * fix type mismatch error
    * Fix wrong email address
    * convert termdebug plugin to Vim9 script
  - Update to 9.1.0470:
    * tests Test_ColonEight_MultiByte() fails sporadically
    * Cannot have buffer-local value for 'completeopt'
    * GvimExt does not consult HKEY_CURRENT_USER
    * typos in some comments
    * runtime(vim): Update base-syntax, allow whitespace before
    :substitute pattern
    * Missing comments for fuzzy completion
    * runtime(man): update Vim manpage
    * runtime(comment): clarify the usage of 'commentstring' option
    value
    * runtime(doc): clarify how fuzzy 'completeopt' should work
    * runtime(netrw): prevent accidental data loss
    * missing filecopy() function
    * no whitespace padding in commentstring option in ftplugins
    * no fuzzy-matching support for insert-completion
    * eval5() and eval7 are too complex
    * too many strlen() calls in drawline.c
    * filetype lintstagedrc files are not recognized
    * Vim9 import autoload does not work with symlink
    * Coverity complains about division by zero
    * tests test_gui fails on Wayland
    * Left shift is incorrect with vartabstop and shiftwidth=0
    * runtime(doc): clarify 'shortmess' flag "S"
    * MS-Windows compiler warning for size_t to int conversion
    * runtime(doc): include some vim9 script examples in the help
    * minor issues in test_filetype with rasi test
    * filetype rasi files are not recognized
    * runtime(java): Improve the matching of lambda expressions
    * Configure checks for libelf unnecessarily
    * No test for escaping '<' with shellescape()
    * check.vim complains about overlong comment lines
    * translation(it): Update Italian translation
    * evalc. code too complex
    * MS-Windows Compiler warnings
  - Update to 9.1.0448:
    * compiler warning in eval.c
    * remove remaining css code
    * Add ft_hare.txt to Reference Manual TOC
    * re-generate vim syntax from generator
    * fix syntax vim bug
    * completion may be wrong when deleting all chars
    * getregionpos() inconsistent for partly-selected multibyte char
    * fix highlighting nested and escaped quotes in string props
    * remove the indent plugin since it has too many issues
    * update Debian runtime files
    * Coverity warning after 9.1.0440
    * Not enough tests for getregion() with multibyte chars
    * Can't use blockwise selection with width for getregion()
    * update outdated syntax files
    * fix floating_modifier highlight
    * hare runtime files outdated
    * getregionpos() can't properly indicate positions beyond eol
    * function get_lval() is too long
    * Cannot filter the history
    * Wrong Ex command executed when :g uses '?' as delimiter
    * support floating_modifier none; revert broken highlighting
    * Motif requires non-const char pointer for XPM  data
    * Crash when using '?' as separator for :s
    * filetype: cygport files are not recognized
    * make errors trying to access autoload/zig
    * Wrong yanking with exclusive selection and ve=all
    * add missing help tags file
    * Ancient XPM preprocessor hack may cause build errors
    * include basic rescript ftplugin file
    * eval.c is too long
    * getregionpos() doesn't handle one char selection
    * check for gdb file/dir before using as buffer name
    * refactor zig ftplugin, remove auto format
    * Coverity complains about eval.c refactor
    * Tag guessing leaves wrong search history with very short names
    * some issues with termdebug mapping test
    * update matchit plugin to v1.20
    * too many strlen() calls in search.c
    * set commentstring option
    * update vb indent plugin as vim9script
    * filetype: purescript files are not recognized
    * filetype: slint files are not recognized
    * basic nim ftplugin file for comments
    * Add Arduino ftplugin and indent files
    * include basic typst ftplugin file
    * include basic prisma ftplugin file
    * include basic v ftplugin for comment support
    * getregionpos() wrong with blockwise mode and multibyte
    * function echo_string_core() is too long
    * hyprlang files are not recognized
    * add basic dart ftplugin file
    * basic ftplugin file for graphql
    * mention comment plugin at :h 'commentstring'
    * set commentstring for sql files in ftplugin
    * :browse oldfiles prompts even with single entry
    * eval.c not sufficiently tested
    * clarify why E195 is returned
    * clarify temporary file clean up
    * fix :NoMatchParen not working
    * Cannot move to previous/next rare word
    * add basic ftplugin file for sshdconfig
    * if_py: find_module has been removed in Python 3.12.0a7
    * some screen dump tests can be improved
    * Some functions are not tested
    * clarify instal instructions for comment package
    * Unable to leave long line with 'smoothscroll' and 'scrolloff'
    * fix typo in vim9script help file
    * Remove trailing spaces
    * clarify {special} argument for shellescape()
  - update to 9.1.0413
    * smoothscroll may cause infinite loop
    * add missing entries for the keys CTRL-W g<Tab> and <C-Tab>
    * update vi_diff.txt: add default value for 'flash'
    * typo in regexp_bt.c in DEBUG code
    * allow indented commands
    * Fix wrong define regex in ftplugin
    * Filter out non-Latin-1 characters for syntax tests
    * prefer scp over pscp
    * fix typo in usr_52.txt
    * too long functions in eval.c
    * warning about uninitialized variable
    * too many strlen() calls in the regexp engine
    * E16 fix, async keyword support for define
    * Stuck with long line and half-page scrolling
    * Divide by zero with getmousepos() and 'smoothscroll'
    * update and remove  some invalid links
    * update translation of xxd manpage
    * Recursively delete directories by default with netrw delete command
    * Strive to remain compatible for at least Vim 7.0
    * tests: xxd buffer overflow fails on 32-bit
    * Stop handpicking syntax groups for @javaTop
    * [security] xxd: buffer-overflow with specific flags
    * Vim9: not able to import file from start dir
    * filetype: mdd files detected as zsh filetype
    * filetype: zsh module files are not recognized
    * Remove hardcoded private.ppk logic from netrw
    * Vim9: confusing error message for unknown type
    * block_editing errors out when using del
    * add new items to scripts section in syntax plugin
    * Vim9: imported vars are not properly type checked
    * Wrong display with 'smoothscroll' when changing quickfix list
    * filetype: jj files are not recognized
    * getregionpos() may leak memory on error
    * The CODEOWNERS File is not useful
    * Remove and cleanup Win9x legacy from netrw
    * add MsgArea to 'highlight' option description
    * Cannot get a list of positions describing a region
    * Fix digit separator in syntax script for octals and floats
    * Update link to Wikipedia Vi page
    * clear $MANPAGER in ftplugin before shelling out
    * Fix typos in help documents
    * 'viewdir' not respecting $XDG_CONFIG_HOME
    * tests: Vim9 debug tests may be flaky
    * correct getscriptinfo() example
    * Vim9: could improve testing
    * test_sound fails on macos-12
    * update Serbian menu
    * update Slovak menu
    * update Slovenian menu
    * update Portuguese menu
    * update Dutch menu
    * update Korean menu
    * update Icelandic menu
    * update Czech menu
    * update Afrikaans menu
    * update German menu
    * filetype: inko files are not recognized
    * filetype: templ files are not recognized
    * cursor() and getregion() don't handle v:maxcol well
    * Vim9: null value tests not sufficient
    * update Catalan menu
    * filetype: stylus files not recognized
    * update spanish menu localization
    * regenerate helptags
    * Vim9: crash with null_class and null_object
    * Add tags about lazyloading of menu
    * tests: vt420 terminfo entry may not be found
    * filetype: .out files recognized as tex files
    * filetype: Kbuild files are not recognized
    * cbuffer and similar commands don't accept a range
    * Improve the recognition of the "indent" method declarations
    * Fix a typo in usr_30.txt
    * remove undefined var s:save_cpoptions and add include setting
    * missing setlocal in indent plugin
    * Calculating line height for unnecessary amount of lines
    * improve syntax file performance
    * There are a few typos
    * Vim9: no comments allowed after class vars
    * CI: remove trailing white space in documentation
    * Formatting text wrong when 'breakindent' is set
    * Add oracular (24.10) as Ubuntu release name
    * Vim9: Trailing commands after class/enum keywords ignored
    * tests: 1-second delay after Test_BufEnter_botline()
    * update helptags for jq syntax
    * include syntax, ftplugin and compiler plugin
    * fix typo synconcealend -> synconcealed
    * include a simple comment toggling plugin
    * wrong botline in BufEnter
    * clarify syntax vs matching mechanism
    * fix undefined variable in indent plugin
    * ops.c code uses too many strlen() calls
    * Calling CLEAR_FIELD() on the same struct twice
    * Vim9: compile_def_function() still too long
    * Update Serbian messages
    * clarify the effect of setting the shell to powershell
    * Improve the recognition of the "style" method declarations
    * Vim9: problem when importing autoloaded scripts
    * compile_def_function is too long
    * filetype: ondir files are not recognized
    * Crash when typing many keys with D- modifier
    * tests: test_vim9_builtin is a bit slow
    * update documentation
    * change the download URL of "libsodium"
    * tests: test_winfixbuf is a bit slow
    * Add filetype, syntax and indent plugin for Astro
    * expanding rc config files does not work well
    * Vim9: vim9type.c is too complicated
    * Vim9: does not handle autoloaded variables well
    * minor spell fix in starting.txt
    * wrong drawing in GUI with setcellwidth()
    * Add include and suffixesadd
    * Page scrolling should place cursor at window boundaries
    * align command line table
    * minor fixes to starting.txt
    * fix comment definition in filetype plugin
    * filetype: flake.lock files are not recognized
    * runtime(uci): No support for uci file types
    * Support "g:ftplugin_java_source_path" with archived files
    * tests: Test_autoload_import_relative_compiled fails on Windows
    * Finding cmd modifiers and cmdline-specials is inefficient
    * No test that completing a partial mapping clears 'showcmd'
    * tests: test_vim9_dissamble may fail
    * Vim9: need static type for typealias
    * X11 does not ignore smooth scroll event
    * A few typos in test_xdg when testing gvimrc
    * Patch v9.1.0338 fixed sourcing a script with import
    * Problem: gvimrc not sourced from XDG_CONFIG_HOME
    * Cursor wrong after using setcellwidth() in terminal
    * 'showcmd' wrong for partial mapping with multibyte
    * tests: test_taglist fails when 'helplang' contains non-english
    * Problem: a few memory leaks are found
    * Problem: Error with matchaddpos() and empty list
    * tests: xdg test uses screen dumps
    * Vim9: import through symlinks not correctly handled
    * Missing entry for XDG vimrc file in :version
    * tests: typo in test_xdg
    * runtime(i3config/swayconfig): update syntax scripts
    * document pandoc compiler and enable configuring arguments
    * String interpolation fails for List type
    * No test for highlight behavior with 'ambiwidth'
    * tests: test_xdg fails on the appimage repo
    * tests: some assert_equal() calls have wrong order of args
    * make install does not install all files
    * runtime(doc): fix typos in starting.txt
  - Updated to version 9.1 with patch level 0330, fixes the following problems
    * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1
  - refreshed vim-7.3-filetype_spec.patch
  - refreshed vim-7.3-filetype_ftl.patch
  - Update spec.skeleton to use autosetup in place of setup macro.
  - for the complete list of changes see
    https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330

++++ vim:

  - Fix for bsc#1231373 / CVE-2024-47814.
  - Fix for bsc#1229238 / CVE-2024-43374.
  - update to 9.1.0836
    * 9.1.0836: The vimtutor can be improved
    * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu'
    * 9.1.0834: tests: 2html test fails
    * 9.1.0833: CI: recent ASAN changes do not work for indent tests
    * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal
    * runtime(doc): update help-toc description
    * runtime(2html): Make links use color scheme colors in TOhtml
    * 9.1.0831: 'findexpr' can't be used as lambad or Funcref
    * Filelist: include helptoc package
    * runtime(doc): include a TOC Vim9 plugin
    * Filelist: ignore .git-blame-ignore-revs
    * 9.1.0830: using wrong highlight group for spaces for popupmenu
    * runtime(typst): synchronize updates from the upstream typst.vim
    * git: ignore reformatting commit for git-blame (after v9.1.0829)
    * 9.1.0829: Vim source code uses a mix of tabs and spaces
    * 9.1.0828: string_T struct could be used more often
    * 9.1.0827: CI: tests can be improved
    * runtime(doc): remove stray sentence in pi_netrw.txt
    * 9.1.0826: filetype: sway files are not recognized
    * runtime(doc): Include netrw-gp in TOC
    * runtime(doc): mention 'iskeyword' at :h charclass()
    * runtime(doc): update help tags
    * 9.1.0825: compile error for non-diff builds
    * runtime(netrw): fix E874 when browsing remote directory which contains `~` character
    * runtime(doc): update coding style documentation
    * runtime(debversions): Add plucky (25.04) as Ubuntu release name
    * 9.1.0824: too many strlen() calls in register.c
    * 9.1.0823: filetype: Zephyr overlay files not recognized
    * runtime(doc): Clean up minor formatting issues for builtin functions
    * runtime(netrw): make :Launch/Open autoloadable
    * runtime(netrw): fix regression with x mapping on Cygwin
    * runtime(netrw): fix filetype detection for remote files
    * 9.1.0822: topline might be changed in diff mode unexpectedly
    * CI: huge linux builds should also run syntax & indent tests
    * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument
    * 9.1.0820: tests: Mac OS tests are too flaky
    * runtime(awk): Highlight more awk comments in syntax script
    * runtime(netrw): add missing change for s:redir()
    * 9.1.0819: tests: using findexpr and imported func not tested
    * runtime(netrw): improve netrw's open-handling further
    * runtime(netrw): fix syntax error in netrwPlugin.vim
    * runtime(netrw): simplify gx file handling
    * 9.1.0818: some global functions are only used in single files
    * 9.1.0817: termdebug: cannot evaluate expr in a popup
    * runtime(defaults): Detect putty terminal and switch to dark background
    * 9.1.0816: tests: not clear what tests cause asan failures
    * runtime(doc): Remove some completed items from todo.txt
    * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position
    * runtime(syntax-tests): tiny vim fails because of line-continuation
    * 9.1.0814: mapset() may remove unrelated mapping
    * 9.1.0813: no error handling with setglobal and number types
    * 9.1.0812: Coverity warns about dereferencing NULL ptr
    * 9.1.0811: :find expansion does not consider 'findexpr'
    * 9.1.0810: cannot easily adjust the |:find| command
    * 9.1.0809: filetype: petalinux config files not recognized
    * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll'
    * 9.1.0807: tests: having 'nolist' in modelines isn't always desired
    * 9.1.0806: tests: no error check when setting global 'briopt'
    * 9.1.0805: tests: minor issues in gen_opt_test.vim
    * 9.1.0804: tests: no error check when setting global 'cc'
    * 9.1.0803: tests: no error check when setting global 'isk'
    * 9.1.0802: tests: no error check when setting global 'fdm' to empty value
    * 9.1.0801: tests: no error check when setting global 'termwinkey'
    * 9.1.0800: tests: no error check when setting global 'termwinsize'
    * runtime(doc): :ownsyntax also resets 'spelloptions'
    * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive
    * runtime(doc): Fix wrong Mac default options
    * 9.1.0798: too many strlen() calls in cmdhist.c
    * 9.1.0797: testing of options can be further improved
    * 9.1.0796: filetype: libtool files are not recognized
    * (typst): add folding to typst ftplugin
    * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke()
    * 9.1.0795: filetype: Vivado memory info file are not recognized
    * 9.1.0794: tests: tests may fail on Windows environment
    * runtime(doc): improve the :colorscheme documentation
    * 9.1.0793: xxd: -e does add one extra space
    * 9.1.0792: tests: Test_set_values() is not comprehensive enough
    * runtime(swayconfig): add flag for bindsym/bindcode to syntax script
    * 9.1.0791: tests: errors in gen_opt_test.vim are not shown
    * runtime(compiler): check for compile_commands in build dirs for cppcheck
    * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib)
    * runtime(help): Update help syntax
    * runtime(help): fix end of sentence highlight in code examples
    * runtime(jinja): Support jinja syntax as secondary filetype
    * 9.1.0789: tests: ':resize + 5' has invalid space after '+'
    * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot
    * 9.1.0787: cursor position changed when using hidden terminal
    * 9.1.0786: tests: quickfix update test does not test location list
    * runtime(doc): add some docs for file-watcher programs
    * CI: uploading failed screendumps still fails on Cirrus CI
    * 9.1.0785: cannot preserve error position when setting quickfix list
    * 9.1.0784: there are several problems with python 3.13
    * 9.1.0783: 'spell' option setting has problems
    * 9.1.0782: tests: using wrong neomuttlog file name
    * runtime(doc): add preview flag to statusline example
    * 9.1.0781: tests: test_filetype fails
    * 9.1.0780: MS-Windows: incorrect Win32 error checking
    * 9.1.0779: filetype: neomuttlog files are not recognized
    * 9.1.0778: filetype: lf config files are not recognized
    * runtime(comment): fix commment toggle with mixed tabs & spaces
    * runtime(misc): Use consistent "Vim script" spelling
    * runtime(gleam): add ftplugin for gleam files
    * runtime(doc): link help-writing from write-local-help
    * 9.1.0777: filetype: Some upstream php files are not recognized
    * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups
    * runtime(doc): mention conversion rules for remote_expr()
    * runtime(tutor): Fix missing :s command in spanish translation section 4.4
    * 9.1.0776: test_strftime may fail because of missing TZ data
    * translation(am): Add Armenian language translation
    * 9.1.0775: tests: not enough tests for setting options
    * 9.1.0774: "shellcmdline" doesn't work with getcompletion()
    * 9.1.0773: filetype: some Apache files are not recognized
    * 9.1.0772: some missing changes from v9.1.0771
    * 9.1.0771: completion attribute hl_group is confusing
    * 9.1.0770: current command line completion is a bit limited
    * 9.1.0769: filetype: MLIR files are not recognized
    * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen
    * runtime(nasm): Update nasm syntax script
    * 9.1.0767: A condition is always true in ex_getln.c
    * runtime(skill): Update syntax file to fix string escapes
    * runtime(help): highlight CTRL-<Key> correctly
    * runtime(doc): add missing usr_52 entry to toc
    * 9.1.0766: too many strlen() calls in ex_getln.c
    * runtime(doc): correct `vi` registers 1-9 documentation error
    * 9.1.0765: No test for patches 6.2.418 and 7.3.489
    * runtime(spec): set comments and commentstring options
    * NSIS: Include libgcc_s_sjlj-1.dll again
    * runtime(doc): clarify the effect of 'startofline' option
    * 9.1.0764: [security]: use-after-free when closing a buffer
    * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting
    * 9.1.0763: tests: cannot run single syntax tests
    * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly
    * 9.1.0761: :cd completion fails on Windows with backslash in path
    * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails
    * 9.1.0759: screenpos() may return invalid position
    * runtime(misc): unset compiler in various ftplugins
    * runtime(doc): update formatting and syntax
    * runtime(compiler): add cppcheck linter compiler plugin
    * runtime(doc): Fix style in documents
    * runtime(doc): Fix to two-space convention in user manual
    * runtime(comment): consider &tabstop in lines after whitespace indent
    * 9.1.0758: it's possible to set an invalid key to 'wildcharm'
    * runtime(java): Manage circularity for every :syn-included syntax file
    * 9.1.0757: tests: messages files contains ANSI escape sequences
    * 9.1.0756: missing change from patch v9.1.0754
    * 9.1.0755: quickfix list does not handle hardlinks well
    * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters
    * runtime(systemd): small fixes to &keywordprg in ftplugin
    * CI: macos-12 runner is being sunset, switch to 13
    * 9.1.0754: fixed order of items in insert-mode completion menu
    * runtime(comment): commenting might be off by one column
    * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll'
    * 9.1.0752: can set 'cedit' to an invalid value
    * runtime(doc): add `usr` tag to usr_toc.txt
    * 9.1.0751: Error callback for term_start() not used
    * 9.1.0750: there are some Win9x legacy references
    * runtime(java): Recognise the CommonMark form (///) of Javadoc comments
    * 9.1.0749: filetype: http files not recognized
    * runtime(comment): fix syntax error
    * CI: uploading failed screendump tests does not work Cirrus
    * 9.1.0748: :keep* commmands are sometimes misidentified as :k
    * runtime(indent): allow matching negative numbers for gnu indent config file
    * runtime(comment): add gC mapping to (un)comment rest of line
    * 9.1.0747: various typos in repo found
    * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals
    * runtime(doc): reformat gnat example
    * runtime(doc): reformat ada_standard_types section
    * 9.1.0745: filetype: bun and deno history files not recognized
    * runtime(glvs): Correct the tag name of glvs-autoinstal
    * runtime(doc): include short form for :earlier/:later
    * runtime(doc): remove completed TODO
    * 9.1.0744: filetype: notmuch configs are not recognised
    * 9.1.0743: diff mode does not handle overlapping diffs correctly
    * runtime(glvs): fix a few issues
    * runtime(doc): Fix typo in :help :command-modifiers
    * 9.1.0742: getcmdprompt() implementation can be improved
    * runtime(docs): update `:set?` command behavior table
    * runtime(doc): update vim90 to vim91 in docs
    * runtime(doc): fix typo in :h dos-colors
    * 9.1.0741: No way to get prompt for input()/confirm()
    * runtime(doc): fix typo in version9.txt nrformat -> nrformats
    * runtime(rmd,rrst): 'fex' option not properly restored
    * runtime(netrw): remove extraneous closing bracket
    * 9.1.0740: incorrect internal diff with empty file
    * 9.1.0739: [security]: use-after-free in ex_getln.c
    * runtime(filetype): tests: Test_filetype_detection() fails
    * runtime(dist): do not output a message if executable is not found
    * 9.1.0738: filetype: rapid files are not recognized
    * runtime(modconf): remove erroneous :endif in ftplugin
    * runtime(lyrics): support multiple timestamps in syntax script
    * runtime(java): Optionally recognise _module_ import declarations
    * runtime(vim): Update base-syntax, improve folding function matches
    * CI: upload failed screendump tests also for Cirrus
    * 9.1.0737: tests: screendump tests may require a bit more time
    * runtime(misc): simplify keywordprg in various ftplugins
    * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels
    * runtime(zsh,sh): set and unset compiler in ftplugin
    * runtime(netrw): using inefficient highlight pattern for 'mf'
    * 9.1.0736: Unicode tables are outdated
    * 9.1.0735: filetype: salt files are not recognized
    * 9.1.0734: filetype: jinja files are not recognized
    * runtime(zathurarc): add double-click-follow to syntax script
    * translation(ru): Updated messages translation
    * translation(it): updated xxd man page
    * translation(ru): updated xxd man page
    * 9.1.0733: keyword completion does not work with fuzzy
    * 9.1.0732: xxd: cannot use -b and -i together
    * runtime(java): Highlight javaConceptKind modifiers with StorageClass
    * runtime(doc): reword and reformat how to use defaults.vim
    * 9.1.0731: inconsistent case sensitive extension matching
    * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return
    * runtime(netrw): delete confirmation not strict enough
    * 9.1.0730: Crash with cursor-screenline and narrow window
    * 9.1.0729: Wrong cursor-screenline when resizing window
    * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
    * runtime(doc): clarify the effect of the timeout for search()-functions
    * runtime(idlang): update syntax script
    * runtime(spec): Recognize epoch when making spec changelog in ftplugin
    * runtime(spec): add file triggers to syntax script
    * 9.1.0727: too many strlen() calls in option.c
    * runtime(make): add compiler/make.vim to reset compiler plugin settings
    * runtime(java): Recognise all available standard doclet tags
    * 9.1.0726: not using correct python3 API with dynamic linking
    * runtime(dosini): Update syntax script, spellcheck comments only
    * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation
    * 9.1.0725: filetype: swiftinterface files are not recognized
    * runtime(pandoc): Update compiler plugin to use actual 'spelllang'
    * runtime(groff): Add compiler plugin for groff
    * 9.1.0724: if_python: link error with python 3.13 and stable ABI
    * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13
    * 9.1.0722: crash with large id in text_prop interface
    * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME
    * runtime(glvs): update GetLatestVimScripts plugin
    * runtime(doc): Fix typo in :help :hide text
    * runtime(doc): buffers can be re-used
    * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs
    * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid
    * runtime(doc): Update version9.txt and mention $MYVIMDIR
  - Update to 9.1.0718:
    * v9.1.0718: hard to know the users personal Vim Runtime Directory
    * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers()
    Maintainers: fix typo in author name
    * v9.1.0716: resetting setcellwidth( doesn't update the screen
    runtime(hcl,terraform): Add runtime files for HCL and Terraform
    runtime(tmux): Update syntax script
    * v9.1.0715: Not correctly parsing color names (after v9.1.0709)
    * v9.1.0714: GuiEnter_Turkish test may fail
    * v9.1.0713: Newline causes E749 in Ex mode
    * v9.1.0712: missing dependency of Test_gettext_makefile
    * v9.1.0711: test_xxd may file when using different xxd
    * v9.1.0710: popup window may hide part of Command line
    runtime(vim): Update syntax, improve user-command matching
    * v9.1.0709: GUIEnter event not found in Turkish locale
    runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items
    * v9.1.0708: Recursive window update does not account for reset skipcol
    runtime(nu): include filetype plugin
    * v9.1.0707: invalid cursor position may cause a crash
    * v9.1.0706: test_gettext fails when using shadow dir
    CI: Install locales-all package
    * v9.1.0705: Sorting of fuzzy filename completion is not stable
    translation(pt): update Portuguese/Brazilian menu translation
    runtime(vim): Update base-syntax, match bracket mark ranges
    runtime(doc): Update :help :command-complete list
    * v9.1.0704: inserting with a count is inefficient
    runtime(doc): use mkdir -p to save a command
    * v9.1.0703: crash with 2byte encoding and glob2regpat()
    runtime(hollywood): update syn highlight for If-Then statements
    and For-In-Loops
    * v9.1.0702: Patch 9.1.0700 broke CI
    * v9.1.0701: crash with NFA regex engine when searching for
    composing chars
    * v9.1.0700: crash with 2byte encoding and glob2regpat()
    * v9.1.0699: "dvgo" is not always an inclusive motion
    runtime(java): Provide support for syntax preview features
    * v9.1.0698: "Untitled" file not removed when running Test_crash1_3
    alone
    * v9.1.0697: heap-buffer-overflow in ins_typebuf
    * v9.1.0696: installing runtime files fails when using SHADOWDIR
    runtime(doc): fix typo
    * v9.1.0695: test_crash leaves Untitled file around
    translation(br): Update Brazilian translation
    translation(pt): Update menu_pt_br
    * v9.1.0694: matchparen is slow on a long line
    * v9.1.0693: Configure doesn't show result when not using python3
    stable abi
    * v9.1.0692: Wrong patlen value in ex_substitute()
    * v9.1.0691: stable-abi may cause segfault on Python 3.11
    runtime(vim): Update base-syntax, match :loadkeymap after colon and bar
    runtime(mane): Improve <Plug>ManBS mapping
    * v9.1.0690: cannot set special highlight kind in popupmenu
    translation(pt): Revert and fix wrong Portuguese menu translation
    files
    translation(pt): revert Portuguese menu translation
    translation(br): Update Brazilian translations
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    * v9.1.0689: buffer-overflow in do_search( with 'rightleft'
    runtime(vim): Improve heredoc handling for all embedded scripts
    * v9.1.0688: dereferences NULL pointer in check_type_is_value()
    * v9.1.0687: Makefile may not install desktop files
    runtime(man): Fix <Plug>ManBS
    runtime(java): Make the bundled &foldtext function optional
    runtime(netrw): Change line on `mx` if command output exists
    runtime(netrw): Fix `mf`-selected entry highlighting
    runtime(htmlangular): add html syntax highlighting
    translation(it): Fix filemode of Italian manpages
    runtime(doc): Update outdated man.vim plugin information
    runtime(zip): simplify condition to detect MS-Windows
    * v9.1.0686: zip-plugin has problems with special characters
    runtime(pandoc): escape quotes in &errorformat for pandoc
    translation(it): updated Italian manpage
    * v9.1.0685: too many strlen( calls in usercmd.c
    runtime(doc): fix grammar in :h :keeppatterns
    runtime(pandoc): refine pandoc compiler settings
    * v9.1.0684: completion is inserted on Enter with "noselect"
    translation(ru): update man pages
    * v9.1.0683: mode( returns wrong value with <Cmd> mapping
    runtime(doc): remove trailing whitespace in cmdline.txt
    * v9.1.0682: Segfault with uninitialized funcref
    * v9.1.0681: Analyzing failed screendumps is hard
    runtime(doc): more clarification for the :keeppatterns needed
    * v9.1.0680: VMS does not have defined uintptr_t
    runtime(doc): improve typedchar documentation for KeyInputPre autocmd
    runtime(dist): verify that executable is in $PATH
    translation(it): update Italian manpages
    runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677
    runtime(doc): update Makefile and make it portable between GNU and BSD
    * v9.1.0679: Rename from w_closing to w_locked is incomplete
    runtime(colors): update colorschemes
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    runtime(doc): Updating the examples in the xxd manpage
    translation(ru): Updated uganda.rux
    runtime(yaml): do not re-indent when commenting out lines
    * v9.1.0678: use-after-free in alist_add()
    * v9.1.0677 :keepp does not retain the substitute pattern
    translation(ja): Update Japanese translations to latest release
    runtime(netrw): Drop committed trace lines
    runtime(netrw): Error popup not always used
    runtime(netrw): ErrorMsg( may throw E121
    runtime(tutor): update Makefile and make it portable between GNU and BSD
    translation: improve the po/cleanup.vim script
    runtime(lang): update Makefile and make it portable between GNU and BSD
    * v9.1.0676: style issues with man pages
    * v9.1.0675: Patch v9.1.0674 causes problems
    runtime(dosbatch): Show %%i as an argument in syntax file
    runtime(dosbatch): Add syn-sync to syntax file
    runtime(sql, mysql): fix E169: Command too recursive with
    sql_type_default = "mysql"
    * v9.1.0674: compiling abstract method fails because of missing return
    runtime(javascript): fix a few issues with syntax higlighting
    runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var
    runtime(termdebug): Fix wrong test for balloon feature
    runtime(doc): Remove mentioning of the voting feature
    runtime(doc): add help tags for json + markdown global variables
    * v9.1.0673: too recursive func calls when calling super-class method
    runtime(syntax-tests): Facilitate the viewing of rendered screendumps
    runtime(doc): fix a few style issues
    * v9.1.0672: marker folds may get corrupted on undo
    * v9.1.0671 Problem:  crash with WinNewPre autocommand
    * v9.1.0670: po file encoding fails on *BSD during make
    translation(it): Update Italian translation
    translation: Stop using msgconv
    * v9.1.0669: stable python ABI not used by default
    Update .gitignore and .hgignore files
    * v9.1.0668: build-error with python3.12 and stable ABI
    translations: Update generated po files
    * v9.1.0667: Some other options reset curswant unnecessarily when set
    * v9.1.0666: assert_equal( doesn't show multibyte string correctly
    runtime(doc): clarify directory of Vim's executable vs CWD
    * v9.1.0665 :for loop
    runtime(proto): Add indent script for protobuf filetype
    * v9.1.0664: console vim did not switch back to main screen on exit
    runtime(zip): zip plugin does not work with Vim 9.0
    * v9.1.0663: zip test still resets 'shellslash' option
    runtime(zip): use defer to restore old settings
    runtime(zip): add a generic Message function
    runtime(zip): increment base version of zip plugin
    runtime(zip): raise minimum Vim version to * v9.0
    runtime(zip): refactor save and restore of options
    runtime(zip): remove test for fnameescape
    runtime(zip): use :echomsg instead of :echo
    runtime(zip): clean up and remove comments
    * v9.1.0662: filecopy( may return wrong value when readlink( fails
    * v9.1.0661: the zip plugin is not tested.
    runtime(zip): Fix for FreeBSD's unzip command
    runtime(doc): capitalize correctly
    * v9.1.0660: Shift-Insert does work on old conhost
    translation(it): update Italian manpage
    runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr
    runtime(zip): escape '[' on Unix as well
    * v9.1.0659: MSVC Makefile is a bit hard to read
    runtime(doc): fix typo in syntax.txt
    runtime(doc): -x is only available when compiled with crypt feature
    * v9.1.0658: Coverity warns about dereferencing NULL pointer.
    runtime(colors): update Todo highlight in habamax colorscheme
    * v9.1.0657: MSVC build time can be optimized
    * v9.1.0656: MSVC Makefile CPU handling can be improved
    * v9.1.0655: goaccess config file not recognized
    CI: update clang compiler to version 20
    runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore`
    * v9.1.0654: completion does not respect completeslash with fuzzy
    * v9.1.0653: Patch v9.1.0648 not completely right
    * v9.1.0652: too many strlen( calls in syntax.c
    * v9.1.0651 :append
    * v9.1.0650: Coverity warning in cstrncmp()
    * v9.1.0649: Wrong comment for "len" argument of call_simple_func()
    * v9.1.0648: [security] double-free in dialog_changed()
    * v9.1.0647: [security] use-after-free in tagstack_clear_entry
    runtime(doc): re-format tag example lines, mention ctags --list-kinds
    * v9.1.0646: imported function may not be found
    runtime(java): Document "g:java_space_errors" and "g:java_comment_strings"
    runtime(java): Cluster optional group definitions and their group links
    runtime(java): Tidy up the syntax file
    runtime(java): Tidy up the documentation for "ft-java-syntax"
    runtime(colors): update habamax scheme - tweak diff/search/todo colors
    runtime(nohlsearch): add missing loaded_hlsearch guard
    runtime(kivy): Updated maintainer info for syntax script
    Maintainers: Add maintainer for ondir ftplugin + syntax files
    runtime(netrw): removing trailing slash when copying files in same
    directory
    * v9.1.0645: wrong match when searching multi-byte char case-insensitive
    runtime(html): update syntax script to sync by 250 minlines by default
    * v9.1.0644: Unnecessary STRLEN( when applying mapping
    runtime(zip): Opening a remote zipfile don't work
    runtime(cuda): source c and cpp ftplugins
    * v9.1.0643: cursor may end up on invalid position
    * v9.1.0642: Check that mapping rhs starts with lhs fails if not
    simplified
    * v9.1.0641: OLE enabled in console version
    runtime(thrift): add ftplugin, indent and syntax scripts
    * v9.1.0640: Makefile can be improved
    * v9.1.0639: channel timeout may wrap around
    * v9.1.0638: E1510 may happen when formatting a message for smsg()
    * v9.1.0637: Style issues in MSVC Makefile
  - Update apparmor.vim to latest version (from AppArmor 4.0.2)
  - add support for "all" and "userns" rules, and new profile flags
  - Update to 9.1.0636:
    * 9.1.0636: filetype: ziggy files are not recognized
    * 9.1.0635: filetype: SuperHTML template files not recognized
    * 9.1.0634: Ctrl-P not working by default
    * 9.1.0633: Compilation warnings with `-Wunused-parameter`
    * 9.1.0632: MS-Windows: Compiler Warnings
    Add support for Files-Included in syntax script
    tweak documentation style a bit
    * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion
    * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme
    * 9.1.0629: Rename of pum hl_group is incomplete
    * 9.1.0628: MinGW: coverage files are not cleaned up
    * 9.1.0627: MinGW: build-error when COVERAGE is enabled
    * 9.1.0626: Vim9: need more tests with null objects
    include initial filetype plugin
    * 9.1.0625: tests: test output all translated messages for all translations
    * 9.1.0624: ex command modifiers not found
    * 9.1.0623: Mingw: errors when trying to delete non-existing files
    * 9.1.0622: MS-Windows: mingw-build can be optimized
    * 9.1.0621: MS-Windows: startup code can be improved
    * 9.1.0620: Vim9: segfauls with null objects
    * 9.1.0619: tests: test_popup fails
    * 9.1.0618: cannot mark deprecated attributes in completion menu
    * 9.1.0617: Cursor moves beyond first line of folded end of buffer
    * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles
    * 9.1.0615: Unnecessary STRLEN() in make_percent_swname()
    Add single-line comment syntax
    Add syntax test for comments
    Update maintainer info
    * 9.1.0614: tests: screendump tests fail due to recent syntax changes
    * 9.1.0613: tests: termdebug test may fail and leave file around
    Update base-syntax, improve :set highlighting
    Optionally highlight the :: token for method references
    * 9.1.0612: filetype: deno.lock file not recognized
    Use delete() for deleting directory
    escape filename before trying to delete it
    * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys
    correctly extract file from zip browser
    * 9.1.0610: filetype: OpenGL Shading Language files are not detected
    Fix endless recursion in netrw#Explore()
    * 9.1.0609: outdated comments in Makefile
    update syntax script
    Fix flow mapping key detection
    Remove orphaned YAML syntax dump files
    * 9.1.0608: Coverity warns about a few potential issues
    Update syntax script and remove syn sync
    * 9.1.0607: termdebug: uses inconsistent style
    * 9.1.0606: tests: generated files may cause failure in test_codestyle
    * 9.1.0605: internal error with fuzzy completion
    * 9.1.0604: popup_filter during Press Enter prompt seems to hang
    translation: Update Serbian messages translation
    * 9.1.0603: filetype: use correct extension for Dracula
    * 9.1.0602: filetype: Prolog detection can be improved
    fix more inconsistencies in assert function docs
    * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit
    Update base-syntax, improve :map highlighting
    * 9.1.0600: Unused function and unused error constants
    * 9.1.0599: Termdebug: still get E1023 when specifying arguments
    correct wrong comment options
    fix typo "a xterm" -> "an xterm"
    * 9.1.0598: fuzzy completion does not work with default completion
    * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key
    * 9.1.0596: filetype: devscripts config files are not recognized
    gdb file/folder check is now performed only in CWD.
    quote filename arguments using double quotes
    update syntax to SDC-standard 2.1
    minor updates.
    Cleanup :match and :loadkeymap syntax test files
    Update base-syntax, match types in Vim9 variable declarations
    * 9.1.0595: make errors out with the po Makefile
    * 9.1.0594: Unnecessary redraw when setting 'winfixbuf'
    using wrong highlight for UTF-8
    include simple syntax plugin
    * 9.1.0593: filetype: Asymptote files are not recognized
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    * 9.1.0592: filetype: Mediawiki files are not recognized
    * 9.1.0591: filetype: *.wl files are not recognized
    * 9.1.0590: Vim9: crash when accessing getregionpos() return value
    'cpoptions': Include "z" in the documented default
    * 9.1.0589: vi: d{motion} and cw work differently than expected
    update included colorschemes
    grammar fixes in options.txt
  - Add "Keywords" to gvim.desktop to make searching for gvim easier
  - Removed patches, as they're no longer required (refreshing them
    deleted their contents):
    * vim-7.3-help_tags.patch
    * vim-7.4-highlight_fstab.patch
  - Reorganise all applied patches in the spec file.
  - Update to 9.1.0588:
    * 9.1.0588: The maze program no longer compiles on newer clang
    runtime(typst): Add typst runtime files
    * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky
    * 9.1.0586: ocaml runtime files are outdated
    runtime(termdebug): fix a few issues
    * 9.1.0585: tests: test_cpoptions leaves swapfiles around
    * 9.1.0584: Warning about redeclaring f_id() non-static
    runtime(doc): Add hint how to load termdebug from vimrc
    runtime(doc): document global insert behavior
    * 9.1.0583: filetype: *.pdf_tex files are not recognized
    * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode
    * 9.1.0581: Various lines are indented inconsistently
    * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode
    * 9.1.0579: Ex command is still executed after giving E1247
    * 9.1.0578: no tests for :Tohtml
    * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim
    * 9.1.0576: tests: still an issue with test_gettext_make
    * 9.1.0575: Wrong comments in alt_tabpage()
    * 9.1.0574: ex: wrong handling of commands after bar
    runtime(doc): add a note for netrw bug reports
    * 9.1.0573: ex: no implicit print for single addresses
    runtime(vim): make &indentexpr available from the outside
    * 9.1.0572: cannot specify tab page closing behaviour
    runtime(doc): remove obsolete Ex insert behavior
    * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky
    runtime(logindefs): update syntax with new keywords
    * 9.1.0570: tests: test_gettext_make can be improved
    runtime(filetype): Fix Prolog file detection regex
    * 9.1.0569: fnamemodify() treats ".." and "../" differently
    runtime(mojo): include mojo ftplugin and indent script
    * 9.1.0568: Cannot expand paths from 'cdpath' setting
    * 9.1.0567: Cannot use relative paths as findfile() stop directories
    * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash
    * 9.1.0565: Stop directory doesn't work properly in 'tags'
    * 9.1.0564: id() can be faster
    * 9.1.0563: Cannot process any Key event
    * 9.1.0562: tests: inconsistency in test_findfile.vim
    runtime(fstab): Add missing keywords to fstab syntax
    * 9.1.0561: netbeans: variable used un-initialized (Coverity)
    * 9.1.0560: bindtextdomain() does not indicate an error
    * 9.1.0559: translation of vim scripts can be improved
    * 9.1.0558: filetype: prolog detection can be improved
    * 9.1.0557: moving in the buffer list doesn't work as documented
    runtime(doc): fix inconsistencies in :h file-searching
    * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages
    runtime(htmlangular): correct comment
    * 9.1.0555: filetype: angular ft detection is still problematic
    * 9.1.0554: :bw leaves jumplist and tagstack data around
    * 9.1.0553: filetype: *.mcmeta files are not recognized
    * 9.1.0552: No test for antlr4 filetype
    * 9.1.0551: filetype: htmlangular files are not properly detected
    * 9.1.0550: filetype: antlr4 files are not recognized
    * 9.1.0549: fuzzycollect regex based completion not working as expected
    runtime(doc): autocmd_add() accepts a list not a dict
    * 9.1.0548: it's not possible to get a unique id for some vars
    runtime(tmux): Update syntax script
    * 9.1.0547: No way to get the arity of a Vim function
    * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A
    runtime(hlsplaylist): include hlsplaylist ftplugin file
    runtime(doc): fix typo in :h ft-csv-syntax
    runtime(doc): Correct shell command to get $VIMRUNTIME into
    shell
    * 9.1.0545: MSVC conversion warning
    * 9.1.0544: filetype: ldapconf files are not recognized
    runtime(cmakecache): include cmakecache ftplugin file
    runtime(lex): include lex ftplugin file
    runtime(yacc): include yacc ftplugin file
    runtime(squirrel): include squirrel ftplugin file
    runtime(objcpp): include objcpp ftplugin file
    runtime(tf): include tf ftplugin file
    runtime(mysql): include mysql ftplugin file
    runtime(javacc): include javacc ftplugin file
    runtime(cabal): include cabal ftplugin file
    runtime(cuda): include CUDA ftplugin file
    runtime(editorconfig): include editorconfig ftplugin file
    runtime(kivy): update kivy syntax, include ftplugin
    runtime(syntax-tests): Stop generating redundant "*_* 99.dump"
    files
    * 9.1.0543: Behavior of CursorMovedC is strange
    runtime(vim): Update base-syntax, improve :match command
    highlighting
    * 9.1.0542: Vim9: confusing string() output for object functions
    * 9.1.0541: failing test with Vim configured without channel
    * 9.1.0540: Unused assignment in sign_define_cmd()
    runtime(doc): add page-scrolling keys to index.txt
    runtime(doc): add reference to xterm-focus-event from
    FocusGained/Lost
    * 9.1.0539: Not enough tests for what v9.1.0535 fixed
    runtime(doc): clarify how to re-init csv syntax file
    * 9.1.0538: not possible to assign priority when defining a sign
    * 9.1.0537: signed number detection for CTRL-X/A can be improved
    * 9.1.0536: filetype: zone files are not recognized
    * 9.1.0535: newline escape wrong in ex mode
    runtime(man): honor cmd modifiers before `g:ft_man_open_mode`
    runtime(man): use `nnoremap` to map to Ex commands
    * 9.1.0534: completion wrong with fuzzy when cycling back to original
    runtime(syntax-tests): Abort and report failed cursor progress
    runtime(syntax-tests): Introduce self tests for screen dumping
    runtime(syntax-tests): Clear and redraw the ruler line with
    the shell info
    runtime(syntax-tests): Allow for folded and wrapped lines in
    syntax test files
    * 9.1.0533: Vim9: need more tests for nested objects equality
    CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries
    runtime(doc): Remove wrong help tag CTRL-SHIFT-CR
    * 9.1.0532: filetype: Cedar files not recognized
    runtime(doc): document further keys that scroll page up/down
    * 9.1.0531: resource leak in mch_get_random()
    runtime(tutor): Fix wrong spanish translation
    runtime(netrw): fix remaining case of register clobber
    * 9.1.0530: xxd: MSVC warning about non-ASCII character
    * 9.1.0529: silent! causes following try/catch to not work
    runtime(rust): use shiftwidth() in indent script
    * 9.1.0528: spell completion message still wrong in translations
    * 9.1.0527: inconsistent parameter in Makefiles for Vim executable
    * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer
    runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config
    * 9.1.0525: Right release selects immediately when pum is truncated.
    * 9.1.0524: the recursive parameter in the *_equal functions can be removed
    runtime(termdebug): Add Deprecation warnings
    * 9.1.0523: Vim9: cannot downcast an object
    * 9.1.0522: Vim9: string(object) hangs for recursive references
    * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13
    * 9.1.0520: Vim9: incorrect type checking for modifying lists
    runtime(manpager): avoid readonly prompt
    * 9.1.0519: MS-Windows: libvterm compilation can be optimized
    * 9.1.0518: initialize the random buffer can be improved
    * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak
    runtime(terraform): Add filetype plugin for terraform
    runtime(dockerfile): enable spellchecking of comments in
    syntax script
    runtime(doc): rename variable for pandoc markdown support
    runtime(doc): In builtin overview use {buf} as param for
    appendbufline/setbufline
    runtime(doc): clarify, that register 1-* 9 will always be shifted
    runtime(netrw): save and restore register 0-* 9, a and unnamed
    runtime(termdebug): Refactored StartDebug_term and EndDebug
    functions
    runtime(java): Compose "g:java_highlight_signature" and
    "g:java_highlight_functions"
    * 9.1.0516: need more tests for nested dicts and list comparision
    * 9.1.0515: Vim9: segfault in object_equal()
    * 9.1.0514: Vim9: issue with comparing objects recursively
    runtime(termdebug): Change some variables to Enums
    runtime(vim): Update base-syntax, fix function tail comments
    * 9.1.0513: Vim9: segfault with object comparison
  - Update to 9.1.0512:
    * Mode message for spell completion doesn't match allowed keys
    * CursorMovedC triggered wrongly with setcmdpos()
    * update runtime files
    * CI: test_gettext fails on MacOS14 + MSVC Win
    * not possible to translate Vim script messages
    * termdebug plugin can be further improved
    * add gomod filetype plugin
    * hard to detect cursor movement in the command line
    * Optionally highlight parameterised types
    * filetype: .envrc & .prettierignore not recognized
    * filetype: Faust files are not recognized
    * inner-tag textobject confused about ">" in attributes
    * cannot use fuzzy keyword completion
    * Remove the group exclusion list from @javaTop
    * wrong return type for execute() function
    * MS-Windows: too much legacy code
    * too complicated mapping restore in termdebug
    * simplify mapping
    * cannot switch buffer in a popup
    * MS-Windows: doesn't handle symlinks properly
    * getcmdcompltype() interferes with cmdline completion
    * termdebug can be further improved
    * update htmldjango detection
    * Improve Turkish documentation
    * include a simple csv filetype and syntax plugin
    * include the the simple nohlsearch package
    * matched text is highlighted case-sensitively
    * Matched text isn't highlighted in cmdline pum
    * Fix typos in several documents
    * clarify when text properties are cleared
    * improve the vim-shebang example
    * revert unintended formatting changes for termdebug
    * Add a config variable for commonly used compiler options
    * Wrong matched text highlighted in pum with 'rightleft'
    * bump length of character references in syntax script
    * properly check mapping variables using null_dict
    * fix KdlIndent and kdlComment in indent script
    * Test for patch 9.1.0489 doesn't fail without the fix
    * Fold multi-line comments with the syntax kind of &fdm
    * using wrong type for PlaceSign()
    * filetype: Vim-script files not detected by shebang line
    * revert unintended change to zip#Write()
    * add another tag for vim-shebang feature
    * Cmdline pum doesn't work properly with 'rightleft'
    * minor style problems with patch 9.1.0487
    * default completion may break with fuzzy
    * Wrong padding for pum "kind" with 'rightleft'
    * Update base-syntax, match shebang lines
    * MS-Windows: handle files with spaces properly
    * Restore HTML syntax file tests
    * completed item not update on fuzzy completion
    * filetype: Snakemake files are not recognized
    * make TermDebugSendCommand() a global function again
    * close all buffers in the same way
    * Matched text shouldn't be highlighted in "kind" and "menu"
    * fix wrong helptag for :defer
    * Update base-syntax, match :sleep arg
    * include Georgian keymap
    * Sorting of completeopt+=fuzzy is not stable
    * correctly test for windows in NetrwGlob()
    * glob() on windows fails with [] in directory name
    * rewrite mkdir() doc and simplify {flags} meaning
    * glob() not sufficiently tested
    * update return type for job_info()
    * termdebug plugin needs more love
    * correct return types for job_start() and job_status()
    * Update base-syntax, match :catch and :throw args
    * Include element values in non-marker annotations
    * Vim9: term_getjob() throws an exception on error
    * fuzzy string matching executed when not needed
    * fuzzy_match_str_with_pos() does unnecessary list operations
    * restore description of "$" in col() and virtcol()
    * deduplicate getpos(), line(), col(), virtcol()
    * Update g:vimsyn_comment_strings dump file tests
    * Use string interpolation instead of string concat
    * potential deref of NULL pointer in fuzzy_match_str_with_pos
    * block_editing errors out when using <enter>
    * Update base-syntax, configurable comment string highlighting
    * fix typos in syntax.txt
    * Cannot see matched text in popup menu
    * Update base-syntax, match multiline continued comments
    * clarify documentation for "v" position at line()
    * cmod_split modifier is always reset in term_start()
    * remove line-continuation characters
    * use shiftwidth() instead of &tabstop in indent script
    * Remove orphaned screen dump files
    * include syntax, indent and ftplugin files
    * CI: Test_ColonEight() fails on github runners
    * add missing Enabled field in syntax script
    * basic svelte ftplugin file
    * term_start() does not clear vertical modifier
    * fix mousemodel restoration by comparing against null_string
    * Added definitions of Vim scripts and plugins
    * Exclude lambda expressions from _when_ _switch-case_ label clauses
    * Fix saved_mousemodel check
    * Inconsistencies between functions for option flags
    * Crash when using autocmd_get() after removing event inside autocmd
    * Fix small style issues
    * add return type info for Vim function descriptions
    * Update Italian Vim manpage
    * disable the q mapping
    * Change 'cms' for C++ to '// %s'
    * fix type mismatch error
    * Fix wrong email address
    * convert termdebug plugin to Vim9 script
  - Update to 9.1.0470:
    * tests Test_ColonEight_MultiByte() fails sporadically
    * Cannot have buffer-local value for 'completeopt'
    * GvimExt does not consult HKEY_CURRENT_USER
    * typos in some comments
    * runtime(vim): Update base-syntax, allow whitespace before
    :substitute pattern
    * Missing comments for fuzzy completion
    * runtime(man): update Vim manpage
    * runtime(comment): clarify the usage of 'commentstring' option
    value
    * runtime(doc): clarify how fuzzy 'completeopt' should work
    * runtime(netrw): prevent accidental data loss
    * missing filecopy() function
    * no whitespace padding in commentstring option in ftplugins
    * no fuzzy-matching support for insert-completion
    * eval5() and eval7 are too complex
    * too many strlen() calls in drawline.c
    * filetype lintstagedrc files are not recognized
    * Vim9 import autoload does not work with symlink
    * Coverity complains about division by zero
    * tests test_gui fails on Wayland
    * Left shift is incorrect with vartabstop and shiftwidth=0
    * runtime(doc): clarify 'shortmess' flag "S"
    * MS-Windows compiler warning for size_t to int conversion
    * runtime(doc): include some vim9 script examples in the help
    * minor issues in test_filetype with rasi test
    * filetype rasi files are not recognized
    * runtime(java): Improve the matching of lambda expressions
    * Configure checks for libelf unnecessarily
    * No test for escaping '<' with shellescape()
    * check.vim complains about overlong comment lines
    * translation(it): Update Italian translation
    * evalc. code too complex
    * MS-Windows Compiler warnings
  - Update to 9.1.0448:
    * compiler warning in eval.c
    * remove remaining css code
    * Add ft_hare.txt to Reference Manual TOC
    * re-generate vim syntax from generator
    * fix syntax vim bug
    * completion may be wrong when deleting all chars
    * getregionpos() inconsistent for partly-selected multibyte char
    * fix highlighting nested and escaped quotes in string props
    * remove the indent plugin since it has too many issues
    * update Debian runtime files
    * Coverity warning after 9.1.0440
    * Not enough tests for getregion() with multibyte chars
    * Can't use blockwise selection with width for getregion()
    * update outdated syntax files
    * fix floating_modifier highlight
    * hare runtime files outdated
    * getregionpos() can't properly indicate positions beyond eol
    * function get_lval() is too long
    * Cannot filter the history
    * Wrong Ex command executed when :g uses '?' as delimiter
    * support floating_modifier none; revert broken highlighting
    * Motif requires non-const char pointer for XPM  data
    * Crash when using '?' as separator for :s
    * filetype: cygport files are not recognized
    * make errors trying to access autoload/zig
    * Wrong yanking with exclusive selection and ve=all
    * add missing help tags file
    * Ancient XPM preprocessor hack may cause build errors
    * include basic rescript ftplugin file
    * eval.c is too long
    * getregionpos() doesn't handle one char selection
    * check for gdb file/dir before using as buffer name
    * refactor zig ftplugin, remove auto format
    * Coverity complains about eval.c refactor
    * Tag guessing leaves wrong search history with very short names
    * some issues with termdebug mapping test
    * update matchit plugin to v1.20
    * too many strlen() calls in search.c
    * set commentstring option
    * update vb indent plugin as vim9script
    * filetype: purescript files are not recognized
    * filetype: slint files are not recognized
    * basic nim ftplugin file for comments
    * Add Arduino ftplugin and indent files
    * include basic typst ftplugin file
    * include basic prisma ftplugin file
    * include basic v ftplugin for comment support
    * getregionpos() wrong with blockwise mode and multibyte
    * function echo_string_core() is too long
    * hyprlang files are not recognized
    * add basic dart ftplugin file
    * basic ftplugin file for graphql
    * mention comment plugin at :h 'commentstring'
    * set commentstring for sql files in ftplugin
    * :browse oldfiles prompts even with single entry
    * eval.c not sufficiently tested
    * clarify why E195 is returned
    * clarify temporary file clean up
    * fix :NoMatchParen not working
    * Cannot move to previous/next rare word
    * add basic ftplugin file for sshdconfig
    * if_py: find_module has been removed in Python 3.12.0a7
    * some screen dump tests can be improved
    * Some functions are not tested
    * clarify instal instructions for comment package
    * Unable to leave long line with 'smoothscroll' and 'scrolloff'
    * fix typo in vim9script help file
    * Remove trailing spaces
    * clarify {special} argument for shellescape()
  - update to 9.1.0413
    * smoothscroll may cause infinite loop
    * add missing entries for the keys CTRL-W g<Tab> and <C-Tab>
    * update vi_diff.txt: add default value for 'flash'
    * typo in regexp_bt.c in DEBUG code
    * allow indented commands
    * Fix wrong define regex in ftplugin
    * Filter out non-Latin-1 characters for syntax tests
    * prefer scp over pscp
    * fix typo in usr_52.txt
    * too long functions in eval.c
    * warning about uninitialized variable
    * too many strlen() calls in the regexp engine
    * E16 fix, async keyword support for define
    * Stuck with long line and half-page scrolling
    * Divide by zero with getmousepos() and 'smoothscroll'
    * update and remove  some invalid links
    * update translation of xxd manpage
    * Recursively delete directories by default with netrw delete command
    * Strive to remain compatible for at least Vim 7.0
    * tests: xxd buffer overflow fails on 32-bit
    * Stop handpicking syntax groups for @javaTop
    * [security] xxd: buffer-overflow with specific flags
    * Vim9: not able to import file from start dir
    * filetype: mdd files detected as zsh filetype
    * filetype: zsh module files are not recognized
    * Remove hardcoded private.ppk logic from netrw
    * Vim9: confusing error message for unknown type
    * block_editing errors out when using del
    * add new items to scripts section in syntax plugin
    * Vim9: imported vars are not properly type checked
    * Wrong display with 'smoothscroll' when changing quickfix list
    * filetype: jj files are not recognized
    * getregionpos() may leak memory on error
    * The CODEOWNERS File is not useful
    * Remove and cleanup Win9x legacy from netrw
    * add MsgArea to 'highlight' option description
    * Cannot get a list of positions describing a region
    * Fix digit separator in syntax script for octals and floats
    * Update link to Wikipedia Vi page
    * clear $MANPAGER in ftplugin before shelling out
    * Fix typos in help documents
    * 'viewdir' not respecting $XDG_CONFIG_HOME
    * tests: Vim9 debug tests may be flaky
    * correct getscriptinfo() example
    * Vim9: could improve testing
    * test_sound fails on macos-12
    * update Serbian menu
    * update Slovak menu
    * update Slovenian menu
    * update Portuguese menu
    * update Dutch menu
    * update Korean menu
    * update Icelandic menu
    * update Czech menu
    * update Afrikaans menu
    * update German menu
    * filetype: inko files are not recognized
    * filetype: templ files are not recognized
    * cursor() and getregion() don't handle v:maxcol well
    * Vim9: null value tests not sufficient
    * update Catalan menu
    * filetype: stylus files not recognized
    * update spanish menu localization
    * regenerate helptags
    * Vim9: crash with null_class and null_object
    * Add tags about lazyloading of menu
    * tests: vt420 terminfo entry may not be found
    * filetype: .out files recognized as tex files
    * filetype: Kbuild files are not recognized
    * cbuffer and similar commands don't accept a range
    * Improve the recognition of the "indent" method declarations
    * Fix a typo in usr_30.txt
    * remove undefined var s:save_cpoptions and add include setting
    * missing setlocal in indent plugin
    * Calculating line height for unnecessary amount of lines
    * improve syntax file performance
    * There are a few typos
    * Vim9: no comments allowed after class vars
    * CI: remove trailing white space in documentation
    * Formatting text wrong when 'breakindent' is set
    * Add oracular (24.10) as Ubuntu release name
    * Vim9: Trailing commands after class/enum keywords ignored
    * tests: 1-second delay after Test_BufEnter_botline()
    * update helptags for jq syntax
    * include syntax, ftplugin and compiler plugin
    * fix typo synconcealend -> synconcealed
    * include a simple comment toggling plugin
    * wrong botline in BufEnter
    * clarify syntax vs matching mechanism
    * fix undefined variable in indent plugin
    * ops.c code uses too many strlen() calls
    * Calling CLEAR_FIELD() on the same struct twice
    * Vim9: compile_def_function() still too long
    * Update Serbian messages
    * clarify the effect of setting the shell to powershell
    * Improve the recognition of the "style" method declarations
    * Vim9: problem when importing autoloaded scripts
    * compile_def_function is too long
    * filetype: ondir files are not recognized
    * Crash when typing many keys with D- modifier
    * tests: test_vim9_builtin is a bit slow
    * update documentation
    * change the download URL of "libsodium"
    * tests: test_winfixbuf is a bit slow
    * Add filetype, syntax and indent plugin for Astro
    * expanding rc config files does not work well
    * Vim9: vim9type.c is too complicated
    * Vim9: does not handle autoloaded variables well
    * minor spell fix in starting.txt
    * wrong drawing in GUI with setcellwidth()
    * Add include and suffixesadd
    * Page scrolling should place cursor at window boundaries
    * align command line table
    * minor fixes to starting.txt
    * fix comment definition in filetype plugin
    * filetype: flake.lock files are not recognized
    * runtime(uci): No support for uci file types
    * Support "g:ftplugin_java_source_path" with archived files
    * tests: Test_autoload_import_relative_compiled fails on Windows
    * Finding cmd modifiers and cmdline-specials is inefficient
    * No test that completing a partial mapping clears 'showcmd'
    * tests: test_vim9_dissamble may fail
    * Vim9: need static type for typealias
    * X11 does not ignore smooth scroll event
    * A few typos in test_xdg when testing gvimrc
    * Patch v9.1.0338 fixed sourcing a script with import
    * Problem: gvimrc not sourced from XDG_CONFIG_HOME
    * Cursor wrong after using setcellwidth() in terminal
    * 'showcmd' wrong for partial mapping with multibyte
    * tests: test_taglist fails when 'helplang' contains non-english
    * Problem: a few memory leaks are found
    * Problem: Error with matchaddpos() and empty list
    * tests: xdg test uses screen dumps
    * Vim9: import through symlinks not correctly handled
    * Missing entry for XDG vimrc file in :version
    * tests: typo in test_xdg
    * runtime(i3config/swayconfig): update syntax scripts
    * document pandoc compiler and enable configuring arguments
    * String interpolation fails for List type
    * No test for highlight behavior with 'ambiwidth'
    * tests: test_xdg fails on the appimage repo
    * tests: some assert_equal() calls have wrong order of args
    * make install does not install all files
    * runtime(doc): fix typos in starting.txt
  - Updated to version 9.1 with patch level 0330, fixes the following problems
    * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1
  - refreshed vim-7.3-filetype_spec.patch
  - refreshed vim-7.3-filetype_ftl.patch
  - Update spec.skeleton to use autosetup in place of setup macro.
  - for the complete list of changes see
    https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330

++++ vim:

  - Fix for bsc#1231373 / CVE-2024-47814.
  - Fix for bsc#1229238 / CVE-2024-43374.
  - update to 9.1.0836
    * 9.1.0836: The vimtutor can be improved
    * 9.1.0835: :setglobal doesn't work properly for 'ffu' and 'tsrfu'
    * 9.1.0834: tests: 2html test fails
    * 9.1.0833: CI: recent ASAN changes do not work for indent tests
    * 9.1.0832: :set doesn't work for 'cot' and 'bkc' after :setlocal
    * runtime(doc): update help-toc description
    * runtime(2html): Make links use color scheme colors in TOhtml
    * 9.1.0831: 'findexpr' can't be used as lambad or Funcref
    * Filelist: include helptoc package
    * runtime(doc): include a TOC Vim9 plugin
    * Filelist: ignore .git-blame-ignore-revs
    * 9.1.0830: using wrong highlight group for spaces for popupmenu
    * runtime(typst): synchronize updates from the upstream typst.vim
    * git: ignore reformatting commit for git-blame (after v9.1.0829)
    * 9.1.0829: Vim source code uses a mix of tabs and spaces
    * 9.1.0828: string_T struct could be used more often
    * 9.1.0827: CI: tests can be improved
    * runtime(doc): remove stray sentence in pi_netrw.txt
    * 9.1.0826: filetype: sway files are not recognized
    * runtime(doc): Include netrw-gp in TOC
    * runtime(doc): mention 'iskeyword' at :h charclass()
    * runtime(doc): update help tags
    * 9.1.0825: compile error for non-diff builds
    * runtime(netrw): fix E874 when browsing remote directory which contains `~` character
    * runtime(doc): update coding style documentation
    * runtime(debversions): Add plucky (25.04) as Ubuntu release name
    * 9.1.0824: too many strlen() calls in register.c
    * 9.1.0823: filetype: Zephyr overlay files not recognized
    * runtime(doc): Clean up minor formatting issues for builtin functions
    * runtime(netrw): make :Launch/Open autoloadable
    * runtime(netrw): fix regression with x mapping on Cygwin
    * runtime(netrw): fix filetype detection for remote files
    * 9.1.0822: topline might be changed in diff mode unexpectedly
    * CI: huge linux builds should also run syntax & indent tests
    * 9.1.0821: 'findexpr' completion doesn't set v:fname to cmdline argument
    * 9.1.0820: tests: Mac OS tests are too flaky
    * runtime(awk): Highlight more awk comments in syntax script
    * runtime(netrw): add missing change for s:redir()
    * 9.1.0819: tests: using findexpr and imported func not tested
    * runtime(netrw): improve netrw's open-handling further
    * runtime(netrw): fix syntax error in netrwPlugin.vim
    * runtime(netrw): simplify gx file handling
    * 9.1.0818: some global functions are only used in single files
    * 9.1.0817: termdebug: cannot evaluate expr in a popup
    * runtime(defaults): Detect putty terminal and switch to dark background
    * 9.1.0816: tests: not clear what tests cause asan failures
    * runtime(doc): Remove some completed items from todo.txt
    * 9.1.0815: "above" virtual text causes wrong 'colorcolumn' position
    * runtime(syntax-tests): tiny vim fails because of line-continuation
    * 9.1.0814: mapset() may remove unrelated mapping
    * 9.1.0813: no error handling with setglobal and number types
    * 9.1.0812: Coverity warns about dereferencing NULL ptr
    * 9.1.0811: :find expansion does not consider 'findexpr'
    * 9.1.0810: cannot easily adjust the |:find| command
    * 9.1.0809: filetype: petalinux config files not recognized
    * 9.1.0808: Terminal scrollback doesn't shrink when decreasing 'termwinscroll'
    * 9.1.0807: tests: having 'nolist' in modelines isn't always desired
    * 9.1.0806: tests: no error check when setting global 'briopt'
    * 9.1.0805: tests: minor issues in gen_opt_test.vim
    * 9.1.0804: tests: no error check when setting global 'cc'
    * 9.1.0803: tests: no error check when setting global 'isk'
    * 9.1.0802: tests: no error check when setting global 'fdm' to empty value
    * 9.1.0801: tests: no error check when setting global 'termwinkey'
    * 9.1.0800: tests: no error check when setting global 'termwinsize'
    * runtime(doc): :ownsyntax also resets 'spelloptions'
    * 9.1.0799: tests: gettwinvar()/gettabwinvar() tests are not comprehensive
    * runtime(doc): Fix wrong Mac default options
    * 9.1.0798: too many strlen() calls in cmdhist.c
    * 9.1.0797: testing of options can be further improved
    * 9.1.0796: filetype: libtool files are not recognized
    * (typst): add folding to typst ftplugin
    * runtime(netrw): deprecate and remove netrwFileHandlers#Invoke()
    * 9.1.0795: filetype: Vivado memory info file are not recognized
    * 9.1.0794: tests: tests may fail on Windows environment
    * runtime(doc): improve the :colorscheme documentation
    * 9.1.0793: xxd: -e does add one extra space
    * 9.1.0792: tests: Test_set_values() is not comprehensive enough
    * runtime(swayconfig): add flag for bindsym/bindcode to syntax script
    * 9.1.0791: tests: errors in gen_opt_test.vim are not shown
    * runtime(compiler): check for compile_commands in build dirs for cppcheck
    * 9.1.0790: Amiga: AmigaOS4 build should use default runtime (newlib)
    * runtime(help): Update help syntax
    * runtime(help): fix end of sentence highlight in code examples
    * runtime(jinja): Support jinja syntax as secondary filetype
    * 9.1.0789: tests: ':resize + 5' has invalid space after '+'
    * 9.1.0788: <CSI>27;<mod>u is not decoded to literal Escape in kitty/foot
    * 9.1.0787: cursor position changed when using hidden terminal
    * 9.1.0786: tests: quickfix update test does not test location list
    * runtime(doc): add some docs for file-watcher programs
    * CI: uploading failed screendumps still fails on Cirrus CI
    * 9.1.0785: cannot preserve error position when setting quickfix list
    * 9.1.0784: there are several problems with python 3.13
    * 9.1.0783: 'spell' option setting has problems
    * 9.1.0782: tests: using wrong neomuttlog file name
    * runtime(doc): add preview flag to statusline example
    * 9.1.0781: tests: test_filetype fails
    * 9.1.0780: MS-Windows: incorrect Win32 error checking
    * 9.1.0779: filetype: neomuttlog files are not recognized
    * 9.1.0778: filetype: lf config files are not recognized
    * runtime(comment): fix commment toggle with mixed tabs & spaces
    * runtime(misc): Use consistent "Vim script" spelling
    * runtime(gleam): add ftplugin for gleam files
    * runtime(doc): link help-writing from write-local-help
    * 9.1.0777: filetype: Some upstream php files are not recognized
    * runtime(java): Define javaBlockStart and javaBlockOtherStart hl groups
    * runtime(doc): mention conversion rules for remote_expr()
    * runtime(tutor): Fix missing :s command in spanish translation section 4.4
    * 9.1.0776: test_strftime may fail because of missing TZ data
    * translation(am): Add Armenian language translation
    * 9.1.0775: tests: not enough tests for setting options
    * 9.1.0774: "shellcmdline" doesn't work with getcompletion()
    * 9.1.0773: filetype: some Apache files are not recognized
    * 9.1.0772: some missing changes from v9.1.0771
    * 9.1.0771: completion attribute hl_group is confusing
    * 9.1.0770: current command line completion is a bit limited
    * 9.1.0769: filetype: MLIR files are not recognized
    * 9.1.0768: MS-Windows: incorrect cursor position when restoring screen
    * runtime(nasm): Update nasm syntax script
    * 9.1.0767: A condition is always true in ex_getln.c
    * runtime(skill): Update syntax file to fix string escapes
    * runtime(help): highlight CTRL-<Key> correctly
    * runtime(doc): add missing usr_52 entry to toc
    * 9.1.0766: too many strlen() calls in ex_getln.c
    * runtime(doc): correct `vi` registers 1-9 documentation error
    * 9.1.0765: No test for patches 6.2.418 and 7.3.489
    * runtime(spec): set comments and commentstring options
    * NSIS: Include libgcc_s_sjlj-1.dll again
    * runtime(doc): clarify the effect of 'startofline' option
    * 9.1.0764: [security]: use-after-free when closing a buffer
    * runtime(vim): Update base-syntax file, improve class, enum and interface highlighting
    * 9.1.0763: tests: cannot run single syntax tests
    * 9.1.0762: 'cedit', 'termwinkey' and 'wildchar' may not be parsed correctly
    * 9.1.0761: :cd completion fails on Windows with backslash in path
    * 9.1.0760: tests: no error reported, if gen_opt_test.vim fails
    * 9.1.0759: screenpos() may return invalid position
    * runtime(misc): unset compiler in various ftplugins
    * runtime(doc): update formatting and syntax
    * runtime(compiler): add cppcheck linter compiler plugin
    * runtime(doc): Fix style in documents
    * runtime(doc): Fix to two-space convention in user manual
    * runtime(comment): consider &tabstop in lines after whitespace indent
    * 9.1.0758: it's possible to set an invalid key to 'wildcharm'
    * runtime(java): Manage circularity for every :syn-included syntax file
    * 9.1.0757: tests: messages files contains ANSI escape sequences
    * 9.1.0756: missing change from patch v9.1.0754
    * 9.1.0755: quickfix list does not handle hardlinks well
    * runtime(doc): 'filetype', 'syntax' and 'keymap' only allow alphanumeric + some characters
    * runtime(systemd): small fixes to &keywordprg in ftplugin
    * CI: macos-12 runner is being sunset, switch to 13
    * 9.1.0754: fixed order of items in insert-mode completion menu
    * runtime(comment): commenting might be off by one column
    * 9.1.0753: Wrong display when typing in diff mode with 'smoothscroll'
    * 9.1.0752: can set 'cedit' to an invalid value
    * runtime(doc): add `usr` tag to usr_toc.txt
    * 9.1.0751: Error callback for term_start() not used
    * 9.1.0750: there are some Win9x legacy references
    * runtime(java): Recognise the CommonMark form (///) of Javadoc comments
    * 9.1.0749: filetype: http files not recognized
    * runtime(comment): fix syntax error
    * CI: uploading failed screendump tests does not work Cirrus
    * 9.1.0748: :keep* commmands are sometimes misidentified as :k
    * runtime(indent): allow matching negative numbers for gnu indent config file
    * runtime(comment): add gC mapping to (un)comment rest of line
    * 9.1.0747: various typos in repo found
    * 9.1.0746: tests: Test_halfpage_longline() fails on large terminals
    * runtime(doc): reformat gnat example
    * runtime(doc): reformat ada_standard_types section
    * 9.1.0745: filetype: bun and deno history files not recognized
    * runtime(glvs): Correct the tag name of glvs-autoinstal
    * runtime(doc): include short form for :earlier/:later
    * runtime(doc): remove completed TODO
    * 9.1.0744: filetype: notmuch configs are not recognised
    * 9.1.0743: diff mode does not handle overlapping diffs correctly
    * runtime(glvs): fix a few issues
    * runtime(doc): Fix typo in :help :command-modifiers
    * 9.1.0742: getcmdprompt() implementation can be improved
    * runtime(docs): update `:set?` command behavior table
    * runtime(doc): update vim90 to vim91 in docs
    * runtime(doc): fix typo in :h dos-colors
    * 9.1.0741: No way to get prompt for input()/confirm()
    * runtime(doc): fix typo in version9.txt nrformat -> nrformats
    * runtime(rmd,rrst): 'fex' option not properly restored
    * runtime(netrw): remove extraneous closing bracket
    * 9.1.0740: incorrect internal diff with empty file
    * 9.1.0739: [security]: use-after-free in ex_getln.c
    * runtime(filetype): tests: Test_filetype_detection() fails
    * runtime(dist): do not output a message if executable is not found
    * 9.1.0738: filetype: rapid files are not recognized
    * runtime(modconf): remove erroneous :endif in ftplugin
    * runtime(lyrics): support multiple timestamps in syntax script
    * runtime(java): Optionally recognise _module_ import declarations
    * runtime(vim): Update base-syntax, improve folding function matches
    * CI: upload failed screendump tests also for Cirrus
    * 9.1.0737: tests: screendump tests may require a bit more time
    * runtime(misc): simplify keywordprg in various ftplugins
    * runtime(java): Optionally recognise all primitive constants in _switch-case_ labels
    * runtime(zsh,sh): set and unset compiler in ftplugin
    * runtime(netrw): using inefficient highlight pattern for 'mf'
    * 9.1.0736: Unicode tables are outdated
    * 9.1.0735: filetype: salt files are not recognized
    * 9.1.0734: filetype: jinja files are not recognized
    * runtime(zathurarc): add double-click-follow to syntax script
    * translation(ru): Updated messages translation
    * translation(it): updated xxd man page
    * translation(ru): updated xxd man page
    * 9.1.0733: keyword completion does not work with fuzzy
    * 9.1.0732: xxd: cannot use -b and -i together
    * runtime(java): Highlight javaConceptKind modifiers with StorageClass
    * runtime(doc): reword and reformat how to use defaults.vim
    * 9.1.0731: inconsistent case sensitive extension matching
    * runtime(vim): Update base-syntax, match Vim9 bool/null literal args to :if/:while/:return
    * runtime(netrw): delete confirmation not strict enough
    * 9.1.0730: Crash with cursor-screenline and narrow window
    * 9.1.0729: Wrong cursor-screenline when resizing window
    * 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
    * runtime(doc): clarify the effect of the timeout for search()-functions
    * runtime(idlang): update syntax script
    * runtime(spec): Recognize epoch when making spec changelog in ftplugin
    * runtime(spec): add file triggers to syntax script
    * 9.1.0727: too many strlen() calls in option.c
    * runtime(make): add compiler/make.vim to reset compiler plugin settings
    * runtime(java): Recognise all available standard doclet tags
    * 9.1.0726: not using correct python3 API with dynamic linking
    * runtime(dosini): Update syntax script, spellcheck comments only
    * runtime(doc): Revert outdated comment in completeopt's fuzzy documentation
    * 9.1.0725: filetype: swiftinterface files are not recognized
    * runtime(pandoc): Update compiler plugin to use actual 'spelllang'
    * runtime(groff): Add compiler plugin for groff
    * 9.1.0724: if_python: link error with python 3.13 and stable ABI
    * 9.1.0723: if_python: dynamic linking fails with python3 >= 3.13
    * 9.1.0722: crash with large id in text_prop interface
    * 9.1.0721: tests: test_mksession does not consider XDG_CONFIG_HOME
    * runtime(glvs): update GetLatestVimScripts plugin
    * runtime(doc): Fix typo in :help :hide text
    * runtime(doc): buffers can be re-used
    * 9.1.0720: Wrong breakindentopt=list:-1 with multibyte or TABs
    * 9.1.0719: Resetting cell widths can make 'listchars' or 'fillchars' invalid
    * runtime(doc): Update version9.txt and mention $MYVIMDIR
  - Update to 9.1.0718:
    * v9.1.0718: hard to know the users personal Vim Runtime Directory
    * v9.1.0717: Unnecessary nextcmd NULL checks in parse_command_modifiers()
    Maintainers: fix typo in author name
    * v9.1.0716: resetting setcellwidth( doesn't update the screen
    runtime(hcl,terraform): Add runtime files for HCL and Terraform
    runtime(tmux): Update syntax script
    * v9.1.0715: Not correctly parsing color names (after v9.1.0709)
    * v9.1.0714: GuiEnter_Turkish test may fail
    * v9.1.0713: Newline causes E749 in Ex mode
    * v9.1.0712: missing dependency of Test_gettext_makefile
    * v9.1.0711: test_xxd may file when using different xxd
    * v9.1.0710: popup window may hide part of Command line
    runtime(vim): Update syntax, improve user-command matching
    * v9.1.0709: GUIEnter event not found in Turkish locale
    runtime(sudoers): improve recognized Runas_Spec and Tag_Spec items
    * v9.1.0708: Recursive window update does not account for reset skipcol
    runtime(nu): include filetype plugin
    * v9.1.0707: invalid cursor position may cause a crash
    * v9.1.0706: test_gettext fails when using shadow dir
    CI: Install locales-all package
    * v9.1.0705: Sorting of fuzzy filename completion is not stable
    translation(pt): update Portuguese/Brazilian menu translation
    runtime(vim): Update base-syntax, match bracket mark ranges
    runtime(doc): Update :help :command-complete list
    * v9.1.0704: inserting with a count is inefficient
    runtime(doc): use mkdir -p to save a command
    * v9.1.0703: crash with 2byte encoding and glob2regpat()
    runtime(hollywood): update syn highlight for If-Then statements
    and For-In-Loops
    * v9.1.0702: Patch 9.1.0700 broke CI
    * v9.1.0701: crash with NFA regex engine when searching for
    composing chars
    * v9.1.0700: crash with 2byte encoding and glob2regpat()
    * v9.1.0699: "dvgo" is not always an inclusive motion
    runtime(java): Provide support for syntax preview features
    * v9.1.0698: "Untitled" file not removed when running Test_crash1_3
    alone
    * v9.1.0697: heap-buffer-overflow in ins_typebuf
    * v9.1.0696: installing runtime files fails when using SHADOWDIR
    runtime(doc): fix typo
    * v9.1.0695: test_crash leaves Untitled file around
    translation(br): Update Brazilian translation
    translation(pt): Update menu_pt_br
    * v9.1.0694: matchparen is slow on a long line
    * v9.1.0693: Configure doesn't show result when not using python3
    stable abi
    * v9.1.0692: Wrong patlen value in ex_substitute()
    * v9.1.0691: stable-abi may cause segfault on Python 3.11
    runtime(vim): Update base-syntax, match :loadkeymap after colon and bar
    runtime(mane): Improve <Plug>ManBS mapping
    * v9.1.0690: cannot set special highlight kind in popupmenu
    translation(pt): Revert and fix wrong Portuguese menu translation
    files
    translation(pt): revert Portuguese menu translation
    translation(br): Update Brazilian translations
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    * v9.1.0689: buffer-overflow in do_search( with 'rightleft'
    runtime(vim): Improve heredoc handling for all embedded scripts
    * v9.1.0688: dereferences NULL pointer in check_type_is_value()
    * v9.1.0687: Makefile may not install desktop files
    runtime(man): Fix <Plug>ManBS
    runtime(java): Make the bundled &foldtext function optional
    runtime(netrw): Change line on `mx` if command output exists
    runtime(netrw): Fix `mf`-selected entry highlighting
    runtime(htmlangular): add html syntax highlighting
    translation(it): Fix filemode of Italian manpages
    runtime(doc): Update outdated man.vim plugin information
    runtime(zip): simplify condition to detect MS-Windows
    * v9.1.0686: zip-plugin has problems with special characters
    runtime(pandoc): escape quotes in &errorformat for pandoc
    translation(it): updated Italian manpage
    * v9.1.0685: too many strlen( calls in usercmd.c
    runtime(doc): fix grammar in :h :keeppatterns
    runtime(pandoc): refine pandoc compiler settings
    * v9.1.0684: completion is inserted on Enter with "noselect"
    translation(ru): update man pages
    * v9.1.0683: mode( returns wrong value with <Cmd> mapping
    runtime(doc): remove trailing whitespace in cmdline.txt
    * v9.1.0682: Segfault with uninitialized funcref
    * v9.1.0681: Analyzing failed screendumps is hard
    runtime(doc): more clarification for the :keeppatterns needed
    * v9.1.0680: VMS does not have defined uintptr_t
    runtime(doc): improve typedchar documentation for KeyInputPre autocmd
    runtime(dist): verify that executable is in $PATH
    translation(it): update Italian manpages
    runtime(doc): clarify the effect of :keeppatterns after * v9.1.0677
    runtime(doc): update Makefile and make it portable between GNU and BSD
    * v9.1.0679: Rename from w_closing to w_locked is incomplete
    runtime(colors): update colorschemes
    runtime(vim): Update base-syntax, improve :let-heredoc highlighting
    runtime(doc): Updating the examples in the xxd manpage
    translation(ru): Updated uganda.rux
    runtime(yaml): do not re-indent when commenting out lines
    * v9.1.0678: use-after-free in alist_add()
    * v9.1.0677 :keepp does not retain the substitute pattern
    translation(ja): Update Japanese translations to latest release
    runtime(netrw): Drop committed trace lines
    runtime(netrw): Error popup not always used
    runtime(netrw): ErrorMsg( may throw E121
    runtime(tutor): update Makefile and make it portable between GNU and BSD
    translation: improve the po/cleanup.vim script
    runtime(lang): update Makefile and make it portable between GNU and BSD
    * v9.1.0676: style issues with man pages
    * v9.1.0675: Patch v9.1.0674 causes problems
    runtime(dosbatch): Show %%i as an argument in syntax file
    runtime(dosbatch): Add syn-sync to syntax file
    runtime(sql, mysql): fix E169: Command too recursive with
    sql_type_default = "mysql"
    * v9.1.0674: compiling abstract method fails because of missing return
    runtime(javascript): fix a few issues with syntax higlighting
    runtime(mediawiki): fix typo in doc, test for b:did_ftplugin var
    runtime(termdebug): Fix wrong test for balloon feature
    runtime(doc): Remove mentioning of the voting feature
    runtime(doc): add help tags for json + markdown global variables
    * v9.1.0673: too recursive func calls when calling super-class method
    runtime(syntax-tests): Facilitate the viewing of rendered screendumps
    runtime(doc): fix a few style issues
    * v9.1.0672: marker folds may get corrupted on undo
    * v9.1.0671 Problem:  crash with WinNewPre autocommand
    * v9.1.0670: po file encoding fails on *BSD during make
    translation(it): Update Italian translation
    translation: Stop using msgconv
    * v9.1.0669: stable python ABI not used by default
    Update .gitignore and .hgignore files
    * v9.1.0668: build-error with python3.12 and stable ABI
    translations: Update generated po files
    * v9.1.0667: Some other options reset curswant unnecessarily when set
    * v9.1.0666: assert_equal( doesn't show multibyte string correctly
    runtime(doc): clarify directory of Vim's executable vs CWD
    * v9.1.0665 :for loop
    runtime(proto): Add indent script for protobuf filetype
    * v9.1.0664: console vim did not switch back to main screen on exit
    runtime(zip): zip plugin does not work with Vim 9.0
    * v9.1.0663: zip test still resets 'shellslash' option
    runtime(zip): use defer to restore old settings
    runtime(zip): add a generic Message function
    runtime(zip): increment base version of zip plugin
    runtime(zip): raise minimum Vim version to * v9.0
    runtime(zip): refactor save and restore of options
    runtime(zip): remove test for fnameescape
    runtime(zip): use :echomsg instead of :echo
    runtime(zip): clean up and remove comments
    * v9.1.0662: filecopy( may return wrong value when readlink( fails
    * v9.1.0661: the zip plugin is not tested.
    runtime(zip): Fix for FreeBSD's unzip command
    runtime(doc): capitalize correctly
    * v9.1.0660: Shift-Insert does work on old conhost
    translation(it): update Italian manpage
    runtime(lua): add/subtract a 'shiftwidth' after '('/')' in indentexpr
    runtime(zip): escape '[' on Unix as well
    * v9.1.0659: MSVC Makefile is a bit hard to read
    runtime(doc): fix typo in syntax.txt
    runtime(doc): -x is only available when compiled with crypt feature
    * v9.1.0658: Coverity warns about dereferencing NULL pointer.
    runtime(colors): update Todo highlight in habamax colorscheme
    * v9.1.0657: MSVC build time can be optimized
    * v9.1.0656: MSVC Makefile CPU handling can be improved
    * v9.1.0655: goaccess config file not recognized
    CI: update clang compiler to version 20
    runtime(netrw): honor `g:netrw_alt{o,v}` for `:{S,H,V}explore`
    * v9.1.0654: completion does not respect completeslash with fuzzy
    * v9.1.0653: Patch v9.1.0648 not completely right
    * v9.1.0652: too many strlen( calls in syntax.c
    * v9.1.0651 :append
    * v9.1.0650: Coverity warning in cstrncmp()
    * v9.1.0649: Wrong comment for "len" argument of call_simple_func()
    * v9.1.0648: [security] double-free in dialog_changed()
    * v9.1.0647: [security] use-after-free in tagstack_clear_entry
    runtime(doc): re-format tag example lines, mention ctags --list-kinds
    * v9.1.0646: imported function may not be found
    runtime(java): Document "g:java_space_errors" and "g:java_comment_strings"
    runtime(java): Cluster optional group definitions and their group links
    runtime(java): Tidy up the syntax file
    runtime(java): Tidy up the documentation for "ft-java-syntax"
    runtime(colors): update habamax scheme - tweak diff/search/todo colors
    runtime(nohlsearch): add missing loaded_hlsearch guard
    runtime(kivy): Updated maintainer info for syntax script
    Maintainers: Add maintainer for ondir ftplugin + syntax files
    runtime(netrw): removing trailing slash when copying files in same
    directory
    * v9.1.0645: wrong match when searching multi-byte char case-insensitive
    runtime(html): update syntax script to sync by 250 minlines by default
    * v9.1.0644: Unnecessary STRLEN( when applying mapping
    runtime(zip): Opening a remote zipfile don't work
    runtime(cuda): source c and cpp ftplugins
    * v9.1.0643: cursor may end up on invalid position
    * v9.1.0642: Check that mapping rhs starts with lhs fails if not
    simplified
    * v9.1.0641: OLE enabled in console version
    runtime(thrift): add ftplugin, indent and syntax scripts
    * v9.1.0640: Makefile can be improved
    * v9.1.0639: channel timeout may wrap around
    * v9.1.0638: E1510 may happen when formatting a message for smsg()
    * v9.1.0637: Style issues in MSVC Makefile
  - Update apparmor.vim to latest version (from AppArmor 4.0.2)
  - add support for "all" and "userns" rules, and new profile flags
  - Update to 9.1.0636:
    * 9.1.0636: filetype: ziggy files are not recognized
    * 9.1.0635: filetype: SuperHTML template files not recognized
    * 9.1.0634: Ctrl-P not working by default
    * 9.1.0633: Compilation warnings with `-Wunused-parameter`
    * 9.1.0632: MS-Windows: Compiler Warnings
    Add support for Files-Included in syntax script
    tweak documentation style a bit
    * 9.1.0631: wrong completion list displayed with non-existing dir + fuzzy completion
    * 9.1.0630: MS-Windows: build fails with VIMDLL and mzscheme
    * 9.1.0629: Rename of pum hl_group is incomplete
    * 9.1.0628: MinGW: coverage files are not cleaned up
    * 9.1.0627: MinGW: build-error when COVERAGE is enabled
    * 9.1.0626: Vim9: need more tests with null objects
    include initial filetype plugin
    * 9.1.0625: tests: test output all translated messages for all translations
    * 9.1.0624: ex command modifiers not found
    * 9.1.0623: Mingw: errors when trying to delete non-existing files
    * 9.1.0622: MS-Windows: mingw-build can be optimized
    * 9.1.0621: MS-Windows: startup code can be improved
    * 9.1.0620: Vim9: segfauls with null objects
    * 9.1.0619: tests: test_popup fails
    * 9.1.0618: cannot mark deprecated attributes in completion menu
    * 9.1.0617: Cursor moves beyond first line of folded end of buffer
    * 9.1.0616: filetype: Make syntax highlighting off for MS Makefiles
    * 9.1.0615: Unnecessary STRLEN() in make_percent_swname()
    Add single-line comment syntax
    Add syntax test for comments
    Update maintainer info
    * 9.1.0614: tests: screendump tests fail due to recent syntax changes
    * 9.1.0613: tests: termdebug test may fail and leave file around
    Update base-syntax, improve :set highlighting
    Optionally highlight the :: token for method references
    * 9.1.0612: filetype: deno.lock file not recognized
    Use delete() for deleting directory
    escape filename before trying to delete it
    * 9.1.0611: ambiguous mappings not correctly resolved with modifyOtherKeys
    correctly extract file from zip browser
    * 9.1.0610: filetype: OpenGL Shading Language files are not detected
    Fix endless recursion in netrw#Explore()
    * 9.1.0609: outdated comments in Makefile
    update syntax script
    Fix flow mapping key detection
    Remove orphaned YAML syntax dump files
    * 9.1.0608: Coverity warns about a few potential issues
    Update syntax script and remove syn sync
    * 9.1.0607: termdebug: uses inconsistent style
    * 9.1.0606: tests: generated files may cause failure in test_codestyle
    * 9.1.0605: internal error with fuzzy completion
    * 9.1.0604: popup_filter during Press Enter prompt seems to hang
    translation: Update Serbian messages translation
    * 9.1.0603: filetype: use correct extension for Dracula
    * 9.1.0602: filetype: Prolog detection can be improved
    fix more inconsistencies in assert function docs
    * 9.1.0601: Wrong cursor position with 'breakindent' when wide char doesn't fit
    Update base-syntax, improve :map highlighting
    * 9.1.0600: Unused function and unused error constants
    * 9.1.0599: Termdebug: still get E1023 when specifying arguments
    correct wrong comment options
    fix typo "a xterm" -> "an xterm"
    * 9.1.0598: fuzzy completion does not work with default completion
    * 9.1.0597: KeyInputPre cannot get the (unmapped typed) key
    * 9.1.0596: filetype: devscripts config files are not recognized
    gdb file/folder check is now performed only in CWD.
    quote filename arguments using double quotes
    update syntax to SDC-standard 2.1
    minor updates.
    Cleanup :match and :loadkeymap syntax test files
    Update base-syntax, match types in Vim9 variable declarations
    * 9.1.0595: make errors out with the po Makefile
    * 9.1.0594: Unnecessary redraw when setting 'winfixbuf'
    using wrong highlight for UTF-8
    include simple syntax plugin
    * 9.1.0593: filetype: Asymptote files are not recognized
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    add recommended indent options to ftplugin
    * 9.1.0592: filetype: Mediawiki files are not recognized
    * 9.1.0591: filetype: *.wl files are not recognized
    * 9.1.0590: Vim9: crash when accessing getregionpos() return value
    'cpoptions': Include "z" in the documented default
    * 9.1.0589: vi: d{motion} and cw work differently than expected
    update included colorschemes
    grammar fixes in options.txt
  - Add "Keywords" to gvim.desktop to make searching for gvim easier
  - Removed patches, as they're no longer required (refreshing them
    deleted their contents):
    * vim-7.3-help_tags.patch
    * vim-7.4-highlight_fstab.patch
  - Reorganise all applied patches in the spec file.
  - Update to 9.1.0588:
    * 9.1.0588: The maze program no longer compiles on newer clang
    runtime(typst): Add typst runtime files
    * 9.1.0587: tests: Test_gui_lowlevel_keyevent is still flaky
    * 9.1.0586: ocaml runtime files are outdated
    runtime(termdebug): fix a few issues
    * 9.1.0585: tests: test_cpoptions leaves swapfiles around
    * 9.1.0584: Warning about redeclaring f_id() non-static
    runtime(doc): Add hint how to load termdebug from vimrc
    runtime(doc): document global insert behavior
    * 9.1.0583: filetype: *.pdf_tex files are not recognized
    * 9.1.0582: Printed line doesn't overwrite colon when pressing Enter in Ex mode
    * 9.1.0581: Various lines are indented inconsistently
    * 9.1.0580: :lmap mapping for keypad key not applied when typed in Select mode
    * 9.1.0579: Ex command is still executed after giving E1247
    * 9.1.0578: no tests for :Tohtml
    * 9.1.0577: Unnecessary checks for v:sizeoflong in test_put.vim
    * 9.1.0576: tests: still an issue with test_gettext_make
    * 9.1.0575: Wrong comments in alt_tabpage()
    * 9.1.0574: ex: wrong handling of commands after bar
    runtime(doc): add a note for netrw bug reports
    * 9.1.0573: ex: no implicit print for single addresses
    runtime(vim): make &indentexpr available from the outside
    * 9.1.0572: cannot specify tab page closing behaviour
    runtime(doc): remove obsolete Ex insert behavior
    * 9.1.0571: tests: Test_gui_lowlevel_keyevent is flaky
    runtime(logindefs): update syntax with new keywords
    * 9.1.0570: tests: test_gettext_make can be improved
    runtime(filetype): Fix Prolog file detection regex
    * 9.1.0569: fnamemodify() treats ".." and "../" differently
    runtime(mojo): include mojo ftplugin and indent script
    * 9.1.0568: Cannot expand paths from 'cdpath' setting
    * 9.1.0567: Cannot use relative paths as findfile() stop directories
    * 9.1.0566: Stop dir in findfile() doesn't work properly w/o trailing slash
    * 9.1.0565: Stop directory doesn't work properly in 'tags'
    * 9.1.0564: id() can be faster
    * 9.1.0563: Cannot process any Key event
    * 9.1.0562: tests: inconsistency in test_findfile.vim
    runtime(fstab): Add missing keywords to fstab syntax
    * 9.1.0561: netbeans: variable used un-initialized (Coverity)
    * 9.1.0560: bindtextdomain() does not indicate an error
    * 9.1.0559: translation of vim scripts can be improved
    * 9.1.0558: filetype: prolog detection can be improved
    * 9.1.0557: moving in the buffer list doesn't work as documented
    runtime(doc): fix inconsistencies in :h file-searching
    * 9.1.0556: :bwipe doesn't remove file from jumplist of other tabpages
    runtime(htmlangular): correct comment
    * 9.1.0555: filetype: angular ft detection is still problematic
    * 9.1.0554: :bw leaves jumplist and tagstack data around
    * 9.1.0553: filetype: *.mcmeta files are not recognized
    * 9.1.0552: No test for antlr4 filetype
    * 9.1.0551: filetype: htmlangular files are not properly detected
    * 9.1.0550: filetype: antlr4 files are not recognized
    * 9.1.0549: fuzzycollect regex based completion not working as expected
    runtime(doc): autocmd_add() accepts a list not a dict
    * 9.1.0548: it's not possible to get a unique id for some vars
    runtime(tmux): Update syntax script
    * 9.1.0547: No way to get the arity of a Vim function
    * 9.1.0546: vim-tiny fails on CTRL-X/CTRL-A
    runtime(hlsplaylist): include hlsplaylist ftplugin file
    runtime(doc): fix typo in :h ft-csv-syntax
    runtime(doc): Correct shell command to get $VIMRUNTIME into
    shell
    * 9.1.0545: MSVC conversion warning
    * 9.1.0544: filetype: ldapconf files are not recognized
    runtime(cmakecache): include cmakecache ftplugin file
    runtime(lex): include lex ftplugin file
    runtime(yacc): include yacc ftplugin file
    runtime(squirrel): include squirrel ftplugin file
    runtime(objcpp): include objcpp ftplugin file
    runtime(tf): include tf ftplugin file
    runtime(mysql): include mysql ftplugin file
    runtime(javacc): include javacc ftplugin file
    runtime(cabal): include cabal ftplugin file
    runtime(cuda): include CUDA ftplugin file
    runtime(editorconfig): include editorconfig ftplugin file
    runtime(kivy): update kivy syntax, include ftplugin
    runtime(syntax-tests): Stop generating redundant "*_* 99.dump"
    files
    * 9.1.0543: Behavior of CursorMovedC is strange
    runtime(vim): Update base-syntax, improve :match command
    highlighting
    * 9.1.0542: Vim9: confusing string() output for object functions
    * 9.1.0541: failing test with Vim configured without channel
    * 9.1.0540: Unused assignment in sign_define_cmd()
    runtime(doc): add page-scrolling keys to index.txt
    runtime(doc): add reference to xterm-focus-event from
    FocusGained/Lost
    * 9.1.0539: Not enough tests for what v9.1.0535 fixed
    runtime(doc): clarify how to re-init csv syntax file
    * 9.1.0538: not possible to assign priority when defining a sign
    * 9.1.0537: signed number detection for CTRL-X/A can be improved
    * 9.1.0536: filetype: zone files are not recognized
    * 9.1.0535: newline escape wrong in ex mode
    runtime(man): honor cmd modifiers before `g:ft_man_open_mode`
    runtime(man): use `nnoremap` to map to Ex commands
    * 9.1.0534: completion wrong with fuzzy when cycling back to original
    runtime(syntax-tests): Abort and report failed cursor progress
    runtime(syntax-tests): Introduce self tests for screen dumping
    runtime(syntax-tests): Clear and redraw the ruler line with
    the shell info
    runtime(syntax-tests): Allow for folded and wrapped lines in
    syntax test files
    * 9.1.0533: Vim9: need more tests for nested objects equality
    CI: Pre-v* 9.0.0110 versions generate bogus documentation tag entries
    runtime(doc): Remove wrong help tag CTRL-SHIFT-CR
    * 9.1.0532: filetype: Cedar files not recognized
    runtime(doc): document further keys that scroll page up/down
    * 9.1.0531: resource leak in mch_get_random()
    runtime(tutor): Fix wrong spanish translation
    runtime(netrw): fix remaining case of register clobber
    * 9.1.0530: xxd: MSVC warning about non-ASCII character
    * 9.1.0529: silent! causes following try/catch to not work
    runtime(rust): use shiftwidth() in indent script
    * 9.1.0528: spell completion message still wrong in translations
    * 9.1.0527: inconsistent parameter in Makefiles for Vim executable
    * 9.1.0526: Unwanted cursor movement with pagescroll at start of buffer
    runtime(doc): mention $XDG_CONFIG_HOME instead of $HOME/.config
    * 9.1.0525: Right release selects immediately when pum is truncated.
    * 9.1.0524: the recursive parameter in the *_equal functions can be removed
    runtime(termdebug): Add Deprecation warnings
    * 9.1.0523: Vim9: cannot downcast an object
    * 9.1.0522: Vim9: string(object) hangs for recursive references
    * 9.1.0521: if_py: _PyObject_CallFunction_SizeT is dropped in Python 3.13
    * 9.1.0520: Vim9: incorrect type checking for modifying lists
    runtime(manpager): avoid readonly prompt
    * 9.1.0519: MS-Windows: libvterm compilation can be optimized
    * 9.1.0518: initialize the random buffer can be improved
    * 9.1.0517: MS-Windows: too long lines in Make_mvc.mak
    runtime(terraform): Add filetype plugin for terraform
    runtime(dockerfile): enable spellchecking of comments in
    syntax script
    runtime(doc): rename variable for pandoc markdown support
    runtime(doc): In builtin overview use {buf} as param for
    appendbufline/setbufline
    runtime(doc): clarify, that register 1-* 9 will always be shifted
    runtime(netrw): save and restore register 0-* 9, a and unnamed
    runtime(termdebug): Refactored StartDebug_term and EndDebug
    functions
    runtime(java): Compose "g:java_highlight_signature" and
    "g:java_highlight_functions"
    * 9.1.0516: need more tests for nested dicts and list comparision
    * 9.1.0515: Vim9: segfault in object_equal()
    * 9.1.0514: Vim9: issue with comparing objects recursively
    runtime(termdebug): Change some variables to Enums
    runtime(vim): Update base-syntax, fix function tail comments
    * 9.1.0513: Vim9: segfault with object comparison
  - Update to 9.1.0512:
    * Mode message for spell completion doesn't match allowed keys
    * CursorMovedC triggered wrongly with setcmdpos()
    * update runtime files
    * CI: test_gettext fails on MacOS14 + MSVC Win
    * not possible to translate Vim script messages
    * termdebug plugin can be further improved
    * add gomod filetype plugin
    * hard to detect cursor movement in the command line
    * Optionally highlight parameterised types
    * filetype: .envrc & .prettierignore not recognized
    * filetype: Faust files are not recognized
    * inner-tag textobject confused about ">" in attributes
    * cannot use fuzzy keyword completion
    * Remove the group exclusion list from @javaTop
    * wrong return type for execute() function
    * MS-Windows: too much legacy code
    * too complicated mapping restore in termdebug
    * simplify mapping
    * cannot switch buffer in a popup
    * MS-Windows: doesn't handle symlinks properly
    * getcmdcompltype() interferes with cmdline completion
    * termdebug can be further improved
    * update htmldjango detection
    * Improve Turkish documentation
    * include a simple csv filetype and syntax plugin
    * include the the simple nohlsearch package
    * matched text is highlighted case-sensitively
    * Matched text isn't highlighted in cmdline pum
    * Fix typos in several documents
    * clarify when text properties are cleared
    * improve the vim-shebang example
    * revert unintended formatting changes for termdebug
    * Add a config variable for commonly used compiler options
    * Wrong matched text highlighted in pum with 'rightleft'
    * bump length of character references in syntax script
    * properly check mapping variables using null_dict
    * fix KdlIndent and kdlComment in indent script
    * Test for patch 9.1.0489 doesn't fail without the fix
    * Fold multi-line comments with the syntax kind of &fdm
    * using wrong type for PlaceSign()
    * filetype: Vim-script files not detected by shebang line
    * revert unintended change to zip#Write()
    * add another tag for vim-shebang feature
    * Cmdline pum doesn't work properly with 'rightleft'
    * minor style problems with patch 9.1.0487
    * default completion may break with fuzzy
    * Wrong padding for pum "kind" with 'rightleft'
    * Update base-syntax, match shebang lines
    * MS-Windows: handle files with spaces properly
    * Restore HTML syntax file tests
    * completed item not update on fuzzy completion
    * filetype: Snakemake files are not recognized
    * make TermDebugSendCommand() a global function again
    * close all buffers in the same way
    * Matched text shouldn't be highlighted in "kind" and "menu"
    * fix wrong helptag for :defer
    * Update base-syntax, match :sleep arg
    * include Georgian keymap
    * Sorting of completeopt+=fuzzy is not stable
    * correctly test for windows in NetrwGlob()
    * glob() on windows fails with [] in directory name
    * rewrite mkdir() doc and simplify {flags} meaning
    * glob() not sufficiently tested
    * update return type for job_info()
    * termdebug plugin needs more love
    * correct return types for job_start() and job_status()
    * Update base-syntax, match :catch and :throw args
    * Include element values in non-marker annotations
    * Vim9: term_getjob() throws an exception on error
    * fuzzy string matching executed when not needed
    * fuzzy_match_str_with_pos() does unnecessary list operations
    * restore description of "$" in col() and virtcol()
    * deduplicate getpos(), line(), col(), virtcol()
    * Update g:vimsyn_comment_strings dump file tests
    * Use string interpolation instead of string concat
    * potential deref of NULL pointer in fuzzy_match_str_with_pos
    * block_editing errors out when using <enter>
    * Update base-syntax, configurable comment string highlighting
    * fix typos in syntax.txt
    * Cannot see matched text in popup menu
    * Update base-syntax, match multiline continued comments
    * clarify documentation for "v" position at line()
    * cmod_split modifier is always reset in term_start()
    * remove line-continuation characters
    * use shiftwidth() instead of &tabstop in indent script
    * Remove orphaned screen dump files
    * include syntax, indent and ftplugin files
    * CI: Test_ColonEight() fails on github runners
    * add missing Enabled field in syntax script
    * basic svelte ftplugin file
    * term_start() does not clear vertical modifier
    * fix mousemodel restoration by comparing against null_string
    * Added definitions of Vim scripts and plugins
    * Exclude lambda expressions from _when_ _switch-case_ label clauses
    * Fix saved_mousemodel check
    * Inconsistencies between functions for option flags
    * Crash when using autocmd_get() after removing event inside autocmd
    * Fix small style issues
    * add return type info for Vim function descriptions
    * Update Italian Vim manpage
    * disable the q mapping
    * Change 'cms' for C++ to '// %s'
    * fix type mismatch error
    * Fix wrong email address
    * convert termdebug plugin to Vim9 script
  - Update to 9.1.0470:
    * tests Test_ColonEight_MultiByte() fails sporadically
    * Cannot have buffer-local value for 'completeopt'
    * GvimExt does not consult HKEY_CURRENT_USER
    * typos in some comments
    * runtime(vim): Update base-syntax, allow whitespace before
    :substitute pattern
    * Missing comments for fuzzy completion
    * runtime(man): update Vim manpage
    * runtime(comment): clarify the usage of 'commentstring' option
    value
    * runtime(doc): clarify how fuzzy 'completeopt' should work
    * runtime(netrw): prevent accidental data loss
    * missing filecopy() function
    * no whitespace padding in commentstring option in ftplugins
    * no fuzzy-matching support for insert-completion
    * eval5() and eval7 are too complex
    * too many strlen() calls in drawline.c
    * filetype lintstagedrc files are not recognized
    * Vim9 import autoload does not work with symlink
    * Coverity complains about division by zero
    * tests test_gui fails on Wayland
    * Left shift is incorrect with vartabstop and shiftwidth=0
    * runtime(doc): clarify 'shortmess' flag "S"
    * MS-Windows compiler warning for size_t to int conversion
    * runtime(doc): include some vim9 script examples in the help
    * minor issues in test_filetype with rasi test
    * filetype rasi files are not recognized
    * runtime(java): Improve the matching of lambda expressions
    * Configure checks for libelf unnecessarily
    * No test for escaping '<' with shellescape()
    * check.vim complains about overlong comment lines
    * translation(it): Update Italian translation
    * evalc. code too complex
    * MS-Windows Compiler warnings
  - Update to 9.1.0448:
    * compiler warning in eval.c
    * remove remaining css code
    * Add ft_hare.txt to Reference Manual TOC
    * re-generate vim syntax from generator
    * fix syntax vim bug
    * completion may be wrong when deleting all chars
    * getregionpos() inconsistent for partly-selected multibyte char
    * fix highlighting nested and escaped quotes in string props
    * remove the indent plugin since it has too many issues
    * update Debian runtime files
    * Coverity warning after 9.1.0440
    * Not enough tests for getregion() with multibyte chars
    * Can't use blockwise selection with width for getregion()
    * update outdated syntax files
    * fix floating_modifier highlight
    * hare runtime files outdated
    * getregionpos() can't properly indicate positions beyond eol
    * function get_lval() is too long
    * Cannot filter the history
    * Wrong Ex command executed when :g uses '?' as delimiter
    * support floating_modifier none; revert broken highlighting
    * Motif requires non-const char pointer for XPM  data
    * Crash when using '?' as separator for :s
    * filetype: cygport files are not recognized
    * make errors trying to access autoload/zig
    * Wrong yanking with exclusive selection and ve=all
    * add missing help tags file
    * Ancient XPM preprocessor hack may cause build errors
    * include basic rescript ftplugin file
    * eval.c is too long
    * getregionpos() doesn't handle one char selection
    * check for gdb file/dir before using as buffer name
    * refactor zig ftplugin, remove auto format
    * Coverity complains about eval.c refactor
    * Tag guessing leaves wrong search history with very short names
    * some issues with termdebug mapping test
    * update matchit plugin to v1.20
    * too many strlen() calls in search.c
    * set commentstring option
    * update vb indent plugin as vim9script
    * filetype: purescript files are not recognized
    * filetype: slint files are not recognized
    * basic nim ftplugin file for comments
    * Add Arduino ftplugin and indent files
    * include basic typst ftplugin file
    * include basic prisma ftplugin file
    * include basic v ftplugin for comment support
    * getregionpos() wrong with blockwise mode and multibyte
    * function echo_string_core() is too long
    * hyprlang files are not recognized
    * add basic dart ftplugin file
    * basic ftplugin file for graphql
    * mention comment plugin at :h 'commentstring'
    * set commentstring for sql files in ftplugin
    * :browse oldfiles prompts even with single entry
    * eval.c not sufficiently tested
    * clarify why E195 is returned
    * clarify temporary file clean up
    * fix :NoMatchParen not working
    * Cannot move to previous/next rare word
    * add basic ftplugin file for sshdconfig
    * if_py: find_module has been removed in Python 3.12.0a7
    * some screen dump tests can be improved
    * Some functions are not tested
    * clarify instal instructions for comment package
    * Unable to leave long line with 'smoothscroll' and 'scrolloff'
    * fix typo in vim9script help file
    * Remove trailing spaces
    * clarify {special} argument for shellescape()
  - update to 9.1.0413
    * smoothscroll may cause infinite loop
    * add missing entries for the keys CTRL-W g<Tab> and <C-Tab>
    * update vi_diff.txt: add default value for 'flash'
    * typo in regexp_bt.c in DEBUG code
    * allow indented commands
    * Fix wrong define regex in ftplugin
    * Filter out non-Latin-1 characters for syntax tests
    * prefer scp over pscp
    * fix typo in usr_52.txt
    * too long functions in eval.c
    * warning about uninitialized variable
    * too many strlen() calls in the regexp engine
    * E16 fix, async keyword support for define
    * Stuck with long line and half-page scrolling
    * Divide by zero with getmousepos() and 'smoothscroll'
    * update and remove  some invalid links
    * update translation of xxd manpage
    * Recursively delete directories by default with netrw delete command
    * Strive to remain compatible for at least Vim 7.0
    * tests: xxd buffer overflow fails on 32-bit
    * Stop handpicking syntax groups for @javaTop
    * [security] xxd: buffer-overflow with specific flags
    * Vim9: not able to import file from start dir
    * filetype: mdd files detected as zsh filetype
    * filetype: zsh module files are not recognized
    * Remove hardcoded private.ppk logic from netrw
    * Vim9: confusing error message for unknown type
    * block_editing errors out when using del
    * add new items to scripts section in syntax plugin
    * Vim9: imported vars are not properly type checked
    * Wrong display with 'smoothscroll' when changing quickfix list
    * filetype: jj files are not recognized
    * getregionpos() may leak memory on error
    * The CODEOWNERS File is not useful
    * Remove and cleanup Win9x legacy from netrw
    * add MsgArea to 'highlight' option description
    * Cannot get a list of positions describing a region
    * Fix digit separator in syntax script for octals and floats
    * Update link to Wikipedia Vi page
    * clear $MANPAGER in ftplugin before shelling out
    * Fix typos in help documents
    * 'viewdir' not respecting $XDG_CONFIG_HOME
    * tests: Vim9 debug tests may be flaky
    * correct getscriptinfo() example
    * Vim9: could improve testing
    * test_sound fails on macos-12
    * update Serbian menu
    * update Slovak menu
    * update Slovenian menu
    * update Portuguese menu
    * update Dutch menu
    * update Korean menu
    * update Icelandic menu
    * update Czech menu
    * update Afrikaans menu
    * update German menu
    * filetype: inko files are not recognized
    * filetype: templ files are not recognized
    * cursor() and getregion() don't handle v:maxcol well
    * Vim9: null value tests not sufficient
    * update Catalan menu
    * filetype: stylus files not recognized
    * update spanish menu localization
    * regenerate helptags
    * Vim9: crash with null_class and null_object
    * Add tags about lazyloading of menu
    * tests: vt420 terminfo entry may not be found
    * filetype: .out files recognized as tex files
    * filetype: Kbuild files are not recognized
    * cbuffer and similar commands don't accept a range
    * Improve the recognition of the "indent" method declarations
    * Fix a typo in usr_30.txt
    * remove undefined var s:save_cpoptions and add include setting
    * missing setlocal in indent plugin
    * Calculating line height for unnecessary amount of lines
    * improve syntax file performance
    * There are a few typos
    * Vim9: no comments allowed after class vars
    * CI: remove trailing white space in documentation
    * Formatting text wrong when 'breakindent' is set
    * Add oracular (24.10) as Ubuntu release name
    * Vim9: Trailing commands after class/enum keywords ignored
    * tests: 1-second delay after Test_BufEnter_botline()
    * update helptags for jq syntax
    * include syntax, ftplugin and compiler plugin
    * fix typo synconcealend -> synconcealed
    * include a simple comment toggling plugin
    * wrong botline in BufEnter
    * clarify syntax vs matching mechanism
    * fix undefined variable in indent plugin
    * ops.c code uses too many strlen() calls
    * Calling CLEAR_FIELD() on the same struct twice
    * Vim9: compile_def_function() still too long
    * Update Serbian messages
    * clarify the effect of setting the shell to powershell
    * Improve the recognition of the "style" method declarations
    * Vim9: problem when importing autoloaded scripts
    * compile_def_function is too long
    * filetype: ondir files are not recognized
    * Crash when typing many keys with D- modifier
    * tests: test_vim9_builtin is a bit slow
    * update documentation
    * change the download URL of "libsodium"
    * tests: test_winfixbuf is a bit slow
    * Add filetype, syntax and indent plugin for Astro
    * expanding rc config files does not work well
    * Vim9: vim9type.c is too complicated
    * Vim9: does not handle autoloaded variables well
    * minor spell fix in starting.txt
    * wrong drawing in GUI with setcellwidth()
    * Add include and suffixesadd
    * Page scrolling should place cursor at window boundaries
    * align command line table
    * minor fixes to starting.txt
    * fix comment definition in filetype plugin
    * filetype: flake.lock files are not recognized
    * runtime(uci): No support for uci file types
    * Support "g:ftplugin_java_source_path" with archived files
    * tests: Test_autoload_import_relative_compiled fails on Windows
    * Finding cmd modifiers and cmdline-specials is inefficient
    * No test that completing a partial mapping clears 'showcmd'
    * tests: test_vim9_dissamble may fail
    * Vim9: need static type for typealias
    * X11 does not ignore smooth scroll event
    * A few typos in test_xdg when testing gvimrc
    * Patch v9.1.0338 fixed sourcing a script with import
    * Problem: gvimrc not sourced from XDG_CONFIG_HOME
    * Cursor wrong after using setcellwidth() in terminal
    * 'showcmd' wrong for partial mapping with multibyte
    * tests: test_taglist fails when 'helplang' contains non-english
    * Problem: a few memory leaks are found
    * Problem: Error with matchaddpos() and empty list
    * tests: xdg test uses screen dumps
    * Vim9: import through symlinks not correctly handled
    * Missing entry for XDG vimrc file in :version
    * tests: typo in test_xdg
    * runtime(i3config/swayconfig): update syntax scripts
    * document pandoc compiler and enable configuring arguments
    * String interpolation fails for List type
    * No test for highlight behavior with 'ambiwidth'
    * tests: test_xdg fails on the appimage repo
    * tests: some assert_equal() calls have wrong order of args
    * make install does not install all files
    * runtime(doc): fix typos in starting.txt
  - Updated to version 9.1 with patch level 0330, fixes the following problems
    * Fixing bsc#1220763 - vim gets Segmentation fault after updating to version 9.1.0111-150500.20.9.1
  - refreshed vim-7.3-filetype_spec.patch
  - refreshed vim-7.3-filetype_ftl.patch
  - Update spec.skeleton to use autosetup in place of setup macro.
  - for the complete list of changes see
    https://github.com/vim/vim/compare/v9.1.0111...v9.1.0330

------------------------------------------------------------------
------------------  2024-11-27  -  Nov 27 2024  -------------------
------------------------------------------------------------------

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ docker:

  - Disable docker-buildx builds for SLES. It turns out that build containers
    with docker-buildx don't currently get the SUSE secrets mounts applied,
    meaning that container-suseconnect doesn't work when building images.
    bsc#1233819

++++ python-kiwi:

  - Added provide/require system files for containers
    Added the attributes provide_system_files and require_system_files
    to control the provider and requester of system files in
    container image builds. systemfiles is a metadata file which
    contains all files from the package database at call time.
    It is used in flake-pilot to provision the systemfiles data
    from the host into the container instance. One possible use
    case for this data is a flake registration which uses a
    base container that is derived from a runtime container but
    all data from the runtime should be provisioned from the
    host. Using this feature tightly couples the flake to the
    host OS distribution and version.
  - Bump version: 10.2.1 → 10.2.2
  - Fix scope issue
    Increase livetime of the the compressor instances
    to the livetime of RootImportOCI. They create temporary
    files which are referenced later and need to live longer
    than the block they got created in

++++ python-kiwi:

  - Added provide/require system files for containers
    Added the attributes provide_system_files and require_system_files
    to control the provider and requester of system files in
    container image builds. systemfiles is a metadata file which
    contains all files from the package database at call time.
    It is used in flake-pilot to provision the systemfiles data
    from the host into the container instance. One possible use
    case for this data is a flake registration which uses a
    base container that is derived from a runtime container but
    all data from the runtime should be provisioned from the
    host. Using this feature tightly couples the flake to the
    host OS distribution and version.
  - Bump version: 10.2.1 → 10.2.2
  - Fix scope issue
    Increase livetime of the the compressor instances
    to the livetime of RootImportOCI. They create temporary
    files which are referenced later and need to live longer
    than the block they got created in

++++ python-kiwi:

  - Added provide/require system files for containers
    Added the attributes provide_system_files and require_system_files
    to control the provider and requester of system files in
    container image builds. systemfiles is a metadata file which
    contains all files from the package database at call time.
    It is used in flake-pilot to provision the systemfiles data
    from the host into the container instance. One possible use
    case for this data is a flake registration which uses a
    base container that is derived from a runtime container but
    all data from the runtime should be provisioned from the
    host. Using this feature tightly couples the flake to the
    host OS distribution and version.
  - Bump version: 10.2.1 → 10.2.2
  - Fix scope issue
    Increase livetime of the the compressor instances
    to the livetime of RootImportOCI. They create temporary
    files which are referenced later and need to live longer
    than the block they got created in

++++ sqlite3:

  - Update to release 3.47.1:
    * Fix the makefiles so that they once again honored DESTDIR for
    the "install" target.
    * Add the SQLITE_IOCAP_SUBPAGE_READ capability to the VFS, to
    work around issues on some non-standard VFSes caused by making
    SQLITE_DIRECT_OVERFLOW_READ the default in version 3.45.0.
    * Fix incorrect answers to certain obscure IN queries caused by
    new query optimizations added in the 3.47.0 release.
    * Other minor bug fixes.

++++ sqlite3:

  - Update to release 3.47.1:
    * Fix the makefiles so that they once again honored DESTDIR for
    the "install" target.
    * Add the SQLITE_IOCAP_SUBPAGE_READ capability to the VFS, to
    work around issues on some non-standard VFSes caused by making
    SQLITE_DIRECT_OVERFLOW_READ the default in version 3.45.0.
    * Fix incorrect answers to certain obscure IN queries caused by
    new query optimizations added in the 3.47.0 release.
    * Other minor bug fixes.

++++ sqlite3:

  - Update to release 3.47.1:
    * Fix the makefiles so that they once again honored DESTDIR for
    the "install" target.
    * Add the SQLITE_IOCAP_SUBPAGE_READ capability to the VFS, to
    work around issues on some non-standard VFSes caused by making
    SQLITE_DIRECT_OVERFLOW_READ the default in version 3.45.0.
    * Fix incorrect answers to certain obscure IN queries caused by
    new query optimizations added in the 3.47.0 release.
    * Other minor bug fixes.

++++ sqlite3:

  - Update to release 3.47.1:
    * Fix the makefiles so that they once again honored DESTDIR for
    the "install" target.
    * Add the SQLITE_IOCAP_SUBPAGE_READ capability to the VFS, to
    work around issues on some non-standard VFSes caused by making
    SQLITE_DIRECT_OVERFLOW_READ the default in version 3.45.0.
    * Fix incorrect answers to certain obscure IN queries caused by
    new query optimizations added in the 3.47.0 release.
    * Other minor bug fixes.

++++ systemd:

  - Import commit a3aa27ac6649cb096b3c87c8ac61a6950bfa3567 (merge of v254.20)
    This merge includes the following fix:
    8b6ae951d3 udev: skipping empty udev rules file while collecting the stats (bsc#1232844)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/ae14c7765524a3c84ce8a65d6a3a4db2be981f69...a3aa27ac6649cb096b3c87c8ac61a6950bfa3567

++++ systemd:

  - Import commit a3aa27ac6649cb096b3c87c8ac61a6950bfa3567 (merge of v254.20)
    This merge includes the following fix:
    8b6ae951d3 udev: skipping empty udev rules file while collecting the stats (bsc#1232844)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/ae14c7765524a3c84ce8a65d6a3a4db2be981f69...a3aa27ac6649cb096b3c87c8ac61a6950bfa3567

++++ systemd:

  - Import commit a3aa27ac6649cb096b3c87c8ac61a6950bfa3567 (merge of v254.20)
    This merge includes the following fix:
    8b6ae951d3 udev: skipping empty udev rules file while collecting the stats (bsc#1232844)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/ae14c7765524a3c84ce8a65d6a3a4db2be981f69...a3aa27ac6649cb096b3c87c8ac61a6950bfa3567

++++ systemd:

  - Import commit a3aa27ac6649cb096b3c87c8ac61a6950bfa3567 (merge of v254.20)
    This merge includes the following fix:
    8b6ae951d3 udev: skipping empty udev rules file while collecting the stats (bsc#1232844)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/ae14c7765524a3c84ce8a65d6a3a4db2be981f69...a3aa27ac6649cb096b3c87c8ac61a6950bfa3567

++++ systemd:

  - Import commit a3aa27ac6649cb096b3c87c8ac61a6950bfa3567 (merge of v254.20)
    This merge includes the following fix:
    8b6ae951d3 udev: skipping empty udev rules file while collecting the stats (bsc#1232844)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/ae14c7765524a3c84ce8a65d6a3a4db2be981f69...a3aa27ac6649cb096b3c87c8ac61a6950bfa3567

++++ systemd:

  - Import commit a3aa27ac6649cb096b3c87c8ac61a6950bfa3567 (merge of v254.20)
    This merge includes the following fix:
    8b6ae951d3 udev: skipping empty udev rules file while collecting the stats (bsc#1232844)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/ae14c7765524a3c84ce8a65d6a3a4db2be981f69...a3aa27ac6649cb096b3c87c8ac61a6950bfa3567

++++ python-tornado6:

  - Add patch CVE-2024-52804-avoid-quadratic-cookie-parsing.patch:
    * Avoid quadratic performance of cookie parsing.
    (CVE-2024-52804, bsc#1233668)

++++ python-tornado6:

  - Add patch CVE-2024-52804-avoid-quadratic-cookie-parsing.patch:
    * Avoid quadratic performance of cookie parsing.
    (CVE-2024-52804, bsc#1233668)

++++ python-tornado6:

  - Add patch CVE-2024-52804-avoid-quadratic-cookie-parsing.patch:
    * Avoid quadratic performance of cookie parsing.
    (CVE-2024-52804, bsc#1233668)

++++ python-tornado6:

  - Add patch CVE-2024-52804-avoid-quadratic-cookie-parsing.patch:
    * Avoid quadratic performance of cookie parsing.
    (CVE-2024-52804, bsc#1233668)

++++ wget:

  - Drop support for shorthand URLs
    * Breaking change to fix CVE-2024-10524.
    [+ drop-support-for-shorthand-URLs.patch, bsc#1233773]

------------------------------------------------------------------
------------------  2024-11-26  -  Nov 26 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.2.0 → 10.2.1

++++ python-kiwi:

  - Bump version: 10.2.0 → 10.2.1

++++ python-kiwi:

  - Bump version: 10.2.0 → 10.2.1

++++ glib2:

  - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow
    (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461).

++++ glib2:

  - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow
    (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461).

++++ glib2:

  - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow
    (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461).

++++ glib2:

  - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow
    (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461).

++++ glib2:

  - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow
    (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461).

++++ glib2:

  - Add glib2-CVE-2024-52533.patch: fix a single byte buffer overflow
    (boo#1233282 CVE-2024-52533 glgo#GNOME/glib#3461).

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to not pass in
    bad targetKeyLength parameters when checking for FIPS approval
    after keygen. This was causing false rejections.

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to not pass in
    bad targetKeyLength parameters when checking for FIPS approval
    after keygen. This was causing false rejections.

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to not pass in
    bad targetKeyLength parameters when checking for FIPS approval
    after keygen. This was causing false rejections.

++++ qemu:

  - Fix boo#1231166, bsc#1228079, bsc#1221812,
    bsc#1232283, bsc#1230978, bsc#1233530:
    * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166)
    * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079)
    * [openSUSE] block: Move qcow2 invalidation query-block op_blocker
    * scsi: megasas: Internal cdbs have 16-byte length (bsc#1233530)
  - Update version to 8.2.8
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/1b7d3242-abe9-408a-bd77-85162e0d0de4@tls.msk.ru/
    * Some backports:
    usb-hub: Fix handling port power control messages
    hw/audio/hda: fix memory leak on audio setup (bsc#1232728)
    hw/misc/mos6522: Fix bad class definition of the MOS6522 device
    contrib/plugins: add compat for g_memdup2
    target/i386: fix hang when using slow path for ptw_setl
    tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc()
    linux-user/arm: Select vdso for be8 and be32 modes
    linux-user/arm: Reduce vdso alignment to 4k
    linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR
    accel/tcg: Fix user-only probe_access_internal plugin check
    target/arm: Drop user-only special case in sve_stN_r
    linux-user: Fix setreuid and setregid to use direct syscalls
    target/i386: Fix legacy page table walk
    9pfs: fix crash on 'Treaddir' request
    hw/nvme: fix handling of over-committed queues
    migration: Ensure vmstate_save() sets errp
    target/arm: Fix SVE SDOT/UDOT/USDOT (4-way, indexed)
    target/ppc: Fix mtDPDES targeting SMT siblings
    target/ppc: Set ctx->opcode for decode_insn32()
    target/riscv: Fix vcompress with rvv_ta_all_1s
    target/riscv/kvm: clarify how 'riscv-aia' default works
    target/riscv/kvm: set 'aia_mode' to default in error path
    hw/intc/riscv_aplic: Check and update pending when write sourcecfg
    hw/intc/riscv_aplic: Fix in_clrip[x] read emulation
    target/riscv: Set vtype.vill on CPU reset
    ... ... ...

++++ qemu:

  - Fix boo#1231166, bsc#1228079, bsc#1221812,
    bsc#1232283, bsc#1230978, bsc#1233530:
    * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166)
    * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079)
    * [openSUSE] block: Move qcow2 invalidation query-block op_blocker
    * scsi: megasas: Internal cdbs have 16-byte length (bsc#1233530)
  - Update version to 8.2.8
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/1b7d3242-abe9-408a-bd77-85162e0d0de4@tls.msk.ru/
    * Some backports:
    usb-hub: Fix handling port power control messages
    hw/audio/hda: fix memory leak on audio setup (bsc#1232728)
    hw/misc/mos6522: Fix bad class definition of the MOS6522 device
    contrib/plugins: add compat for g_memdup2
    target/i386: fix hang when using slow path for ptw_setl
    tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc()
    linux-user/arm: Select vdso for be8 and be32 modes
    linux-user/arm: Reduce vdso alignment to 4k
    linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR
    accel/tcg: Fix user-only probe_access_internal plugin check
    target/arm: Drop user-only special case in sve_stN_r
    linux-user: Fix setreuid and setregid to use direct syscalls
    target/i386: Fix legacy page table walk
    9pfs: fix crash on 'Treaddir' request
    hw/nvme: fix handling of over-committed queues
    migration: Ensure vmstate_save() sets errp
    target/arm: Fix SVE SDOT/UDOT/USDOT (4-way, indexed)
    target/ppc: Fix mtDPDES targeting SMT siblings
    target/ppc: Set ctx->opcode for decode_insn32()
    target/riscv: Fix vcompress with rvv_ta_all_1s
    target/riscv/kvm: clarify how 'riscv-aia' default works
    target/riscv/kvm: set 'aia_mode' to default in error path
    hw/intc/riscv_aplic: Check and update pending when write sourcecfg
    hw/intc/riscv_aplic: Fix in_clrip[x] read emulation
    target/riscv: Set vtype.vill on CPU reset
    ... ... ...

++++ qemu:

  - Fix boo#1231166, bsc#1228079, bsc#1221812,
    bsc#1232283, bsc#1230978, bsc#1233530:
    * [openSUSE][RPM] The qemu translation is not being installed (boo#1231166)
    * target/i386: Expose IBPB-BRTYPE and SBPB CPUID bits to the guest (bsc#1228079)
    * [openSUSE] block: Move qcow2 invalidation query-block op_blocker
    * scsi: megasas: Internal cdbs have 16-byte length (bsc#1233530)
  - Update version to 8.2.8
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/1b7d3242-abe9-408a-bd77-85162e0d0de4@tls.msk.ru/
    * Some backports:
    usb-hub: Fix handling port power control messages
    hw/audio/hda: fix memory leak on audio setup (bsc#1232728)
    hw/misc/mos6522: Fix bad class definition of the MOS6522 device
    contrib/plugins: add compat for g_memdup2
    target/i386: fix hang when using slow path for ptw_setl
    tcg: Allow top bit of SIMD_DATA_BITS to be set in simd_desc()
    linux-user/arm: Select vdso for be8 and be32 modes
    linux-user/arm: Reduce vdso alignment to 4k
    linux-user: Tolerate CONFIG_LSM_MMAP_MIN_ADDR
    accel/tcg: Fix user-only probe_access_internal plugin check
    target/arm: Drop user-only special case in sve_stN_r
    linux-user: Fix setreuid and setregid to use direct syscalls
    target/i386: Fix legacy page table walk
    9pfs: fix crash on 'Treaddir' request
    hw/nvme: fix handling of over-committed queues
    migration: Ensure vmstate_save() sets errp
    target/arm: Fix SVE SDOT/UDOT/USDOT (4-way, indexed)
    target/ppc: Fix mtDPDES targeting SMT siblings
    target/ppc: Set ctx->opcode for decode_insn32()
    target/riscv: Fix vcompress with rvv_ta_all_1s
    target/riscv/kvm: clarify how 'riscv-aia' default works
    target/riscv/kvm: set 'aia_mode' to default in error path
    hw/intc/riscv_aplic: Check and update pending when write sourcecfg
    hw/intc/riscv_aplic: Fix in_clrip[x] read emulation
    target/riscv: Set vtype.vill on CPU reset
    ... ... ...

------------------------------------------------------------------
------------------  2024-11-25  -  Nov 25 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed use of fscreateoptions for iso type
    The information for fscreateoptions was not passed along to the
    tooling if a custom filesystem attribute was specified.
    This Fixes #2681
  - Allow to derive from multiple containers
    Add support for multi inheritance to the derived_from attribute
    In the order of a comma seperated list of docker source URI's
    a base tree is created. This was possible only with one container
    so far and Fixes #2680 as well as jira#OBS-354

++++ python-kiwi:

  - Fixed use of fscreateoptions for iso type
    The information for fscreateoptions was not passed along to the
    tooling if a custom filesystem attribute was specified.
    This Fixes #2681
  - Allow to derive from multiple containers
    Add support for multi inheritance to the derived_from attribute
    In the order of a comma seperated list of docker source URI's
    a base tree is created. This was possible only with one container
    so far and Fixes #2680 as well as jira#OBS-354

++++ python-kiwi:

  - Fixed use of fscreateoptions for iso type
    The information for fscreateoptions was not passed along to the
    tooling if a custom filesystem attribute was specified.
    This Fixes #2681
  - Allow to derive from multiple containers
    Add support for multi inheritance to the derived_from attribute
    In the order of a comma seperated list of docker source URI's
    a base tree is created. This was possible only with one container
    so far and Fixes #2680 as well as jira#OBS-354

++++ git:

  - update to 2.47.1:
    * Use after free and double freeing at the end in
    "git log -L... -p" had been identified and fixed.
    * "git maintenance start" crashed due to an uninitialized
    variable reference, which has been corrected.
    * Fail gracefully instead of crashing when attempting to write
    the contents of a corrupt in-core index as a tree object.
    * A "git fetch" from the superproject going down to a submodule
    used a wrong remote when the default remote names are set
    differently between them.
    * The "gitk" project tree has been synchronized again

++++ kernel-firmware:

  - Update to version 20241125 (git commit 508d770ee6f3):
    * ice: update ice DDP wireless_edge package to 1.3.20.0
    * ice: update ice DDP comms package to 1.3.52.0
    * ice: update ice DDP package to ice-1.3.41.0
    * amdgpu: update DMCUB to v9.0.10.0 for DCN314
    * amdgpu: update DMCUB to v9.0.10.0 for DCN351

++++ kernel-firmware:

  - Update to version 20241125 (git commit 508d770ee6f3):
    * ice: update ice DDP wireless_edge package to 1.3.20.0
    * ice: update ice DDP comms package to 1.3.52.0
    * ice: update ice DDP package to ice-1.3.41.0
    * amdgpu: update DMCUB to v9.0.10.0 for DCN314
    * amdgpu: update DMCUB to v9.0.10.0 for DCN351

++++ mozilla-nspr:

  - update to version 4.36
    * remove support for OS/2
    * remove support for Unixware, Bsdi, old AIX, old HPUX9 & scoos
    * remove support for Windows 16 bit
    * renamed the prwin16.h header to prwin.h
    * configure was updated from 2.69 to 2.71
    * various build, test and automation script fixes
    * major parts of the source code were reformatted

++++ nvidia-open-driver-G06-signed:

  - fixed my wrong patch 550.135.patch I introduced right below;
    it fixed x86_64 build more-or-less accidently but broke aarch64
    build completely ...
  - Improve handling of conflicts between different flavors
    (gfx vs. CUDA) (bsc#1233332).
  - Update to 550.135 (boo#1233673)
  - 550.135.patch:
    * fixes wrong logic for checking supported architectures

------------------------------------------------------------------
------------------  2024-11-22  -  Nov 22 2024  -------------------
------------------------------------------------------------------

++++ kernel-firmware:

  - Update to version 20241121 (git commit 48bb90cceb88):
    * linux-firmware: Update AMD cpu microcode
    * xe: Update GUC to v70.36.0 for BMG, LNL
    * i915: Update GUC to v70.36.0 for ADL-P, DG1, DG2, MTL, TGL

++++ kernel-firmware:

  - Update to version 20241121 (git commit 48bb90cceb88):
    * linux-firmware: Update AMD cpu microcode
    * xe: Update GUC to v70.36.0 for BMG, LNL
    * i915: Update GUC to v70.36.0 for ADL-P, DG1, DG2, MTL, TGL

------------------------------------------------------------------
------------------  2024-11-21  -  Nov 21 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.1.18 → 10.2.0
  - Add selinux test build to TW
    Also update derived docker integration test to latest Leap

++++ python-kiwi:

  - Bump version: 10.1.18 → 10.2.0
  - Add selinux test build to TW
    Also update derived docker integration test to latest Leap

++++ python-kiwi:

  - Bump version: 10.1.18 → 10.2.0
  - Add selinux test build to TW
    Also update derived docker integration test to latest Leap

------------------------------------------------------------------
------------------  2024-11-20  -  Nov 20 2024  -------------------
------------------------------------------------------------------

++++ avahi:

  - Add avahi-CVE-2024-52616.patch:
    Backporting 1dade81c from upstream: Properly randomize query id
    of DNS packets.
    (CVE-2024-52616, bsc#1233420)

++++ avahi:

  - Add avahi-CVE-2024-52616.patch:
    Backporting 1dade81c from upstream: Properly randomize query id
    of DNS packets.
    (CVE-2024-52616, bsc#1233420)

++++ avahi:

  - Add avahi-CVE-2024-52616.patch:
    Backporting 1dade81c from upstream: Properly randomize query id
    of DNS packets.
    (CVE-2024-52616, bsc#1233420)

++++ avahi:

  - Add avahi-CVE-2024-52616.patch:
    Backporting 1dade81c from upstream: Properly randomize query id
    of DNS packets.
    (CVE-2024-52616, bsc#1233420)

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ docker:

  - Add docker-integration-tests-devel subpackage for building and running the
    upstream Docker integration tests on machines to test that Docker works
    properly. Users should not install this package.
  - docker-rpmlintrc updated to include allow-list for all of the integration
    tests package, since it contains a bunch of stuff that wouldn't normally be
    allowed.

++++ python-kiwi:

  - kiwi/schema: Fix allowed value type for ISO publisher and application ID
    According to the spec, this should be constrained to 128 characters
    but also allow quite a few other special characters (as well as spaces).
    We didn't allow spaces in application ID, but allowed too much for Publisher.
    Now we set up both correctly.

++++ python-kiwi:

  - kiwi/schema: Fix allowed value type for ISO publisher and application ID
    According to the spec, this should be constrained to 128 characters
    but also allow quite a few other special characters (as well as spaces).
    We didn't allow spaces in application ID, but allowed too much for Publisher.
    Now we set up both correctly.

++++ python-kiwi:

  - kiwi/schema: Fix allowed value type for ISO publisher and application ID
    According to the spec, this should be constrained to 128 characters
    but also allow quite a few other special characters (as well as spaces).
    We didn't allow spaces in application ID, but allowed too much for Publisher.
    Now we set up both correctly.

++++ kernel-firmware:

  - Update to version 20241119 (git commit 60cdfe1831e8):
    * iwlwifi: add Bz-gf FW for core91-69 release
  - Update aliases from 6.12

++++ kernel-firmware:

  - Update to version 20241119 (git commit 60cdfe1831e8):
    * iwlwifi: add Bz-gf FW for core91-69 release
  - Update aliases from 6.12

------------------------------------------------------------------
------------------  2024-11-18  -  Nov 18 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to 10.3.8 (bsc#1233333)
    + Fix the package requirements for cloud-regionsrv-client
    + Follow changes to suseconnect error reporting from stdout to stderr

++++ cloud-regionsrv-client:

  - Update to 10.3.8 (bsc#1233333)
    + Fix the package requirements for cloud-regionsrv-client
    + Follow changes to suseconnect error reporting from stdout to stderr

++++ cloud-regionsrv-client:

  - Update to 10.3.8 (bsc#1233333)
    + Fix the package requirements for cloud-regionsrv-client
    + Follow changes to suseconnect error reporting from stdout to stderr

++++ cloud-regionsrv-client:

  - Update to 10.3.8 (bsc#1233333)
    + Fix the package requirements for cloud-regionsrv-client
    + Follow changes to suseconnect error reporting from stdout to stderr

++++ cloud-regionsrv-client:

  - Update to 10.3.8 (bsc#1233333)
    + Fix the package requirements for cloud-regionsrv-client
    + Follow changes to suseconnect error reporting from stdout to stderr

++++ python-kiwi:

  - Fix setup of kiwi environment variables
    Some kiwi env vars are initialized with an empty value
    and not overwritten if another value is provided. For
    the selected variables an empty value setting is not
    allowed because the schema also enforces the value to
    be set at least once. In addition a helpful option
    named --print-kiwi-env was added to the 'image info'
    command which allows to print the environment variables
    and their values.

++++ python-kiwi:

  - Fix setup of kiwi environment variables
    Some kiwi env vars are initialized with an empty value
    and not overwritten if another value is provided. For
    the selected variables an empty value setting is not
    allowed because the schema also enforces the value to
    be set at least once. In addition a helpful option
    named --print-kiwi-env was added to the 'image info'
    command which allows to print the environment variables
    and their values.

------------------------------------------------------------------
------------------  2024-11-17  -  Nov 17 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix setup of kiwi environment variables
    Some kiwi env vars are initialized with an empty value
    and not overwritten if another value is provided. For
    the selected variables an empty value setting is not
    allowed because the schema also enforces the value to
    be set at least once. In addition a helpful option
    named --print-kiwi-env was added to the 'image info'
    command which allows to print the environment variables
    and their values.

------------------------------------------------------------------
------------------  2024-11-16  -  Nov 16 2024  -------------------
------------------------------------------------------------------

++++ runc:

  - Update to runc v1.2.2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.2>.

++++ runc:

  - Update to runc v1.2.2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.2>.

++++ runc:

  - Update to runc v1.2.2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.2>.

++++ runc:

  - Update to runc v1.2.2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.2>.

------------------------------------------------------------------
------------------  2024-11-15  -  Nov 15 2024  -------------------
------------------------------------------------------------------

++++ libzypp:

  - The 20MB download limit must not apply to non-metadata files like
    package URLs provided via the CLI (bsc#1233393).
  - version 17.35.14 (35)

++++ libzypp:

  - The 20MB download limit must not apply to non-metadata files like
    package URLs provided via the CLI (bsc#1233393).
  - version 17.35.14 (35)

++++ libzypp:

  - The 20MB download limit must not apply to non-metadata files like
    package URLs provided via the CLI (bsc#1233393).
  - version 17.35.14 (35)

------------------------------------------------------------------
------------------  2024-11-14  -  Nov 14 2024  -------------------
------------------------------------------------------------------

++++ net-snmp:

  - Update to net-snmp-5.9.4 (bsc#1214364).
    add (rename):
    * net-snmp-5.9.4-add-lustre-fs-support.patch
    * net-snmp-5.9.4-add-netgroups-functionality.patch
    * net-snmp-5.9.4-fix-create-v3-user-outfile.patch
    * net-snmp-5.9.4-fixed-python2-bindings.patch
    * net-snmp-5.9.4-fix-Makefile.PL.patch
    * net-snmp-5.9.4-modern-rpm-api.patch
    * net-snmp-5.9.4-net-snmp-config-headercheck.patch
    * net-snmp-5.9.4-perl-tk-warning.patch
    * net-snmp-5.9.4-pie.patch
    * net-snmp-5.9.4-snmpstatus-suppress-output.patch
    * net-snmp-5.9.4-socket-path.patch
    * net-snmp-5.9.4-subagent-set-response.patch
    * net-snmp-5.9.4-suse-systemd-service-files.patch
    * net-snmp-5.9.4-testing-empty-arptable.patch
    delete (now part of v5.9.4):
    * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
    * net-snmp-5.9.3-grep.patch
    delete (rename):
    * net-snmp-5.9.1-add-lustre-fs-support.patch
    * net-snmp-5.9.1-fix-Makefile.PL.patch
    * net-snmp-5.9.1-modern-rpm-api.patch
    * net-snmp-5.9.1-net-snmp-config-headercheck.patch
    * net-snmp-5.9.1-perl-tk-warning.patch
    * net-snmp-5.9.1-snmpstatus-suppress-output.patch
    * net-snmp-5.9.1-socket-path.patch
    * net-snmp-5.9.1-subagent-set-response.patch
    * net-snmp-5.9.1-suse-systemd-service-files.patch
    * net-snmp-5.9.1-testing-empty-arptable.patch
    * net-snmp-5.9.1-velocity-mib.patch
    * net-snmp-5.9.2-fix-create-v3-user-outfile.patch
    * net-snmp-5.9.2-pie.patch
    * net-snmp-5.9.3-fixed-python2-bindings.patch
  - Removing legacy MIBs used by Velocity Software (jira#PED-6416).
  - Re-add support for hostname netgroups that was removed accidentally and
    previously added with FATE#316305 (bsc#1207697).
    '@hostgroup' can be specified for multiple hosts
  - Hardening systemd services setting "ProtectHome=true" caused home directory
    size and allocation to be listed incorrectly (bsc#1206044).
    add (rename):
    * net-snmp-5.9.4-harden_snmpd.service.patch
    * net-snmp-5.9.4-harden_snmptrapd.service.patch
    delete (rename):
    * net-snmp-5.9.1-harden_snmpd.service.patch
    * net-snmp-5.9.1-harden_snmptrapd.service.patch
  - logrotate should use reload instead of restart (bsc#1232030)

++++ net-snmp:

  - Update to net-snmp-5.9.4 (bsc#1214364).
    add (rename):
    * net-snmp-5.9.4-add-lustre-fs-support.patch
    * net-snmp-5.9.4-add-netgroups-functionality.patch
    * net-snmp-5.9.4-fix-create-v3-user-outfile.patch
    * net-snmp-5.9.4-fixed-python2-bindings.patch
    * net-snmp-5.9.4-fix-Makefile.PL.patch
    * net-snmp-5.9.4-modern-rpm-api.patch
    * net-snmp-5.9.4-net-snmp-config-headercheck.patch
    * net-snmp-5.9.4-perl-tk-warning.patch
    * net-snmp-5.9.4-pie.patch
    * net-snmp-5.9.4-snmpstatus-suppress-output.patch
    * net-snmp-5.9.4-socket-path.patch
    * net-snmp-5.9.4-subagent-set-response.patch
    * net-snmp-5.9.4-suse-systemd-service-files.patch
    * net-snmp-5.9.4-testing-empty-arptable.patch
    delete (now part of v5.9.4):
    * net-snmp-5.9.3-disallow_SET_requests_with_NULL_varbind.patch
    * net-snmp-5.9.3-grep.patch
    delete (rename):
    * net-snmp-5.9.1-add-lustre-fs-support.patch
    * net-snmp-5.9.1-fix-Makefile.PL.patch
    * net-snmp-5.9.1-modern-rpm-api.patch
    * net-snmp-5.9.1-net-snmp-config-headercheck.patch
    * net-snmp-5.9.1-perl-tk-warning.patch
    * net-snmp-5.9.1-snmpstatus-suppress-output.patch
    * net-snmp-5.9.1-socket-path.patch
    * net-snmp-5.9.1-subagent-set-response.patch
    * net-snmp-5.9.1-suse-systemd-service-files.patch
    * net-snmp-5.9.1-testing-empty-arptable.patch
    * net-snmp-5.9.1-velocity-mib.patch
    * net-snmp-5.9.2-fix-create-v3-user-outfile.patch
    * net-snmp-5.9.2-pie.patch
    * net-snmp-5.9.3-fixed-python2-bindings.patch
  - Removing legacy MIBs used by Velocity Software (jira#PED-6416).
  - Re-add support for hostname netgroups that was removed accidentally and
    previously added with FATE#316305 (bsc#1207697).
    '@hostgroup' can be specified for multiple hosts
  - Hardening systemd services setting "ProtectHome=true" caused home directory
    size and allocation to be listed incorrectly (bsc#1206044).
    add (rename):
    * net-snmp-5.9.4-harden_snmpd.service.patch
    * net-snmp-5.9.4-harden_snmptrapd.service.patch
    delete (rename):
    * net-snmp-5.9.1-harden_snmpd.service.patch
    * net-snmp-5.9.1-harden_snmptrapd.service.patch
  - logrotate should use reload instead of restart (bsc#1232030)

++++ suseconnect-ng:

  - Update version to 1.13:
  - Integrating uptime-tracker
  - Honor auto-import-gpg-keys flag on migration (bsc#1231328)
  - Only send labels if targetting SCC
  - Skip the docker auth generation on RMT (bsc#1231185)
  - Add --set-labels to register command to set labels at registration time on SCC
  - Add a new function to display suse-uptime-tracker version
  - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ )
  - Add a command to show the info being gathered

++++ suseconnect-ng:

  - Update version to 1.13:
  - Integrating uptime-tracker
  - Honor auto-import-gpg-keys flag on migration (bsc#1231328)
  - Only send labels if targetting SCC
  - Skip the docker auth generation on RMT (bsc#1231185)
  - Add --set-labels to register command to set labels at registration time on SCC
  - Add a new function to display suse-uptime-tracker version
  - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ )
  - Add a command to show the info being gathered

++++ suseconnect-ng:

  - Update version to 1.13:
  - Integrating uptime-tracker
  - Honor auto-import-gpg-keys flag on migration (bsc#1231328)
  - Only send labels if targetting SCC
  - Skip the docker auth generation on RMT (bsc#1231185)
  - Add --set-labels to register command to set labels at registration time on SCC
  - Add a new function to display suse-uptime-tracker version
  - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ )
  - Add a command to show the info being gathered

++++ suseconnect-ng:

  - Update version to 1.13:
  - Integrating uptime-tracker
  - Honor auto-import-gpg-keys flag on migration (bsc#1231328)
  - Only send labels if targetting SCC
  - Skip the docker auth generation on RMT (bsc#1231185)
  - Add --set-labels to register command to set labels at registration time on SCC
  - Add a new function to display suse-uptime-tracker version
  - Integrate with uptime-tracker ( https://github.com/SUSE/uptime-tracker/ )
  - Add a command to show the info being gathered

------------------------------------------------------------------
------------------  2024-11-13  -  Nov 13 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Add patch to fix libcurl when netrc parsing is enabled.
    curl_easy_duphandle did not init netrc which broke applications such
    as for example git. gh#curl/curl#15496
    * 0001-duphandle-also-init-netrc.patch

++++ curl:

  - Add patch to fix libcurl when netrc parsing is enabled.
    curl_easy_duphandle did not init netrc which broke applications such
    as for example git. gh#curl/curl#15496
    * 0001-duphandle-also-init-netrc.patch

++++ curl:

  - Add patch to fix libcurl when netrc parsing is enabled.
    curl_easy_duphandle did not init netrc which broke applications such
    as for example git. gh#curl/curl#15496
    * 0001-duphandle-also-init-netrc.patch

++++ curl:

  - Add patch to fix libcurl when netrc parsing is enabled.
    curl_easy_duphandle did not init netrc which broke applications such
    as for example git. gh#curl/curl#15496
    * 0001-duphandle-also-init-netrc.patch

++++ curl:

  - Add patch to fix libcurl when netrc parsing is enabled.
    curl_easy_duphandle did not init netrc which broke applications such
    as for example git. gh#curl/curl#15496
    * 0001-duphandle-also-init-netrc.patch

++++ curl:

  - Add patch to fix libcurl when netrc parsing is enabled.
    curl_easy_duphandle did not init netrc which broke applications such
    as for example git. gh#curl/curl#15496
    * 0001-duphandle-also-init-netrc.patch

++++ kernel-firmware:

  - Update to version 20241113 (git commit 1727aceef4d2):
    * qcom: venus-5.4: add venus firmware file for qcs615
    * qcom: update venus firmware file for SC7280
    * QCA: Add 22 bluetooth firmware nvm files for QCA2066

++++ kernel-firmware:

  - Update to version 20241113 (git commit 1727aceef4d2):
    * qcom: venus-5.4: add venus firmware file for qcs615
    * qcom: update venus firmware file for SC7280
    * QCA: Add 22 bluetooth firmware nvm files for QCA2066

------------------------------------------------------------------
------------------  2024-11-12  -  Nov 12 2024  -------------------
------------------------------------------------------------------

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker:

  - Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from
    sysconfig a long time ago, and apparently this causes issues with systemd in
    some cases.

++++ docker-compose:

  - Update to version 2.30.3:
    * bump compose-go v2.4.4
    * Avoid starting all services on rebuild

++++ docker-compose:

  - Update to version 2.30.3:
    * bump compose-go v2.4.4
    * Avoid starting all services on rebuild

++++ docker-compose:

  - Update to version 2.30.3:
    * bump compose-go v2.4.4
    * Avoid starting all services on rebuild

++++ python-kiwi:

  - Add random key support for LUKS encryption
    Allow to pass luks="random". In random mode use the
    generated keyfile as the only key to decrypt. This is
    only secure if the generated initrd also gets protected
    e.g. through encryption like it is done with the secure
    linux execution on zSystems

++++ python-kiwi:

  - Add random key support for LUKS encryption
    Allow to pass luks="random". In random mode use the
    generated keyfile as the only key to decrypt. This is
    only secure if the generated initrd also gets protected
    e.g. through encryption like it is done with the secure
    linux execution on zSystems

++++ python-kiwi:

  - Add random key support for LUKS encryption
    Allow to pass luks="random". In random mode use the
    generated keyfile as the only key to decrypt. This is
    only secure if the generated initrd also gets protected
    e.g. through encryption like it is done with the secure
    linux execution on zSystems

++++ kernel-firmware:

  - Update to version 20241112 (git commit c57a0a42468b):
    * mediatek MT7922: update bluetooth firmware to 20241106163512
    * mediatek MT7921: update bluetooth firmware to 20241106151414
    * linux-firmware: update firmware for MT7922 WiFi device
    * linux-firmware: update firmware for MT7921 WiFi device
    * qcom: Add QDU100 firmware image files.
    * qcom: Update aic100 firmware files
    * dedup-firmware.sh: fix infinite loop for --verbose
    * rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x04D7_63F7
    * cnm: update chips&media wave521c firmware.
    * mediatek MT7920: update bluetooth firmware to 20241104091246
    * linux-firmware: update firmware for MT7920 WiFi device
    * copy-firmware.sh: Run check_whence.py only if in a git repo
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops
    * amdgpu: update DMCUB to v9.0.10.0 for DCN351
    * rtw89: 8852a: update fw to v0.13.36.2
    * rtw88: Add firmware v52.14.0 for RTL8812AU
    * i915: Update Xe2LPD DMC to v2.23
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7925)
    * linux-firmware: update firmware for MT7925 WiFi device
    * WHENCE: Add sof-tolg for mt8195
    * linux-firmware: Update firmware file for Intel BlazarI core
    * qcom: Add link for QCS6490 GPU firmware
    * qcom: update gpu firmwares for qcs615 chipset
    * cirrus: cs35l56: Update firmware for Cirrus Amps for some HP laptops
    * mediatek: Add sof-tolg for mt8195
  - Drop obsoleted workaround patch: copy-file-skip-check.patch

++++ kernel-firmware:

  - Update to version 20241112 (git commit c57a0a42468b):
    * mediatek MT7922: update bluetooth firmware to 20241106163512
    * mediatek MT7921: update bluetooth firmware to 20241106151414
    * linux-firmware: update firmware for MT7922 WiFi device
    * linux-firmware: update firmware for MT7921 WiFi device
    * qcom: Add QDU100 firmware image files.
    * qcom: Update aic100 firmware files
    * dedup-firmware.sh: fix infinite loop for --verbose
    * rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x04D7_63F7
    * cnm: update chips&media wave521c firmware.
    * mediatek MT7920: update bluetooth firmware to 20241104091246
    * linux-firmware: update firmware for MT7920 WiFi device
    * copy-firmware.sh: Run check_whence.py only if in a git repo
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops
    * amdgpu: update DMCUB to v9.0.10.0 for DCN351
    * rtw89: 8852a: update fw to v0.13.36.2
    * rtw88: Add firmware v52.14.0 for RTL8812AU
    * i915: Update Xe2LPD DMC to v2.23
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7925)
    * linux-firmware: update firmware for MT7925 WiFi device
    * WHENCE: Add sof-tolg for mt8195
    * linux-firmware: Update firmware file for Intel BlazarI core
    * qcom: Add link for QCS6490 GPU firmware
    * qcom: update gpu firmwares for qcs615 chipset
    * cirrus: cs35l56: Update firmware for Cirrus Amps for some HP laptops
    * mediatek: Add sof-tolg for mt8195
  - Drop obsoleted workaround patch: copy-file-skip-check.patch

++++ expat:

  - no source changes, just adding jira reference: jsc#SLE-21253

++++ expat:

  - no source changes, just adding jira reference: jsc#SLE-21253

++++ expat:

  - no source changes, just adding jira reference: jsc#SLE-21253

++++ expat:

  - no source changes, just adding jira reference: jsc#SLE-21253

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to approve
    RSA signature verification  mechanisms with PKCS padding and
    legacy moduli (bsc#1222834).

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to approve
    RSA signature verification  mechanisms with PKCS padding and
    legacy moduli (bsc#1222834).

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to approve
    RSA signature verification  mechanisms with PKCS padding and
    legacy moduli (bsc#1222834).

++++ libsolv:

  - fix replaces_installed_package using the wrong solvable id
    when checking the noupdate map
  - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard
  - add rpm_query_idarray query function
  - support rpm's "orderwithrequires" dependency
  - bump version to 0.7.31

++++ libsolv:

  - fix replaces_installed_package using the wrong solvable id
    when checking the noupdate map
  - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard
  - add rpm_query_idarray query function
  - support rpm's "orderwithrequires" dependency
  - bump version to 0.7.31

++++ libsolv:

  - fix replaces_installed_package using the wrong solvable id
    when checking the noupdate map
  - make POOL_FLAG_ADDFILEPROVIDESFILTERED behaviour more standard
  - add rpm_query_idarray query function
  - support rpm's "orderwithrequires" dependency
  - bump version to 0.7.31

++++ tiff:

  - make doc packages noarch. no need to have those per arch
  - ensure that the src rpms are named per build flavor:
    You might now ask why. Good question:
    1. the spec file during the build get patched. `@BUILD_FLAVOR@`
    gets replaced with the value. which means the src rpm between
    build flavor builds is not identical. Also the last built
    src.rpm will be published. with different content and runtime
    requires (aka our BuildRequires).
    2. for historical reasons the internal dependency tracking goes
    via the src.rpm package. So without having differently named
    src.rpms the build cycle we were trying to solve was not
    actually solved. So we append a suffix to the Name attribute
    in the preamble now.

++++ libzypp:

  - BuildCache: Don't try to retrieve missing raw metadata if no
    permission to write the cache (bsc#1225451)
  - RepoManager: throw RepoNoPermissionException if the user has no
    permission to update(write) the caches (bsc#1225451)
  - version 17.35.13 (35)

++++ libzypp:

  - BuildCache: Don't try to retrieve missing raw metadata if no
    permission to write the cache (bsc#1225451)
  - RepoManager: throw RepoNoPermissionException if the user has no
    permission to update(write) the caches (bsc#1225451)
  - version 17.35.13 (35)

++++ libzypp:

  - BuildCache: Don't try to retrieve missing raw metadata if no
    permission to write the cache (bsc#1225451)
  - RepoManager: throw RepoNoPermissionException if the user has no
    permission to update(write) the caches (bsc#1225451)
  - version 17.35.13 (35)

++++ zypper:

  - Don't try to download missing raw metadata if cache is not
    writable (bsc#1225451)
  - man: Update 'search' command description.
    Hint to "se -v" showing the matches within the packages metadata.
    Explain that search strings starting with a "/" will implicitly
    look into the filelist as well. Otherfise an explicit "-f" is
    needed.
  - version 1.14.78

++++ zypper:

  - Don't try to download missing raw metadata if cache is not
    writable (bsc#1225451)
  - man: Update 'search' command description.
    Hint to "se -v" showing the matches within the packages metadata.
    Explain that search strings starting with a "/" will implicitly
    look into the filelist as well. Otherfise an explicit "-f" is
    needed.
  - version 1.14.78

------------------------------------------------------------------
------------------  2024-11-11  -  Nov 11 2024  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311-core:

  - Remove -IVendor/ from python-config boo#1231795

++++ tiff:

  - In the previous change to enable the cmake based build
    we also needed python3-Sphinx to build the man pages, as unlike
    the autotools based build, the cmake based build does not fall
    back to the pre-built man pages.
    This causes build cycle. Split out the documentation building to
    break the cycle. The Tumbleweed release managers preferred this
    solution over a mini package.

++++ nvidia-open-driver-G06-signed:

  - kmp-trigger.sh:
    * avoid to return with exit code != 0 if no modules are loaded

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

++++ python311:

  - Remove -IVendor/ from python-config boo#1231795

------------------------------------------------------------------
------------------  2024-11-9  -  Nov 9 2024  -------------------
------------------------------------------------------------------

++++ tiff:

  - switch build to cmake for the webp build - we need the cmake
    finder code

------------------------------------------------------------------
------------------  2024-11-8  -  Nov 8 2024  -------------------
------------------------------------------------------------------

++++ expat:

  - security update
  - added patches
    fix CVE-2024-50602 [bsc#1232579], DoS via XML_ResumeParser
    + expat-CVE-2024-50602.patch

------------------------------------------------------------------
------------------  2024-11-7  -  Nov 7 2024  -------------------
------------------------------------------------------------------

++++ container-selinux:

  - Update to version 2.233.0:
    * container_engine_t: small change to allow non root exec in a container
    * RPM: explicitly list ghosted paths and skip mode verification
    * container-selinux install on non selinux-policy-targeted systems (#332)
    * set container_log_t type for /var/log/kube-apiserver
    * Allow kubelet_t to create a sock file kubelet_var_lib_t
    * dontaudit spc_t to mmap_zero
    * Packit: update targets (#330)
    * container_engine_t: another round of small improvements (#327)
    * Allow container_device_plugin_t to use the network (#325)
    * RPM: cleanup changelog (#324)
    * TMT: Simplify tests

++++ docker-compose:

  - Update to version 2.30.2:
    * remove ArtifactType from Config in OCI v1.1 definition of the
    artifact
    * build(deps): bump github.com/compose-spec/compose-go/v2
    * Service being declared in a profile must not trigger
    re-creation
    * Add profile e2e test case to document in compose
    * Update `MAINTAINERS` file

++++ docker-compose:

  - Update to version 2.30.2:
    * remove ArtifactType from Config in OCI v1.1 definition of the
    artifact
    * build(deps): bump github.com/compose-spec/compose-go/v2
    * Service being declared in a profile must not trigger
    re-creation
    * Add profile e2e test case to document in compose
    * Update `MAINTAINERS` file

++++ docker-compose:

  - Update to version 2.30.2:
    * remove ArtifactType from Config in OCI v1.1 definition of the
    artifact
    * build(deps): bump github.com/compose-spec/compose-go/v2
    * Service being declared in a profile must not trigger
    re-creation
    * Add profile e2e test case to document in compose
    * Update `MAINTAINERS` file

++++ python-kiwi:

  - Added development group in pyproject setup
    generateDS and other tools are needed and were forgotten
    to be added when we deleted the tox dependency

++++ python-kiwi:

  - Added development group in pyproject setup
    generateDS and other tools are needed and were forgotten
    to be added when we deleted the tox dependency

++++ python-kiwi:

  - Added development group in pyproject setup
    generateDS and other tools are needed and were forgotten
    to be added when we deleted the tox dependency

++++ expat:

  - version update to 2.6.4
    * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
    * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake >=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
    [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
    [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do

++++ expat:

  - version update to 2.6.4
    * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
    * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake >=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
    [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
    [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do

++++ expat:

  - version update to 2.6.4
    * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
    * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake >=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
    [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
    [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do

++++ expat:

  - version update to 2.6.4
    * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
    * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake >=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
    [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
    [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do

++++ wpa_supplicant:

  - Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975)
  - Change ctrl_interface from /var/run to %_rundir (/run)

------------------------------------------------------------------
------------------  2024-11-6  -  Nov 6 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.11.0:
    * Security fixes: [bsc#1232528, CVE-2024-9681]
  - curl: HSTS subdomain overwrites parent cache entry
    * Changes:
  - curl: --create-dirs works for --dump-header as well
  - gtls: Add P12 format support
  - ipfs: add options to disable
  - TLS: TLSv1.3 earlydata support for curl
  - WebSockets: make support official (non-experimental)
    * Bugfixes:
  - build: clarify CA embed is for curl tool, mark default, improve summary
  - build: show if CA bundle to embed was found
  - build: tidy up and improve versioned-symbols options
  - cmake/FindNGTCP2: use library path as hint for finding crypto module
  - cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
  - cmake: rename LDAP dependency config variables to match Find modules
  - cmake: replace 'check_include_file_concat()' for LDAP and GSS detection
  - cmake: use OpenSSL for LDAP detection only if available
  - curl: add build options for safe/no CA bundle search (Windows)
  - curl: detect ECH support dynamically, not at build time
  - curl_addrinfo: support operating systems with only getaddrinfo(3)
  - ftp: fix 0-length last write on upload from stdin
  - gnutls: use session cache for QUIC
  - hsts: improve subdomain handling
  - hsts: support "implied LWS" properly around max-age
  - http2: auto reset stream on server eos
  - json.md: cli-option '--json' is an alias of '--data-binary'
  - lib: move curl_path.[ch] into vssh/
  - lib: remove function pointer typecasts for hmac/sha256/md5
  - libssh.c: handle EGAINS during proto-connect correctly
  - libssh2: use the filename buffer when getting the homedir
  - multi.c: warn/assert on stall only without timer
  - negotiate: conditional check around GSS & SSL specific code
  - netrc: cache the netrc file in memory
  - ngtcp2: do not loop on recv
  - ngtcp2: set max window size to 10x of initial (128KB)
  - openssl quic: populate x509 store before handshake
  - openssl: extend the OpenSSL error messages
  - openssl: improve retries on shutdown
  - quic: use send/recvmmsg when available
  - schannel: fix TLS cert verification by IP SAN
  - schannel: ignore error on recv beyond close notify
  - select: use poll() if existing, avoid poll() with no sockets
  - sendf: add condition to max-filesize check
  - server/mqttd: fix two memory leaks
  - setopt: return error for bad input to CURLOPT_RTSP_REQUEST
  - setopt_cptr: make overflow check only done when needed
  - tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED
  - tool: support --show-headers AND --remote-header-name
  - tool_operate: make --skip-existing work for --parallel
  - url: connection reuse on h3 connections
  - url: use same credentials on redirect
  - urlapi: normalize the IPv6 address
  - version: say quictls in MSH3 builds
  - vquic: fix compiler warning with gcc + MUSL
  - vquic: recv_mmsg, use fewer, but larger buffers
  - vtls: convert Curl_pin_peer_pubkey to use dynbuf
  - vtls: convert pubkey_pem_to_der to use dynbuf
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to 8.11.0:
    * Security fixes: [bsc#1232528, CVE-2024-9681]
  - curl: HSTS subdomain overwrites parent cache entry
    * Changes:
  - curl: --create-dirs works for --dump-header as well
  - gtls: Add P12 format support
  - ipfs: add options to disable
  - TLS: TLSv1.3 earlydata support for curl
  - WebSockets: make support official (non-experimental)
    * Bugfixes:
  - build: clarify CA embed is for curl tool, mark default, improve summary
  - build: show if CA bundle to embed was found
  - build: tidy up and improve versioned-symbols options
  - cmake/FindNGTCP2: use library path as hint for finding crypto module
  - cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
  - cmake: rename LDAP dependency config variables to match Find modules
  - cmake: replace 'check_include_file_concat()' for LDAP and GSS detection
  - cmake: use OpenSSL for LDAP detection only if available
  - curl: add build options for safe/no CA bundle search (Windows)
  - curl: detect ECH support dynamically, not at build time
  - curl_addrinfo: support operating systems with only getaddrinfo(3)
  - ftp: fix 0-length last write on upload from stdin
  - gnutls: use session cache for QUIC
  - hsts: improve subdomain handling
  - hsts: support "implied LWS" properly around max-age
  - http2: auto reset stream on server eos
  - json.md: cli-option '--json' is an alias of '--data-binary'
  - lib: move curl_path.[ch] into vssh/
  - lib: remove function pointer typecasts for hmac/sha256/md5
  - libssh.c: handle EGAINS during proto-connect correctly
  - libssh2: use the filename buffer when getting the homedir
  - multi.c: warn/assert on stall only without timer
  - negotiate: conditional check around GSS & SSL specific code
  - netrc: cache the netrc file in memory
  - ngtcp2: do not loop on recv
  - ngtcp2: set max window size to 10x of initial (128KB)
  - openssl quic: populate x509 store before handshake
  - openssl: extend the OpenSSL error messages
  - openssl: improve retries on shutdown
  - quic: use send/recvmmsg when available
  - schannel: fix TLS cert verification by IP SAN
  - schannel: ignore error on recv beyond close notify
  - select: use poll() if existing, avoid poll() with no sockets
  - sendf: add condition to max-filesize check
  - server/mqttd: fix two memory leaks
  - setopt: return error for bad input to CURLOPT_RTSP_REQUEST
  - setopt_cptr: make overflow check only done when needed
  - tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED
  - tool: support --show-headers AND --remote-header-name
  - tool_operate: make --skip-existing work for --parallel
  - url: connection reuse on h3 connections
  - url: use same credentials on redirect
  - urlapi: normalize the IPv6 address
  - version: say quictls in MSH3 builds
  - vquic: fix compiler warning with gcc + MUSL
  - vquic: recv_mmsg, use fewer, but larger buffers
  - vtls: convert Curl_pin_peer_pubkey to use dynbuf
  - vtls: convert pubkey_pem_to_der to use dynbuf
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to 8.11.0:
    * Security fixes: [bsc#1232528, CVE-2024-9681]
  - curl: HSTS subdomain overwrites parent cache entry
    * Changes:
  - curl: --create-dirs works for --dump-header as well
  - gtls: Add P12 format support
  - ipfs: add options to disable
  - TLS: TLSv1.3 earlydata support for curl
  - WebSockets: make support official (non-experimental)
    * Bugfixes:
  - build: clarify CA embed is for curl tool, mark default, improve summary
  - build: show if CA bundle to embed was found
  - build: tidy up and improve versioned-symbols options
  - cmake/FindNGTCP2: use library path as hint for finding crypto module
  - cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
  - cmake: rename LDAP dependency config variables to match Find modules
  - cmake: replace 'check_include_file_concat()' for LDAP and GSS detection
  - cmake: use OpenSSL for LDAP detection only if available
  - curl: add build options for safe/no CA bundle search (Windows)
  - curl: detect ECH support dynamically, not at build time
  - curl_addrinfo: support operating systems with only getaddrinfo(3)
  - ftp: fix 0-length last write on upload from stdin
  - gnutls: use session cache for QUIC
  - hsts: improve subdomain handling
  - hsts: support "implied LWS" properly around max-age
  - http2: auto reset stream on server eos
  - json.md: cli-option '--json' is an alias of '--data-binary'
  - lib: move curl_path.[ch] into vssh/
  - lib: remove function pointer typecasts for hmac/sha256/md5
  - libssh.c: handle EGAINS during proto-connect correctly
  - libssh2: use the filename buffer when getting the homedir
  - multi.c: warn/assert on stall only without timer
  - negotiate: conditional check around GSS & SSL specific code
  - netrc: cache the netrc file in memory
  - ngtcp2: do not loop on recv
  - ngtcp2: set max window size to 10x of initial (128KB)
  - openssl quic: populate x509 store before handshake
  - openssl: extend the OpenSSL error messages
  - openssl: improve retries on shutdown
  - quic: use send/recvmmsg when available
  - schannel: fix TLS cert verification by IP SAN
  - schannel: ignore error on recv beyond close notify
  - select: use poll() if existing, avoid poll() with no sockets
  - sendf: add condition to max-filesize check
  - server/mqttd: fix two memory leaks
  - setopt: return error for bad input to CURLOPT_RTSP_REQUEST
  - setopt_cptr: make overflow check only done when needed
  - tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED
  - tool: support --show-headers AND --remote-header-name
  - tool_operate: make --skip-existing work for --parallel
  - url: connection reuse on h3 connections
  - url: use same credentials on redirect
  - urlapi: normalize the IPv6 address
  - version: say quictls in MSH3 builds
  - vquic: fix compiler warning with gcc + MUSL
  - vquic: recv_mmsg, use fewer, but larger buffers
  - vtls: convert Curl_pin_peer_pubkey to use dynbuf
  - vtls: convert pubkey_pem_to_der to use dynbuf
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to 8.11.0:
    * Security fixes: [bsc#1232528, CVE-2024-9681]
  - curl: HSTS subdomain overwrites parent cache entry
    * Changes:
  - curl: --create-dirs works for --dump-header as well
  - gtls: Add P12 format support
  - ipfs: add options to disable
  - TLS: TLSv1.3 earlydata support for curl
  - WebSockets: make support official (non-experimental)
    * Bugfixes:
  - build: clarify CA embed is for curl tool, mark default, improve summary
  - build: show if CA bundle to embed was found
  - build: tidy up and improve versioned-symbols options
  - cmake/FindNGTCP2: use library path as hint for finding crypto module
  - cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
  - cmake: rename LDAP dependency config variables to match Find modules
  - cmake: replace 'check_include_file_concat()' for LDAP and GSS detection
  - cmake: use OpenSSL for LDAP detection only if available
  - curl: add build options for safe/no CA bundle search (Windows)
  - curl: detect ECH support dynamically, not at build time
  - curl_addrinfo: support operating systems with only getaddrinfo(3)
  - ftp: fix 0-length last write on upload from stdin
  - gnutls: use session cache for QUIC
  - hsts: improve subdomain handling
  - hsts: support "implied LWS" properly around max-age
  - http2: auto reset stream on server eos
  - json.md: cli-option '--json' is an alias of '--data-binary'
  - lib: move curl_path.[ch] into vssh/
  - lib: remove function pointer typecasts for hmac/sha256/md5
  - libssh.c: handle EGAINS during proto-connect correctly
  - libssh2: use the filename buffer when getting the homedir
  - multi.c: warn/assert on stall only without timer
  - negotiate: conditional check around GSS & SSL specific code
  - netrc: cache the netrc file in memory
  - ngtcp2: do not loop on recv
  - ngtcp2: set max window size to 10x of initial (128KB)
  - openssl quic: populate x509 store before handshake
  - openssl: extend the OpenSSL error messages
  - openssl: improve retries on shutdown
  - quic: use send/recvmmsg when available
  - schannel: fix TLS cert verification by IP SAN
  - schannel: ignore error on recv beyond close notify
  - select: use poll() if existing, avoid poll() with no sockets
  - sendf: add condition to max-filesize check
  - server/mqttd: fix two memory leaks
  - setopt: return error for bad input to CURLOPT_RTSP_REQUEST
  - setopt_cptr: make overflow check only done when needed
  - tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED
  - tool: support --show-headers AND --remote-header-name
  - tool_operate: make --skip-existing work for --parallel
  - url: connection reuse on h3 connections
  - url: use same credentials on redirect
  - urlapi: normalize the IPv6 address
  - version: say quictls in MSH3 builds
  - vquic: fix compiler warning with gcc + MUSL
  - vquic: recv_mmsg, use fewer, but larger buffers
  - vtls: convert Curl_pin_peer_pubkey to use dynbuf
  - vtls: convert pubkey_pem_to_der to use dynbuf
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to 8.11.0:
    * Security fixes: [bsc#1232528, CVE-2024-9681]
  - curl: HSTS subdomain overwrites parent cache entry
    * Changes:
  - curl: --create-dirs works for --dump-header as well
  - gtls: Add P12 format support
  - ipfs: add options to disable
  - TLS: TLSv1.3 earlydata support for curl
  - WebSockets: make support official (non-experimental)
    * Bugfixes:
  - build: clarify CA embed is for curl tool, mark default, improve summary
  - build: show if CA bundle to embed was found
  - build: tidy up and improve versioned-symbols options
  - cmake/FindNGTCP2: use library path as hint for finding crypto module
  - cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
  - cmake: rename LDAP dependency config variables to match Find modules
  - cmake: replace 'check_include_file_concat()' for LDAP and GSS detection
  - cmake: use OpenSSL for LDAP detection only if available
  - curl: add build options for safe/no CA bundle search (Windows)
  - curl: detect ECH support dynamically, not at build time
  - curl_addrinfo: support operating systems with only getaddrinfo(3)
  - ftp: fix 0-length last write on upload from stdin
  - gnutls: use session cache for QUIC
  - hsts: improve subdomain handling
  - hsts: support "implied LWS" properly around max-age
  - http2: auto reset stream on server eos
  - json.md: cli-option '--json' is an alias of '--data-binary'
  - lib: move curl_path.[ch] into vssh/
  - lib: remove function pointer typecasts for hmac/sha256/md5
  - libssh.c: handle EGAINS during proto-connect correctly
  - libssh2: use the filename buffer when getting the homedir
  - multi.c: warn/assert on stall only without timer
  - negotiate: conditional check around GSS & SSL specific code
  - netrc: cache the netrc file in memory
  - ngtcp2: do not loop on recv
  - ngtcp2: set max window size to 10x of initial (128KB)
  - openssl quic: populate x509 store before handshake
  - openssl: extend the OpenSSL error messages
  - openssl: improve retries on shutdown
  - quic: use send/recvmmsg when available
  - schannel: fix TLS cert verification by IP SAN
  - schannel: ignore error on recv beyond close notify
  - select: use poll() if existing, avoid poll() with no sockets
  - sendf: add condition to max-filesize check
  - server/mqttd: fix two memory leaks
  - setopt: return error for bad input to CURLOPT_RTSP_REQUEST
  - setopt_cptr: make overflow check only done when needed
  - tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED
  - tool: support --show-headers AND --remote-header-name
  - tool_operate: make --skip-existing work for --parallel
  - url: connection reuse on h3 connections
  - url: use same credentials on redirect
  - urlapi: normalize the IPv6 address
  - version: say quictls in MSH3 builds
  - vquic: fix compiler warning with gcc + MUSL
  - vquic: recv_mmsg, use fewer, but larger buffers
  - vtls: convert Curl_pin_peer_pubkey to use dynbuf
  - vtls: convert pubkey_pem_to_der to use dynbuf
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to 8.11.0:
    * Security fixes: [bsc#1232528, CVE-2024-9681]
  - curl: HSTS subdomain overwrites parent cache entry
    * Changes:
  - curl: --create-dirs works for --dump-header as well
  - gtls: Add P12 format support
  - ipfs: add options to disable
  - TLS: TLSv1.3 earlydata support for curl
  - WebSockets: make support official (non-experimental)
    * Bugfixes:
  - build: clarify CA embed is for curl tool, mark default, improve summary
  - build: show if CA bundle to embed was found
  - build: tidy up and improve versioned-symbols options
  - cmake/FindNGTCP2: use library path as hint for finding crypto module
  - cmake: disable default OpenSSL if BearSSL, GnuTLS or Rustls is enabled
  - cmake: rename LDAP dependency config variables to match Find modules
  - cmake: replace 'check_include_file_concat()' for LDAP and GSS detection
  - cmake: use OpenSSL for LDAP detection only if available
  - curl: add build options for safe/no CA bundle search (Windows)
  - curl: detect ECH support dynamically, not at build time
  - curl_addrinfo: support operating systems with only getaddrinfo(3)
  - ftp: fix 0-length last write on upload from stdin
  - gnutls: use session cache for QUIC
  - hsts: improve subdomain handling
  - hsts: support "implied LWS" properly around max-age
  - http2: auto reset stream on server eos
  - json.md: cli-option '--json' is an alias of '--data-binary'
  - lib: move curl_path.[ch] into vssh/
  - lib: remove function pointer typecasts for hmac/sha256/md5
  - libssh.c: handle EGAINS during proto-connect correctly
  - libssh2: use the filename buffer when getting the homedir
  - multi.c: warn/assert on stall only without timer
  - negotiate: conditional check around GSS & SSL specific code
  - netrc: cache the netrc file in memory
  - ngtcp2: do not loop on recv
  - ngtcp2: set max window size to 10x of initial (128KB)
  - openssl quic: populate x509 store before handshake
  - openssl: extend the OpenSSL error messages
  - openssl: improve retries on shutdown
  - quic: use send/recvmmsg when available
  - schannel: fix TLS cert verification by IP SAN
  - schannel: ignore error on recv beyond close notify
  - select: use poll() if existing, avoid poll() with no sockets
  - sendf: add condition to max-filesize check
  - server/mqttd: fix two memory leaks
  - setopt: return error for bad input to CURLOPT_RTSP_REQUEST
  - setopt_cptr: make overflow check only done when needed
  - tls: avoid abusing CURLE_SSL_ENGINE_INITFAILED
  - tool: support --show-headers AND --remote-header-name
  - tool_operate: make --skip-existing work for --parallel
  - url: connection reuse on h3 connections
  - url: use same credentials on redirect
  - urlapi: normalize the IPv6 address
  - version: say quictls in MSH3 builds
  - vquic: fix compiler warning with gcc + MUSL
  - vquic: recv_mmsg, use fewer, but larger buffers
  - vtls: convert Curl_pin_peer_pubkey to use dynbuf
  - vtls: convert pubkey_pem_to_der to use dynbuf
    * Rebase curl-secure-getenv.patch

++++ python-kiwi:

  - Added containers integration with OBS
    When building in the Open Build Service (OBS) there is no way
    to create outgoing connections from the build workers. To allow
    the <containers> section to fetch containers from the SUSE
    registry we need to apply an OCI URI translation into a local
    path. The actual OCI container image is expected to be provided
    by the obs backend on the worker. Along with this commit also an
    integration test named test-image-disk-containers is provided.
    This Fixes jira#OBS-351

++++ python-kiwi:

  - Added containers integration with OBS
    When building in the Open Build Service (OBS) there is no way
    to create outgoing connections from the build workers. To allow
    the <containers> section to fetch containers from the SUSE
    registry we need to apply an OCI URI translation into a local
    path. The actual OCI container image is expected to be provided
    by the obs backend on the worker. Along with this commit also an
    integration test named test-image-disk-containers is provided.
    This Fixes jira#OBS-351

++++ python-kiwi:

  - Added containers integration with OBS
    When building in the Open Build Service (OBS) there is no way
    to create outgoing connections from the build workers. To allow
    the <containers> section to fetch containers from the SUSE
    registry we need to apply an OCI URI translation into a local
    path. The actual OCI container image is expected to be provided
    by the obs backend on the worker. Along with this commit also an
    integration test named test-image-disk-containers is provided.
    This Fixes jira#OBS-351

------------------------------------------------------------------
------------------  2024-11-5  -  Nov 5 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to 10.3.7 (bsc#1232770)
    + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS

++++ cloud-regionsrv-client:

  - Update to 10.3.7 (bsc#1232770)
    + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS

++++ cloud-regionsrv-client:

  - Update to 10.3.7 (bsc#1232770)
    + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS

++++ cloud-regionsrv-client:

  - Update to 10.3.7 (bsc#1232770)
    + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS

++++ cloud-regionsrv-client:

  - Update to 10.3.7 (bsc#1232770)
    + Fix the product triplet for LTSS, it is always SLES-LTSS, not
    $BASEPRODUCT-LTSS

------------------------------------------------------------------
------------------  2024-11-4  -  Nov 4 2024  -------------------
------------------------------------------------------------------

++++ dracut:

  - Update to version 059+suse.578.gd47ce28c:
    * fix(dm): remove 59-persistent-storage-dm.rules (bsc#1232063)

++++ dracut:

  - Update to version 059+suse.578.gd47ce28c:
    * fix(dm): remove 59-persistent-storage-dm.rules (bsc#1232063)

++++ dracut:

  - Update to version 059+suse.578.gd47ce28c:
    * fix(dm): remove 59-persistent-storage-dm.rules (bsc#1232063)

++++ dracut:

  - Update to version 059+suse.578.gd47ce28c:
    * fix(dm): remove 59-persistent-storage-dm.rules (bsc#1232063)

------------------------------------------------------------------
------------------  2024-11-3  -  Nov 3 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix rendering of SUSE docs
    The SUSE documentation is produced through a conversion
    of the ReST source into docbook. The name kiwi is reserved
    in the index and needs to be referenced as kiwi-ng when
    used as command.
  - Remove tox dependency
    tox was used as sort of a make target to run unit tests
    and more in a python virtualenv. However, since we switched
    everything to poetry it's no longer needed to let tox create
    the python virtual environments. This commit moves the tox
    targets into the Makefile and adapts the github workflow
    files accordingly. In addition the scripts container based
    tests were re-activated and fixed such that they succeed
    again.

++++ python-kiwi:

  - Fix rendering of SUSE docs
    The SUSE documentation is produced through a conversion
    of the ReST source into docbook. The name kiwi is reserved
    in the index and needs to be referenced as kiwi-ng when
    used as command.
  - Remove tox dependency
    tox was used as sort of a make target to run unit tests
    and more in a python virtualenv. However, since we switched
    everything to poetry it's no longer needed to let tox create
    the python virtual environments. This commit moves the tox
    targets into the Makefile and adapts the github workflow
    files accordingly. In addition the scripts container based
    tests were re-activated and fixed such that they succeed
    again.

++++ python-kiwi:

  - Fix rendering of SUSE docs
    The SUSE documentation is produced through a conversion
    of the ReST source into docbook. The name kiwi is reserved
    in the index and needs to be referenced as kiwi-ng when
    used as command.
  - Remove tox dependency
    tox was used as sort of a make target to run unit tests
    and more in a python virtualenv. However, since we switched
    everything to poetry it's no longer needed to let tox create
    the python virtual environments. This commit moves the tox
    targets into the Makefile and adapts the github workflow
    files accordingly. In addition the scripts container based
    tests were re-activated and fixed such that they succeed
    again.

------------------------------------------------------------------
------------------  2024-11-1  -  Nov 1 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix make build target
    Move the actions done by the tox target into the
    build target and call them there in a clean and easy
    to spot sequence. There is no need to call tox to
    prepare for the package submission, instead the
    checks and poetry runs to prepare for the package
    target should be called directly as part of the
    build target. In the future we might get rid of
    tox completely.
  - Bump version: 10.1.17 → 10.1.18

++++ python-kiwi:

  - Fix make build target
    Move the actions done by the tox target into the
    build target and call them there in a clean and easy
    to spot sequence. There is no need to call tox to
    prepare for the package submission, instead the
    checks and poetry runs to prepare for the package
    target should be called directly as part of the
    build target. In the future we might get rid of
    tox completely.
  - Bump version: 10.1.17 → 10.1.18
  - Fixed zipl caller environment
    zipl gets confused with an active sysfs mount inside
    the root tree at call time of zipl. This commit
    umounts the /sys bind mount in the image tree prior
    calling zipl

++++ python-kiwi:

  - Fix make build target
    Move the actions done by the tox target into the
    build target and call them there in a clean and easy
    to spot sequence. There is no need to call tox to
    prepare for the package submission, instead the
    checks and poetry runs to prepare for the package
    target should be called directly as part of the
    build target. In the future we might get rid of
    tox completely.
  - Bump version: 10.1.17 → 10.1.18
  - Fixed zipl caller environment
    zipl gets confused with an active sysfs mount inside
    the root tree at call time of zipl. This commit
    umounts the /sys bind mount in the image tree prior
    calling zipl

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311-core:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ python311:

  - Add CVE-2024-9287-venv_path_unquoted.patch to properly quote
    path names provided when creating a virtual environment
    (bsc#1232241, CVE-2024-9287)

++++ runc:

  - Update to runc v1.2.1. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.1>.

++++ runc:

  - Update to runc v1.2.1. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.1>.

++++ runc:

  - Update to runc v1.2.1. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.1>.

++++ runc:

  - Update to runc v1.2.1. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.1>.

------------------------------------------------------------------
------------------  2024-10-31  -  Oct 31 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed zipl caller environment
    zipl gets confused with an active sysfs mount inside
    the root tree at call time of zipl. This commit
    umounts the /sys bind mount in the image tree prior
    calling zipl
  - Fix s390 test-image-disk build
    Add missing kernel links used by suse tools
  - Bump version: 10.1.16 → 10.1.17

++++ python-kiwi:

  - Fix s390 test-image-disk build
    Add missing kernel links used by suse tools
  - Bump version: 10.1.16 → 10.1.17

++++ python-kiwi:

  - Fix s390 test-image-disk build
    Add missing kernel links used by suse tools
  - Bump version: 10.1.16 → 10.1.17

++++ kernel-firmware:

  - Update to version 20241029 (git commit 048795eef350):
    * ath11k: move WCN6750 firmware to the device-specific subdir
    * xe: Update LNL GSC to v104.0.0.1263
    * i915: Update MTL/ARL GSC to v102.1.15.1926

++++ kernel-firmware:

  - Update to version 20241029 (git commit 048795eef350):
    * ath11k: move WCN6750 firmware to the device-specific subdir
    * xe: Update LNL GSC to v104.0.0.1263
    * i915: Update MTL/ARL GSC to v102.1.15.1926

------------------------------------------------------------------
------------------  2024-10-30  -  Oct 30 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ curl:

  - Security fix: [bsc#1232528, CVE-2024-9681]
    * HSTS subdomain overwrites parent cache entry
    * Add curl-CVE-2024-9681.patch

++++ docker-compose:

  - Update to version 2.30.1:
    * bump compose-go to version v2.4.2

++++ docker-compose:

  - Update to version 2.30.1:
    * bump compose-go to version v2.4.2

++++ docker-compose:

  - Update to version 2.30.1:
    * bump compose-go to version v2.4.2

++++ python-kiwi:

  - Fix coloring of build_status.sh flags
    Depending on the place of the status flag the color
    setup might fail. This commit fixes it
  - Add pytest-container as optional dependency
    The pyproject.toml listed pytest-container as dependency
    but it is used only to run the container based integration
    tests for the shell helper methods. For building the package
    this dependency should not be pulled in

++++ python-kiwi:

  - Fix coloring of build_status.sh flags
    Depending on the place of the status flag the color
    setup might fail. This commit fixes it
  - Add pytest-container as optional dependency
    The pyproject.toml listed pytest-container as dependency
    but it is used only to run the container based integration
    tests for the shell helper methods. For building the package
    this dependency should not be pulled in

++++ python-kiwi:

  - Fix coloring of build_status.sh flags
    Depending on the place of the status flag the color
    setup might fail. This commit fixes it
  - Add pytest-container as optional dependency
    The pyproject.toml listed pytest-container as dependency
    but it is used only to run the container based integration
    tests for the shell helper methods. For building the package
    this dependency should not be pulled in

++++ python-M2Crypto:

  - Update to 0.43.0:
  - feat[m2]: add m2.time_t_bits to checking for 32bitness.
  - fix[tests]: Use only X509_VERSION_1 (0) as version for CSR.
  - fix[EC]: raise ValueError when load_key_bio() cannot read the
    file (bsc#1231589).
  - ci: use -mpip wheel instead of -mbuild
  - fix: use PyMem_Malloc() instead of malloc()
  - fix[hints]: more work on conversion of type hints to the py3k ones
  - fix: make the package build even on Python 3.6
  - ci[local]: skip freezing local tests
  - fix[hints]: remove AnyStr type
  - test: add suggested test for RSA.{get,set}_ex_data
  - fix: implement interfaces for RSA_{get,set}_ex_new_{data,index}
  - fix: generate src/SWIG/x509_v_flag.h to overcome weaknesses of
    swig
  - fix: replace literal enumeration of all VERIFY_ constants by a
    cycle
  - test: unify various test cases in test_ssl related to ftpslib
  - fix: replace deprecated url keyword in setup.cfg with complete
    project_urls map

------------------------------------------------------------------
------------------  2024-10-29  -  Oct 29 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
    + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
    + spec file
    ~ Remove traces of registry related entries on SLE 12
    + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
    + Deregister non free extensions at registercloudguest --clean
    + Fix registry cleanup at registercloudguest --clean, don't remove files
    + Prevent duplicate search entries in registry setup
  - Update EC2 plugin to 1.0.5
    + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone

++++ cloud-regionsrv-client:

  - Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
    + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
    + spec file
    ~ Remove traces of registry related entries on SLE 12
    + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
    + Deregister non free extensions at registercloudguest --clean
    + Fix registry cleanup at registercloudguest --clean, don't remove files
    + Prevent duplicate search entries in registry setup
  - Update EC2 plugin to 1.0.5
    + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone

++++ cloud-regionsrv-client:

  - Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
    + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
    + spec file
    ~ Remove traces of registry related entries on SLE 12
    + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
    + Deregister non free extensions at registercloudguest --clean
    + Fix registry cleanup at registercloudguest --clean, don't remove files
    + Prevent duplicate search entries in registry setup
  - Update EC2 plugin to 1.0.5
    + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone

++++ cloud-regionsrv-client:

  - Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
    + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
    + spec file
    ~ Remove traces of registry related entries on SLE 12
    + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
    + Deregister non free extensions at registercloudguest --clean
    + Fix registry cleanup at registercloudguest --clean, don't remove files
    + Prevent duplicate search entries in registry setup
  - Update EC2 plugin to 1.0.5
    + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone

++++ cloud-regionsrv-client:

  - Update to 10.3.6 (jsc#PCT-471, bsc#1230615)
    + Fix sudo setup
    ~ permissions cloudguestregistryauth
    ~ directory ownership /etc/sudoers.d
    + spec file
    ~ Remove traces of registry related entries on SLE 12
    + Forward port
    ~ fix-for-sles12-disable-registry.patch
    ~ fix-for-sles12-no-trans_update.patch
    + Deregister non free extensions at registercloudguest --clean
    + Fix registry cleanup at registercloudguest --clean, don't remove files
    + Prevent duplicate search entries in registry setup
  - Update EC2 plugin to 1.0.5
    + Switch to using the region endpoint from IMDS to determine the region
    instead of deriving the data from the availability zone

++++ docker-compose:

  - Update to version 2.30.0:
    * Improvements
  - Introduce service hooks by @ndeloof (12166)
  - Introduce generate command as alpha command by @glours
    (12209)
  - Add export command by @jarqvi (12120)
  - Add support for CDI device request using devices by @ndeloof
    (12184)
  - Add support for bind recursive by @ndeloof (12210)
  - Allow usage of -f flag with OCI Compose artifacts by @glours
    (12220)
    * Fixes
  - Append unix-style relative path when computing container
    target path by @ndeloof (12145)
  - Wait for dependent service up to delay set by --wait-timeout
    by @ndeloof (12156)
  - Check secret source exists, as bind mount would create target
    by @ndeloof (12151)
  - After container restart register printer consumer by @jhrotko
    (12158)
  - Fix(down): Fix down command if specified services are not
    running by @idsulik (12164)
  - Show watch error message and open DD only when w is pressed
    by @jhrotko (12165)
  - Fix(push): Fix unexpected EOF on alpha publish by @idsulik
    (12169)
  - Fix(convergence): Serialize access to observed state by
    @anantadwi13 (12150)
  - Remove feature flag integration with Docker Desktop for
    ComposeUI and ComposeNav by @jhrotko (12192)
  - Support Dockerfile-specific ignore-file with watch by
    @ndeloof (12193)
  - Add support for raw env_file format by @ndeloof (12179)
  - Convert GPUs to DeviceRequests with implicit "gpu" capability
    by @ndeloof (12197)
  - Improve error message to include expected network label by
    @divinity76 (12213)
  - Don't use progress to render restart, which hides logs by
    @ndeloof (12226)
  - One-off containers are not indexed, and must be ignored by
    exec --index command by @ndeloof (12224)
  - Don't warn about uid/gid not being supported while ... they
    are by @ndeloof (12232)
  - Connect to external networks by name by @ndeloof (12234)
  - Fix push error message typo by @chris-crone (12237)
  - Fix(dockerignore): Add wildcard support to dockerignore.go by
    @idsulik (12239)
    * Internal
  - Remove bind options when creating a volume type by @jhrotko
    (12177)
  - pass device.options to engine by @ndeloof (12183)
  - Add security policy by @thaJeztah (12194)
  - Gha: set default permissions to "contents: read" by
    @thaJeztah (12195)
  - Desktop: allow this client to be identified via user-agent by
    @djs55 (12212)
  - Compose-go clean volume target to avoid ambiguous comparisons
    by @ndeloof (12208)
    * Dependencies
  - Bump docker v27.3.1 by @ndeloof (12178)
  - Build(deps): bump golang.org/x/sys from 0.25.0 to 0.26.0 by
    @dependabot (12189)
  - Bump compose-go to v2.3.0 by @glours (12198)
  - Bump compose-go to v2.4.0 by @glours (12231)
  - Bump compose-go to v2.4.1 by @glours (12243)
  - Build(deps): bump github.com/containerd/containerd from
    1.7.22 to 1.7.23 by @dependabot (12211)
  - Bump golang minimal version to 1.22 in go.mod by @glours
    (12246)
  - Bump go.uber.org/mock to v0.5.0 and google.golang.org/grpc to
    v1.67.1 by @glours (12245)

++++ docker-compose:

  - Update to version 2.30.0:
    * Improvements
  - Introduce service hooks by @ndeloof (12166)
  - Introduce generate command as alpha command by @glours
    (12209)
  - Add export command by @jarqvi (12120)
  - Add support for CDI device request using devices by @ndeloof
    (12184)
  - Add support for bind recursive by @ndeloof (12210)
  - Allow usage of -f flag with OCI Compose artifacts by @glours
    (12220)
    * Fixes
  - Append unix-style relative path when computing container
    target path by @ndeloof (12145)
  - Wait for dependent service up to delay set by --wait-timeout
    by @ndeloof (12156)
  - Check secret source exists, as bind mount would create target
    by @ndeloof (12151)
  - After container restart register printer consumer by @jhrotko
    (12158)
  - Fix(down): Fix down command if specified services are not
    running by @idsulik (12164)
  - Show watch error message and open DD only when w is pressed
    by @jhrotko (12165)
  - Fix(push): Fix unexpected EOF on alpha publish by @idsulik
    (12169)
  - Fix(convergence): Serialize access to observed state by
    @anantadwi13 (12150)
  - Remove feature flag integration with Docker Desktop for
    ComposeUI and ComposeNav by @jhrotko (12192)
  - Support Dockerfile-specific ignore-file with watch by
    @ndeloof (12193)
  - Add support for raw env_file format by @ndeloof (12179)
  - Convert GPUs to DeviceRequests with implicit "gpu" capability
    by @ndeloof (12197)
  - Improve error message to include expected network label by
    @divinity76 (12213)
  - Don't use progress to render restart, which hides logs by
    @ndeloof (12226)
  - One-off containers are not indexed, and must be ignored by
    exec --index command by @ndeloof (12224)
  - Don't warn about uid/gid not being supported while ... they
    are by @ndeloof (12232)
  - Connect to external networks by name by @ndeloof (12234)
  - Fix push error message typo by @chris-crone (12237)
  - Fix(dockerignore): Add wildcard support to dockerignore.go by
    @idsulik (12239)
    * Internal
  - Remove bind options when creating a volume type by @jhrotko
    (12177)
  - pass device.options to engine by @ndeloof (12183)
  - Add security policy by @thaJeztah (12194)
  - Gha: set default permissions to "contents: read" by
    @thaJeztah (12195)
  - Desktop: allow this client to be identified via user-agent by
    @djs55 (12212)
  - Compose-go clean volume target to avoid ambiguous comparisons
    by @ndeloof (12208)
    * Dependencies
  - Bump docker v27.3.1 by @ndeloof (12178)
  - Build(deps): bump golang.org/x/sys from 0.25.0 to 0.26.0 by
    @dependabot (12189)
  - Bump compose-go to v2.3.0 by @glours (12198)
  - Bump compose-go to v2.4.0 by @glours (12231)
  - Bump compose-go to v2.4.1 by @glours (12243)
  - Build(deps): bump github.com/containerd/containerd from
    1.7.22 to 1.7.23 by @dependabot (12211)
  - Bump golang minimal version to 1.22 in go.mod by @glours
    (12246)
  - Bump go.uber.org/mock to v0.5.0 and google.golang.org/grpc to
    v1.67.1 by @glours (12245)

++++ docker-compose:

  - Update to version 2.30.0:
    * Improvements
  - Introduce service hooks by @ndeloof (12166)
  - Introduce generate command as alpha command by @glours
    (12209)
  - Add export command by @jarqvi (12120)
  - Add support for CDI device request using devices by @ndeloof
    (12184)
  - Add support for bind recursive by @ndeloof (12210)
  - Allow usage of -f flag with OCI Compose artifacts by @glours
    (12220)
    * Fixes
  - Append unix-style relative path when computing container
    target path by @ndeloof (12145)
  - Wait for dependent service up to delay set by --wait-timeout
    by @ndeloof (12156)
  - Check secret source exists, as bind mount would create target
    by @ndeloof (12151)
  - After container restart register printer consumer by @jhrotko
    (12158)
  - Fix(down): Fix down command if specified services are not
    running by @idsulik (12164)
  - Show watch error message and open DD only when w is pressed
    by @jhrotko (12165)
  - Fix(push): Fix unexpected EOF on alpha publish by @idsulik
    (12169)
  - Fix(convergence): Serialize access to observed state by
    @anantadwi13 (12150)
  - Remove feature flag integration with Docker Desktop for
    ComposeUI and ComposeNav by @jhrotko (12192)
  - Support Dockerfile-specific ignore-file with watch by
    @ndeloof (12193)
  - Add support for raw env_file format by @ndeloof (12179)
  - Convert GPUs to DeviceRequests with implicit "gpu" capability
    by @ndeloof (12197)
  - Improve error message to include expected network label by
    @divinity76 (12213)
  - Don't use progress to render restart, which hides logs by
    @ndeloof (12226)
  - One-off containers are not indexed, and must be ignored by
    exec --index command by @ndeloof (12224)
  - Don't warn about uid/gid not being supported while ... they
    are by @ndeloof (12232)
  - Connect to external networks by name by @ndeloof (12234)
  - Fix push error message typo by @chris-crone (12237)
  - Fix(dockerignore): Add wildcard support to dockerignore.go by
    @idsulik (12239)
    * Internal
  - Remove bind options when creating a volume type by @jhrotko
    (12177)
  - pass device.options to engine by @ndeloof (12183)
  - Add security policy by @thaJeztah (12194)
  - Gha: set default permissions to "contents: read" by
    @thaJeztah (12195)
  - Desktop: allow this client to be identified via user-agent by
    @djs55 (12212)
  - Compose-go clean volume target to avoid ambiguous comparisons
    by @ndeloof (12208)
    * Dependencies
  - Bump docker v27.3.1 by @ndeloof (12178)
  - Build(deps): bump golang.org/x/sys from 0.25.0 to 0.26.0 by
    @dependabot (12189)
  - Bump compose-go to v2.3.0 by @glours (12198)
  - Bump compose-go to v2.4.0 by @glours (12231)
  - Bump compose-go to v2.4.1 by @glours (12243)
  - Build(deps): bump github.com/containerd/containerd from
    1.7.22 to 1.7.23 by @dependabot (12211)
  - Bump golang minimal version to 1.22 in go.mod by @glours
    (12246)
  - Bump go.uber.org/mock to v0.5.0 and google.golang.org/grpc to
    v1.67.1 by @glours (12245)

++++ libarchive:

  - Fix CVE-2024-48958, out-of-bounds access in execute_filter_delta
    (CVE-2024-48958, bsc#1231624)
    * CVE-2024-48958.patch
  - Additional patch to fix CVE-2024-20697 (also attributed CVE-2024-26256)
    (CVE-2024-20697, CVE-2024-26256, bsc#1225972)
    * CVE-2024-20697-2.patch
  - Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
    (CVE-2024-48957, bsc#1231544)
    * CVE-2024-48957.patch

++++ libarchive:

  - Fix CVE-2024-48958, out-of-bounds access in execute_filter_delta
    (CVE-2024-48958, bsc#1231624)
    * CVE-2024-48958.patch
  - Additional patch to fix CVE-2024-20697 (also attributed CVE-2024-26256)
    (CVE-2024-20697, CVE-2024-26256, bsc#1225972)
    * CVE-2024-20697-2.patch
  - Fix CVE-2024-48957, out-of-bounds access in execute_filter_audio
    (CVE-2024-48957, bsc#1231544)
    * CVE-2024-48957.patch

++++ skopeo:

  - Add patch for CVE-2024-9676 (bsc#1231698)
    * 0001-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ skopeo:

  - Add patch for CVE-2024-9676 (bsc#1231698)
    * 0001-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

++++ skopeo:

  - Add patch for CVE-2024-9676 (bsc#1231698)
    * 0001-Use-securejoin.SecureJoin-when-forming-userns-paths.patch

------------------------------------------------------------------
------------------  2024-10-28  -  Oct 28 2024  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.23. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.23>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.23. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.23>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.23. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.23>
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ kernel-firmware:

  - Update to version 20241028 (git commit 987607d681cb):
    * amdgpu: DMCUB updates for various AMDGPU ASICs
    * i915: Add Xe3LPD DMC
    * cnm: update chips&media wave521c firmware.
    * linux-firmware: Add firmware for Cirrus CS35L41
    * linux-firmware: Update firmware file for Intel BlazarU core
    * Makefile: error out of 'install' if COPYOPTS is set

++++ kernel-firmware:

  - Update to version 20241028 (git commit 987607d681cb):
    * amdgpu: DMCUB updates for various AMDGPU ASICs
    * i915: Add Xe3LPD DMC
    * cnm: update chips&media wave521c firmware.
    * linux-firmware: Add firmware for Cirrus CS35L41
    * linux-firmware: Update firmware file for Intel BlazarU core
    * Makefile: error out of 'install' if COPYOPTS is set

------------------------------------------------------------------
------------------  2024-10-25  -  Oct 25 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix networking in erofs integration test
    The network setup was systemd-networkd based but
    the provided network config was not for systemd

++++ python-kiwi:

  - Fix networking in erofs integration test
    The network setup was systemd-networkd based but
    the provided network config was not for systemd

++++ python-kiwi:

  - Fix networking in erofs integration test
    The network setup was systemd-networkd based but
    the provided network config was not for systemd

------------------------------------------------------------------
------------------  2024-10-24  -  Oct 24 2024  -------------------
------------------------------------------------------------------

++++ python-requests:

  - Switch to pyproject macros.

++++ python-requests:

  - Switch to pyproject macros.

------------------------------------------------------------------
------------------  2024-10-23  -  Oct 23 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.1.15 → 10.1.16
  - Fix erofs requires in spec
    erofs-utils for SUSE only exists in Tumbleweed. The
    former conditon would also add the requirement for ALP
    and SLFO which is wrong. This commit fixes it

++++ python-kiwi:

  - Bump version: 10.1.15 → 10.1.16
  - Fix erofs requires in spec
    erofs-utils for SUSE only exists in Tumbleweed. The
    former conditon would also add the requirement for ALP
    and SLFO which is wrong. This commit fixes it

++++ python-kiwi:

  - Bump version: 10.1.15 → 10.1.16
  - Fix erofs requires in spec
    erofs-utils for SUSE only exists in Tumbleweed. The
    former conditon would also add the requirement for ALP
    and SLFO which is wrong. This commit fixes it

++++ nvidia-open-driver-G06-signed:

  - Update to 550.127.05 (boo#1232057)
    * Fixed a bug which could cause applications using GBM to crash
    when running with nvidia-drm.modeset=0.

------------------------------------------------------------------
------------------  2024-10-22  -  Oct 22 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add vagrantconfig rule for vagrant format
    If the format="vagrant" attribute is set, a vagrantconfig
    section becomes mandatory. This commit enforces this rule
    on the schema. This Fixes #2666

++++ python-kiwi:

  - Add vagrantconfig rule for vagrant format
    If the format="vagrant" attribute is set, a vagrantconfig
    section becomes mandatory. This commit enforces this rule
    on the schema. This Fixes #2666

++++ python-kiwi:

  - Add vagrantconfig rule for vagrant format
    If the format="vagrant" attribute is set, a vagrantconfig
    section becomes mandatory. This commit enforces this rule
    on the schema. This Fixes #2666

++++ sqlite3:

  - Update to release 3.47.0:
    * Allow arbitrary expressions in the second argument to the RAISE
    function.
    * If the RHS of the ->> operator is negative, then access array
    elements counting from the right.
    * Fix a problem with rolling back hot journal files in the
    seldom-used unix-dotfile VFS.
    * FTS5 tables can now be dropped even if they use a non-standard
    tokenizer that has not been registered.
    * Fix the group_concat() aggregate function so that it returns an
    empty string, not a NULL, if it receives a single input value
    which is an empty string.
    * Enhance the generate_series() table-valued function so that it
    is able to recognize and use constraints on its output value.
    Preupdate hooks now recognize when a column added by ALTER
    TABLE ADD COLUMN has a non-null default value.
    * Improved reuse of subqueries associated with the IN operator,
    especially when the IN operator has been duplicated due to
    predicate push-down.
    * Use a Bloom filter on subqueries on the right-hand side of the
    IN operator, in cases where that seems likely to improve
    performance.
    * Ensure that queries like "SELECT func(a) FROM tab GROUP BY 1"
    only invoke the func() function once per row.
    * No attempt is made to create automatic indexes on a column
    that is known to be non-selective because of its use in other
    indexes that have been analyzed.
    * Adjustments to the query planner so that it produces better
    plans for star queries with a large number of dimension
    tables.
    * Add the "order-by-subquery" optimization, that seeks to
    disable sort operations in outer queries if the desired order
    is obtained naturally due to ORDER BY clauses in subqueries.
    * The "indexed-subtype-expr" optimization strives to use
    expressions that are part of an index rather than recomputing
    the expression based on table values, as long as the query
    planner can prove that the subtype of the expression will
    never be used.
    * Miscellaneous coding tweaks for faster runtimes.
    * Add the experimental sqlite3_rsync program.
    * Add extension functions median(), percentile(),
    percentile_cont(), and percentile_disc() to the CLI.
    * Add the .www dot-command to the CLI.
    * The sqlite3_analyzer utility now provides a break-out of
    statistics for WITHOUT ROWID tables.
    * The sqldiff utility avoids creating an empty database if its
    second argument does not exist.
    * Enhance the sqlite_dbpage table-valued function such that
    INSERT can be used to increase or decrease the size of the
    database file.
    * SQLite no longer makes any use of the "long double" data type,
    as hardware support for long double is becoming less common
    and long double creates challenges for some compiler tool
    chains. Instead, SQLite uses Dekker's algorithm when extended
    precision is needed.
    * The TCL Interface for SQLite supports TCL9. Everything
    probably still works for TCL 8.5 and later, though this is not
    guaranteed. Users are encouraged to upgrade to TCL9.
    * Fix a corruption-causing bug in the JavaScript "opfs" VFS.
    Correct "mode=ro" handling for the "opfs" VFS.  Work around a
    couple of browser-specific OPFS quirks.
    * Add the fts5_tokenizer_v2 API and the locale=1 option, for
    creating custom locale-aware tokenizers and fts5 tables that
    may take advantage of them.
    * Add the contentless_unindexed=1 option, for creating
    contentless fts5 tables that store the values of any UNINDEXED
    columns persistently in the database.
    * Allow an FTS5 table to be dropped even if it uses a custom
    tokenizer whose implementation is not available.

++++ sqlite3:

  - Update to release 3.47.0:
    * Allow arbitrary expressions in the second argument to the RAISE
    function.
    * If the RHS of the ->> operator is negative, then access array
    elements counting from the right.
    * Fix a problem with rolling back hot journal files in the
    seldom-used unix-dotfile VFS.
    * FTS5 tables can now be dropped even if they use a non-standard
    tokenizer that has not been registered.
    * Fix the group_concat() aggregate function so that it returns an
    empty string, not a NULL, if it receives a single input value
    which is an empty string.
    * Enhance the generate_series() table-valued function so that it
    is able to recognize and use constraints on its output value.
    Preupdate hooks now recognize when a column added by ALTER
    TABLE ADD COLUMN has a non-null default value.
    * Improved reuse of subqueries associated with the IN operator,
    especially when the IN operator has been duplicated due to
    predicate push-down.
    * Use a Bloom filter on subqueries on the right-hand side of the
    IN operator, in cases where that seems likely to improve
    performance.
    * Ensure that queries like "SELECT func(a) FROM tab GROUP BY 1"
    only invoke the func() function once per row.
    * No attempt is made to create automatic indexes on a column
    that is known to be non-selective because of its use in other
    indexes that have been analyzed.
    * Adjustments to the query planner so that it produces better
    plans for star queries with a large number of dimension
    tables.
    * Add the "order-by-subquery" optimization, that seeks to
    disable sort operations in outer queries if the desired order
    is obtained naturally due to ORDER BY clauses in subqueries.
    * The "indexed-subtype-expr" optimization strives to use
    expressions that are part of an index rather than recomputing
    the expression based on table values, as long as the query
    planner can prove that the subtype of the expression will
    never be used.
    * Miscellaneous coding tweaks for faster runtimes.
    * Add the experimental sqlite3_rsync program.
    * Add extension functions median(), percentile(),
    percentile_cont(), and percentile_disc() to the CLI.
    * Add the .www dot-command to the CLI.
    * The sqlite3_analyzer utility now provides a break-out of
    statistics for WITHOUT ROWID tables.
    * The sqldiff utility avoids creating an empty database if its
    second argument does not exist.
    * Enhance the sqlite_dbpage table-valued function such that
    INSERT can be used to increase or decrease the size of the
    database file.
    * SQLite no longer makes any use of the "long double" data type,
    as hardware support for long double is becoming less common
    and long double creates challenges for some compiler tool
    chains. Instead, SQLite uses Dekker's algorithm when extended
    precision is needed.
    * The TCL Interface for SQLite supports TCL9. Everything
    probably still works for TCL 8.5 and later, though this is not
    guaranteed. Users are encouraged to upgrade to TCL9.
    * Fix a corruption-causing bug in the JavaScript "opfs" VFS.
    Correct "mode=ro" handling for the "opfs" VFS.  Work around a
    couple of browser-specific OPFS quirks.
    * Add the fts5_tokenizer_v2 API and the locale=1 option, for
    creating custom locale-aware tokenizers and fts5 tables that
    may take advantage of them.
    * Add the contentless_unindexed=1 option, for creating
    contentless fts5 tables that store the values of any UNINDEXED
    columns persistently in the database.
    * Allow an FTS5 table to be dropped even if it uses a custom
    tokenizer whose implementation is not available.

++++ sqlite3:

  - Update to release 3.47.0:
    * Allow arbitrary expressions in the second argument to the RAISE
    function.
    * If the RHS of the ->> operator is negative, then access array
    elements counting from the right.
    * Fix a problem with rolling back hot journal files in the
    seldom-used unix-dotfile VFS.
    * FTS5 tables can now be dropped even if they use a non-standard
    tokenizer that has not been registered.
    * Fix the group_concat() aggregate function so that it returns an
    empty string, not a NULL, if it receives a single input value
    which is an empty string.
    * Enhance the generate_series() table-valued function so that it
    is able to recognize and use constraints on its output value.
    Preupdate hooks now recognize when a column added by ALTER
    TABLE ADD COLUMN has a non-null default value.
    * Improved reuse of subqueries associated with the IN operator,
    especially when the IN operator has been duplicated due to
    predicate push-down.
    * Use a Bloom filter on subqueries on the right-hand side of the
    IN operator, in cases where that seems likely to improve
    performance.
    * Ensure that queries like "SELECT func(a) FROM tab GROUP BY 1"
    only invoke the func() function once per row.
    * No attempt is made to create automatic indexes on a column
    that is known to be non-selective because of its use in other
    indexes that have been analyzed.
    * Adjustments to the query planner so that it produces better
    plans for star queries with a large number of dimension
    tables.
    * Add the "order-by-subquery" optimization, that seeks to
    disable sort operations in outer queries if the desired order
    is obtained naturally due to ORDER BY clauses in subqueries.
    * The "indexed-subtype-expr" optimization strives to use
    expressions that are part of an index rather than recomputing
    the expression based on table values, as long as the query
    planner can prove that the subtype of the expression will
    never be used.
    * Miscellaneous coding tweaks for faster runtimes.
    * Add the experimental sqlite3_rsync program.
    * Add extension functions median(), percentile(),
    percentile_cont(), and percentile_disc() to the CLI.
    * Add the .www dot-command to the CLI.
    * The sqlite3_analyzer utility now provides a break-out of
    statistics for WITHOUT ROWID tables.
    * The sqldiff utility avoids creating an empty database if its
    second argument does not exist.
    * Enhance the sqlite_dbpage table-valued function such that
    INSERT can be used to increase or decrease the size of the
    database file.
    * SQLite no longer makes any use of the "long double" data type,
    as hardware support for long double is becoming less common
    and long double creates challenges for some compiler tool
    chains. Instead, SQLite uses Dekker's algorithm when extended
    precision is needed.
    * The TCL Interface for SQLite supports TCL9. Everything
    probably still works for TCL 8.5 and later, though this is not
    guaranteed. Users are encouraged to upgrade to TCL9.
    * Fix a corruption-causing bug in the JavaScript "opfs" VFS.
    Correct "mode=ro" handling for the "opfs" VFS.  Work around a
    couple of browser-specific OPFS quirks.
    * Add the fts5_tokenizer_v2 API and the locale=1 option, for
    creating custom locale-aware tokenizers and fts5 tables that
    may take advantage of them.
    * Add the contentless_unindexed=1 option, for creating
    contentless fts5 tables that store the values of any UNINDEXED
    columns persistently in the database.
    * Allow an FTS5 table to be dropped even if it uses a custom
    tokenizer whose implementation is not available.

++++ sqlite3:

  - Update to release 3.47.0:
    * Allow arbitrary expressions in the second argument to the RAISE
    function.
    * If the RHS of the ->> operator is negative, then access array
    elements counting from the right.
    * Fix a problem with rolling back hot journal files in the
    seldom-used unix-dotfile VFS.
    * FTS5 tables can now be dropped even if they use a non-standard
    tokenizer that has not been registered.
    * Fix the group_concat() aggregate function so that it returns an
    empty string, not a NULL, if it receives a single input value
    which is an empty string.
    * Enhance the generate_series() table-valued function so that it
    is able to recognize and use constraints on its output value.
    Preupdate hooks now recognize when a column added by ALTER
    TABLE ADD COLUMN has a non-null default value.
    * Improved reuse of subqueries associated with the IN operator,
    especially when the IN operator has been duplicated due to
    predicate push-down.
    * Use a Bloom filter on subqueries on the right-hand side of the
    IN operator, in cases where that seems likely to improve
    performance.
    * Ensure that queries like "SELECT func(a) FROM tab GROUP BY 1"
    only invoke the func() function once per row.
    * No attempt is made to create automatic indexes on a column
    that is known to be non-selective because of its use in other
    indexes that have been analyzed.
    * Adjustments to the query planner so that it produces better
    plans for star queries with a large number of dimension
    tables.
    * Add the "order-by-subquery" optimization, that seeks to
    disable sort operations in outer queries if the desired order
    is obtained naturally due to ORDER BY clauses in subqueries.
    * The "indexed-subtype-expr" optimization strives to use
    expressions that are part of an index rather than recomputing
    the expression based on table values, as long as the query
    planner can prove that the subtype of the expression will
    never be used.
    * Miscellaneous coding tweaks for faster runtimes.
    * Add the experimental sqlite3_rsync program.
    * Add extension functions median(), percentile(),
    percentile_cont(), and percentile_disc() to the CLI.
    * Add the .www dot-command to the CLI.
    * The sqlite3_analyzer utility now provides a break-out of
    statistics for WITHOUT ROWID tables.
    * The sqldiff utility avoids creating an empty database if its
    second argument does not exist.
    * Enhance the sqlite_dbpage table-valued function such that
    INSERT can be used to increase or decrease the size of the
    database file.
    * SQLite no longer makes any use of the "long double" data type,
    as hardware support for long double is becoming less common
    and long double creates challenges for some compiler tool
    chains. Instead, SQLite uses Dekker's algorithm when extended
    precision is needed.
    * The TCL Interface for SQLite supports TCL9. Everything
    probably still works for TCL 8.5 and later, though this is not
    guaranteed. Users are encouraged to upgrade to TCL9.
    * Fix a corruption-causing bug in the JavaScript "opfs" VFS.
    Correct "mode=ro" handling for the "opfs" VFS.  Work around a
    couple of browser-specific OPFS quirks.
    * Add the fts5_tokenizer_v2 API and the locale=1 option, for
    creating custom locale-aware tokenizers and fts5 tables that
    may take advantage of them.
    * Add the contentless_unindexed=1 option, for creating
    contentless fts5 tables that store the values of any UNINDEXED
    columns persistently in the database.
    * Allow an FTS5 table to be dropped even if it uses a custom
    tokenizer whose implementation is not available.

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

++++ podman:

  - Add patch for CVE-2024-9676 (bsc#1231698):
    * 0005-Use-securejoin.SecureJoin-when-forming-userns-paths.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
    * 0004-Properly-validate-cache-IDs-and-sources.patch

------------------------------------------------------------------
------------------  2024-10-21  -  Oct 21 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.1.14 → 10.1.15

++++ python-kiwi:

  - Bump version: 10.1.14 → 10.1.15

++++ python-kiwi:

  - Bump version: 10.1.14 → 10.1.15

++++ kernel-firmware:

  - Update to version 20241018 (git commit 2f0464118f40):
    * check_whence.py: skip some validation if git ls-files fails
    * qcom: Add Audio firmware for X1E80100 CRD/QCPs
    * amdgpu: DMCUB updates forvarious AMDGPU ASICs
    * brcm: replace NVRAM for Jetson TX1
    * rtlwifi: Update firmware for RTL8192FU to v7.3
    * make: separate installation and de-duplication targets
    * check_whence.py: check the permissions
    * Remove execute bit from firmware files
    * configure: remove unused file
    * rtl_nic: add firmware rtl8125d-1

++++ kernel-firmware:

  - Update to version 20241018 (git commit 2f0464118f40):
    * check_whence.py: skip some validation if git ls-files fails
    * qcom: Add Audio firmware for X1E80100 CRD/QCPs
    * amdgpu: DMCUB updates forvarious AMDGPU ASICs
    * brcm: replace NVRAM for Jetson TX1
    * rtlwifi: Update firmware for RTL8192FU to v7.3
    * make: separate installation and de-duplication targets
    * check_whence.py: check the permissions
    * Remove execute bit from firmware files
    * configure: remove unused file
    * rtl_nic: add firmware rtl8125d-1

++++ systemd:

  - Import commit ae14c7765524a3c84ce8a65d6a3a4db2be981f69 (merge of v254.19)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/87f11f092e2a63f6b9af98871ea716dab54f8b58...ae14c7765524a3c84ce8a65d6a3a4db2be981f69

++++ systemd:

  - Import commit ae14c7765524a3c84ce8a65d6a3a4db2be981f69 (merge of v254.19)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/87f11f092e2a63f6b9af98871ea716dab54f8b58...ae14c7765524a3c84ce8a65d6a3a4db2be981f69

++++ systemd:

  - Import commit ae14c7765524a3c84ce8a65d6a3a4db2be981f69 (merge of v254.19)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/87f11f092e2a63f6b9af98871ea716dab54f8b58...ae14c7765524a3c84ce8a65d6a3a4db2be981f69

++++ systemd:

  - Import commit ae14c7765524a3c84ce8a65d6a3a4db2be981f69 (merge of v254.19)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/87f11f092e2a63f6b9af98871ea716dab54f8b58...ae14c7765524a3c84ce8a65d6a3a4db2be981f69

++++ systemd:

  - Import commit ae14c7765524a3c84ce8a65d6a3a4db2be981f69 (merge of v254.19)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/87f11f092e2a63f6b9af98871ea716dab54f8b58...ae14c7765524a3c84ce8a65d6a3a4db2be981f69

++++ systemd:

  - Import commit ae14c7765524a3c84ce8a65d6a3a4db2be981f69 (merge of v254.19)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/87f11f092e2a63f6b9af98871ea716dab54f8b58...ae14c7765524a3c84ce8a65d6a3a4db2be981f69

++++ nvidia-open-driver-G06-signed:

  - cuda-flavor
    provide also nvidia-open-driver-G06-kmp-$flavor = %version to
    workaround broken cuda-drivers

++++ runc:

  - Update to runc v1.2.0. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0>.
  - Remove upstreamed patches.
  - 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
  - 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
  - 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

  - Update to runc v1.2.0. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0>.
  - Remove upstreamed patches.
  - 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
  - 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
  - 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

  - Update to runc v1.2.0. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0>.
  - Remove upstreamed patches.
  - 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
  - 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
  - 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

  - Update to runc v1.2.0. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0>.
  - Remove upstreamed patches.
  - 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
  - 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
  - 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

------------------------------------------------------------------
------------------  2024-10-18  -  Oct 18 2024  -------------------
------------------------------------------------------------------

++++ unbound:

  - Update to 1.22.0:
    Features:
    * Add iter-scrub-ns, iter-scrub-cname and max-global-quota
    configuration options.
    * Merge patch to fix for glue that is outside of zone, with
    `harden-unverified-glue`, from Karthik Umashankar (Microsoft).
    Enabling this option protects the Unbound resolver against bad
    glue, that is unverified out of zone glue, by resolving them.
    It uses the records as last resort if there is no other working
    glue.
    * Add redis-command-timeout: 20 and redis-connect-timeout: 200,
    that can set the timeout separately for commands and the
    connection set up to the redis server. If they are not
    specified, the redis-timeout value is used.
    * Log timestamps in ISO8601 format with timezone. This adds the
    option `log-time-iso: yes` that logs in ISO8601 format.
    * DNS over QUIC. This adds `quic-port: 853` and `quic-size: 8m`
    that enable dnsoverquic, and the counters `num.query.quic` and
    `mem.quic` in the statistics output. The feature needs to be
    enabled by compiling with libngtcp2, with
    `--with-libngtcp2=path` and libngtcp2 needs openssl+quic, pass
    that with `--with-ssl=path` to compile unbound as well.
    Bug Fixes:
    * unbound-control-setup hangs while testing for openssl presence
    starting from version 1.21.0.
    * Fix error: "memory exhausted" when defining more than 9994
    local-zones.
    * Fix documentation for cache_fill_missing function.
    * Fix Loads of logs: "validation failure: key for validation
    <domain>. is marked as invalid because of a previous" for
    non-DNSSEC signed zone.
    * Fix that when rpz is applied the message does not get picked up
    by the validator. That stops validation failures for the
    message.
    * Fix that stub-zone and forward-zone clauses do not exhaust
    memory for long content.
    * Fix to print port number in logs for auth zone transfer
    activities.
    * b.root renumbering.
    * Add new IANA trust anchor.
    * Fix config file read for dnstap-sample-rate.
    * Fix alloc-size and calloc-transposed-args compiler warnings.
    * Fix to limit NSEC and NSEC3 TTL when aggressive nsec is enabled
    (RFC9077).
    * Fix dns64 with prefetch that the prefetch is stored in cache.
    * Attempt to further fix doh_downstream_buffer_size.tdir
    flakiness.
    * More clear text for prefetch and minimal-responses in the
    unbound.conf man page.
    * Fix cache update when serve expired is used. Expired records
    are favored over resolution and validation failures when
    serve-expired is used.
    * Fix negative cache NSEC3 parameter compares for zero length
    NSEC3 salt.
    * Fix unbound-control-setup hangs sometimes depending on the
    openssl version.
    * Fix Cannot override tcp-upstream and tls-upstream with
    forward-tcp-upstream and forward-tls-upstream.
    * Fix to limit NSEC TTL for messages from cachedb. Fix to limit
    the prefetch ttl for messages after a CNAME with short TTL.
    * Fix to disable detection of quic configured ports when quic is
    not compiled in.
    * Fix harden-unverified-glue for AAAA cache_fill_missing lookups.
    * Fix contrib/aaaa-filter-iterator.patch for change in call
    signature for cache_fill_missing.
    * Fix to display warning if quic-port is set but dnsoverquic is
    not enabled when compiled.
    * Fix dnsoverquic to extend the number of streams when one is
    closed.
    * Fix for dnstap with dnscrypt and dnstap without dnsoverquic.
    * Fix for dnsoverquic and dnstap to use the correct dnstap
    environment.
  - Update keyring

++++ unbound:

  - Update to 1.22.0:
    Features:
    * Add iter-scrub-ns, iter-scrub-cname and max-global-quota
    configuration options.
    * Merge patch to fix for glue that is outside of zone, with
    `harden-unverified-glue`, from Karthik Umashankar (Microsoft).
    Enabling this option protects the Unbound resolver against bad
    glue, that is unverified out of zone glue, by resolving them.
    It uses the records as last resort if there is no other working
    glue.
    * Add redis-command-timeout: 20 and redis-connect-timeout: 200,
    that can set the timeout separately for commands and the
    connection set up to the redis server. If they are not
    specified, the redis-timeout value is used.
    * Log timestamps in ISO8601 format with timezone. This adds the
    option `log-time-iso: yes` that logs in ISO8601 format.
    * DNS over QUIC. This adds `quic-port: 853` and `quic-size: 8m`
    that enable dnsoverquic, and the counters `num.query.quic` and
    `mem.quic` in the statistics output. The feature needs to be
    enabled by compiling with libngtcp2, with
    `--with-libngtcp2=path` and libngtcp2 needs openssl+quic, pass
    that with `--with-ssl=path` to compile unbound as well.
    Bug Fixes:
    * unbound-control-setup hangs while testing for openssl presence
    starting from version 1.21.0.
    * Fix error: "memory exhausted" when defining more than 9994
    local-zones.
    * Fix documentation for cache_fill_missing function.
    * Fix Loads of logs: "validation failure: key for validation
    <domain>. is marked as invalid because of a previous" for
    non-DNSSEC signed zone.
    * Fix that when rpz is applied the message does not get picked up
    by the validator. That stops validation failures for the
    message.
    * Fix that stub-zone and forward-zone clauses do not exhaust
    memory for long content.
    * Fix to print port number in logs for auth zone transfer
    activities.
    * b.root renumbering.
    * Add new IANA trust anchor.
    * Fix config file read for dnstap-sample-rate.
    * Fix alloc-size and calloc-transposed-args compiler warnings.
    * Fix to limit NSEC and NSEC3 TTL when aggressive nsec is enabled
    (RFC9077).
    * Fix dns64 with prefetch that the prefetch is stored in cache.
    * Attempt to further fix doh_downstream_buffer_size.tdir
    flakiness.
    * More clear text for prefetch and minimal-responses in the
    unbound.conf man page.
    * Fix cache update when serve expired is used. Expired records
    are favored over resolution and validation failures when
    serve-expired is used.
    * Fix negative cache NSEC3 parameter compares for zero length
    NSEC3 salt.
    * Fix unbound-control-setup hangs sometimes depending on the
    openssl version.
    * Fix Cannot override tcp-upstream and tls-upstream with
    forward-tcp-upstream and forward-tls-upstream.
    * Fix to limit NSEC TTL for messages from cachedb. Fix to limit
    the prefetch ttl for messages after a CNAME with short TTL.
    * Fix to disable detection of quic configured ports when quic is
    not compiled in.
    * Fix harden-unverified-glue for AAAA cache_fill_missing lookups.
    * Fix contrib/aaaa-filter-iterator.patch for change in call
    signature for cache_fill_missing.
    * Fix to display warning if quic-port is set but dnsoverquic is
    not enabled when compiled.
    * Fix dnsoverquic to extend the number of streams when one is
    closed.
    * Fix for dnstap with dnscrypt and dnstap without dnsoverquic.
    * Fix for dnsoverquic and dnstap to use the correct dnstap
    environment.
  - Update keyring

++++ nvidia-open-driver-G06-signed:

  - For CUDA update version to 560.35.03
  - supersedes kernel-6.10.patch
  - cuda-flavor
    * provide nvidia-open-driver-G06-kmp = %version to workaround
    broken cuda-drivers
  - nv-prefer-signed-open-driver
    * added comments for requirements
  - latest change hardcoded to 555.42.06; we no longer need this
    for 560
  - nv-prefer-signed-open-driver:
    * added specicic versions of cuda-drivers/cuda-drivers-xxx as
    preconditions for requiring specific version of
    nvidia-compute-G06
  - nv-prefer-signed-open-driver:
    * no longer require a specific version of
    nvidia-open-driver-G06-signed-cuda-kmp, so it can select the
    correct open driver KMP matching the cuda-runtime version
  - cuda-flavor:
    * added nvidia-compute-G06 = %version to preconditions for
    requiring kernel-firmware-nvidia-gspx-G06, since
    nvidia-compute-utils-G06 does not have a version-specific
    requires on nvidia-compute-G06

------------------------------------------------------------------
------------------  2024-10-17  -  Oct 17 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed sphinx_rtd_theme setup
    Delete obsolete display_version attribute
  - Evaluate eficsm everywhere
    Fixed _supports_bios_modules() to take an eventually
    provided eficsm setup into account. The grub config still
    searches for i386 grub modules even if eficsm="false"
    is set.
  - Fixed debian bootstrap script calls
    Run scripts as commands with their native shebang and not
    through bash. Not all debian package scripts uses bash, some
    of them uses sh which can be a link to dash or other
    interpreters. This Fixes #2660
  - Update TW integration tests
    The package x86info was dropped from TW

++++ python-kiwi:

  - Fixed sphinx_rtd_theme setup
    Delete obsolete display_version attribute
  - Evaluate eficsm everywhere
    Fixed _supports_bios_modules() to take an eventually
    provided eficsm setup into account. The grub config still
    searches for i386 grub modules even if eficsm="false"
    is set.
  - Fixed debian bootstrap script calls
    Run scripts as commands with their native shebang and not
    through bash. Not all debian package scripts uses bash, some
    of them uses sh which can be a link to dash or other
    interpreters. This Fixes #2660
  - Update TW integration tests
    The package x86info was dropped from TW

++++ python-kiwi:

  - Fixed sphinx_rtd_theme setup
    Delete obsolete display_version attribute
  - Evaluate eficsm everywhere
    Fixed _supports_bios_modules() to take an eventually
    provided eficsm setup into account. The grub config still
    searches for i386 grub modules even if eficsm="false"
    is set.
  - Fixed debian bootstrap script calls
    Run scripts as commands with their native shebang and not
    through bash. Not all debian package scripts uses bash, some
    of them uses sh which can be a link to dash or other
    interpreters. This Fixes #2660
  - Update TW integration tests
    The package x86info was dropped from TW

++++ openssl-3:

  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch

++++ openssl-3:

  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch

++++ openssl-3:

  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch

++++ openssl-3:

  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch

++++ openssl-3:

  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch

++++ openssl-3:

  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch

++++ openssl-3:

  - Security fix: [bsc#1220262, CVE-2023-50782]
    * Implicit rejection in PKCS#1 v1.5
    * Add openssl-CVE-2023-50782.patch

++++ python-requests:

  - Add patch inject-default-ca-bundles.patch:
    * Inject the default CA bundles if they are not specified.
    (bsc#1226321, bsc#1231500)

++++ python-requests:

  - Add patch inject-default-ca-bundles.patch:
    * Inject the default CA bundles if they are not specified.
    (bsc#1226321, bsc#1231500)

++++ python-requests:

  - Add patch inject-default-ca-bundles.patch:
    * Inject the default CA bundles if they are not specified.
    (bsc#1226321, bsc#1231500)

++++ qemu:

  - Bugfixes and CVEs:
    * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354)
    * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612)
    * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612)

++++ qemu:

  - Bugfixes and CVEs:
    * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354)
    * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612)
    * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612)

++++ qemu:

  - Bugfixes and CVEs:
    * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354)
    * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612)
    * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612)

++++ qemu:

  - Bugfixes and CVEs:
    * hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or OUT (bsc#1230834, CVE-2024-8354)
    * softmmu: Support concurrent bounce buffers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Per-AddressSpace bounce buffering (bsc#1230915, CVE-2024-8612)
    * system/physmem: Propagate AddressSpace to MapClient helpers (bsc#1230915, CVE-2024-8612)
    * system/physmem: Replace qemu_mutex_lock() calls with QEMU_LOCK_GUARD (bsc#1230915, CVE-2024-8612)

------------------------------------------------------------------
------------------  2024-10-16  -  Oct 16 2024  -------------------
------------------------------------------------------------------

++++ cups:

  - Drop rcFOO symlinks for CODE16 (PED-266).

++++ cups:

  - Drop rcFOO symlinks for CODE16 (PED-266).

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ docker:

  - Further merge docker and docker-stable specfiles to minimise the differences.
    The main thing is that we now include both halves of the
    Conflicts/Provides/Obsoletes dance in both specfiles.
  - Update to docker-buildx v0.17.1 to match standalone docker-buildx package we
    are replacing. See upstream changelog online at
    <https://github.com/docker/buildx/releases/tag/v0.17.1>

++++ python-kiwi:

  - Turn DiskFormat into an ordinary class
  - it does not need to be an abstract base class
  - use f-strings where applicable instead of format()
  - change return type of _custom_args_for_format from list to tuple

++++ python-kiwi:

  - Turn DiskFormat into an ordinary class
  - it does not need to be an abstract base class
  - use f-strings where applicable instead of format()
  - change return type of _custom_args_for_format from list to tuple

++++ python-kiwi:

  - Turn DiskFormat into an ordinary class
  - it does not need to be an abstract base class
  - use f-strings where applicable instead of format()
  - change return type of _custom_args_for_format from list to tuple

++++ gcc13:

  - Add gcc13-pr116657.patch to fix for parsing tzdata 2024b [gcc#116657]

++++ nvidia-open-driver-G06-signed:

  - cuda-flavor:
    * require kernel-firmware-nvidia-gspx-G06 instead of
    kernel-firmware-nvidia-gspx-G06-cuda (which provides also
    kernel-firmware-nvidia-gspx-G06)
    * trigger removal of driver modules also on
    kernel-firmware-nvidia-gspx-G06
  - no longer hard-require kernel firmware package, but install it
    automatically once nvidia-compute-utils-G06 gets installed
  - trigger removal of driver modules with non-existing or wrong
    firmware when (new) firmware gets installed

------------------------------------------------------------------
------------------  2024-10-15  -  Oct 15 2024  -------------------
------------------------------------------------------------------

++++ avahi:

  - Drop rcFOO symlinks (PED-266).

++++ avahi:

  - Drop rcFOO symlinks (PED-266).

++++ avahi:

  - Drop rcFOO symlinks (PED-266).

++++ avahi:

  - Drop rcFOO symlinks (PED-266).

++++ python-kiwi:

  - Add new containers section
    Allow to specify references to OCI containers in the
    image description like in the following example:
    <containers source="registry.suse.com" backend="podman">
    <container name="some" tag="some" path="/some/path"/>
    </containers>
    During the kiwi process the containers are fetched into a
    temporary location and a systemd service is configured to
    one time load the containers into the local registry at
    first boot of the system. This Fixes #2663

++++ python-kiwi:

  - Add new containers section
    Allow to specify references to OCI containers in the
    image description like in the following example:
    <containers source="registry.suse.com" backend="podman">
    <container name="some" tag="some" path="/some/path"/>
    </containers>
    During the kiwi process the containers are fetched into a
    temporary location and a systemd service is configured to
    one time load the containers into the local registry at
    first boot of the system. This Fixes #2663

++++ kernel-firmware:

  - Update to version 20241014 (git commit 99f9c7ed1f4a):
    * iwlwifi: add gl/Bz FW for core91-69 release
    * iwlwifi: update ty/So/Ma firmwares for core91-69 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core91-69 release
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for a Lenovo Laptop
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for some ASUS laptops
    * cirrus: cs35l56: Add firmware for Cirrus Amps for some HP laptops
    * linux-firmware: update firmware for en8811h 2.5G ethernet phy
    * QCA: Add Bluetooth firmwares for WCN785x with UART transport

++++ kernel-firmware:

  - Update to version 20241014 (git commit 99f9c7ed1f4a):
    * iwlwifi: add gl/Bz FW for core91-69 release
    * iwlwifi: update ty/So/Ma firmwares for core91-69 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core91-69 release
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for a Lenovo Laptop
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for some ASUS laptops
    * cirrus: cs35l56: Add firmware for Cirrus Amps for some HP laptops
    * linux-firmware: update firmware for en8811h 2.5G ethernet phy
    * QCA: Add Bluetooth firmwares for WCN785x with UART transport

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ podman:

  - Add patch for CVE-2024-9675 (bsc#1231499):
    * 0004-Properly-validate-cache-IDs-and-sources.patch
  - Add patch for CVE-2024-9407 (bsc#1231208):
    * 0003-CVE-2024-9407-validate-bind-propagation-flag-setting.patch
  - Rebase patches:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch

++++ qemu:

  - Update version to 8.2.7
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/d9ff276f-f1ba-4e90-8343-a7a0dc2bf305@tls.msk.ru/
    * Fixes:
    bsc#1229007, CVE-2024-7409
    bsc#1224132, CVE-2024-4693
    * Some backports:
    gitlab: fix logic for changing docker tag on stable branches
    ui/sdl2: set swap interval explicitly when OpenGL is enabled
    hw/intc/arm_gic: fix spurious level triggered interrupts
    hw/audio/virtio-sound: fix heap buffer overflow
    tests/docker: update debian i686 and mipsel images to bookworm
    tests/docker: remove debian-armel-cross
    hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
    crypto: check gnutls & gcrypt support the requested pbkdf hash
    crypto: run qcrypto_pbkdf2_count_iters in a new thread
    softmmu/physmem: fix memory leak in dirty_memory_extend()
    target/ppc: Fix migration of CPUs with TLB_EMB TLB type
    gitlab: migrate the s390x custom machine to 22.04
    target/hppa: Fix PSW V-bit packaging in cpu_hppa_get for hppa64
    hw/audio/virtio-snd: fix invalid param check
    virtio-pci: Fix the use of an uninitialized irqfd

++++ qemu:

  - Update version to 8.2.7
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/d9ff276f-f1ba-4e90-8343-a7a0dc2bf305@tls.msk.ru/
    * Fixes:
    bsc#1229007, CVE-2024-7409
    bsc#1224132, CVE-2024-4693
    * Some backports:
    gitlab: fix logic for changing docker tag on stable branches
    ui/sdl2: set swap interval explicitly when OpenGL is enabled
    hw/intc/arm_gic: fix spurious level triggered interrupts
    hw/audio/virtio-sound: fix heap buffer overflow
    tests/docker: update debian i686 and mipsel images to bookworm
    tests/docker: remove debian-armel-cross
    hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
    crypto: check gnutls & gcrypt support the requested pbkdf hash
    crypto: run qcrypto_pbkdf2_count_iters in a new thread
    softmmu/physmem: fix memory leak in dirty_memory_extend()
    target/ppc: Fix migration of CPUs with TLB_EMB TLB type
    gitlab: migrate the s390x custom machine to 22.04
    target/hppa: Fix PSW V-bit packaging in cpu_hppa_get for hppa64
    hw/audio/virtio-snd: fix invalid param check
    virtio-pci: Fix the use of an uninitialized irqfd

++++ qemu:

  - Update version to 8.2.7
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/d9ff276f-f1ba-4e90-8343-a7a0dc2bf305@tls.msk.ru/
    * Fixes:
    bsc#1229007, CVE-2024-7409
    bsc#1224132, CVE-2024-4693
    * Some backports:
    gitlab: fix logic for changing docker tag on stable branches
    ui/sdl2: set swap interval explicitly when OpenGL is enabled
    hw/intc/arm_gic: fix spurious level triggered interrupts
    hw/audio/virtio-sound: fix heap buffer overflow
    tests/docker: update debian i686 and mipsel images to bookworm
    tests/docker: remove debian-armel-cross
    hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
    crypto: check gnutls & gcrypt support the requested pbkdf hash
    crypto: run qcrypto_pbkdf2_count_iters in a new thread
    softmmu/physmem: fix memory leak in dirty_memory_extend()
    target/ppc: Fix migration of CPUs with TLB_EMB TLB type
    gitlab: migrate the s390x custom machine to 22.04
    target/hppa: Fix PSW V-bit packaging in cpu_hppa_get for hppa64
    hw/audio/virtio-snd: fix invalid param check
    virtio-pci: Fix the use of an uninitialized irqfd

++++ qemu:

  - Update version to 8.2.7
    * Full changelog here:
    https://lore.kernel.org/qemu-devel/d9ff276f-f1ba-4e90-8343-a7a0dc2bf305@tls.msk.ru/
    * Fixes:
    bsc#1229007, CVE-2024-7409
    bsc#1224132, CVE-2024-4693
    * Some backports:
    gitlab: fix logic for changing docker tag on stable branches
    ui/sdl2: set swap interval explicitly when OpenGL is enabled
    hw/intc/arm_gic: fix spurious level triggered interrupts
    hw/audio/virtio-sound: fix heap buffer overflow
    tests/docker: update debian i686 and mipsel images to bookworm
    tests/docker: remove debian-armel-cross
    hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
    crypto: check gnutls & gcrypt support the requested pbkdf hash
    crypto: run qcrypto_pbkdf2_count_iters in a new thread
    softmmu/physmem: fix memory leak in dirty_memory_extend()
    target/ppc: Fix migration of CPUs with TLB_EMB TLB type
    gitlab: migrate the s390x custom machine to 22.04
    target/hppa: Fix PSW V-bit packaging in cpu_hppa_get for hppa64
    hw/audio/virtio-snd: fix invalid param check
    virtio-pci: Fix the use of an uninitialized irqfd

------------------------------------------------------------------
------------------  2024-10-14  -  Oct 14 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add new containers section
    Allow to specify references to OCI containers in the
    image description like in the following example:
    <containers source="registry.suse.com" backend="podman">
    <container name="some" tag="some" path="/some/path"/>
    </containers>
    During the kiwi process the containers are fetched into a
    temporary location and a systemd service is configured to
    one time load the containers into the local registry at
    first boot of the system. This Fixes #2663

++++ kernel-firmware:

  - Update to version 20241011 (git commit 808cba847c70):
    * mtk_wed: add firmware for mt7988 Wireless Ethernet Dispatcher
    * ath12k: WCN7850 hw2.0: update board-2.bin (bsc#1230596)
    * ath12k: QCN9274 hw2.0: add to WLAN.WBE.1.3.1-00162-QCAHKSWPL_SILICONZ-1
    * ath12k: QCN9274 hw2.0: add board-2.bin
    * copy-firmware.sh: rename variables in symlink hanlding
    * copy-firmware.sh: remove no longer reachable test -L
    * copy-firmware.sh: remove no longer reachable test -f
    * copy-firmware.sh: call ./check_whence.py before parsing the file
    * copy-firmware.sh: warn if the destination folder is not empty
    * copy-firmware.sh: add err() helper
    * copy-firmware.sh: fix indentation
    * copy-firmware.sh: reset and consistently handle destdir
    * Revert "copy-firmware: Support additional compressor options"
    * copy-firmware.sh: flesh out and fix dedup-firmware.sh
    * Style update yaml files
    * editorconfig: add initial config file
    * check_whence.py: annotate replacement strings as raw
    * check_whence.py: LC_ALL=C sort -u the filelist
    * check_whence.py: ban link-to-a-link
    * check_whence.py: use consistent naming
    * Add a link from TAS2XXX1EB3.bin -> ti/tas2781/TAS2XXX1EB30.bin
    * tas2781: Upload dsp firmware for ASUS laptop 1EB30 & 1EB31
  - Skip invocation of check_whence.py at copying:
    copy-file-skip-check.patch
  - Refresh copy-file-ignore-README.patch
  - Drop obsoleted --ignore-duplicates option to copy-firmware.sh
  - Drop the ath12k workaround again

++++ kernel-firmware:

  - Update to version 20241011 (git commit 808cba847c70):
    * mtk_wed: add firmware for mt7988 Wireless Ethernet Dispatcher
    * ath12k: WCN7850 hw2.0: update board-2.bin (bsc#1230596)
    * ath12k: QCN9274 hw2.0: add to WLAN.WBE.1.3.1-00162-QCAHKSWPL_SILICONZ-1
    * ath12k: QCN9274 hw2.0: add board-2.bin
    * copy-firmware.sh: rename variables in symlink hanlding
    * copy-firmware.sh: remove no longer reachable test -L
    * copy-firmware.sh: remove no longer reachable test -f
    * copy-firmware.sh: call ./check_whence.py before parsing the file
    * copy-firmware.sh: warn if the destination folder is not empty
    * copy-firmware.sh: add err() helper
    * copy-firmware.sh: fix indentation
    * copy-firmware.sh: reset and consistently handle destdir
    * Revert "copy-firmware: Support additional compressor options"
    * copy-firmware.sh: flesh out and fix dedup-firmware.sh
    * Style update yaml files
    * editorconfig: add initial config file
    * check_whence.py: annotate replacement strings as raw
    * check_whence.py: LC_ALL=C sort -u the filelist
    * check_whence.py: ban link-to-a-link
    * check_whence.py: use consistent naming
    * Add a link from TAS2XXX1EB3.bin -> ti/tas2781/TAS2XXX1EB30.bin
    * tas2781: Upload dsp firmware for ASUS laptop 1EB30 & 1EB31
  - Skip invocation of check_whence.py at copying:
    copy-file-skip-check.patch
  - Refresh copy-file-ignore-README.patch
  - Drop obsoleted --ignore-duplicates option to copy-firmware.sh
  - Drop the ath12k workaround again

------------------------------------------------------------------
------------------  2024-10-10  -  Oct 10 2024  -------------------
------------------------------------------------------------------

++++ kernel-firmware:

  - Update to version 20241010 (git commit d4e688aa74a0):
    * rtlwifi: Add firmware v39.0 for RTL8192DU
    * Revert "ath12k: WCN7850 hw2.0: update board-2.bin"
    (replaced with a newer firmware in this package instead)
  - update aliases

++++ kernel-firmware:

  - Update to version 20241010 (git commit d4e688aa74a0):
    * rtlwifi: Add firmware v39.0 for RTL8192DU
    * Revert "ath12k: WCN7850 hw2.0: update board-2.bin"
    (replaced with a newer firmware in this package instead)
  - update aliases

------------------------------------------------------------------
------------------  2024-10-9  -  Oct 9 2024  -------------------
------------------------------------------------------------------

++++ git:

  - update to 2.47.0:
    * https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.47.0.txt
    * Many Porcelain commands that internally use the merge machinery
    were taught to consistently honor the diff.algorithm
    configuration.
    * A few descriptions in "git show-ref -h" have been clarified.
    * A 'P' command to "git add -p" that passes the patch hunk to the
    pager has been added.
    * "git grep -W" omits blank lines that follow the found function at
    the end of the file, just like it omits blank lines before the next
    function.
    * The value of http.proxy can have "path" at the end for a socks
    proxy that listens to a unix-domain socket, but we started to
    discard it when we taught proxy auth code path to use the
    credential helpers, which has been corrected.
    * The code paths to compact multiple reftable files have been updated
    to correctly deal with multiple compaction triggering at the same
    time.
    * Support to specify ref backend for submodules has been enhanced.
    * "git svn" has been taught about svn:global-ignores property
    recent versions of Subversion has.
    * The default object hash and ref backend format used to be settable
    only with explicit command line option to "git init" and
    environment variables, but now they can be configured in the user's
    global and system wide configuration.
    * "git send-email" learned "--translate-aliases" option that reads
    addresses from the standard input and emits the result of applying
    aliases on them to the standard output.
    * 'git for-each-ref' learned a new "--format" atom to find the branch
    that the history leading to a given commit "%(is-base:<commit>)" is
    likely based on.
    * The command line prompt support used to be littered with bash-isms,
    which has been corrected to work with more shells.
    * Support for the RUNTIME_PREFIX feature has been added to z/OS port.
    * "git send-email" learned "--mailmap" option to allow rewriting the
    recipient addresses.
    * "git mergetool" learned to use VSCode as a merge backend.
    * "git pack-redundant" has been marked for removal in Git 3.0.
    * One-line messages to "die" and other helper functions will get LF
    added by these helper functions, but many existing messages had an
    unnecessary LF at the end, which have been corrected.
    * The "scalar clone" command learned the "--no-tags" option.
    * The environment GIT_ADVICE has been intentionally kept undocumented
    to discourage its use by interactive users.  Add documentation to
    help tool writers.
    * "git apply --3way" learned to take "--ours" and other options.

++++ libzypp:

  - PluginFrame: Send unescaped colons in header values
    (bsc#1231043)
    According to the STOMP protocol it would be correct to escape a
    colon in a header-value, but it breaks plugin receivers which do
    not expect this. The first colon separates header-name from
    header-value, so escaping in the header-value is not needed
    anyway.
    Escaping in the header-value affects especially the urlresolver
    plugins. The input URL is passed in a header, but sent back as
    raw data in the frames body. If the plugin receiver does not
    correctly unescape the URL we may get back a "https\c//" which is
    not usable.
  - Do not ignore return value of std::remove_if in MediaSyncFacade
    (fixes #579)
  - Fix hang in curl code with no network connection (bsc#1230912)
  - version 17.35.12 (35)

++++ libzypp:

  - PluginFrame: Send unescaped colons in header values
    (bsc#1231043)
    According to the STOMP protocol it would be correct to escape a
    colon in a header-value, but it breaks plugin receivers which do
    not expect this. The first colon separates header-name from
    header-value, so escaping in the header-value is not needed
    anyway.
    Escaping in the header-value affects especially the urlresolver
    plugins. The input URL is passed in a header, but sent back as
    raw data in the frames body. If the plugin receiver does not
    correctly unescape the URL we may get back a "https\c//" which is
    not usable.
  - Do not ignore return value of std::remove_if in MediaSyncFacade
    (fixes #579)
  - Fix hang in curl code with no network connection (bsc#1230912)
  - version 17.35.12 (35)

++++ libzypp:

  - PluginFrame: Send unescaped colons in header values
    (bsc#1231043)
    According to the STOMP protocol it would be correct to escape a
    colon in a header-value, but it breaks plugin receivers which do
    not expect this. The first colon separates header-name from
    header-value, so escaping in the header-value is not needed
    anyway.
    Escaping in the header-value affects especially the urlresolver
    plugins. The input URL is passed in a header, but sent back as
    raw data in the frames body. If the plugin receiver does not
    correctly unescape the URL we may get back a "https\c//" which is
    not usable.
  - Do not ignore return value of std::remove_if in MediaSyncFacade
    (fixes #579)
  - Fix hang in curl code with no network connection (bsc#1230912)
  - version 17.35.12 (35)

++++ libzypp:

  - PluginFrame: Send unescaped colons in header values
    (bsc#1231043)
    According to the STOMP protocol it would be correct to escape a
    colon in a header-value, but it breaks plugin receivers which do
    not expect this. The first colon separates header-name from
    header-value, so escaping in the header-value is not needed
    anyway.
    Escaping in the header-value affects especially the urlresolver
    plugins. The input URL is passed in a header, but sent back as
    raw data in the frames body. If the plugin receiver does not
    correctly unescape the URL we may get back a "https\c//" which is
    not usable.
  - Do not ignore return value of std::remove_if in MediaSyncFacade
    (fixes #579)
  - Fix hang in curl code with no network connection (bsc#1230912)
  - version 17.35.12 (35)

++++ libzypp:

  - PluginFrame: Send unescaped colons in header values
    (bsc#1231043)
    According to the STOMP protocol it would be correct to escape a
    colon in a header-value, but it breaks plugin receivers which do
    not expect this. The first colon separates header-name from
    header-value, so escaping in the header-value is not needed
    anyway.
    Escaping in the header-value affects especially the urlresolver
    plugins. The input URL is passed in a header, but sent back as
    raw data in the frames body. If the plugin receiver does not
    correctly unescape the URL we may get back a "https\c//" which is
    not usable.
  - Do not ignore return value of std::remove_if in MediaSyncFacade
    (fixes #579)
  - Fix hang in curl code with no network connection (bsc#1230912)
  - version 17.35.12 (35)

------------------------------------------------------------------
------------------  2024-10-8  -  Oct 8 2024  -------------------
------------------------------------------------------------------

++++ kernel-firmware:

  - Update to version 20241004 (git commit bbb77872a8a7):
    * amdgpu: DMCUB DCN35 update
    * brcm: Add BCM4354 NVRAM for Jetson TX1
    * brcm: Link FriendlyElec NanoPi M4 to AP6356S nvram

++++ kernel-firmware:

  - Update to version 20241004 (git commit bbb77872a8a7):
    * amdgpu: DMCUB DCN35 update
    * brcm: Add BCM4354 NVRAM for Jetson TX1
    * brcm: Link FriendlyElec NanoPi M4 to AP6356S nvram

------------------------------------------------------------------
------------------  2024-10-7  -  Oct 7 2024  -------------------
------------------------------------------------------------------

++++ git:

  - Update to version 2.46.2:
    * Revert the "git patch-id" change that went into 2.46.1,
    as it seems to have got a regression reported (I haven't verified,
    but it is better to keep a known breakage than adding an unintended
    regression).
    * In a few corner cases "git diff --exit-code" failed to report
    "changes" (e.g., renamed without any content change), which has
    been corrected.
    * The interpret-trailers command failed to recognise the end of the
    message when the commit log ends in an incomplete line.

++++ unbound:

  - Update to 1.21.1:
    Security Fixes:
    * Fix CVE-2024-8508, unbounded name compression could lead to
    denial of service.
    [CVE-2024-8508, bsc#1231284]
  - Update keyring

++++ unbound:

  - Update to 1.21.1:
    Security Fixes:
    * Fix CVE-2024-8508, unbounded name compression could lead to
    denial of service.
    [CVE-2024-8508, bsc#1231284]
  - Update keyring

------------------------------------------------------------------
------------------  2024-10-4  -  Oct 4 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.1.13 → 10.1.14
  - Revert "Install usrmerge for Debian integration test"
    This reverts commit 95ac861741f14c4f35611c16328384c18e53dcfb.
    Solution needs to be provided in code
  - Install usrmerge for Debian integration test

++++ python-kiwi:

  - Bump version: 10.1.13 → 10.1.14
  - Revert "Install usrmerge for Debian integration test"
    This reverts commit 95ac861741f14c4f35611c16328384c18e53dcfb.
    Solution needs to be provided in code
  - Install usrmerge for Debian integration test

++++ python-kiwi:

  - Bump version: 10.1.13 → 10.1.14
  - Revert "Install usrmerge for Debian integration test"
    This reverts commit 95ac861741f14c4f35611c16328384c18e53dcfb.
    Solution needs to be provided in code
  - Install usrmerge for Debian integration test

------------------------------------------------------------------
------------------  2024-10-3  -  Oct 3 2024  -------------------
------------------------------------------------------------------

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

++++ podman:

  - Add patch for CVE-2024-9341 (bsc#1231230):
    * 0002-pkg-subscriptions-use-securejoin-for-the-container-p.patch
  - Rebase patch:
    * 0001-Backport-fix-for-CVE-2024-6104.patch

------------------------------------------------------------------
------------------  2024-10-2  -  Oct 2 2024  -------------------
------------------------------------------------------------------

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311-core:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ systemd:

  - Clean up some remnants from when homed was in the experimental sub-package (bsc#1231048)

++++ systemd:

  - Clean up some remnants from when homed was in the experimental sub-package (bsc#1231048)

++++ systemd:

  - Clean up some remnants from when homed was in the experimental sub-package (bsc#1231048)

++++ systemd:

  - Clean up some remnants from when homed was in the experimental sub-package (bsc#1231048)

++++ systemd:

  - Clean up some remnants from when homed was in the experimental sub-package (bsc#1231048)

++++ systemd:

  - Clean up some remnants from when homed was in the experimental sub-package (bsc#1231048)

++++ salt:

  - Fix failing x509 tests with OpenSSL < 1.1
  - Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  - Allow NamedLoaderContexts to be returned from loader
  - Revert the change making reactor less blocking (bsc#1230322)
  - Use --cachedir for extension_modules in salt-call (bsc#1226141)
  - Prevent using SyncWrapper with no reason
  - Fix the SELinux context for Salt Minion service (bsc#1219041)
  - Set contextvars as a build requirement for package
  - Increase warn_until_date date for code we still support
  - The test_debian test now uses port 80 for ubuntu keyserver
  - Fix too frequent systemd service restart in test_system test
  - Avoid crash on wrong output of systemctl version (bsc#1229539)
  - Improve error handling with different OpenSSL versions
  - Remove redundant run_func from salt.master.MWorker._handle_aes
  - Fix cloud minion configuration for multiple masters (bsc#1229109)
  - Use Pygit2 id instead of deprecated oid in gitfs
  - Fix few failing tests to work with both Salt and Salt bundle
  - Skip testing unsupported OpenSSL crypto algorithms
  - Added:
    * fix-x509-test-fails-on-old-openssl-systems-682.patch
    * make-tests-compatible-with-venv-bundle.patch
    * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch
    * fix-test_system-flaky-setup_teardown-fn.patch
    * fix-deprecated-code-677.patch
    * join-masters-if-it-is-a-list-671.patch
    * fix-test_debian-to-work-in-our-infrastructure-676.patch
    * skip-more-tests-related-to-old-openssl-algorithms.patch
    * remove-redundant-run_func-from-salt.master.mworker._.patch
    * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch
    * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch
    * allow-namedloadercontexts-to-be-returned-from-loader.patch
    * fix-the-selinux-context-for-salt-minion-service-bsc-.patch
    * improve-error-handling-with-different-openssl-versio.patch
    * prevent-using-syncwrapper-with-no-reason.patch
    * revert-the-change-making-reactor-less-blocking-bsc-1.patch
    * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ python311:

  - Drop .pyc files from docdir for reproducible builds
    (bsc#1230906).

++++ salt:

  - Fix failing x509 tests with OpenSSL < 1.1
  - Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  - Allow NamedLoaderContexts to be returned from loader
  - Revert the change making reactor less blocking (bsc#1230322)
  - Use --cachedir for extension_modules in salt-call (bsc#1226141)
  - Prevent using SyncWrapper with no reason
  - Fix the SELinux context for Salt Minion service (bsc#1219041)
  - Set contextvars as a build requirement for package
  - Increase warn_until_date date for code we still support
  - The test_debian test now uses port 80 for ubuntu keyserver
  - Fix too frequent systemd service restart in test_system test
  - Avoid crash on wrong output of systemctl version (bsc#1229539)
  - Improve error handling with different OpenSSL versions
  - Remove redundant run_func from salt.master.MWorker._handle_aes
  - Fix cloud minion configuration for multiple masters (bsc#1229109)
  - Use Pygit2 id instead of deprecated oid in gitfs
  - Fix few failing tests to work with both Salt and Salt bundle
  - Skip testing unsupported OpenSSL crypto algorithms
  - Added:
    * fix-x509-test-fails-on-old-openssl-systems-682.patch
    * make-tests-compatible-with-venv-bundle.patch
    * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch
    * fix-test_system-flaky-setup_teardown-fn.patch
    * fix-deprecated-code-677.patch
    * join-masters-if-it-is-a-list-671.patch
    * fix-test_debian-to-work-in-our-infrastructure-676.patch
    * skip-more-tests-related-to-old-openssl-algorithms.patch
    * remove-redundant-run_func-from-salt.master.mworker._.patch
    * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch
    * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch
    * allow-namedloadercontexts-to-be-returned-from-loader.patch
    * fix-the-selinux-context-for-salt-minion-service-bsc-.patch
    * improve-error-handling-with-different-openssl-versio.patch
    * prevent-using-syncwrapper-with-no-reason.patch
    * revert-the-change-making-reactor-less-blocking-bsc-1.patch
    * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch

++++ salt:

  - Fix failing x509 tests with OpenSSL < 1.1
  - Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  - Allow NamedLoaderContexts to be returned from loader
  - Revert the change making reactor less blocking (bsc#1230322)
  - Use --cachedir for extension_modules in salt-call (bsc#1226141)
  - Prevent using SyncWrapper with no reason
  - Fix the SELinux context for Salt Minion service (bsc#1219041)
  - Set contextvars as a build requirement for package
  - Increase warn_until_date date for code we still support
  - The test_debian test now uses port 80 for ubuntu keyserver
  - Fix too frequent systemd service restart in test_system test
  - Avoid crash on wrong output of systemctl version (bsc#1229539)
  - Improve error handling with different OpenSSL versions
  - Remove redundant run_func from salt.master.MWorker._handle_aes
  - Fix cloud minion configuration for multiple masters (bsc#1229109)
  - Use Pygit2 id instead of deprecated oid in gitfs
  - Fix few failing tests to work with both Salt and Salt bundle
  - Skip testing unsupported OpenSSL crypto algorithms
  - Added:
    * fix-x509-test-fails-on-old-openssl-systems-682.patch
    * make-tests-compatible-with-venv-bundle.patch
    * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch
    * fix-test_system-flaky-setup_teardown-fn.patch
    * fix-deprecated-code-677.patch
    * join-masters-if-it-is-a-list-671.patch
    * fix-test_debian-to-work-in-our-infrastructure-676.patch
    * skip-more-tests-related-to-old-openssl-algorithms.patch
    * remove-redundant-run_func-from-salt.master.mworker._.patch
    * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch
    * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch
    * allow-namedloadercontexts-to-be-returned-from-loader.patch
    * fix-the-selinux-context-for-salt-minion-service-bsc-.patch
    * improve-error-handling-with-different-openssl-versio.patch
    * prevent-using-syncwrapper-with-no-reason.patch
    * revert-the-change-making-reactor-less-blocking-bsc-1.patch
    * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch

++++ salt:

  - Fix failing x509 tests with OpenSSL < 1.1
  - Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  - Allow NamedLoaderContexts to be returned from loader
  - Revert the change making reactor less blocking (bsc#1230322)
  - Use --cachedir for extension_modules in salt-call (bsc#1226141)
  - Prevent using SyncWrapper with no reason
  - Fix the SELinux context for Salt Minion service (bsc#1219041)
  - Set contextvars as a build requirement for package
  - Increase warn_until_date date for code we still support
  - The test_debian test now uses port 80 for ubuntu keyserver
  - Fix too frequent systemd service restart in test_system test
  - Avoid crash on wrong output of systemctl version (bsc#1229539)
  - Improve error handling with different OpenSSL versions
  - Remove redundant run_func from salt.master.MWorker._handle_aes
  - Fix cloud minion configuration for multiple masters (bsc#1229109)
  - Use Pygit2 id instead of deprecated oid in gitfs
  - Fix few failing tests to work with both Salt and Salt bundle
  - Skip testing unsupported OpenSSL crypto algorithms
  - Added:
    * fix-x509-test-fails-on-old-openssl-systems-682.patch
    * make-tests-compatible-with-venv-bundle.patch
    * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch
    * fix-test_system-flaky-setup_teardown-fn.patch
    * fix-deprecated-code-677.patch
    * join-masters-if-it-is-a-list-671.patch
    * fix-test_debian-to-work-in-our-infrastructure-676.patch
    * skip-more-tests-related-to-old-openssl-algorithms.patch
    * remove-redundant-run_func-from-salt.master.mworker._.patch
    * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch
    * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch
    * allow-namedloadercontexts-to-be-returned-from-loader.patch
    * fix-the-selinux-context-for-salt-minion-service-bsc-.patch
    * improve-error-handling-with-different-openssl-versio.patch
    * prevent-using-syncwrapper-with-no-reason.patch
    * revert-the-change-making-reactor-less-blocking-bsc-1.patch
    * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch

++++ salt:

  - Fix failing x509 tests with OpenSSL < 1.1
  - Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  - Allow NamedLoaderContexts to be returned from loader
  - Revert the change making reactor less blocking (bsc#1230322)
  - Use --cachedir for extension_modules in salt-call (bsc#1226141)
  - Prevent using SyncWrapper with no reason
  - Fix the SELinux context for Salt Minion service (bsc#1219041)
  - Set contextvars as a build requirement for package
  - Increase warn_until_date date for code we still support
  - The test_debian test now uses port 80 for ubuntu keyserver
  - Fix too frequent systemd service restart in test_system test
  - Avoid crash on wrong output of systemctl version (bsc#1229539)
  - Improve error handling with different OpenSSL versions
  - Remove redundant run_func from salt.master.MWorker._handle_aes
  - Fix cloud minion configuration for multiple masters (bsc#1229109)
  - Use Pygit2 id instead of deprecated oid in gitfs
  - Fix few failing tests to work with both Salt and Salt bundle
  - Skip testing unsupported OpenSSL crypto algorithms
  - Added:
    * fix-x509-test-fails-on-old-openssl-systems-682.patch
    * make-tests-compatible-with-venv-bundle.patch
    * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch
    * fix-test_system-flaky-setup_teardown-fn.patch
    * fix-deprecated-code-677.patch
    * join-masters-if-it-is-a-list-671.patch
    * fix-test_debian-to-work-in-our-infrastructure-676.patch
    * skip-more-tests-related-to-old-openssl-algorithms.patch
    * remove-redundant-run_func-from-salt.master.mworker._.patch
    * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch
    * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch
    * allow-namedloadercontexts-to-be-returned-from-loader.patch
    * fix-the-selinux-context-for-salt-minion-service-bsc-.patch
    * improve-error-handling-with-different-openssl-versio.patch
    * prevent-using-syncwrapper-with-no-reason.patch
    * revert-the-change-making-reactor-less-blocking-bsc-1.patch
    * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch

++++ salt:

  - Fix failing x509 tests with OpenSSL < 1.1
  - Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  - Allow NamedLoaderContexts to be returned from loader
  - Revert the change making reactor less blocking (bsc#1230322)
  - Use --cachedir for extension_modules in salt-call (bsc#1226141)
  - Prevent using SyncWrapper with no reason
  - Fix the SELinux context for Salt Minion service (bsc#1219041)
  - Set contextvars as a build requirement for package
  - Increase warn_until_date date for code we still support
  - The test_debian test now uses port 80 for ubuntu keyserver
  - Fix too frequent systemd service restart in test_system test
  - Avoid crash on wrong output of systemctl version (bsc#1229539)
  - Improve error handling with different OpenSSL versions
  - Remove redundant run_func from salt.master.MWorker._handle_aes
  - Fix cloud minion configuration for multiple masters (bsc#1229109)
  - Use Pygit2 id instead of deprecated oid in gitfs
  - Fix few failing tests to work with both Salt and Salt bundle
  - Skip testing unsupported OpenSSL crypto algorithms
  - Added:
    * fix-x509-test-fails-on-old-openssl-systems-682.patch
    * make-tests-compatible-with-venv-bundle.patch
    * use-cachedir-for-extension_modules-in-salt-call-bsc-.patch
    * fix-test_system-flaky-setup_teardown-fn.patch
    * fix-deprecated-code-677.patch
    * join-masters-if-it-is-a-list-671.patch
    * fix-test_debian-to-work-in-our-infrastructure-676.patch
    * skip-more-tests-related-to-old-openssl-algorithms.patch
    * remove-redundant-run_func-from-salt.master.mworker._.patch
    * avoid-explicit-reading-of-etc-salt-minion-bsc-122035.patch
    * avoid-crash-on-wrong-output-of-systemctl-version-bsc.patch
    * allow-namedloadercontexts-to-be-returned-from-loader.patch
    * fix-the-selinux-context-for-salt-minion-service-bsc-.patch
    * improve-error-handling-with-different-openssl-versio.patch
    * prevent-using-syncwrapper-with-no-reason.patch
    * revert-the-change-making-reactor-less-blocking-bsc-1.patch
    * replace-use-of-pygit2-deprecated-and-removed-1.15.0-.patch

------------------------------------------------------------------
------------------  2024-10-1  -  Oct 1 2024  -------------------
------------------------------------------------------------------

++++ Mesa:

  - u_mesa-CVE-2023-45913.patch
    * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
  - u_mesa-CVE-2023-45919.patch
    * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
  - u_mesa-CVE-2023-45922.patch
    * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)

++++ Mesa:

  - u_mesa-CVE-2023-45913.patch
    * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
  - u_mesa-CVE-2023-45919.patch
    * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
  - u_mesa-CVE-2023-45922.patch
    * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)
  - u_mesa-CVE-2023-45913.patch
    * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
  - u_mesa-CVE-2023-45919.patch
    * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
  - u_mesa-CVE-2023-45922.patch
    * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)

++++ Mesa-drivers:

  - u_mesa-CVE-2023-45913.patch
    * NULL pointer dereference via dri2GetGlxDrawableFromXDrawableId()
    (CVE-2023-45913, bsc#1222040)
  - u_mesa-CVE-2023-45919.patch
    * buffer over-read in glXQueryServerString()
    (CVE-2023-45919, bsc#1222041)
  - u_mesa-CVE-2023-45922.patch
    * segmentation violation in __glXGetDrawableAttribute()
    (CVE-2023-45922, bsc#1222042)

++++ kernel-default:

  - ACPICA: executer/exsystem: Don't nag user about every Stall()
    violating the spec (git-fixes).
  - ACPICA: Implement ACPI_WARNING_ONCE and ACPI_ERROR_ONCE
    (stable-fixes).
  - commit f94e799
  - cachefiles: fix dentry leak in cachefiles_open_file()
    (bsc#1231183).
  - ceph: remove the incorrect Fw reference check when dirtying
    pages (bsc#1231182).
  - commit ba82da7
  - can: mcp251xfd: move mcp251xfd_timestamp_start()/stop() into
    mcp251xfd_chip_start/stop() (stable-fixes).
  - Refresh
    patches.suse/can-mcp251xfd-clarify-the-meaning-of-timestamp.patch.
  - commit 6779985
  - USB: serial: pl2303: add device id for Macrosilicon MS3020
    (stable-fixes).
  - powercap/intel_rapl: Add support for AMD family 1Ah
    (stable-fixes).
  - ASoC: amd: yc: Add a quirk for MSI Bravo 17 (D7VEK)
    (stable-fixes).
  - ASoC: tda7419: fix module autoloading (stable-fixes).
  - ASoC: intel: fix module autoloading (stable-fixes).
  - ASoC: Intel: soc-acpi-cht: Make Lenovo Yoga Tab 3 X90F DMI
    match less strict (stable-fixes).
  - ALSA: hda: add HDMI codec ID for Intel PTL (stable-fixes).
  - drm: komeda: Fix an issue related to normalized zpos
    (stable-fixes).
  - can: mcp251xfd: mcp251xfd_ring_init(): check TX-coalescing
    configuration (stable-fixes).
  - spi: spidev: Add missing spi_device_id for jg10309-01
    (git-fixes).
  - spi: bcm63xx: Enable module autoloading (stable-fixes).
  - spi: spidev: Add an entry for elgin,jg10309-01 (stable-fixes).
  - hwmon: (asus-ec-sensors) remove VRM temp X570-E GAMING
    (stable-fixes).
  - wifi: iwlwifi: clear trans->state earlier upon error
    (stable-fixes).
  - wifi: mac80211: free skb on error path in
    ieee80211_beacon_get_ap() (stable-fixes).
  - wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
    (stable-fixes).
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped
    (stable-fixes).
  - wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
    (stable-fixes).
  - wifi: iwlwifi: mvm: fix iwl_mvm_scan_fits() calculation
    (stable-fixes).
  - wifi: iwlwifi: lower message level for FW buffer destination
    (stable-fixes).
  - platform/x86: x86-android-tablets: Make Lenovo Yoga Tab 3 X90F
    DMI match less strict (stable-fixes).
  - pinctrl: at91: make it work with current gpiolib (stable-fixes).
  - can: mcp251xfd: properly indent labels (stable-fixes).
  - commit a530f31

++++ kernel-firmware:

  - Update to version 20241001 (git commit 51e5af813eaf):
    * linux-firmware: add firmware for MediaTek Bluetooth chip (MT7920)
    * linux-firmware: add firmware for MT7920
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update VCN 3.1.2 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update PSP 13.0.8 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update PSP 14.0.4 firmware
    * amdgpu: update GC 11.5.2 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VCN 4.0.6 firmware
    * amdgpu: update PSP 14.0.1 firmware
    * amdgpu: update GC 11.5.1 firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update SMU 13.0.6 firmware
    * amdgpu: update SDMA 4.4.2 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update aldebaran firmware
    * qcom: update gpu firmwares for qcm6490 chipset
    * mt76: mt7996: add firmware files for mt7992 chipset
    * mt76: mt7996: add firmware files for mt7996 chipset variants
    * qcom: add gpu firmwares for sa8775p chipset
    * rtw89: 8922a: add fw format-2 v0.35.42.1
  - Pick up the fixed ath12k firmware from
    https://git.codelinaro.org/clo/ath-firmware/ath12k-firmware
    (bsc#1230596)
  - Update aliases from 6.11.x and 6.12-rc1

++++ kernel-firmware:

  - Update to version 20241001 (git commit 51e5af813eaf):
    * linux-firmware: add firmware for MediaTek Bluetooth chip (MT7920)
    * linux-firmware: add firmware for MT7920
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update VCN 3.1.2 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update PSP 13.0.8 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update PSP 14.0.4 firmware
    * amdgpu: update GC 11.5.2 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VCN 4.0.6 firmware
    * amdgpu: update PSP 14.0.1 firmware
    * amdgpu: update GC 11.5.1 firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update SMU 13.0.6 firmware
    * amdgpu: update SDMA 4.4.2 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update aldebaran firmware
    * qcom: update gpu firmwares for qcm6490 chipset
    * mt76: mt7996: add firmware files for mt7992 chipset
    * mt76: mt7996: add firmware files for mt7996 chipset variants
    * qcom: add gpu firmwares for sa8775p chipset
    * rtw89: 8922a: add fw format-2 v0.35.42.1
  - Pick up the fixed ath12k firmware from
    https://git.codelinaro.org/clo/ath-firmware/ath12k-firmware
    (bsc#1230596)
  - Update aliases from 6.11.x and 6.12-rc1

++++ opensc:

  - - Security fix: [CVE-2024-8443, bsc#1230364]
    * opensc: heap buffer overflow in OpenPGP driver when generating key
    * Added patch: opensc-CVE-2024-8443.patch
  - Security fix: [opensc-CVE-2024-45620, bsc#1230076]
  - Security fix: [opensc-CVE-2024-45619, bsc#1230075]
  - Security fix: [opensc-CVE-2024-45618, bsc#1230074]
  - Security fix: [opensc-CVE-2024-45617, bsc#1230073]
  - Security fix: [opensc-CVE-2024-45616, bsc#1230072]
  - Security fix: [opensc-CVE-2024-45615, bsc#1230071]
    * opensc: pkcs15init: Usage of uninitialized values in libopensc and pkcs15init
    * opensc: Uninitialized values after incorrect check or usage of APDU response values in libopensc
    * opensc: Uninitialized values after incorrect or missing checking return values of functions in libopensc
    * opensc: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init
    * opensc: Incorrect handling length of buffers or files in libopensc
    * opensc: Incorrect handling of the length of buffers or files in pkcs15init
    * Added patches:
  - opensc-CVE-2024-45615.patch
  - opensc-CVE-2024-45616.patch
  - opensc-CVE-2024-45617.patch
  - opensc-CVE-2024-45618.patch
  - opensc-CVE-2024-45619.patch
  - opensc-CVE-2024-45620.patch

++++ opensc:

  - - Security fix: [CVE-2024-8443, bsc#1230364]
    * opensc: heap buffer overflow in OpenPGP driver when generating key
    * Added patch: opensc-CVE-2024-8443.patch
  - Security fix: [opensc-CVE-2024-45620, bsc#1230076]
  - Security fix: [opensc-CVE-2024-45619, bsc#1230075]
  - Security fix: [opensc-CVE-2024-45618, bsc#1230074]
  - Security fix: [opensc-CVE-2024-45617, bsc#1230073]
  - Security fix: [opensc-CVE-2024-45616, bsc#1230072]
  - Security fix: [opensc-CVE-2024-45615, bsc#1230071]
    * opensc: pkcs15init: Usage of uninitialized values in libopensc and pkcs15init
    * opensc: Uninitialized values after incorrect check or usage of APDU response values in libopensc
    * opensc: Uninitialized values after incorrect or missing checking return values of functions in libopensc
    * opensc: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init
    * opensc: Incorrect handling length of buffers or files in libopensc
    * opensc: Incorrect handling of the length of buffers or files in pkcs15init
    * Added patches:
  - opensc-CVE-2024-45615.patch
  - opensc-CVE-2024-45616.patch
  - opensc-CVE-2024-45617.patch
  - opensc-CVE-2024-45618.patch
  - opensc-CVE-2024-45619.patch
  - opensc-CVE-2024-45620.patch

++++ opensc:

  - - Security fix: [CVE-2024-8443, bsc#1230364]
    * opensc: heap buffer overflow in OpenPGP driver when generating key
    * Added patch: opensc-CVE-2024-8443.patch
  - Security fix: [opensc-CVE-2024-45620, bsc#1230076]
  - Security fix: [opensc-CVE-2024-45619, bsc#1230075]
  - Security fix: [opensc-CVE-2024-45618, bsc#1230074]
  - Security fix: [opensc-CVE-2024-45617, bsc#1230073]
  - Security fix: [opensc-CVE-2024-45616, bsc#1230072]
  - Security fix: [opensc-CVE-2024-45615, bsc#1230071]
    * opensc: pkcs15init: Usage of uninitialized values in libopensc and pkcs15init
    * opensc: Uninitialized values after incorrect check or usage of APDU response values in libopensc
    * opensc: Uninitialized values after incorrect or missing checking return values of functions in libopensc
    * opensc: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init
    * opensc: Incorrect handling length of buffers or files in libopensc
    * opensc: Incorrect handling of the length of buffers or files in pkcs15init
    * Added patches:
  - opensc-CVE-2024-45615.patch
  - opensc-CVE-2024-45616.patch
  - opensc-CVE-2024-45617.patch
  - opensc-CVE-2024-45618.patch
  - opensc-CVE-2024-45619.patch
  - opensc-CVE-2024-45620.patch

------------------------------------------------------------------
------------------  2024-9-30  -  Sep 30 2024  -------------------
------------------------------------------------------------------

++++ cups:

  - Version upgrade to 2.4.11:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.11 brings several bug fixes regarding IPP response
    validation, processing PPD values, Web UI support
    (checkbox support, modifying printers) and others fixes.
    Detailed list (from CHANGES.md):
    * Updated the maximum file descriptor limit
    for `cupsd` to 64k-1 (Issue #989)
    * Fixed `lpoptions -d` with a discovered
    but not added printer (Issue #833)
    * Fixed incorrect error message for HTTP/IPP errors (Issue #893)
    * Fixed JobPrivateAccess and SubscriptionPrivateAccess support
    for "all" (Issue #990)
    * Fixed issues with cupsGetDestMediaByXxx (Issue #993)
    * Fixed adding and modifying of printers
    via the web interface (Issue #998)
    * Fixed HTTP PeerCred authentication
    for domain users (Issue #1001)
    * Fixed checkbox support (Issue #1008)
    * Fixed printer state notifications (Issue #1013)
    * Fixed IPP Everywhere printer setup (Issue #1033)
    Issues are those at https://github.com/OpenPrinting/cups/issues
    In particular CUPS 2.4.11 contains those commit regarding
    IPP response validation and processing PPD values:
    * "Quote PPD localized strings"
    https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd
    plus a cleanup to "Fix warnings for unused vars"
    https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.11
  - avoid_C99_mode_for_loop_initial_declarations.patch
    is no longer needed because the issue is fixed upstream.

++++ cups:

  - Version upgrade to 2.4.11:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.11 brings several bug fixes regarding IPP response
    validation, processing PPD values, Web UI support
    (checkbox support, modifying printers) and others fixes.
    Detailed list (from CHANGES.md):
    * Updated the maximum file descriptor limit
    for `cupsd` to 64k-1 (Issue #989)
    * Fixed `lpoptions -d` with a discovered
    but not added printer (Issue #833)
    * Fixed incorrect error message for HTTP/IPP errors (Issue #893)
    * Fixed JobPrivateAccess and SubscriptionPrivateAccess support
    for "all" (Issue #990)
    * Fixed issues with cupsGetDestMediaByXxx (Issue #993)
    * Fixed adding and modifying of printers
    via the web interface (Issue #998)
    * Fixed HTTP PeerCred authentication
    for domain users (Issue #1001)
    * Fixed checkbox support (Issue #1008)
    * Fixed printer state notifications (Issue #1013)
    * Fixed IPP Everywhere printer setup (Issue #1033)
    Issues are those at https://github.com/OpenPrinting/cups/issues
    In particular CUPS 2.4.11 contains those commit regarding
    IPP response validation and processing PPD values:
    * "Quote PPD localized strings"
    https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd
    plus a cleanup to "Fix warnings for unused vars"
    https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.11
  - avoid_C99_mode_for_loop_initial_declarations.patch
    is no longer needed because the issue is fixed upstream.

++++ python-kiwi:

  - Support older apt versions for bootstrap
    This Fixes #2660

++++ python-kiwi:

  - Support older apt versions for bootstrap
    This Fixes #2660

++++ python-kiwi:

  - Support older apt versions for bootstrap
    This Fixes #2660

++++ kernel-default:

  - kthread: Fix task state in kthread worker if being frozen
    (bsc#1231146).
  - commit fe88a62
  - supported.conf: mark adiantum and xctr crypto modules as supported (bsc#1231035)
  - commit 59d03d7
  - Refresh
    patches.suse/bpf-kprobe-remove-unused-declaring-of-bpf_kprobe_override.patch.
  - commit 5a0b269
  - bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
    (git-fixes).
  - commit 1884922
  - tracing: Avoid possible softlockup in tracing_iter_reset()
    (git-fixes).
  - commit d5df75c
  - tracing: Fix overflow in get_free_elt() (git-fixes
    CVE-2024-43890 bsc#1229764).
  - commit ceb524e
  - arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120 CVE-2024-46822)
  - commit cc6d7b5
  - mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).
  - mailbox: rockchip: fix a typo in module autoloading (git-fixes).
  - i2c: designware: fix controller is holding SCL low while ENABLE
    bit is disabled (git-fixes).
  - drm/amd/display: handle nulled pipe context in DCE110's
    set_drr() (git-fixes).
  - drm/amdgpu: Fix get each xcp macro (git-fixes).
  - tomoyo: fallback to realpath if symlink's pathname does not
    exist (git-fixes).
  - cxl/pci: Fix to record only non-zero ranges (git-fixes).
  - ata: libata-scsi: Fix ata_msense_control() CDL page reporting
    (git-fixes).
  - firmware_loader: Block path traversal (git-fixes).
  - driver core: Fix a potential null-ptr-deref in
    module_add_driver() (git-fixes).
  - driver core: Fix error handling in driver API device_rename()
    (git-fixes).
  - ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
    (git-fixes).
  - iio: magnetometer: ak8975: Fix reading for ak099xx sensors
    (git-fixes).
  - iio: chemical: bme680: Fix read/write ops to device by adding
    mutexes (git-fixes).
  - ABI: testing: fix admv8818 attr description (git-fixes).
  - iio: adc: ad7606: fix standby gpio state to match the
    documentation (git-fixes).
  - iio: adc: ad7606: fix oversampling gpio array (git-fixes).
  - tty: rp2: Fix reset with non forgiving PCIe host bridges
    (git-fixes).
  - USB: class: CDC-ACM: fix race between get_serial and set_serial
    (git-fixes).
  - usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).
  - usb: cdnsp: Fix incorrect usb_request status (git-fixes).
  - USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).
  - USB: serial: kobil_sct: restore initial terminal settings
    (git-fixes).
  - xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and
    freeing them (git-fixes).
  - usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).
  - spi: atmel-quadspi: Avoid overwriting delay register settings
    (git-fixes).
  - spi: spi-fsl-lpspi: Undo runtime PM changes at driver exit time
    (git-fixes).
  - spi: atmel-quadspi: Undo runtime PM changes at driver exit time
    (git-fixes).
  - rtc: at91sam9: fix OF node leak in probe() error path
    (git-fixes).
  - i3c: master: svc: Fix use after free vulnerability in
    svc_i3c_master Driver Due to Race Condition (git-fixes).
  - remoteproc: k3-r5: Fix error handling when power-up failed
    (git-fixes).
  - remoteproc: imx_rproc: Initialize workqueue earlier (git-fixes).
  - remoteproc: imx_rproc: Correct ddr alias for i.MX8M (git-fixes).
  - KEYS: prevent NULL pointer dereference in find_asymmetric_key()
    (git-fixes).
  - media: i2c: ar0521: Use cansleep version of gpiod_set_value()
    (git-fixes).
  - media: ov5675: Fix power on/off delay timings (git-fixes).
  - media: sun4i_csi: Implement link validate for sun4i_csi subdev
    (git-fixes).
  - media: platform: rzg2l-cru: rzg2l-csi2: Add missing
    MODULE_DEVICE_TABLE (git-fixes).
  - media: venus: fix use after free bug in venus_remove due to
    race condition (git-fixes).
  - media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
    (git-fixes).
  - clk: ti: dra7-atl: Fix leak of of_nodes (git-fixes).
  - watchdog: imx_sc_wdt: Don't disable WDT in suspend (git-fixes).
  - pinctrl: single: fix missing error code in pcs_probe()
    (git-fixes).
  - xz: cleanup CRC32 edits from 2018 (git-fixes).
  - ata: pata_macio: Use WARN instead of BUG (stable-fixes).
  - commit c5ab3ca
  - Drop mm patches that caused regressions (bsc#1230413)
    Those should have been already dropped via SLE15-SP6 merge, but slipped
    due to incorrect merge conflict resolutions
  - commit 09dbc92
  - Move upstreamed SCSI patches into sorted section
  - commit aba5747
  - kcm: Serialise kcm_sendmsg() for the same socket (CVE-2024-44946
    bsc#1230015).
  - commit 4310760
  - nvme-multipath: avoid hang on inaccessible namespaces
    (bsc#1228244).
  - kcm: Serialise kcm_sendmsg() for the same socket
    (CVE-2024-44946,bsc#1230015).
  - commit a84ca87
  - nvme-multipath: system fails to create generic nvme device
    (bsc#1228244).
  - commit 4fc57d2
  - erofs: fix incorrect symlink detection in fast symlink
    (git-fixes).
  - commit 2e1ae75
  - afs: Don't cross .backup mountpoint from backup volume
    (git-fixes).
  - commit f35dae1
  - afs: Revert "afs: Hide silly-rename files from userspace"
    (git-fixes).
  - commit 11353bb

------------------------------------------------------------------
------------------  2024-9-27  -  Sep 27 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Run package scripts in apt bootstrap phase
    The bootstrap procedure based on apt only runs a manual
    collection of package scripts. This commit refactors the
    code that unpacks the bootstrap packages to a python
    implementation and adds a method to run the bootstrap
    scripts from all packages resolved by apt.

++++ python-kiwi:

  - Run package scripts in apt bootstrap phase
    The bootstrap procedure based on apt only runs a manual
    collection of package scripts. This commit refactors the
    code that unpacks the bootstrap packages to a python
    implementation and adds a method to run the bootstrap
    scripts from all packages resolved by apt.

++++ python-kiwi:

  - Run package scripts in apt bootstrap phase
    The bootstrap procedure based on apt only runs a manual
    collection of package scripts. This commit refactors the
    code that unpacks the bootstrap packages to a python
    implementation and adds a method to run the bootstrap
    scripts from all packages resolved by apt.

++++ kernel-default:

  - scsi: sd: Fix off-by-one error in
    sd_read_block_characteristics() (bsc#1223848).
  - commit 621f2fb
  - scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).
  - commit af0ff0f
  - drm/amd/display: Check denominator crb_pipes before used (CVE-2024-46772 bsc#1230772)
  - commit 322be4a
  - blacklist.conf: CVE-2024-46727 bsc#1230707: not applicable
    No OTG code and all return values from
    resource_get_otg_master_for_stream() are checked before use.
  - commit f44b1e7
  - arm64: dts: allwinner: h616: Add r_i2c pinctrl nodes
    (git-fixes).
  - commit 642d7e6
  - arm64: dts: imx8-ss-dma: Fix adc0 closing brace location
    (git-fixes).
  - commit 970cc49
  - arm64: dts: rockchip: Correct vendor prefix for Hardkernel
    ODROID-M1 (git-fixes).
  - commit 87f0ae6
  - arm64: dts: rockchip: Raise Pinebook Pro's panel backlight
    PWM frequency (git-fixes).
  - commit 1582b94
  - arm64: dts: rockchip: Correct the Pinebook Pro battery design
    capacity (git-fixes).
  - commit 3b2ebbf
  - arm64: dts: exynos: exynos7885-jackpotlte: Correct RAM amount
    to 4GB (git-fixes).
  - commit 1059c29
  - arm64: signal: Fix some under-bracketed UAPI macros (git-fixes).
  - commit 9704ff3
  - arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO
    hog on RK3399 Puma (git-fixes).
  - commit 6052a8c
  - arm64: dts: rockchip: fix eMMC/SPI corruption when audio has
    been used on RK3399 Puma (git-fixes).
  - commit 8b3743b
  - Update
    patches.suse/powerpc-pseries-make-max-polling-consistent-for-long.patch
    (bsc#1215199 jsc#PED-10954).
  - Update
    patches.suse/security-integrity-fix-pointer-to-ESL-data-and-.patch
    (bsc#1012628 jsc#PED-5085 jsc#PED-10954).
  - commit ec9be2c
  - arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for
    ROCK Pi E (git-fixes).
  - commit 7527015
  - arm64: acpi: Move get_cpu_for_acpi_id() to a header (git-fixes).
  - commit 42389f0
  - ipmi:ssif: Improve detecting during probing (bsc#1228771)
    Move patch into the sorted section.
  - commit 77cf6fc
  - Update patches.suse/ALSA-line6-Fix-racy-access-to-midibuf.patch
    (stable-fixes CVE-2024-44954 bsc#1230176).
  - Update
    patches.suse/ASoC-dapm-Fix-UAF-for-snd_soc_pcm_runtime-object.patch
    (git-fixes CVE-2024-46798 bsc#1230830).
  - Update
    patches.suse/Bluetooth-btnxpuart-Fix-Null-pointer-dereference-in-.patch
    (stable-fixes CVE-2024-46749 bsc#1230780).
  - Update
    patches.suse/Bluetooth-btnxpuart-Shutdown-timer-and-prevent-rearm.patch
    (stable-fixes CVE-2024-44962 bsc#1230213).
  - Update
    patches.suse/HID-amd_sfh-free-driver_data-after-destroying-hid-de.patch
    (stable-fixes CVE-2024-46746 bsc#1230751).
  - Update
    patches.suse/HID-cougar-fix-slab-out-of-bounds-Read-in-cougar_rep.patch
    (stable-fixes CVE-2024-46747 bsc#1230752).
  - Update patches.suse/Input-MT-limit-max-slots.patch (stable-fixes
    CVE-2024-45008 bsc#1230248).
  - Update
    patches.suse/Input-uinput-reject-requests-with-unreasonable-numbe.patch
    (stable-fixes CVE-2024-46745 bsc#1230748).
  - Update
    patches.suse/KVM-arm64-Make-ICC_-SGI-_EL1-undef-in-the-absence-of.patch
    (git-fixes CVE-2024-46707 bsc#1230582).
  - Update
    patches.suse/KVM-s390-fix-validity-interception-issue-when-gisa-is-switched-off.patch
    (git-fixes bsc#1229167 CVE-2024-45005 bsc#1230173).
  - Update
    patches.suse/PCI-Add-missing-bridge-lock-to-pci_bus_lock.patch
    (stable-fixes CVE-2024-46750 bsc#1230783).
  - Update
    patches.suse/Squashfs-sanity-check-symbolic-link-size.patch
    (git-fixes CVE-2024-46744 bsc#1230747).
  - Update
    patches.suse/VMCI-Fix-use-after-free-when-removing-resource-in-vm.patch
    (git-fixes CVE-2024-46738 bsc#1230731).
  - Update
    patches.suse/bpf-Fix-a-kernel-verifier-crash-in-stacksafe.patch
    (bsc#1225903 CVE-2024-45020 bsc#1230433).
  - Update
    patches.suse/btrfs-fix-race-between-direct-IO-write-and-fsync-whe.patch
    (git-fixes CVE-2024-46734 bsc#1230726).
  - Update
    patches.suse/can-bcm-Remove-proc-entry-when-dev-is-unregistered.patch
    (git-fixes CVE-2024-46771 bsc#1230766).
  - Update
    patches.suse/can-mcp251x-fix-deadlock-if-an-interrupt-occurs-duri.patch
    (git-fixes CVE-2024-46791 bsc#1230821).
  - Update
    patches.suse/char-xillybus-Check-USB-endpoints-when-probing-devic.patch
    (git-fixes CVE-2024-45011 bsc#1230440).
  - Update
    patches.suse/char-xillybus-Don-t-destroy-workqueue-from-work-item.patch
    (stable-fixes CVE-2024-45007 bsc#1230175).
  - Update
    patches.suse/dmaengine-altera-msgdma-properly-free-descriptor-in-.patch
    (stable-fixes CVE-2024-46716 bsc#1230715).
  - Update
    patches.suse/driver-core-Fix-uevent_show-vs-driver-detach-race.patch
    (git-fixes CVE-2024-44952 bsc#1230178).
  - Update
    patches.suse/driver-iio-add-missing-checks-on-iio_info-s-callback.patch
    (stable-fixes CVE-2024-46715 bsc#1230700).
  - Update
    patches.suse/drm-amd-display-Assign-linear_pitch_alignment-even-f.patch
    (stable-fixes CVE-2024-46732 bsc#1230711).
  - Update
    patches.suse/drm-amd-display-Check-UnboundedRequestEnabled-s-valu.patch
    (stable-fixes CVE-2024-46778 bsc#1230776).
  - Update
    patches.suse/drm-amd-display-Check-denominator-pbn_div-before-use.patch
    (stable-fixes CVE-2024-46773 bsc#1230791).
  - Update
    patches.suse/drm-amd-display-Check-index-for-aux_rd_interval-befo.patch
    (stable-fixes CVE-2024-46728 bsc#1230703).
  - Update
    patches.suse/drm-amd-display-Ensure-array-index-tg_inst-won-t-be-.patch
    (stable-fixes CVE-2024-46730 bsc#1230701).
  - Update
    patches.suse/drm-amd-display-Ensure-index-calculation-will-not-ov.patch
    (stable-fixes CVE-2024-46726 bsc#1230706).
  - Update
    patches.suse/drm-amd-display-Run-DC_LOG_DC-after-checking-link-li.patch
    (stable-fixes CVE-2024-46776 bsc#1230775).
  - Update
    patches.suse/drm-amd-display-Skip-wbscl_set_scaler_filter-if-filt.patch
    (stable-fixes CVE-2024-46714 bsc#1230699).
  - Update
    patches.suse/drm-amd-display-avoid-using-null-object-of-framebuff.patch
    (git-fixes CVE-2024-46694 bsc#1230511).
  - Update
    patches.suse/drm-amd-pm-fix-the-Out-of-bounds-read-warning.patch
    (stable-fixes CVE-2024-46731 bsc#1230709).
  - Update
    patches.suse/drm-amdgpu-Fix-out-of-bounds-read-of-df_v1_7_channel.patch
    (stable-fixes CVE-2024-46724 bsc#1230725).
  - Update
    patches.suse/drm-amdgpu-Fix-out-of-bounds-write-warning.patch
    (stable-fixes CVE-2024-46725 bsc#1230705).
  - Update
    patches.suse/drm-amdgpu-Forward-soft-recovery-errors-to-userspace.patch
    (stable-fixes CVE-2024-44961 bsc#1230207).
  - Update patches.suse/drm-amdgpu-Validate-TA-binary-size.patch
    (stable-fixes CVE-2024-44977 bsc#1230217).
  - Update
    patches.suse/drm-amdgpu-fix-dereference-after-null-check.patch
    (stable-fixes CVE-2024-46720 bsc#1230724).
  - Update
    patches.suse/drm-amdgpu-fix-mc_data-out-of-bounds-read-warning.patch
    (stable-fixes CVE-2024-46722 bsc#1230712).
  - Update
    patches.suse/drm-amdgpu-fix-ucode-out-of-bounds-read-warning.patch
    (stable-fixes CVE-2024-46723 bsc#1230702).
  - Update
    patches.suse/drm-mgag200-Bind-I2C-lifetime-to-DRM-device.patch
    (git-fixes CVE-2024-44967 bsc#1230224).
  - Update
    patches.suse/drm-msm-dpu-cleanup-FB-if-dpu_format_populate_layout.patch
    (git-fixes CVE-2024-44982 bsc#1230204).
  - Update
    patches.suse/drm-msm-dpu-move-dpu_encoder-s-connector-assignment-.patch
    (git-fixes CVE-2024-45015 bsc#1230444).
  - Update
    patches.suse/drm-vmwgfx-Fix-prime-with-external-buffers.patch
    (git-fixes CVE-2024-46709 bsc#1230539).
  - Update
    patches.suse/fs-netfs-fscache_cookie-add-missing-n_accesses-check.patch
    (bsc#1229455 CVE-2024-45000 bsc#1230170).
  - Update
    patches.suse/fscache-delete-fscache_cookie_lru_timer-when-fscache-.patch
    (bsc#1230602 CVE-2024-46786 bsc#1230813).
  - Update
    patches.suse/fuse-Initialize-beyond-EOF-page-contents-before-setti.patch
    (bsc#1229456 CVE-2024-44947).
  - Update
    patches.suse/hwmon-adc128d818-Fix-underflows-seen-when-writing-li.patch
    (stable-fixes CVE-2024-46759 bsc#1230814).
  - Update
    patches.suse/hwmon-lm95234-Fix-underflows-seen-when-writing-limit.patch
    (stable-fixes CVE-2024-46758 bsc#1230812).
  - Update
    patches.suse/hwmon-nct6775-core-Fix-underflows-seen-when-writing-.patch
    (stable-fixes CVE-2024-46757 bsc#1230809).
  - Update
    patches.suse/hwmon-w83627ehf-Fix-underflows-seen-when-writing-lim.patch
    (stable-fixes CVE-2024-46756 bsc#1230806).
  - Update
    patches.suse/media-dvb-usb-v2-af9035-Fix-null-ptr-deref-in-af9035.patch
    (git-fixes CVE-2023-52915 bsc#1230270).
  - Update
    patches.suse/misc-fastrpc-Fix-double-free-of-buf-in-error-path.patch
    (git-fixes CVE-2024-46741 bsc#1230749).
  - Update
    patches.suse/mmc-mmc_test-Fix-NULL-dereference-on-allocation-fail.patch
    (git-fixes CVE-2024-45028 bsc#1230450).
  - Update
    patches.suse/msft-hv-3046-uio_hv_generic-Fix-kernel-NULL-pointer-dereference-i.patch
    (git-fixes CVE-2024-46739 bsc#1230732).
  - Update
    patches.suse/msft-hv-3048-net-mana-Fix-error-handling-in-mana_create_txq-rxq-s.patch
    (git-fixes CVE-2024-46784 bsc#1230771).
  - Update
    patches.suse/net-ethernet-mtk_wed-fix-use-after-free-panic-in-mtk.patch
    (git-fixes CVE-2024-44997 bsc#1230232).
  - Update
    patches.suse/net-mana-Fix-RX-buf-alloc_size-alignment-and-atomic-.patch
    (bsc#1229086 CVE-2024-45001 bsc#1230244).
  - Update
    patches.suse/net-phy-Fix-missing-of_node_put-for-leds.patch
    (git-fixes CVE-2024-46767 bsc#1230787).
  - Update
    patches.suse/nfc-pn533-Add-poll-mod-list-filling-check.patch
    (git-fixes CVE-2024-46676 bsc#1230535).
  - Update
    patches.suse/nilfs2-fix-missing-cleanup-on-rollforward-recovery-error.patch
    (git-fixes CVE-2024-46781 bsc#1230768).
  - Update
    patches.suse/nilfs2-protect-references-to-superblock-parameters-exposed-in-sysfs.patch
    (git-fixes CVE-2024-46780 bsc#1230808).
  - Update
    patches.suse/nouveau-firmware-use-dma-non-coherent-allocator.patch
    (git-fixes CVE-2024-45012 bsc#1230441).
  - Update
    patches.suse/nvmet-tcp-fix-kernel-crash-if-commands-allocation-fa.patch
    (git-fixes CVE-2024-46737 bsc#1230730).
  - Update
    patches.suse/pci-hotplug-pnv_php-Fix-hotplug-driver-crash-on-Powe.patch
    (stable-fixes CVE-2024-46761 bsc#1230761).
  - Update patches.suse/perf-Fix-event-leak-upon-exit.patch
    (git-fixes CVE-2024-43870 bsc#1229494).
  - Update
    patches.suse/pinctrl-single-fix-potential-NULL-dereference-in-pcs.patch
    (git-fixes CVE-2024-46685 bsc#1230515).
  - Update
    patches.suse/powerpc-qspinlock-Fix-deadlock-in-MCS-queue.patch
    (bac#1230295 ltc#206656 CVE-2024-46797 bsc#1230831).
  - Update
    patches.suse/powerpc-rtas-Prevent-Spectre-v1-gadget-construction-.patch
    (bsc#1227487 CVE-2024-46774 bsc#1230767).
  - Update
    patches.suse/s390-dasd-fix-error-recovery-leading-to-data-corruption-on-ESE-devices.patch
    (git-fixes bsc#1229452 CVE-2024-45026 bsc#1230454).
  - Update
    patches.suse/s390-sclp-Prevent-release-of-buffer-in-I-O.patch
    (git-fixes bsc#1229169 CVE-2024-44969 bsc#1230200).
  - Update
    patches.suse/soc-qcom-cmd-db-Map-shared-memory-as-WC-not-WB.patch
    (git-fixes CVE-2024-46689 bsc#1230524).
  - Update
    patches.suse/thunderbolt-Mark-XDomain-as-unplugged-when-router-is.patch
    (stable-fixes CVE-2024-46702 bsc#1230589).
  - Update
    patches.suse/tty-serial-fsl_lpuart-mark-last-busy-before-uart_add.patch
    (git-fixes CVE-2024-46706 bsc#1230580).
  - Update
    patches.suse/usb-dwc3-core-Prevent-USB-core-invalid-event-buffer-.patch
    (stable-fixes CVE-2024-46675 bsc#1230533).
  - Update
    patches.suse/usb-dwc3-st-fix-probed-platform-device-ref-count-on-.patch
    (git-fixes CVE-2024-46674 bsc#1230507).
  - Update
    patches.suse/usb-gadget-core-Check-for-unset-descriptor.patch
    (git-fixes CVE-2024-44960 bsc#1230191).
  - Update
    patches.suse/usb-typec-ucsi-Fix-null-pointer-dereference-in-trace.patch
    (stable-fixes CVE-2024-46719 bsc#1230722).
  - Update
    patches.suse/wifi-brcmfmac-cfg80211-Handle-SSID-based-pmksa-delet.patch
    (git-fixes CVE-2024-46672 bsc#1230459).
  - Update
    patches.suse/wifi-mwifiex-Do-not-return-unused-priv-in-mwifiex_ge.patch
    (stable-fixes CVE-2024-46755 bsc#1230802).
  - Update
    patches.suse/wifi-rtw88-usb-schedule-rx-work-after-everything-is-.patch
    (stable-fixes CVE-2024-46760 bsc#1230753).
  - Update
    patches.suse/x86-mm-Fix-pti_clone_pgtable-alignment-assumption.patch
    (git-fixes CVE-2024-44965 bsc#1230221).
  - Update
    patches.suse/x86-mtrr-Check-if-fixed-MTRRs-exist-before-saving-them.patch
    (git-fixes CVE-2024-44948 bsc#1230174).
  - Update
    patches.suse/xhci-Fix-Panther-point-NULL-pointer-deref-at-full-sp.patch
    (git-fixes CVE-2024-45006 bsc#1230247).
  - commit 6da06c4
  - Update patches.suse/gfs2-Fix-NULL-pointer-dereference-in-gfs2_log_flush.patch (bsc#1230948)
  - commit 90a5b1b

------------------------------------------------------------------
------------------  2024-9-26  -  Sep 26 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.1.12 → 10.1.13
  - Fix bundle extension for vagrant type
    When bundling result files that uses a vagrant type,
    kiwi creates them with the extension .vagrant.virtualbox.box
    or .vagrant.libvirt.box. The bundler code renames them using
    only the .box suffix which is too short as it is missing
    the subformat information. This commit fixes it and keeps
    this information in the result bundle file name.
    This Fixes #2656
  - Use simple quotas (squota) for volumes

++++ python-kiwi:

  - Bump version: 10.1.12 → 10.1.13
  - Fix bundle extension for vagrant type
    When bundling result files that uses a vagrant type,
    kiwi creates them with the extension .vagrant.virtualbox.box
    or .vagrant.libvirt.box. The bundler code renames them using
    only the .box suffix which is too short as it is missing
    the subformat information. This commit fixes it and keeps
    this information in the result bundle file name.
    This Fixes #2656
  - Use simple quotas (squota) for volumes

++++ python-kiwi:

  - Bump version: 10.1.12 → 10.1.13
  - Fix bundle extension for vagrant type
    When bundling result files that uses a vagrant type,
    kiwi creates them with the extension .vagrant.virtualbox.box
    or .vagrant.libvirt.box. The bundler code renames them using
    only the .box suffix which is too short as it is missing
    the subformat information. This commit fixes it and keeps
    this information in the result bundle file name.
    This Fixes #2656
  - Use simple quotas (squota) for volumes

++++ e2fsprogs:

  - resize2fs-Check-number-of-group-descriptors-only-if-.patch: resize2fs: Check
    number of group descriptors only if meta_bg is disabled (bsc#1230145)
  - EA Inode handling fixes:
  - e2fsck-add-more-checks-for-ea-inode-consistency.patch: e2fsck: add more
    checks for ea inode consistency (bsc#1223596)
  - e2fsck-fix-golden-output-of-several-tests.patch: e2fsck: fix golden output
    of several tests (bsc#1223596)

++++ kernel-default:

  - userfaultfd: fix checks for huge PMDs (CVE-2024-46787
    bsc#1230815).
  - commit a236c90
  - cachefiles: Fix non-taking of sb_writers around set/removexattr
    (bsc#1231008).
  - commit 1b01b3e
  - RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds (git-fixes)
  - commit a6683f0
  - PCI: dwc: Expose dw_pcie_ep_exit() to module (git-fixes).
  - Refresh
    patches.suse/PCI-dwc-endpoint-Introduce-.pre_init-and-.deinit.patch.
  - commit 34c9950
  - PCI: xilinx-nwl: Clean up clock on probe failure/removal
    (git-fixes).
  - PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes).
  - PCI: qcom-ep: Enable controller resources like PHY only after
    refclk is available (git-fixes).
  - PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
    (git-fixes).
  - PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
    (git-fixes).
  - PCI: imx6: Fix missing call to phy_power_off() in error handling
    (git-fixes).
  - PCI: dra7xx: Fix error handling when IRQ request fails in probe
    (git-fixes).
  - PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main"
    IRQ (git-fixes).
  - PCI: Wait for Link before restoring Downstream Buses
    (git-fixes).
  - commit 1528eee

++++ expat:

  - updated keyring [https://build.suse.de/request/show/345282]
  - modified sources
    % expat.keyring

++++ expat:

  - updated keyring [https://build.suse.de/request/show/345282]
  - modified sources
    % expat.keyring

++++ expat:

  - updated keyring [https://build.suse.de/request/show/345282]
  - modified sources
    % expat.keyring

++++ expat:

  - updated keyring [https://build.suse.de/request/show/345282]
  - modified sources
    % expat.keyring

------------------------------------------------------------------
------------------  2024-9-25  -  Sep 25 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add quota attribute to volume section
    Allow to set quota per volume for the btrfs filesystem
    This Fixes #2651

++++ python-kiwi:

  - Add quota attribute to volume section
    Allow to set quota per volume for the btrfs filesystem
    This Fixes #2651

++++ python-kiwi:

  - Add quota attribute to volume section
    Allow to set quota per volume for the btrfs filesystem
    This Fixes #2651

++++ kernel-default:

  - WIP DO NOT PUSH btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk() (CVE-2024-46687 bsc#1230518)
  - commit 17b4a47
  - exfat: fix memory leak in exfat_load_bitmap() (git-fixes).
  - commit 9f477b0
  - net: ip_tunnel: prevent perpetual headroom growth
    (CVE-2024-26804 bsc#1222629).
  - commit 0ca3b23
  - Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq()
    (git-fixes).
  - commit 45cee3b
  - blacklist.conf: too risky
  - commit f0e13c3
  - Input: ilitek_ts_i2c - avoid wrong input subsystem sync
    (git-fixes).
  - commit e5e587b
  - Input: tsc2004/5 - fix reset handling on probe (git-fixes).
  - commit 1366de4
  - Input: tsc2004/5 - do not hard code interrupt trigger
    (git-fixes).
  - commit 110dbdb
  - Input: tsc2004/5 - use device core to create driver-specific
    device attributes (git-fixes).
  - commit 958966c
  - Input: adp5588-keys - fix check on return code (git-fixes).
  - commit d15133c
  - drm/amd/display: Fix incorrect size calculation for loop (bsc#1230704 CVE-2024-46729)
  - commit 55d78a7
  - RDMA/hns: Fix ah error counter in sw stat not increasing (git-fixes)
  - commit d7bebcf
  - RDMA/mlx5: Fix MR cache temp entries cleanup (git-fixes)
  - commit b0aa848
  - RDMA/mlx5: Drop redundant work canceling from clean_keys() (git-fixes)
  - commit 6800d7e
  - RDMA/irdma: fix error message in irdma_modify_qp_roce() (git-fixes)
  - commit dcf63e1
  - RDMA/cxgb4: Added NULL check for lookup_atid (git-fixes)
  - commit 23d3195
  - RDMA/mlx5: Obtain upper net device only when needed (git-fixes)
  - commit ca2d8dc
  - RDMA/hns: Fix restricted __le16 degrades to integer issue (git-fixes)
  - commit 4481358
  - RDMA/hns: Optimize hem allocation performance (git-fixes)
  - commit 7afe440
  - RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS (git-fixes)
  - commit 25e36c2
  - RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler (git-fixes)
  - commit a18704a
  - RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled (git-fixes)
  - commit 7b15e64
  - RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() (git-fixes)
  - commit 60eb35c
  - RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08 (git-fixes)
  - commit 3ab1ca2
  - RDMA/hns: Don't modify rq next block addr in HIP09 QPC (git-fixes)
  - commit 7100eb8
  - RDMA/mlx5: Limit usage of over-sized mkeys from the MR cache (git-fixes)
  - commit 914ed66
  - RDMA/mlx5: Fix counter update on MR cache mkey creation (git-fixes)
  - commit 60e75bb
  - RDMA/erdma: Return QP state in erdma_query_qp (git-fixes)
  - commit 09a59c3
  - IB/core: Fix ib_cache_setup_one error flow cleanup (git-fixes)
  - commit 38bf526
  - RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer (git-fixes)
  - commit c4f28a8
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (git-fixes)
  - commit 0456b72
  - RDMA/core: Remove unused declaration rdma_resolve_ip_route() (git-fixes)
  - commit 4cb7201
  - blacklist.conf: add one for clang and one PCI git-fixes
  - commit b26aea4
  - Revert "PCI: Extend ACS configurability (bsc#1228090)." (bsc#1229019)
    This reverts commit 571e4310e81312c847a5caee7e45e66aeea2a169. It breaks
    ACS on certain platforms. Even 6.11 is affected. So drop for now and
    investigate.
  - commit 3b92a44

++++ openssl-3:

  - Security fix: [bsc#1230698, CVE-2024-41996]
    * Validating the order of the public keys in the Diffie-Hellman
    Key Agreement Protocol, when an approved safe prime is used.
    * Added openssl-3-CVE-2024-41996.patch

++++ openssl-3:

  - Security fix: [bsc#1230698, CVE-2024-41996]
    * Validating the order of the public keys in the Diffie-Hellman
    Key Agreement Protocol, when an approved safe prime is used.
    * Added openssl-3-CVE-2024-41996.patch

++++ openssl-3:

  - Security fix: [bsc#1230698, CVE-2024-41996]
    * Validating the order of the public keys in the Diffie-Hellman
    Key Agreement Protocol, when an approved safe prime is used.
    * Added openssl-3-CVE-2024-41996.patch

++++ openssl-3:

  - Security fix: [bsc#1230698, CVE-2024-41996]
    * Validating the order of the public keys in the Diffie-Hellman
    Key Agreement Protocol, when an approved safe prime is used.
    * Added openssl-3-CVE-2024-41996.patch

++++ openssl-3:

  - Security fix: [bsc#1230698, CVE-2024-41996]
    * Validating the order of the public keys in the Diffie-Hellman
    Key Agreement Protocol, when an approved safe prime is used.
    * Added openssl-3-CVE-2024-41996.patch

++++ openssl-3:

  - Security fix: [bsc#1230698, CVE-2024-41996]
    * Validating the order of the public keys in the Diffie-Hellman
    Key Agreement Protocol, when an approved safe prime is used.
    * Added openssl-3-CVE-2024-41996.patch

++++ openssl-3:

  - Security fix: [bsc#1230698, CVE-2024-41996]
    * Validating the order of the public keys in the Diffie-Hellman
    Key Agreement Protocol, when an approved safe prime is used.
    * Added openssl-3-CVE-2024-41996.patch

------------------------------------------------------------------
------------------  2024-9-24  -  Sep 24 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.10.1:
    * Bugfixes:
  - autotools: fix `--with-ca-embed` build rule
  - cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync
  - cmake: fix MSH3 to appear on the feature list
  - connect: store connection info when really done
  - FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
  - http2: when uploading data from stdin, fix eos forwarding
  - http: make max-filesize check not count ignored bodies
  - lib: fix AF_INET6 use outside of USE_IPV6
  - multi: check that the multi handle is valid in curl_multi_assign
  - QUIC: on connect, keep on trying on draining server
  - request: correctly reset the eos_sent flag
  - setopt: remove superfluous use of ternary expressions
  - singleuse: drop `Curl_memrchr()` for no-HTTP builds
  - tool_cb_wrt: use "curl_response" if no file name in URL
  - transfer: fix sendrecv() without interim poll
  - vtls: fix `Curl_ssl_conn_config_match` doc param

++++ curl:

  - Update to 8.10.1:
    * Bugfixes:
  - autotools: fix `--with-ca-embed` build rule
  - cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync
  - cmake: fix MSH3 to appear on the feature list
  - connect: store connection info when really done
  - FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
  - http2: when uploading data from stdin, fix eos forwarding
  - http: make max-filesize check not count ignored bodies
  - lib: fix AF_INET6 use outside of USE_IPV6
  - multi: check that the multi handle is valid in curl_multi_assign
  - QUIC: on connect, keep on trying on draining server
  - request: correctly reset the eos_sent flag
  - setopt: remove superfluous use of ternary expressions
  - singleuse: drop `Curl_memrchr()` for no-HTTP builds
  - tool_cb_wrt: use "curl_response" if no file name in URL
  - transfer: fix sendrecv() without interim poll
  - vtls: fix `Curl_ssl_conn_config_match` doc param

++++ curl:

  - Update to 8.10.1:
    * Bugfixes:
  - autotools: fix `--with-ca-embed` build rule
  - cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync
  - cmake: fix MSH3 to appear on the feature list
  - connect: store connection info when really done
  - FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
  - http2: when uploading data from stdin, fix eos forwarding
  - http: make max-filesize check not count ignored bodies
  - lib: fix AF_INET6 use outside of USE_IPV6
  - multi: check that the multi handle is valid in curl_multi_assign
  - QUIC: on connect, keep on trying on draining server
  - request: correctly reset the eos_sent flag
  - setopt: remove superfluous use of ternary expressions
  - singleuse: drop `Curl_memrchr()` for no-HTTP builds
  - tool_cb_wrt: use "curl_response" if no file name in URL
  - transfer: fix sendrecv() without interim poll
  - vtls: fix `Curl_ssl_conn_config_match` doc param

++++ curl:

  - Update to 8.10.1:
    * Bugfixes:
  - autotools: fix `--with-ca-embed` build rule
  - cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync
  - cmake: fix MSH3 to appear on the feature list
  - connect: store connection info when really done
  - FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
  - http2: when uploading data from stdin, fix eos forwarding
  - http: make max-filesize check not count ignored bodies
  - lib: fix AF_INET6 use outside of USE_IPV6
  - multi: check that the multi handle is valid in curl_multi_assign
  - QUIC: on connect, keep on trying on draining server
  - request: correctly reset the eos_sent flag
  - setopt: remove superfluous use of ternary expressions
  - singleuse: drop `Curl_memrchr()` for no-HTTP builds
  - tool_cb_wrt: use "curl_response" if no file name in URL
  - transfer: fix sendrecv() without interim poll
  - vtls: fix `Curl_ssl_conn_config_match` doc param

++++ curl:

  - Update to 8.10.1:
    * Bugfixes:
  - autotools: fix `--with-ca-embed` build rule
  - cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync
  - cmake: fix MSH3 to appear on the feature list
  - connect: store connection info when really done
  - FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
  - http2: when uploading data from stdin, fix eos forwarding
  - http: make max-filesize check not count ignored bodies
  - lib: fix AF_INET6 use outside of USE_IPV6
  - multi: check that the multi handle is valid in curl_multi_assign
  - QUIC: on connect, keep on trying on draining server
  - request: correctly reset the eos_sent flag
  - setopt: remove superfluous use of ternary expressions
  - singleuse: drop `Curl_memrchr()` for no-HTTP builds
  - tool_cb_wrt: use "curl_response" if no file name in URL
  - transfer: fix sendrecv() without interim poll
  - vtls: fix `Curl_ssl_conn_config_match` doc param

++++ curl:

  - Update to 8.10.1:
    * Bugfixes:
  - autotools: fix `--with-ca-embed` build rule
  - cmake: ensure `CURL_USE_OPENSSL`/`USE_OPENSSL_QUIC` are set in sync
  - cmake: fix MSH3 to appear on the feature list
  - connect: store connection info when really done
  - FTP: partly revert eeb7c1280742f5c8fa48a4340fc1e1a1a2c7075a
  - http2: when uploading data from stdin, fix eos forwarding
  - http: make max-filesize check not count ignored bodies
  - lib: fix AF_INET6 use outside of USE_IPV6
  - multi: check that the multi handle is valid in curl_multi_assign
  - QUIC: on connect, keep on trying on draining server
  - request: correctly reset the eos_sent flag
  - setopt: remove superfluous use of ternary expressions
  - singleuse: drop `Curl_memrchr()` for no-HTTP builds
  - tool_cb_wrt: use "curl_response" if no file name in URL
  - transfer: fix sendrecv() without interim poll
  - vtls: fix `Curl_ssl_conn_config_match` doc param

++++ python-kiwi:

  - Fix globbing with exclude with regex
    This fixes a collection of bugs when producing erofs images.
    On one hand, this ensures that an exclude of `/sys` doesn't accidentally
    match `/lib/libsystemd.so`, only `/sys/whatever`.
    On the other hand, this ensures that `/dev/*` does match `/dev/vda` and
    not just `/dev///////////`.
    This fixes libsystemd.so getting dropped in Kiwi-built FEX images.
    Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io>
  - Honour custom exclude for filesystem builds
    All other call sites honour the custom exclude file, it's just this one
    that needs to be fixed. This unblocks use of Kiwi for generating FEX
    rootfs.
    Closes: #2652
    Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io>

++++ python-kiwi:

  - Fix globbing with exclude with regex
    This fixes a collection of bugs when producing erofs images.
    On one hand, this ensures that an exclude of `/sys` doesn't accidentally
    match `/lib/libsystemd.so`, only `/sys/whatever`.
    On the other hand, this ensures that `/dev/*` does match `/dev/vda` and
    not just `/dev///////////`.
    This fixes libsystemd.so getting dropped in Kiwi-built FEX images.
    Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io>
  - Honour custom exclude for filesystem builds
    All other call sites honour the custom exclude file, it's just this one
    that needs to be fixed. This unblocks use of Kiwi for generating FEX
    rootfs.
    Closes: #2652
    Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io>

++++ python-kiwi:

  - Fix globbing with exclude with regex
    This fixes a collection of bugs when producing erofs images.
    On one hand, this ensures that an exclude of `/sys` doesn't accidentally
    match `/lib/libsystemd.so`, only `/sys/whatever`.
    On the other hand, this ensures that `/dev/*` does match `/dev/vda` and
    not just `/dev///////////`.
    This fixes libsystemd.so getting dropped in Kiwi-built FEX images.
    Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io>
  - Honour custom exclude for filesystem builds
    All other call sites honour the custom exclude file, it's just this one
    that needs to be fixed. This unblocks use of Kiwi for generating FEX
    rootfs.
    Closes: #2652
    Signed-off-by: Alyssa Rosenzweig <alyssa@rosenzweig.io>

++++ transactional-update:

  - Version 4.8.3
  - Check return value of register command [bsc#1230901]

++++ ignition:

  - Add compatibility with Go 1.23
    Drop "go clean" from the upstream build script: since we build in
    clean environments, we don't have caches. Additionally, the way
    it is used does not even work and reports:
    go: clean -cache cannot be used with package arguments
    The error was masked until GO 1.23, as the test wether go
    supported caching was checking for go 1.23 formatted output.
    Thanks to dimstar for the fix.

++++ kernel-default:

  - blacklist.conf: CVE-2024-44972 bsc#1230212: not applicable
    Subpage code exists but zoned mode is not enabled being hidden behind
    CONFIG_BTRFS_DEBUG.
  - commit ed17920
  - btrfs: handle errors from btrfs_dec_ref() properly (CVE-2024-46753 bsc#1230796)
  - commit 3e3b2cb
  - blacklist.conf: kABI
  - commit 05421bb
  - media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes).
  - commit 62ef4d1
  - media: qcom: camss: Remove use_count guard in stop_streaming
    (git-fixes).
  - commit ef85228
  - Revert "media: tuners: fix error return code of
    hybrid_tuner_request_state()" (git-fixes).
  - drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds
    write error (git-fixes).
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds
    write error (git-fixes).
  - commit 48dc3a9
  - net: bridge: xmit: make sure we have at least eth header len
    bytes (CVE-2024-38538 bsc#1226606).
  - commit 2548071
  - PKCS#7: Check codeSigning EKU of certificates in PKCS#7
    (bsc#1226666).
  - commit dbae63e

++++ sqlite3:

  - Update to release 3.46.1:
    * Improved robustness while parsing the tokenize= arguments in
    FTS5.
    * Enhancements to covering index prediction in the query planner.
    * Do not let the number of terms on a VALUES clause be limited by
    SQLITE_LIMIT_COMPOUND_SELECT, even if the VALUES clause
    contains elements that appear to be variables due to
    double-quoted string literals.
    * Fix the window function version of group_concat() so that it
    returns an empty string if it has one or more empty string
    inputs.
    * In FTS5 secure-delete mode, fix false-positive integrity-check
    reports about corrupt indexes.
    * Syntax errors in ALTER TABLE should always return SQLITE_ERROR.
    In some cases, they were formerly returning SQLITE_INTERNAL.
    * Other minor fixes.

++++ sqlite3:

  - Update to release 3.46.1:
    * Improved robustness while parsing the tokenize= arguments in
    FTS5.
    * Enhancements to covering index prediction in the query planner.
    * Do not let the number of terms on a VALUES clause be limited by
    SQLITE_LIMIT_COMPOUND_SELECT, even if the VALUES clause
    contains elements that appear to be variables due to
    double-quoted string literals.
    * Fix the window function version of group_concat() so that it
    returns an empty string if it has one or more empty string
    inputs.
    * In FTS5 secure-delete mode, fix false-positive integrity-check
    reports about corrupt indexes.
    * Syntax errors in ALTER TABLE should always return SQLITE_ERROR.
    In some cases, they were formerly returning SQLITE_INTERNAL.
    * Other minor fixes.

++++ sqlite3:

  - Update to release 3.46.1:
    * Improved robustness while parsing the tokenize= arguments in
    FTS5.
    * Enhancements to covering index prediction in the query planner.
    * Do not let the number of terms on a VALUES clause be limited by
    SQLITE_LIMIT_COMPOUND_SELECT, even if the VALUES clause
    contains elements that appear to be variables due to
    double-quoted string literals.
    * Fix the window function version of group_concat() so that it
    returns an empty string if it has one or more empty string
    inputs.
    * In FTS5 secure-delete mode, fix false-positive integrity-check
    reports about corrupt indexes.
    * Syntax errors in ALTER TABLE should always return SQLITE_ERROR.
    In some cases, they were formerly returning SQLITE_INTERNAL.
    * Other minor fixes.

++++ sqlite3:

  - Update to release 3.46.1:
    * Improved robustness while parsing the tokenize= arguments in
    FTS5.
    * Enhancements to covering index prediction in the query planner.
    * Do not let the number of terms on a VALUES clause be limited by
    SQLITE_LIMIT_COMPOUND_SELECT, even if the VALUES clause
    contains elements that appear to be variables due to
    double-quoted string literals.
    * Fix the window function version of group_concat() so that it
    returns an empty string if it has one or more empty string
    inputs.
    * In FTS5 secure-delete mode, fix false-positive integrity-check
    reports about corrupt indexes.
    * Syntax errors in ALTER TABLE should always return SQLITE_ERROR.
    In some cases, they were formerly returning SQLITE_INTERNAL.
    * Other minor fixes.

------------------------------------------------------------------
------------------  2024-9-23  -  Sep 23 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - test: storage: update clone_device tests with new block size
    Signed-off-by: Isaac True <isaac@is.having.coffee>

++++ python-kiwi:

  - test: storage: update clone_device tests with new block size
    Signed-off-by: Isaac True <isaac@is.having.coffee>

++++ python-kiwi:

  - test: storage: update clone_device tests with new block size
    Signed-off-by: Isaac True <isaac@is.having.coffee>

++++ kernel-default:

  - xen/swiotlb: fix allocated size (git-fixes).
  - commit 199871d
  - xen/swiotlb: add alignment check for dma buffers (bsc#1229928).
  - commit 0ffbc04
  - xen: tolerate ACPI NVS memory overlapping with Xen allocated
    memory (bsc#1226003).
  - commit 3dc14d8
  - xen: allow mapping ACPI data using a different physical address
    (bsc#1226003).
  - commit 0928eec
  - x86/tdx: Fix data leak in mmio_read() (CVE-2024-46794 bsc#1230825)
  - commit 9a2a1c2
  - tcp_bpf: fix return value of tcp_bpf_sendmsg() (CVE-2024-46783 bsc#1230810)
  - commit eb9d143
  - nvme: fix namespace removal list (git-fixes).
  - commit b45d192
  - ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery() (CVE-2024-46735 bsc#1230727)
  - commit 23e039f
  - Update references for patches.suse/nvmet-tcp-fix-kernel-crash-if-commands-allocation-fa.patch (CVE-2024-46737 bsc#1230730)
  - commit 8ce7f58
  - xen: add capability to remap non-RAM pages to different PFNs
    (bsc#1226003).
  - commit 47109fd
  - net/mlx5e: SHAMPO, Fix incorrect page release (CVE-2024-46717 bsc#1230719)
  - commit d6a30a9
  - xen: move max_pfn in xen_memory_setup() out of function scope
    (bsc#1226003).
  - commit 2750357
  - xen: move checks for e820 conflicts further up (bsc#1226003).
  - commit 191a602
  - xen: introduce generic helper checking for memory map conflicts
    (bsc#1226003).
  - commit eb57cec
  - xen: use correct end address of kernel for conflict checking
    (bsc#1226003).
  - commit c40fc6b
  - scsi: lpfc: Copyright updates for 14.4.0.4 patches (bsc#1229429
    jsc#PED-9899).
  - scsi: lpfc: Update lpfc version to 14.4.0.4 (bsc#1229429
    jsc#PED-9899).
  - scsi: lpfc: Update PRLO handling in direct attached topology
    (bsc#1229429 jsc#PED-9899).
  - scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct
    attached topology (bsc#1229429 jsc#PED-9899).
  - scsi: lpfc: Fix unintentional double clearing of vmid_flag
    (bsc#1229429 jsc#PED-9899).
  - scsi: lpfc: Validate hdwq pointers before dereferencing in
    reset/errata paths (bsc#1229429 jsc#PED-9899).
  - scsi: lpfc: Remove redundant vport assignment when building
    an abort request (bsc#1229429 jsc#PED-9899).
  - scsi: lpfc: Change diagnostic log flag during receipt of
    unknown ELS cmds (bsc#1229429 jsc#PED-9899).
  - scsi: lpfc: Fix overflow build issue (bsc#1229429 jsc#PED-9899).
  - commit 18ec475
  - drm/vmwgfx: Prevent unmapping active read buffers (bsc#1230540 CVE-2024-46710)
  - commit 84f019d
  - nvme-tcp: fix link failure for TCP auth (git-fixes).
  - nvmet: Identify-Active Namespace ID List command should reject
    invalid nsid (git-fixes).
  - nvme-pci: Add sleep quirk for Samsung 990 Evo (git-fixes).
  - nvme-pci: allocate tagset on reset if necessary (git-fixes).
  - nvmet-tcp: fix kernel crash if commands allocation fails
    (git-fixes).
  - nvme/pci: Add APST quirk for Lenovo N60z laptop (git-fixes).
  - nvme: use srcu for iterating namespace list (git-fixes).
    Refresh:
  - patches.suse/nvme-tcp-sanitize-tls-key-handling.patch
  - nvmet-rdma: fix possible bad dereference when freeing rsps
    (git-fixes).
  - nvmet-tcp: do not continue for invalid icreq (git-fixes).
  - nvme: clear caller pointer on identify failure (git-fixes).
  - nvmet-trace: avoid dereferencing pointer too early (git-fixes).
  - commit 7382ad4
  - Update
    patches.suse/KVM-arm64-vgic-v2-Check-for-non-NULL-vCPU-in-vgic_v2.patch
    (git-fixes CVE-2024-36953 bsc#1225812).
  - Update
    patches.suse/vfio-pci-fix-potential-memory-leak-in-vfio_intx_enab.patch
    (git-fixes CVE-2024-38632 bsc#1226860).
    Add CVE references.
  - commit c9c3b6f

++++ perl-Bootloader:

  - merge gh#openSUSE/perl-bootloader#176
  - handle missing grub_installdevice on powerpc (bsc#1230070)
  - 1.8.2
  - removing patch 0001-bootloader_entry-script-can-have-an-optional-force-d.patch
  - merge gh#openSUSE/perl-bootloader#167
  - log grub2-install errors correctly (bsc#1221470)
  - 1.8.1
  - merge gh#openSUSE/perl-bootloader#158
  - skip warning about unsupported options when in compat mode
  - 1.8
  - merge gh#openSUSE/perl-bootloader#156
  - bootloader_entry script can have an optional 'force-default'
    argument (bsc#1215064)
  - 1.7

------------------------------------------------------------------
------------------  2024-9-22  -  Sep 22 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - nilfs2: fix potential oob read in nilfs_btree_check_delete()
    (git-fixes).
  - commit cc0f59d
  - nilfs2: determine empty node blocks as corrupted (git-fixes).
  - commit 3244e52
  - nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
    (git-fixes).
  - commit 90f4e49

------------------------------------------------------------------
------------------  2024-9-21  -  Sep 21 2024  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.29.7:
    * revert commits link to mount API over bind changes
  - Update to version 2.29.6:
    * don't set propagation if target engine isn't linux
    * build(deps): bump github.com/docker/docker v27.3.0-rc.2
    * build(deps): bump github.com/docker/cli v27.3.0-rc.2
  - Update to version 2.29.5:
    * set propagation default
    * Remove custom codeql workflow
  - Update to version 2.29.4:
    * fix import
    * chore(watch): Add debug log when skipping service without build
    context
    * stop dependent containers before recreating diverged service
    * Fixed possible `nil` pointer dereference
    * bump github.com/docker/buildx v0.17.1
    * build(deps): bump docker, docker/cli to v27.3.0-rc.1
    * gha: test against docker engine v27.3.0

++++ docker-compose:

  - Update to version 2.29.7:
    * revert commits link to mount API over bind changes
  - Update to version 2.29.6:
    * don't set propagation if target engine isn't linux
    * build(deps): bump github.com/docker/docker v27.3.0-rc.2
    * build(deps): bump github.com/docker/cli v27.3.0-rc.2
  - Update to version 2.29.5:
    * set propagation default
    * Remove custom codeql workflow
  - Update to version 2.29.4:
    * fix import
    * chore(watch): Add debug log when skipping service without build
    context
    * stop dependent containers before recreating diverged service
    * Fixed possible `nil` pointer dereference
    * bump github.com/docker/buildx v0.17.1
    * build(deps): bump docker, docker/cli to v27.3.0-rc.1
    * gha: test against docker engine v27.3.0

++++ docker-compose:

  - Update to version 2.29.7:
    * revert commits link to mount API over bind changes
  - Update to version 2.29.6:
    * don't set propagation if target engine isn't linux
    * build(deps): bump github.com/docker/docker v27.3.0-rc.2
    * build(deps): bump github.com/docker/cli v27.3.0-rc.2
  - Update to version 2.29.5:
    * set propagation default
    * Remove custom codeql workflow
  - Update to version 2.29.4:
    * fix import
    * chore(watch): Add debug log when skipping service without build
    context
    * stop dependent containers before recreating diverged service
    * Fixed possible `nil` pointer dereference
    * bump github.com/docker/buildx v0.17.1
    * build(deps): bump docker, docker/cli to v27.3.0-rc.1
    * gha: test against docker engine v27.3.0

++++ nvidia-open-driver-G06-signed:

  - Update to 550.120 (boo#1230779)
    * Fixed a bug that could cause kernel crashes upon attempting
    KMS operations through DRM when nvidia_drm was loaded with
    modeset=0.
  - aarch64-TW-buildfix.patch
    * fixes build on aarch64 with latest TW kernel

------------------------------------------------------------------
------------------  2024-9-20  -  Sep 20 2024  -------------------
------------------------------------------------------------------

++++ dracut:

  - Update to version 059+suse.575.g06a9ae1f:
    Fixes for NVMeoF boot (bsc#1230468):
    * fix(nvmf): install (only) required nvmf modules
    * fix(nvmf): require NVMeoF modules
    * fix(nvmf): move /etc/nvme/host{nqn,id} requirement to hostonly

++++ dracut:

  - Update to version 059+suse.575.g06a9ae1f:
    Fixes for NVMeoF boot (bsc#1230468):
    * fix(nvmf): install (only) required nvmf modules
    * fix(nvmf): require NVMeoF modules
    * fix(nvmf): move /etc/nvme/host{nqn,id} requirement to hostonly

++++ dracut:

  - Update to version 059+suse.575.g06a9ae1f:
    Fixes for NVMeoF boot (bsc#1230468):
    * fix(nvmf): install (only) required nvmf modules
    * fix(nvmf): require NVMeoF modules
    * fix(nvmf): move /etc/nvme/host{nqn,id} requirement to hostonly

++++ dracut:

  - Update to version 059+suse.575.g06a9ae1f:
    Fixes for NVMeoF boot (bsc#1230468):
    * fix(nvmf): install (only) required nvmf modules
    * fix(nvmf): require NVMeoF modules
    * fix(nvmf): move /etc/nvme/host{nqn,id} requirement to hostonly

++++ python-kiwi:

  - storage: clone_device: increase dd block size
    Increasing the block size used for dd reduces the time needed to clone a
    device.
    Signed-off-by: Isaac True <isaac@is.having.coffee>

++++ python-kiwi:

  - storage: clone_device: increase dd block size
    Increasing the block size used for dd reduces the time needed to clone a
    device.
    Signed-off-by: Isaac True <isaac@is.having.coffee>

++++ python-kiwi:

  - storage: clone_device: increase dd block size
    Increasing the block size used for dd reduces the time needed to clone a
    device.
    Signed-off-by: Isaac True <isaac@is.having.coffee>

++++ git:

  - Update to version 2.46.1;
    * "git checkout --ours" (no other arguments) complained that the
    option is incompatible with branch switching, which is technically
    correct, but found confusing by some users.  It now says that the
    user needs to give pathspec to specify what paths to checkout.
    * It has been documented that we avoid "VAR=VAL shell_func" and why.
    * "git add -p" by users with diff.suppressBlankEmpty set to true
    failed to parse the patch that represents an unmodified empty line
    with an empty line (not a line with a single space on it), which
    has been corrected.
    * "git rebase --help" referred to "offset" (the difference between
    the location a change was taken from and the change gets replaced)
    incorrectly and called it "fuzz", which has been corrected.
    * "git notes add -m '' --allow-empty" and friends that take prepared
    data to create notes should not invoke an editor, but it started
    doing so since Git 2.42, which has been corrected.
    * An expensive operation to prepare tracing was done in re-encoding
    code path even when the tracing was not requested, which has been
    corrected.
    * Perforce tests have been updated.
    * The credential helper to talk to OSX keychain sometimes sent
    garbage bytes after the username, which has been corrected.
    * A recent update broke "git ls-remote" used outside a repository,
    which has been corrected.
    * "git config --value=foo --fixed-value section.key newvalue" barfed
    when the existing value in the configuration file used the
    valueless true syntax, which has been corrected.
    * "git reflog expire" failed to honor annotated tags when computing
    reachable commits.
    * A flakey test and incorrect calls to strtoX() functions have been
    fixed.
    * Follow-up on 2.45.1 regression fix.
    * "git rev-list ... | git diff-tree -p --remerge-diff --stdin" should
    behave more or less like "git log -p --remerge-diff" but instead it
    crashed, forgetting to prepare a temporary object store needed.
    * The patch parser in "git patch-id" has been tightened to avoid
    getting confused by lines that look like a patch header in the log
    message.
    * "git bundle unbundle" outside a repository triggered a BUG()
    unnecessarily, which has been corrected.
    * The code forgot to discard unnecessary in-core commit buffer data
    for commits that "git log --skip=<number>" traversed but omitted
    from the output, which has been corrected.
    * "git verify-pack" and "git index-pack" started dying outside a
    repository, which has been corrected.
    * A corner case bug in "git stash" was fixed.

++++ kernel-default:

  - media: mtk-vcodec: potential null pointer deference in SCP (CVE-2024-40973 bsc#1227890)
  - commit ce5074d
  - btrfs: don't BUG_ON() when 0 reference count at
    btrfs_lookup_extent_info() (bsc#1230786 CVE-2024-46751).
  - btrfs: reduce nesting for extent processing at
    btrfs_lookup_extent_info() (bsc#1230794 CVE-2024-46752).
  - btrfs: remove superfluous metadata check at
    btrfs_lookup_extent_info() (bsc#1230794 CVE-2024-46752).
  - btrfs: replace BUG_ON() with error handling at
    update_ref_for_cow() (bsc#1230794 CVE-2024-46752).
  - btrfs: simplify setting the full backref flag at
    update_ref_for_cow() (bsc#1230794 CVE-2024-46752).
  - btrfs: remove NULL transaction support for
    btrfs_lookup_extent_info() (bsc#1230794 CVE-2024-46752).
  - btrfs: remove level argument from btrfs_set_block_flags
    (bsc#1230794 CVE-2024-46752).
  - commit a1c1176
  - btrfs: send: allow cloning non-aligned extent if it ends at
    i_size (bsc#1230854).
  - commit e9cad4b
  - blacklist.conf: kABI
  - commit 5244a06
  - ocfs2: cancel dqi_sync_work before freeing oinfo (git-fixes).
  - commit 1f37ac4
  - ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
    (git-fixes).
  - commit b7bf7eb
  - ocfs2: remove unreasonable unlock in ocfs2_read_blocks
    (git-fixes).
  - commit e2cb129
  - ocfs2: fix null-ptr-deref when journal load failed (git-fixes).
  - commit b463b02
  - jfs: fix out-of-bounds in dbNextAG() and diAlloc() (git-fixes).
  - commit d948d87
  - of/irq: Prevent device address out-of-bounds read in interrupt
    map walk (CVE-2024-46743 bsc#1230756).
  - commit 300f40a
  - i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
    (git-fixes).
  - i2c: isch: Add missed 'else' (git-fixes).
  - i2c: xiic: Wait for TX empty to avoid missed TX NAKs
    (git-fixes).
  - i2c: aspeed: Update the stop sw state when the bus recovery
    occurs (git-fixes).
  - resource: fix region_intersects() vs add_memory_driver_managed()
    (git-fixes).
  - drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
    (git-fixes).
  - drm/msm: fix %s null argument error (git-fixes).
  - drm/msm/dsi: correct programming sequence for SM8350 / SM8450
    (git-fixes).
  - drm/msm/a5xx: workaround early ring-buffer emptiness check
    (git-fixes).
  - drm/msm/a5xx: fix races in preemption evaluation stage
    (git-fixes).
  - drm/msm/a5xx: properly clear preemption records on resume
    (git-fixes).
  - drm/msm/a5xx: disable preemption in submits by default
    (git-fixes).
  - drm/msm: Fix incorrect file name output in adreno_request_fw()
    (git-fixes).
  - drm/mediatek: ovl_adaptor: Add missing of_node_put()
    (git-fixes).
  - drm: omapdrm: Add missing check for alloc_ordered_workqueue
    (git-fixes).
  - drm/radeon/evergreen_cs: fix int overflow errors in cs track
    offsets (git-fixes).
  - drm/amd/amdgpu: Properly tune the size of struct (git-fixes).
  - drm/radeon: properly handle vbios fake edid sizing (git-fixes).
  - drm/amdgpu: properly handle vbios fake edid sizing (git-fixes).
  - drm/amd/display: Add null check for set_output_gamma in
    dcn30_set_output_transfer_func (git-fixes).
  - drm/amdgpu: fix a possible null pointer dereference (git-fixes).
  - drm/radeon: fix null pointer dereference in
    radeon_add_common_modes (git-fixes).
  - drm/vc4: hdmi: Handle error case of pm_runtime_resume_and_get
    (git-fixes).
  - drm/bridge: lontium-lt8912b: Validate mode in
    drm_bridge_funcs::mode_valid() (git-fixes).
  - drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
    (git-fixes).
  - drm/rockchip: vop: Allow 4096px width scaling (git-fixes).
  - drm/rockchip: vop: enable VOP_FEATURE_INTERNAL_RGB on RK3066
    (git-fixes).
  - drm/rockchip: vop: clear DMA stop bit on RK3066 (git-fixes).
  - drm/stm: ltdc: check memory returned by devm_kzalloc()
    (git-fixes).
  - drm/stm: Fix an error handling path in stm_drm_platform_probe()
    (git-fixes).
  - ata: libata: Clear DID_TIME_OUT for ATA PT commands with sense
    data (git-fixes).
  - HID: wacom: Do not warn about dropped packets for first packet
    (git-fixes).
  - HID: wacom: Support sequence numbers smaller than 16-bit
    (git-fixes).
  - tpm: Clean up TPM space after command failure (git-fixes).
  - ipmi: docs: don't advertise deprecated sysfs entries
    (git-fixes).
  - commit b4e4911

------------------------------------------------------------------
------------------  2024-9-19  -  Sep 19 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() (CVE-2024-46686 bsc#1230517)
  - commit a155846
  - firmware: qcom: scm: Mark get_wq_ctx() as atomic call (CVE-2024-46692 bsc#1230520)
  - commit ee65da0
  - scsi: aacraid: Fix double-free on probe failure (CVE-2024-46673 bsc#1230506)
  - commit 49aab2b
  - gtp: fix a potential NULL pointer dereference (CVE-2024-46677 bsc#1230549)
  - commit 9cdd14b
  - blacklist.conf: CVE-2024-46711 bsc#1230542: code partially present, fix part of refactoring and fix series
    The patch to backport is one in a number of about 30 patches refactoring
    and reworking MPTCP subflow handling. Several other patches are needed
    just to apply it cleanly but also change some of the logic where the
    actual fix would apply.
  - commit 1a03613
  - ethtool: check device is present when getting link settings (CVE-2024-46679 bsc#1230556)
  - commit 68643d1
  - md/raid5: avoid BUG_ON() while continue reshape after
    reassembling (bsc#1229790, CVE-2024-43914).
  - commit bfb799a
  - xfs: restrict when we try to align cow fork delalloc to cowextsz
    hints (git-fixes).
  - commit 96ac1b7
  - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
    (bsc#1227885).
  - commit bf3362b
  - Replace git-fixes tag by bsc#1226507,
    patches.suse/md-Don-t-wait-for-MD_RECOVERY_NEEDED-for-HOT_REMOVE_DISK-ioctl-a1fd.patch
    (bsc#1226507).
  - commit b04e0cb
  - closures: Change BUG_ON() to WARN_ON() (bsc#1229004,
    CVE-2024-42252).
  - commit 84b7984
  - clk: Add a devm variant of clk_rate_exclusive_get()
    (bsc#1227885).
  - commit b6fb747
  - r8152: add vendor/device ID pair for D-Link DUB-E250
    (git-fixes).
  - Refresh
    patches.suse/r8152-add-vendor-device-ID-pair-for-ASUS-USB-C2500.patch.
  - commit 0c077ab
  - usbnet: ipheth: fix carrier detection in modes 1 and 4
    (git-fixes).
  - commit 591cebb
  - usbnet: ipheth: do not stop RX on failing RX callback
    (git-fixes).
  - commit c58c483
  - usbnet: ipheth: drop RX URBs with no payload (git-fixes).
  - commit 73a78e2
  - KVM: arm64: Disallow copying MTE to guest memory while KVM is
    dirty logging (git-fixes).
  - commit 3cf4c02
  - usbnet: ipheth: remove extraneous rx URB length check
    (git-fixes).
  - commit 507443a
  - usbnet: ipheth: add CDC NCM support (git-fixes).
  - commit 1bf1d1e
  - KVM: arm64: Release pfn, i.e. put page, if copying MTE tags
    hits ZONE_DEVICE (git-fixes).
  - commit 64bccd6
  - usbnet: ipheth: transmit URBs without trailing padding
    (git-fixes).
  - usbnet: ipheth: fix risk of NULL pointer deallocation
    (git-fixes).
  - commit d804072
  - KVM: arm64: Invalidate EL1&0 TLB entries for all VMIDs in nvhe
    hyp init (git-fixes).
  - commit 30df9d2
  - drm/amd/display: Solve mst monitors blank out problem after
    resume (git-fixes).
  - commit cd94b30
  - virtio-net: synchronize probe with ndo_set_features (git-fixes).
  - commit 1a471dd
  - fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
    (git-fixes).
  - hwmon: (ntc_thermistor) fix module autoloading (git-fixes).
  - hwmon: (max16065) Fix overflows seen when writing limits
    (git-fixes).
  - mtd: powernv: Add check devm_kasprintf() returned value
    (git-fixes).
  - mtd: slram: insert break after errors in parsing the map
    (git-fixes).
  - power: supply: hwmon: Fix missing temp1_max_alarm attribute
    (git-fixes).
  - power: supply: Drop use_cnt check from
    power_supply_property_is_writeable() (git-fixes).
  - power: supply: max17042_battery: Fix SOC threshold calc w/
    no current sense (git-fixes).
  - power: supply: axp20x_battery: Remove design from min and max
    voltage (git-fixes).
  - pinctrl: meteorlake: Add Arrow Lake-H/U ACPI ID (stable-fixes).
  - drm/amdgpu/atomfirmware: Silence UBSAN warning (stable-fixes).
  - drm/amd/display: Avoid race between dcn10_set_drr() and
    dc_state_destruct() (git-fixes).
  - Input: synaptics - enable SMBus for HP Elitebook 840 G2
    (stable-fixes).
  - Input: ads7846 - ratelimit the spi_sync error message
    (stable-fixes).
  - drm/msm/adreno: Fix error return if missing firmware-name
    (stable-fixes).
  - scripts: kconfig: merge_config: config files: add a trailing
    newline (stable-fixes).
  - platform/surface: aggregator_registry: Add support for Surface
    Laptop Go 3 (stable-fixes).
  - platform/surface: aggregator_registry: Add Support for Surface
    Pro 10 (stable-fixes).
  - HID: multitouch: Add support for GT7868Q (stable-fixes).
  - drm/mediatek: Set sensible cursor width/height values to fix
    crash (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Ayn Loki Max
    (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Ayn Loki Zero
    (stable-fixes).
  - wifi: mt76: mt7921: fix NULL pointer access in
    mt7921_ipv6_addr_change (stable-fixes).
  - net: phy: vitesse: repair vsc73xx autonegotiation
    (stable-fixes).
  - cxl/core: Fix incorrect vendor debug UUID define (git-fixes).
  - drm/amd/display: Fix FEC_READY write on DP LT (stable-fixes).
  - drm/amd/display: Defer handling mst up request in resume
    (stable-fixes).
  - drm/amd/display: Disable error correction if it's not supported
    (stable-fixes).
  - commit 040b0ea

++++ python311-core:

  - Add CVE-2024-8088-zipfile-Path-sanitization.patch sanitizing
    names in zipfile.Path (bsc#1229704, CVE-2024-8088).
  - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch removing
    backtracking when parsing tarfile headers (bsc#1230227,
    CVE-2024-6232).
  - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic
    complexity in parsing "-quoted cookie values with backslashes
    (bsc#1229596, CVE-2024-7592).

++++ python311:

  - Add CVE-2024-8088-zipfile-Path-sanitization.patch sanitizing
    names in zipfile.Path (bsc#1229704, CVE-2024-8088).
  - Add CVE-2024-6232-ReDOS-backtrack-tarfile.patch removing
    backtracking when parsing tarfile headers (bsc#1230227,
    CVE-2024-6232).
  - Add CVE-2024-7592-quad-complex-cookies.patch fixing quadratic
    complexity in parsing "-quoted cookie values with backslashes
    (bsc#1229596, CVE-2024-7592).

++++ shim:

  - Update shim-install to use the 'removable' way for encrypted
    SL-Micro images (bsc#1230316)
    * 433cc4e Always use the removable way for SL-Micro
    * 769e41d Limit the removable option to encrypted SL-Micro

++++ shim:

  - Update shim-install to use the 'removable' way for encrypted
    SL-Micro images (bsc#1230316)
    * 433cc4e Always use the removable way for SL-Micro
    * 769e41d Limit the removable option to encrypted SL-Micro

------------------------------------------------------------------
------------------  2024-9-18  -  Sep 18 2024  -------------------
------------------------------------------------------------------

++++ chrony:

  - Update to version 4.6:
    * Add activate option to local directive to set activation threshold
    * Add ipv4 and ipv6 options to server/pool/peer directive
    * Add kod option to ratelimit directive for server KoD RATE support
    * Add leapseclist directive to read NIST/IERS leap-seconds.list file
    * Add ptpdomain directive to set PTP domain for NTP over PTP
    * Allow disabling pidfile
    * Improve copy server option to accept unsynchronised status instantly
    * Log one selection failure on start
    * Add offset command to modify source offset correction
    * Add timestamp sources to ntpdata report
    * Fix crash on sources reload during initstepslew or RTC initialisation
    * Fix source refreshment to not repeat failed name resolving attempts
    * Obsoletes chrony-124-tai.patch
  - The project's new home is https://chrony-project.org/ .

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ docker:

  - Add %{_sysconfdir}/audit/rules.d to filelist.

++++ kernel-default:

  - i2c: lpi2c: Avoid calling clk_get_rate during transfer
    (bsc#1227885 CVE-2024-40965).
  - commit abb755c
  - x86/mm/ident_map: Use gbpages only where full GB page should
    be mapped (bsc#1220382).
  - x86/kexec: Add EFI config table identity mapping for kexec
    kernel (bsc#1220382).
  - commit 26eab5b
  - Move upstreamed nvme patches into sorted section
  - commit 1e42d2f
  - spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
    (git-fixes).
  - commit 1cec71a
  - ASoC: meson: Remove unused declartion in header file
    (git-fixes).
  - ASoC: soc-ac97: Fix the incorrect description (git-fixes).
  - ASoC: rt5682: Return devm_of_clk_add_hw_provider to transfer
    the error (git-fixes).
  - ASoC: tas2781-i2c: Get the right GPIO line (git-fixes).
  - ASoC: cs42l42: Convert comma to semicolon (git-fixes).
  - ASoC: rt5682s: Return devm_of_clk_add_hw_provider to transfer
    the error (git-fixes).
  - ALSA: hda: cs35l41: fix module autoloading (git-fixes).
  - selftests: lib: remove strscpy test (git-fixes).
  - scripts: sphinx-pre-install: remove unnecessary double check
    for $cur_version (git-fixes).
  - Documentation: ioctl: document 0x07 ioctl code (git-fixes).
  - module: Fix KCOV-ignored file name (git-fixes).
  - reset: k210: fix OF node leak in probe() error path (git-fixes).
  - reset: berlin: fix OF node leak in probe() error path
    (git-fixes).
  - bus: integrator-lm: fix OF node leak in probe() (git-fixes).
  - soc: fsl: cpm1: tsa: Fix tsa_write8() (git-fixes).
  - firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
    (git-fixes).
  - firmware: arm_scmi: Fix double free in OPTEE transport
    (git-fixes).
  - soc: versatile: integrator: fix OF node leak in probe() error
    path (git-fixes).
  - memory: mtk-smi: Use devm_clk_get_enabled() (git-fixes).
  - memory: tegra186-emc: drop unused to_tegra186_emc() (git-fixes).
  - spi: bcm63xx: Fix module autoloading (git-fixes).
  - spi: rpc-if: Add missing MODULE_DEVICE_TABLE (git-fixes).
  - spi: meson-spicc: convert comma to semicolon (git-fixes).
  - spi: ppc4xx: handle irq_of_parse_and_map() errors (git-fixes).
  - regulator: core: Fix regulator_is_supported_voltage() kerneldoc
    return value (git-fixes).
  - regulator: core: Fix short description for
    _regulator_check_status_enabled() (git-fixes).
  - regulator: Return actual error in of_regulator_bulk_get_all()
    (git-fixes).
  - regulator: rt5120: Convert comma to semicolon (git-fixes).
  - regulator: wm831x-isink: Convert comma to semicolon (git-fixes).
  - clocksource/drivers/qcom: Add missing iounmap() on errors in
    msm_dt_timer_init() (git-fixes).
  - commit 994b020

++++ pcp:

  - Fix symlink race; CVE-2024-45770; (bsc#1230552)
    + 0012-src-pmpost-pmpost.c-guard-against-possible-symlink-a.patch
  - Fix pmstore corruption; CVE-2024-45769 (bsc#1230551)
    + 0013-src-libpcp-src-p_result.c-correct-buffer-over-run-te.patch
    + 0014-src-libpcp-src-p_result.c-hardening-of-the-result-PD.patch
    + 0015-src-libpcp-src-p_result.c-hardening-of-result-PDU-ev.patch
    + 0016-src-libpcp-src-p_result.c-rework-PDU-integrity-check.patch
    + 0017-src-libpcp-src-p_result.c-re-instate-__pmPrintResult.patch
    + 0018-src-libpcp-src-p_result.c-re-instate-__pmPrintResult.patch
    + 0019-src-libpcp-src-p_result.c-32-bit-fix-for-SUSE-Issue-.patch

++++ tiff:

  - Update to 4.7.0:
    * This version restores in the default build the availability of
    the tools that had been dropped in v4.6.0
    See https://libtiff.gitlab.io/libtiff/rfcs/rfc2_restoring_needed_tools.html#rfc2-restoring-needed-tools
    * Software configuration changes:
    + autoconf build: configure.ac: avoid -Werror passed to CFLAGS to interfere with feature detection
    + autoconf build: fix error when running make clean (fixes issue #630)
    + autoconf build: back off the minimum required automake version to 1.11
    + autoconf.ac: fix detection of windows.h for mingw (fixes issue #605)
    + libtiff-4.pc: Fix Requires.private missing Lerc. It provides a .pc file
    starting from version 4 (in autoconf builds, we assume that liblerc is at least version 4)
    + CMake: Fix TIFF_INCLUDE_DIRS
    + CMake: MinGW compilers don't need a .def file for shared library
    + CMake: move libdeflate and Lerc to Requires.private
    + CMake: enable resource compilation on all Windows.
    * Library changes:
    + Add TIFFOpenOptionsSetMaxCumulatedMemAlloc(). This function complements
    TIFFOpenOptionsSetMaxSingleMemAlloc() to define the maximum cumulated memory
    allocations in byte, for a given TIFF handle, that libtiff internal memory
    allocation functions are allowed.
    + TIFFWriteDirectory(): Avoid overwriting following data if an IFD is enlarged.
    + TIFFXYZToRGB: avoid integer overflow (fixes issue #644)
    + uv_decode() and uv_encode(): avoid potential out-of-bounds array index (fixes issue #645)
    + Fix cases where tif_curdir is set incorrectly. Fix cases where the current directory number (tif_curdir)
    is set inconsistently or incorrectly, depending on the previous history.
    + TIFFRead[Scanline/EncodedStrip/EncodeTile]: 0-initialize output buffer if setupdecode fails ;
    most codecs: zero-initialize (not-yet-written parts of) output buffer if failure (fixes issue #375)
    + OJPEG: reset subsampling_convert_state=0 in OJPEGPreDecode (fixes issue #183)
    + ThunderRLE: fix failure when decoding last run. Bug seen with GhostPDL
    + LERC codec: deal with issues with multi-band PlanarConfig=Contig and NaN values
    + tif_fax3.c: error out after a number of times end-of-file has been reached (fixes issue #583)
    + LZW: avoid warning about misaligned address with UBSAN (fixes issue #616)
    + TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of col/row (fixes issue #622, CVE-2023-52356)
    + tif_dirread.c: only issue TIFFGetFileSize() for large enough RAM requests
    + Avoid FPEs (division by zero) in tif_getimage.c.
    + Avoiding FPE (division by zero) for TIFFhowmany_32() and TIFFhowmany_64() macros by checking for
    denominator not zero before macros are executed. (fixes issue #628)
    + Add non-zero check before division in TIFFComputeStrip()
    + Fix wrong return of TIFFIsBigTIFF() in case byte-swapping is active
    + Setting the TIFFFieldInfo field set_field_type should consider field_writecount not field_readcount
    + Avoid memory leaks when using TIFFCreateDirectory() by releasing the allocated memory in the tif-structure.
    + For non-terminated ASCII arrays, the buffer is first enlarged before a NULL is set at the end to
    avoid deleting the last character. (fixes issue #579)
    + Check return value of _TIFFCreateAnonField(). (fixes issue #624, CVE-2024-7006)
    + Prevent some out-of-memory attacks (https://gitlab.com/libtiff/libtiff/-/issues/614#note_1602683857)
    + Ensure absolute seeking is forced independent of TIFFReadDirectory success. (fixes issue #618)
    + tif_dirinfo.c: re-enable TIFFTAG_EP_CFAREPEATPATTERNDIM and TIFFTAG_EP_CFAPATTERN tags (fixes issue #608)
    + Fix warnings with GCC 14
    + tif_dir.c: Log source file, line number, and input tif for directory count error (fixes issue #627)
    + Last usage of get_field_type of TIFFField structure at TIFFWriteDirectorySec() changed to using set_field_type.
    + tif_jpeg.c/tif_ojpeg.c: remove likely ifdef tricks related to old compilers or unusual setups
    + Remove _TIFFUInt64ToFloat() and _TIFFUInt64ToDouble()
    + Remove support for _MSC_VER < 1500.
    + Use #ifdef _WIN32 to test for Windows, and tiffio.h: remove definition of __WIN32__
    * Documentation:
    + Amend manpages for changes in current directory index behaviour
    + Note on using TIFFFlush() before TIFFClose() to check that the data has been successfully written to the file. (fixes issue #506)
    + Update TIFF documentation about TIFFOpenOptions.rst and TIFFOpenOptionsSetMaxSingleMemAlloc() usage and some other small fixes (relates to CVE-2024-7006)
    * Re-added tools:
    + fax2ps
    + fax2tiff
    + pal2rgb
    + ppm2tiff
    + raw2tiff
    + rgb2ycbcr (not installed)
    + thumbnail (not installed)
    + tiff2bw
    + tiff2rgba
    + tiffcmp
    + tiffcrop
    + tiffdither
    + tiffgt
    + tiffmedian
    + tiff2ps
    + tiff2pdf
    * New/improved functionality:
    + tiff2rgba: Add background gradient option for alpha compositing
    + tiffcp: -i flag restored
    * Bug fixes for tools:
    + tiffcrop: address Coverity scan issues 1605444, 1605445, and 16054
    + tiffcrop: Apply "Fix heap-buffer-overflow in function extractImageSection"
    + tiffcrop: fix buffer overflows, use after free (fixes issue #542, issue #550, issue #552)
    + tiff2pdf: address Coverity scan issues
    + tiff2pdf: fix inconsistent PLANARCONFIG value for the input and output TIFF
    + tiff2pdf: fix issue with JPEG restart-interval marker when converting from JPEG-compressed files (fixes issue #539)
    + tiff2pdf: red and blue were being swapped for RGBA decoding (fixes issue #253)
    + tiff2pdf: fixes issue #596
    + thumbnail: address Coverity scan issues
    + tiffcp: Add check for limitMalloc return to fix Coverity 1603334
    + tiffcp: preserve TIFFTAG_REFERENCEBLACKWHITE when doing YCbCr JPEG -> YCbCr JPEG
    + tiffcp: replace PHOTOMETRIC_YCBCR with PHOTOMETRIC_RGB when outputing to compression != JPEG (refs issue #571)
    + tiffcp: do not copy tags YCBCRCOEFFICIENTS, YCBCRSUBSAMPLING, YCBCRPOSITIONING, REFERENCEBLACKWHITE. Only set YCBCRSUBSAMPLING when generating YCbCr JPEG
    + tiffcp: Check also codec of input image, not only from output image (fixes issue #606)
    + Add some basic sanity checks for tiffcp and tiffcrop RGB->YCbCr JPEG conversions.
    + fax2ps and fax2tiff: memory leak fixes (fixes issue #476)
    + tiffmedian: memory leak fixes (fixes issue #599)
    + fax2tiff: fix EOFB interpretation (fixes issue #191)
    + fax2tiff: fix issue with unreasonable width input (fixes issue #249)
    + tiffcp and tiffcrop: fixes issue #228
    + tiff2rgba: fixes issue #469
    + tiffdither: fixes issue #473
    + tiffdump: fix wrong printf formatter in error message (Coverity 1472932)
    + tiffset: avoid false positive Coverity Scan warning on 64-bit builds (Coverity 1518997)
    + tifcp/tiffset: use correct format specifiers
    * Changes to contributed and unsupported tools
    + contrib/addtiffo: validate return of TIFFWriteEncodedXXXX() calls (Coverity 1024680)
  - Remove patches contained in upstream:
    * tiff-CVE-2023-52356.patch
    * tiff-CVE-2024-7006.patch
  - Tools are not built for now due to test failure: `FAIL: tiffcp-32bpp-None-jpeg.sh`

------------------------------------------------------------------
------------------  2024-9-17  -  Sep 17 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ curl:

  - Make special characters in URL work with aws-sigv4 [bsc#1230516]
    * aws-sigv4: url encode the canonical path [768909d8]
    * Add upstream patch:
  - curl-aws_sigv4-url-encode-the-canonical-path.patch

++++ python-kiwi:

  - Bump version: 10.1.11 → 10.1.12
  - Add missing erofscompression validation
    In the filesystem builder I forgot to evaluate the
    erofscompression attribute. This Fixes #2647

++++ python-kiwi:

  - Bump version: 10.1.11 → 10.1.12
  - Add missing erofscompression validation
    In the filesystem builder I forgot to evaluate the
    erofscompression attribute. This Fixes #2647

++++ python-kiwi:

  - Bump version: 10.1.11 → 10.1.12
  - Add missing erofscompression validation
    In the filesystem builder I forgot to evaluate the
    erofscompression attribute. This Fixes #2647

++++ kernel-default:

  - cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails
    appropriately (git-fixes).
  - ACPI: CPPC: Fix MASK_VAL() usage (git-fixes).
  - ACPI: PMIC: Remove unneeded check in
    tps68470_pmic_opregion_probe() (git-fixes).
  - ACPI: sysfs: validate return type of _STR method (git-fixes).
  - crypto: ccp - do not request interrupt on cmd completion when
    irqs disabled (git-fixes).
  - hwrng: mtk - Use devm_pm_runtime_enable (git-fixes).
  - crypto: ccp - Properly unregister /dev/sev on sev
    PLATFORM_STATUS failure (git-fixes).
  - hwrng: cctrng - Add missing clk_disable_unprepare in
    cctrng_resume (git-fixes).
  - hwrng: bcm2835 - Add missing clk_disable_unprepare in
    bcm2835_rng_init (git-fixes).
  - crypto: iaa - Fix potential use after free bug (git-fixes).
  - crypto: xor - fix template benchmarking (git-fixes).
  - can: m_can: m_can_close(): stop clocks after device has been
    shut down (git-fixes).
  - can: m_can: enable NAPI before enabling interrupts (git-fixes).
  - can: bcm: Clear bo->bcm_proc_read after remove_proc_entry()
    (git-fixes).
  - Bluetooth: btusb: Fix not handling ZPL/short-transfer
    (git-fixes).
  - Bluetooth: hci_sync: Ignore errors from
    HCI_OP_REMOTE_NAME_REQ_CANCEL (git-fixes).
  - Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED
    (git-fixes).
  - wifi: mt76: mt7925: fix a potential array-index-out-of-bounds
    issue for clc (git-fixes).
  - wifi: mt76: mt7615: check devm_kasprintf() returned value
    (git-fixes).
  - wifi: mt76: mt7921: Check devm_kasprintf() returned value
    (git-fixes).
  - wifi: mt76: mt7915: check devm_kasprintf() returned value
    (git-fixes).
  - wifi: mt76: mt7996: fix uninitialized TLV data (git-fixes).
  - wifi: mt76: mt7915: fix rx filter setting for bfee functionality
    (git-fixes).
  - wifi: mt76: mt7603: fix mixed declarations and code (git-fixes).
  - wifi: mt76: connac: fix checksum offload fields of connac3 RXD
    (git-fixes).
  - wifi: mt76: mt7996: fix NULL pointer dereference in
    mt7996_mcu_sta_bfer_he (git-fixes).
  - wifi: mt76: mt7996: fix EHT beamforming capability check
    (git-fixes).
  - wifi: mt76: mt7996: fix HE and EHT beamforming capabilities
    (git-fixes).
  - wifi: mt76: mt7996: fix wmm set of station interface to 3
    (git-fixes).
  - wifi: mt76: mt7996: fix traffic delay when switching back to
    working channel (git-fixes).
  - wifi: mt76: mt7996: use hweight16 to get correct tx antenna
    (git-fixes).
  - wifi: mt76: mt7921: fix wrong UNII-4 freq range check for the
    channel usage (git-fixes).
  - wifi: mt76: mt7915: fix oops on non-dbdc mt7986 (git-fixes).
  - wifi: rtw88: remove CPT execution branch never used (git-fixes).
  - wifi: wilc1000: fix potential RCU dereference issue in
    wilc_parse_join_bss_param (git-fixes).
  - wifi: mac80211: use two-phase skb reclamation in
    ieee80211_do_stop() (git-fixes).
  - wifi: cfg80211: fix two more possible UBSAN-detected off-by-one
    errors (git-fixes).
  - wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
    (git-fixes).
  - wifi: mac80211: fix the comeback long retry times (git-fixes).
  - wifi: cfg80211: fix bug of mapping AF3x to incorrect User
    Priority (git-fixes).
  - wifi: iwlwifi: mvm: increase the time between ranging
    measurements (git-fixes).
  - wifi: mac80211: don't use rate mask for offchannel TX either
    (git-fixes).
  - wifi: ath12k: fix invalid AMPDU factor calculation in
    ath12k_peer_assoc_h_he() (git-fixes).
  - wifi: ath12k: match WMI BSS chan info structure with firmware
    definition (git-fixes).
  - wifi: ath12k: fix BSS chan info request WMI command (git-fixes).
  - wifi: ath9k: Remove error checks when creating debugfs entries
    (git-fixes).
  - wifi: rtw88: always wait for both firmware loading attempts
    (git-fixes).
  - wifi: rtw88: 8822c: Fix reported RX band width (git-fixes).
  - wifi: brcmfmac: introducing fwil query functions (git-fixes).
  - can: j1939: use correct function name in comment (git-fixes).
  - commit ffce0ad

++++ qemu:

  - Fix bsc#1229929, bsc#1230140 (patch already submitted upstream):
    * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)

++++ qemu:

  - Fix bsc#1229929, bsc#1230140 (patch already submitted upstream):
    * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)

++++ qemu:

  - Fix bsc#1229929 (patch already submitted upstream):
    * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)

++++ qemu:

  - Fix bsc#1229929, bsc#1230140 (patch already submitted upstream):
    * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)

++++ qemu:

  - Fix bsc#1229929, bsc#1230140 (patch already submitted upstream):
    * [openSUSE] target/ppc: Fix lxvx/stxvx facility check (bsc#1229929)

------------------------------------------------------------------
------------------  2024-9-16  -  Sep 16 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Include PI and comments in XSL stylesheets
    So far comments and processing instructions (PI) were
    ignored when applying the XSL stylesheets. This commit
    updates all stylesheets to take them into account

++++ python-kiwi:

  - Include PI and comments in XSL stylesheets
    So far comments and processing instructions (PI) were
    ignored when applying the XSL stylesheets. This commit
    updates all stylesheets to take them into account

++++ python-kiwi:

  - Include PI and comments in XSL stylesheets
    So far comments and processing instructions (PI) were
    ignored when applying the XSL stylesheets. This commit
    updates all stylesheets to take them into account

++++ transactional-update:

  - Version 4.8.2
  - Allow specifying only low value with setup-kdump [bsc#1230537]

++++ kernel-default:

  - net: tighten bad gso csum offset check in virtio_net_hdr
    (git-fixes).
  - commit 6b94c45
  - blacklist.conf: add 840b2d39a2dc ("virtio_ring: fix KMSAN error for premapped mode")
  - commit 2b97440
  - KVM: SVM: fix emulation of msr reads/writes of MSR_FS_BASE
    and MSR_GS_BASE (git-fixes).
  - commit aeba695
  - blacklist.conf: add 611ff1b1ae98 ("xen: privcmd: Fix possible access to a freed kirqfd instance")
  - commit d91e53f
  - fscache: delete fscache_cookie_lru_timer when fscache exits
    to avoid  UAF (bsc#1230602).
  - commit d2c95a5
  - Update
    patches.suse/virtio_net-Fix-napi_skb_cache_put-warning.patch
    (git-fixes CVE-2024-43835 bsc#1229289).
  - commit b9542fb
  - x86/hyperv: fix kexec crash due to VP assist page corruption
    (git-fixes).
  - Drivers: hv: vmbus: Fix the misplaced function description
    (git-fixes).
  - commit c60d936
  - Update references
    patches.suse/selinux-smack-don-t-bypass-permissions-check-in-inod.patch
    (stable-fixes CVE-2024-46695 bsc#1230519).
  - commit 2a7bb57
  - NFSv4: Add missing rescheduling points in
    nfs_client_return_marked_delegations (git-fixes).
  - commit a563f31
  - nfsd: Don't leave work of closing files to a work queue
    (bsc#1228140).
  - Refresh
    patches.suse/nfsd-use-__fput_sync-to-avoid-delayed-closing-of-fil.patch.
  - commit 83ce74a

++++ kernel-firmware:

  - Update to version 20240913 (git commit bcbdd1670bc3):
    * amdgpu: update DMCUB to v0.0.233.0 DCN351
    * copy-firmware: Handle links to uncompressed files
    * WHENCE: Fix battmgr.jsn entry type
  - Drop obsoleted workaround patch:
    copy-firmware-fix-symlink-without-compress.patch
  - Temporary revert for ath12k firmware (bsc#1230596)

++++ kernel-firmware:

  - Update to version 20240913 (git commit bcbdd1670bc3):
    * amdgpu: update DMCUB to v0.0.233.0 DCN351
    * copy-firmware: Handle links to uncompressed files
    * WHENCE: Fix battmgr.jsn entry type
  - Drop obsoleted workaround patch:
    copy-firmware-fix-symlink-without-compress.patch
  - Temporary revert for ath12k firmware (bsc#1230596)

------------------------------------------------------------------
------------------  2024-9-15  -  Sep 15 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - ASoC: meson: axg-card: fix 'use-after-free' (git-fixes).
  - ASoC: codecs: avoid possible garbage value in peb2466_reg_read()
    (git-fixes).
  - commit 5a67afd

------------------------------------------------------------------
------------------  2024-9-14  -  Sep 14 2024  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.29.3:
    * show sync files only in debug level
    * chore(watch): Add changed files path/count to log
    * build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0
    * bump compose-go to version v2.2.0
    * Restore compose v1 behavior to recreate containers when ran
    with -V
    * fix linting issues with golangci-lint 1.60.2
    * bump golang to version 1.22.7
    * bump dependencies versions, engine and cli v27.2.1 containerd
    v1.7.22 buildx v0.17.0 buildkit v0.16.0
    * build(deps): bump golang.org/x/sys from 0.22.0 to 0.25.0
    * Fix typos
    * Use logrus instead of direct output to stderr.
    * attach: close streams when done
    * Fix typo in pull.go
    * Allow combination of bind mounts and 'rebuild' watches
    * service hash must exlude depends_on
    * prefer mount API over bind
    * docs: duplicate documentation for root cmd
    * docs(wait): Fix wait command description
    * allow to add empty line in the logs when nav menu activated
    * upgrade docker versions

++++ docker-compose:

  - Update to version 2.29.3:
    * show sync files only in debug level
    * chore(watch): Add changed files path/count to log
    * build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0
    * bump compose-go to version v2.2.0
    * Restore compose v1 behavior to recreate containers when ran
    with -V
    * fix linting issues with golangci-lint 1.60.2
    * bump golang to version 1.22.7
    * bump dependencies versions, engine and cli v27.2.1 containerd
    v1.7.22 buildx v0.17.0 buildkit v0.16.0
    * build(deps): bump golang.org/x/sys from 0.22.0 to 0.25.0
    * Fix typos
    * Use logrus instead of direct output to stderr.
    * attach: close streams when done
    * Fix typo in pull.go
    * Allow combination of bind mounts and 'rebuild' watches
    * service hash must exlude depends_on
    * prefer mount API over bind
    * docs: duplicate documentation for root cmd
    * docs(wait): Fix wait command description
    * allow to add empty line in the logs when nav menu activated
    * upgrade docker versions

++++ docker-compose:

  - Update to version 2.29.3:
    * show sync files only in debug level
    * chore(watch): Add changed files path/count to log
    * build(deps): bump golang.org/x/sync from 0.7.0 to 0.8.0
    * bump compose-go to version v2.2.0
    * Restore compose v1 behavior to recreate containers when ran
    with -V
    * fix linting issues with golangci-lint 1.60.2
    * bump golang to version 1.22.7
    * bump dependencies versions, engine and cli v27.2.1 containerd
    v1.7.22 buildx v0.17.0 buildkit v0.16.0
    * build(deps): bump golang.org/x/sys from 0.22.0 to 0.25.0
    * Fix typos
    * Use logrus instead of direct output to stderr.
    * attach: close streams when done
    * Fix typo in pull.go
    * Allow combination of bind mounts and 'rebuild' watches
    * service hash must exlude depends_on
    * prefer mount API over bind
    * docs: duplicate documentation for root cmd
    * docs(wait): Fix wait command description
    * allow to add empty line in the logs when nav menu activated
    * upgrade docker versions

++++ kernel-default:

  - kABI workaround for soc-qcom pmic_glink changes (CVE-2024-46693
    bsc#1230521).
  - commit 9a06e25
  - usb: typec: ucsi: Move unregister out of atomic section
    (CVE-2024-46691 bsc#1230526).
  - soc: qcom: pmic_glink: Fix race during initialization
    (CVE-2024-46693 bsc#1230521).
  - commit 26dd9b4
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug
    (git-fixes).
  - drm/syncobj: Fix syncobj leak in drm_syncobj_eventfd_ioctl
    (git-fixes).
  - drm/nouveau/fb: restore init() for ramgp102 (git-fixes).
  - dma-buf: heaps: Fix off-by-one in CMA heap fault handler
    (git-fixes).
  - drm/i915/guc: prevent a possible int overflow in wq offsets
    (git-fixes).
  - usbnet: ipheth: race between ipheth_close and error handling
    (stable-fixes).
  - commit 8d8bf2f
  - md/raid1: Fix data corruption for degraded array with slow disk
    (bsc#1230455, CVE-2024-45023).
  - commit 34cd7b5

------------------------------------------------------------------
------------------  2024-9-13  -  Sep 13 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.1.10 → 10.1.11
  - doc: Add login information test build test images
  - Bump version: 10.1.9 → 10.1.10

++++ python-kiwi:

  - Bump version: 10.1.10 → 10.1.11
  - doc: Add login information test build test images
  - Bump version: 10.1.9 → 10.1.10

++++ python-kiwi:

  - Bump version: 10.1.10 → 10.1.11
  - doc: Add login information test build test images
  - Bump version: 10.1.9 → 10.1.10

++++ kernel-default:

  - Revert "mm/sparsemem: fix race in accessing memory_section->usage"
    This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
  - commit 720e36b
  - Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
    This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
  - commit 2fd5290
  - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
    This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
    (bsc#1230413)
  - commit 7e5afd7

++++ kernel-default:

  - perf/x86/intel: Limit the period on Haswell (git-fixes).
  - perf/x86: Fix smp_processor_id()-in-preemptible warnings
    (git-fixes).
  - perf/x86/intel/cstate: Add pkg C2 residency counter for Sierra
    Forest (git-fixes).
  - ARM: 9406/1: Fix callchain_trace() return value (git-fixes).
  - bpf, events: Use prog to emit ksymbol event for main program
    (git-fixes).
  - perf/x86/intel: Add a distinct name for Granite Rapids
    (git-fixes).
  - perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake
    (git-fixes).
  - perf/x86/intel/uncore: Fix the bits of the CHA extended umask
    for SPR (git-fixes).
  - perf: Fix event leak upon exit (git-fixes).
  - perf/x86/intel/cstate: Fix Alderlake/Raptorlake/Meteorlake
    (git-fixes).
  - perf: Fix default aux_watermark calculation (git-fixes).
  - perf: Prevent passing zero nr_pages to rb_alloc_aux()
    (git-fixes).
  - perf: Fix perf_aux_size() for greater-than 32-bit size
    (git-fixes).
  - perf/x86/intel/pt: Fix pt_topa_entry_for_page() address
    calculation (git-fixes).
  - perf/x86/intel/pt: Fix a topa_entry base address calculation
    (git-fixes).
  - perf/x86/intel/pt: Fix topa_entry base length (git-fixes).
  - perf/x86: Serialize set_attr_rdpmc() (git-fixes).
  - perf/core: Fix missing wakeup when waiting for context reference
    (git-fixes).
  - perf/x86/intel: Factor out the initialization code for SPR
    (git fixes).
  - perf/x86/intel: Use the common uarch name for the shared
    functions (git fixes).
  - commit bb48e43
  - blacklist.conf: Add perf git-fix that won't be backported
  - commit fbbd522
  - nvme: move stopping keep-alive into nvme_uninit_ctrl() (CVE-2024-45013 bsc#1230442)
  - commit ce739c4
  - i2c: tegra: Do not mark ACPI devices as irq safe (CVE-2024-45029 bsc#1230451)
  - commit 2870112
  - netfilter: flowtable: initialise extack before use (CVE-2024-45018 bsc#1230431)
  - commit 8b44b15
  - net/mlx5e: Take state lock during tx timeout reporter (CVE-2024-45019 bsc#1230432)
  - commit 2552371
  - net/mlx5: Fix IPsec RoCE MPV trace call (CVE-2024-45017 bsc#1230430)
  - commit 60aac02
  - igb: cope with large MAX_SKB_FRAGS (CVE-2024-45030 bsc#1230457)
  - commit d2d3c69
  - Move s390 kabi patch into the kabi section
  - commit 4ab5d36
  - s390/uv: Don't call folio_wait_writeback() without a folio
    reference (git-fixes bsc#1229380 CVE-2024-43832).
  - s390/mm: Convert gmap_make_secure to use a folio (git-fixes
    bsc#1230562).
  - s390/mm: Convert make_page_secure to use a folio (git-fixes
    bsc#1230563).
  - s390: allow pte_offset_map_lock() to fail (git-fixes
    bsc#1230564).
  - commit 7069eb7
  - mm/vmalloc: fix page mapping if vm_area_alloc_pages() with
    high order fallback to order 0 (CVE-2024-45022 bsc#1230435).
  - commit cc8880a
  - Revert "mm/sparsemem: fix race in accessing memory_section->usage"
    This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680 to fix a regression (bsc#1230413)
  - commit 720e36b
  - Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
    This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741 to fix a regression (bsc#1230413)
  - commit 2fd5290
  - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
    This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe to fix a refression
    (bsc#1230413)
  - commit 7e5afd7
  - memcg_write_event_control(): fix a user-triggerable oops
    (CVE-2024-45021 bsc#1230434).
  - commit 99a85a8
  - platform/x86: panasonic-laptop: Allocate 1 entry extra in the
    sinf array (git-fixes).
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds
    accesses (git-fixes).
  - usb: dwc3: core: update LC timer as per USB Spec V3.2
    (stable-fixes).
  - lib/generic-radix-tree.c: Fix rare race in
    __genradix_ptr_alloc() (stable-fixes).
  - kselftests: dmabuf-heaps: Ensure the driver name is
    null-terminated (stable-fixes).
  - regmap: maple: work around gcc-14.1 false-positive warning
    (stable-fixes).
  - phy: zynqmp: Take the phy mutex in xlate (stable-fixes).
  - pcmcia: Use resource_size function on resource object
    (stable-fixes).
  - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
    (stable-fixes).
  - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
    (stable-fixes).
  - PCI: Add missing bridge lock to pci_bus_lock() (stable-fixes).
  - usb: gadget: aspeed_udc: validate endpoint index for ast udc
    (stable-fixes).
  - usb: uas: set host status byte on data completion error
    (stable-fixes).
  - media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
    (stable-fixes).
  - media: vivid: don't set HDMI TX controls if there are no HDMI
    outputs (stable-fixes).
  - media: vivid: fix wrong sizeimage value for mplane
    (stable-fixes).
  - leds: spi-byte: Call of_node_put() on error path (stable-fixes).
  - wifi: rtw88: usb: schedule rx work after everything is set up
    (stable-fixes).
  - wifi: rtw89: wow: prevent to send unexpected H2C during download
    Firmware (stable-fixes).
  - wifi: mwifiex: Do not return unused priv in
    mwifiex_get_priv_by_id() (stable-fixes).
  - wifi: ath12k: fix firmware crash due to invalid peer nss
    (stable-fixes).
  - wifi: ath12k: fix uninitialize symbol error on
    ath12k_peer_assoc_h_he() (stable-fixes).
  - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
    (stable-fixes).
  - wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check
    (stable-fixes).
  - commit 3b57fa8
  - Squashfs: sanity check symbolic link size (git-fixes).
  - commit fa6af4a
  - hwmon: (pmbus) Conditionally clear individual status bits for
    pmbus rev >= 1.2 (git-fixes).
  - Input: uinput - reject requests with unreasonable number of
    slots (stable-fixes).
  - HID: amd_sfh: free driver_data after destroying hid device
    (stable-fixes).
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
    (stable-fixes).
  - i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA
    setup (stable-fixes).
  - Input: ili210x - use kvmalloc() to allocate buffer for firmware
    update (stable-fixes).
  - drm/amdgpu: reject gang submit on reserved VMIDs (stable-fixes).
  - drm/amdgpu: Set no_hw_access when VF request full GPU fails
    (stable-fixes).
  - drm/amdgpu/display: handle gfx12 in
    amdgpu_dm_plane_format_mod_supported (stable-fixes).
  - drm/amdgpu: handle gfx12 in amdgpu_display_verify_sizes
    (stable-fixes).
  - drm/amdgpu: check for LINEAR_ALIGNED correctly in
    check_tiling_flags_gfx6 (stable-fixes).
  - drm/amd/display: Check denominator pbn_div before used
    (stable-fixes).
  - drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts
    (stable-fixes).
  - drm/amdgpu: Fix smatch static checker warning (stable-fixes).
  - drm/amdgpu: add missing error handling in function
    amdgpu_gmc_flush_gpu_tlb_pasid (stable-fixes).
  - drm/amd/display: Check HDCP returned status (stable-fixes).
  - hwmon: (w83627ehf) Fix underflows seen when writing limit
    attributes (stable-fixes).
  - hwmon: (nct6775-core) Fix underflows seen when writing limit
    attributes (stable-fixes).
  - hwmon: (lm95234) Fix underflows seen when writing limit
    attributes (stable-fixes).
  - hwmon: (adc128d818) Fix underflows seen when writing limit
    attributes (stable-fixes).
  - commit 2fa929e
  - Revert "mm/sparsemem: fix race in accessing memory_section->usage"
    This reverts commit 6aa8957889611fbe7f06353f917cfb3d9620a680.
  - commit 5376e5a
  - Revert "mm, kmsan: fix infinite recursion due to RCU critical section"
    This reverts commit 16ad73a9f4c2888f3bc28513f5e9a88d753f8741.
  - commit 505329c
  - Revert "mm: prevent derefencing NULL ptr in pfn_section_valid()"
    This reverts commit 35f619d3c421219e07bc89d2d6a37fbff25519fe.
  - commit 937414d
  - ata: libata: Fix memory leak for error path in ata_host_alloc()
    (git-fixes).
  - devres: Initialize an uninitialized struct member
    (stable-fixes).
  - ASoc: TAS2781: replace beXX_to_cpup with get_unaligned_beXX
    for potentially broken alignment (stable-fixes).
  - ASoC: topology: Properly initialize soc_enum values
    (stable-fixes).
  - ALSA: hda: Add input value sanity checks to HDMI channel map
    controls (stable-fixes).
  - ALSA: control: Apply sanity check of input values for user
    elements (stable-fixes).
  - crypto: qat - fix unintentional re-enabling of error interrupts
    (stable-fixes).
  - drm/amd/display: Run DC_LOG_DC after checking link->link_enc
    (stable-fixes).
  - drm/amd/display: Check UnboundedRequestEnabled's value
    (stable-fixes).
  - drm/amd: Add gfx12 swizzle mode defs (stable-fixes).
  - Bluetooth: btnxpuart: Fix Null pointer dereference in
    btnxpuart_flush() (stable-fixes).
  - can: mcp251xfd: rx: add workaround for erratum DS80000789E 6
    of mcp2518fd (stable-fixes).
  - can: mcp251xfd: rx: prepare to workaround broken RX FIFO head
    index erratum (stable-fixes).
  - can: mcp251xfd: mcp251xfd_handle_rxif_ring_uinc(): factor out
    in separate function (stable-fixes).
  - can: mcp251xfd: clarify the meaning of timestamp (stable-fixes).
  - can: kvaser_pciefd: Skip redundant NULL pointer check in ISR
    (stable-fixes).
  - ACPI: processor: Fix memory leaks in error paths of
    processor_add() (stable-fixes).
  - ACPI: processor: Return an error if acpi_processor_get_info()
    fails in processor_add() (stable-fixes).
  - cpufreq: amd-pstate: fix the highest frequency issue which
    limits performance (git-fixes).
  - cpufreq: amd-pstate: Enable amd-pstate preferred core support
    (stable-fixes).
  - ACPI: CPPC: Add helper to get the highest performance value
    (stable-fixes).
  - Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync
    queue (stable-fixes).
  - Bluetooth: hci_event: Use HCI error defines instead of magic
    values (stable-fixes).
  - commit 96be389

++++ kernel-firmware:

  - Update to version 20240912 (git commit 47c72fee8fe3):
    * amdgpu: Add VPE 6.1.3 microcode
    * amdgpu: add SDMA 6.1.2 microcode
    * amdgpu: Add support for PSP 14.0.4
    * amdgpu: add GC 11.5.2 microcode
    * qcom: qcm6490: add ADSP and CDSP firmware
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - Temporary fix for the missing symlink installations:
    copy-firmware-fix-symlink-without-compress.patch

++++ kernel-firmware:

  - Update to version 20240912 (git commit 47c72fee8fe3):
    * amdgpu: Add VPE 6.1.3 microcode
    * amdgpu: add SDMA 6.1.2 microcode
    * amdgpu: Add support for PSP 14.0.4
    * amdgpu: add GC 11.5.2 microcode
    * qcom: qcm6490: add ADSP and CDSP firmware
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - Temporary fix for the missing symlink installations:
    copy-firmware-fix-symlink-without-compress.patch

++++ systemd:

  - Add 0001-udev-restore-some-legacy-symlinks-to-maintain-backwa.patch
    Given that SLE16 will be based on SLFO, we have no choice but to continue
    supporting these compat symlinks. This compatibility code is no longer
    maintained in the Git repository though, as we primarily backport upstream
    commits these days. Additionally, the compat code rarely changes and often
    causes conflicts when merged into recent versions of systemd.

++++ systemd:

  - Add 0001-udev-restore-some-legacy-symlinks-to-maintain-backwa.patch
    Given that SLE16 will be based on SLFO, we have no choice but to continue
    supporting these compat symlinks. This compatibility code is no longer
    maintained in the Git repository though, as we primarily backport upstream
    commits these days. Additionally, the compat code rarely changes and often
    causes conflicts when merged into recent versions of systemd.

++++ systemd:

  - Add 0001-udev-restore-some-legacy-symlinks-to-maintain-backwa.patch
    Given that SLE16 will be based on SLFO, we have no choice but to continue
    supporting these compat symlinks. This compatibility code is no longer
    maintained in the Git repository though, as we primarily backport upstream
    commits these days. Additionally, the compat code rarely changes and often
    causes conflicts when merged into recent versions of systemd.

++++ systemd:

  - Add 0001-udev-restore-some-legacy-symlinks-to-maintain-backwa.patch
    Given that SLE16 will be based on SLFO, we have no choice but to continue
    supporting these compat symlinks. This compatibility code is no longer
    maintained in the Git repository though, as we primarily backport upstream
    commits these days. Additionally, the compat code rarely changes and often
    causes conflicts when merged into recent versions of systemd.

++++ systemd:

  - Add 0001-udev-restore-some-legacy-symlinks-to-maintain-backwa.patch
    Given that SLE16 will be based on SLFO, we have no choice but to continue
    supporting these compat symlinks. This compatibility code is no longer
    maintained in the Git repository though, as we primarily backport upstream
    commits these days. Additionally, the compat code rarely changes and often
    causes conflicts when merged into recent versions of systemd.

++++ systemd:

  - Add 0001-udev-restore-some-legacy-symlinks-to-maintain-backwa.patch
    Given that SLE16 will be based on SLFO, we have no choice but to continue
    supporting these compat symlinks. This compatibility code is no longer
    maintained in the Git repository though, as we primarily backport upstream
    commits these days. Additionally, the compat code rarely changes and often
    causes conflicts when merged into recent versions of systemd.

++++ suseconnect-ng:

  - Update version to 1.12:
  - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014)

++++ suseconnect-ng:

  - Update version to 1.12:
  - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014)

++++ suseconnect-ng:

  - Update version to 1.12:
  - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014)

++++ suseconnect-ng:

  - Update version to 1.12:
  - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014)

++++ suseconnect-ng:

  - Update version to 1.12:
  - Set the filesystem root on zypper when given (bsc#1230229,bsc#1229014)

------------------------------------------------------------------
------------------  2024-9-12  -  Sep 12 2024  -------------------
------------------------------------------------------------------

++++ afterburn:

  - enable all arches

++++ afterburn:

  - enable all arches

++++ python-kiwi:

  - bootloader: Fix up ppc64 bootinfo again
    To make the code look pretty extra newline is inserted at the start of
    bootinfo file. This appears to break boot on Power9 PowerVM LPARs.
  - Add support for erofs
    erofs is an alternative readonly filesystem that can be
    used as alternative to squashfs. This Fixes #2633
  - Fixed enclave integration test
    The SELinux policy of Fedora Rawhide when running completely in
    an initrd is not suitable to let the system boot up. Thus the
    current solution is to boot in permissive mode. A better solution
    for the future would probably be a selinux policy for enclaves

++++ python-kiwi:

  - bootloader: Fix up ppc64 bootinfo again
    To make the code look pretty extra newline is inserted at the start of
    bootinfo file. This appears to break boot on Power9 PowerVM LPARs.
  - Add support for erofs
    erofs is an alternative readonly filesystem that can be
    used as alternative to squashfs. This Fixes #2633
  - Fixed enclave integration test
    The SELinux policy of Fedora Rawhide when running completely in
    an initrd is not suitable to let the system boot up. Thus the
    current solution is to boot in permissive mode. A better solution
    for the future would probably be a selinux policy for enclaves

++++ python-kiwi:

  - bootloader: Fix up ppc64 bootinfo again
    To make the code look pretty extra newline is inserted at the start of
    bootinfo file. This appears to break boot on Power9 PowerVM LPARs.
  - Add support for erofs
    erofs is an alternative readonly filesystem that can be
    used as alternative to squashfs. This Fixes #2633
  - Fixed enclave integration test
    The SELinux policy of Fedora Rawhide when running completely in
    an initrd is not suitable to let the system boot up. Thus the
    current solution is to boot in permissive mode. A better solution
    for the future would probably be a selinux policy for enclaves

++++ kernel-default:

  - virtio_net: Fix napi_skb_cache_put warning (git-fixes).
  - commit 860ef0a
  - virtio_net: fixing XDP for fully checksummed packets handling
    (git-fixes).
  - commit 77fb9e7
  - s390/dasd: Fix redundant /proc/dasd* entries removal
    (bsc#1227694).
  - commit b66530a
  - Move upstreamed input patch into sorted section
  - commit e197a51
  - blacklist.conf: add db5247d9bf5c ("vhost_task: Handle SIGKILL by flushing work and exiting")
  - commit 7acfcbb
  - KVM: SVM: Don't advertise Bus Lock Detect to guest if SVM
    support is missing (git-fixes).
  - commit 42f7b0c
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
    (git-fixes).
  - commit 610cfdd
  - KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
    (git-fixes).
  - commit bae7627
  - kABI: Workaround kABI change in
    patches.suse/iommu-dma-Trace-bounce-buffer-usage-when-mapping-buf.patch
    (git-fixes).
  - Refresh
    patches.suse/iommu-dma-Trace-bounce-buffer-usage-when-mapping-buf.patch.
  - commit d37ca1f
  - blacklist.conf: add 778c350eb580 ("Revert KVM: async_pf: avoid recursive flushing of work items")
  - commit 3ff1683
  - KVM: arm64: Do not re-initialize the KVM lock (git-fixes).
  - commit b05c6c8
  - s390/dasd: Remove DMA alignment (LTC#208933 bsc#1230426
    git-fixes).
  - commit 5b1f3c2
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in
    vgic_v2_parse_attr() (git-fixes).
  - commit 4ccaaf2
  - KVM: arm64: Don't pass a TLBI level hint when zapping table
    entries (git-fixes).
  - commit e3cb3e5
  - blacklist.conf: add f62d4c3eb687 ("KVM: arm64: Don't defer TLB invalidation when zapping table entries")
  - commit 80a75dc
  - blacklist.conf: add c60d847be7b8 ("KVM: arm64: Fix double-free following kvm_pgtable_stage2_free_unlinked()")
  - commit 518faac
  - KVM: arm64: nvhe: Ignore SVE hint in SMCCC function ID
    (git-fixes).
  - commit 9d7939a
  - KVM: arm64: Block unsafe FF-A calls from the host (git-fixes).
  - commit 6327e50
  - minmax: reduce min/max macro expansion in atomisp driver
    (git-fixes).
  - commit 6d37707
  - net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (CVE-2024-44971 bsc#1230211)
  - commit f262d95
  - tcp: prevent concurrent execution of tcp_sk_exit_batch (CVE-2024-44991 bsc#1230195)
  - commit 179b01d

++++ libzypp:

  - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267)
    It's preferred to explicitly tell the root directory of the
    system whose database you want to query.
  - version 17.35.11 (35)

++++ libzypp:

  - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267)
    It's preferred to explicitly tell the root directory of the
    system whose database you want to query.
  - version 17.35.11 (35)

++++ libzypp:

  - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267)
    It's preferred to explicitly tell the root directory of the
    system whose database you want to query.
  - version 17.35.11 (35)

++++ libzypp:

  - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267)
    It's preferred to explicitly tell the root directory of the
    system whose database you want to query.
  - version 17.35.11 (35)

++++ libzypp:

  - Deprecate librpmDb::db_const_iterator default ctor (bsc#1230267)
    It's preferred to explicitly tell the root directory of the
    system whose database you want to query.
  - version 17.35.11 (35)

------------------------------------------------------------------
------------------  2024-9-11  -  Sep 11 2024  -------------------
------------------------------------------------------------------

++++ audit-secondary:

  - Fix plugin termination when using systemd service units (bsc#1215377)
    * add auditd.service-fix-plugin-termination.patch

++++ cloud-regionsrv-client:

  - Update to 10.3.5
    + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies

++++ cloud-regionsrv-client:

  - Update to 10.3.5
    + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies

++++ cloud-regionsrv-client:

  - Update to 10.3.5
    + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies

++++ cloud-regionsrv-client:

  - Update to 10.3.5
    + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies

++++ cloud-regionsrv-client:

  - Update to 10.3.5
    + Update spec file to build in all code streams,
    SLE 12, SLE 15, ALP, and SLFO and have proper dependencies

++++ containerd:

  - Update to containerd v1.7.22. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.22>
  - Bump minimum Go version to 1.22.
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.22. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.22>
  - Bump minimum Go version to 1.22.
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.22. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.22>
  - Bump minimum Go version to 1.22.
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ curl:

  - Update to version 8.10.0:
    * Security fixes:
  - [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS
    * Changes:
  - curl: make --rate accept "number of units"
  - curl: make --show-headers the same as --include
  - curl: support --dump-header % to direct to stderr
  - curl: support embedding a CA bundle and --dump-ca-embed
  - curl: support repeated use of the verbose option; -vv etc
  - curl: use libuv for parallel transfers with --test-event
  - vtls: stop offering alpn http/1.1 for http2-prior-knowledge
    * Bugfixes:
  - curl: allow 500MB data URL encode strings
  - curl: warn on unsupported SSL options
  - Curl_rand_bytes to control env override
  - curl_sha512_256: fix symbol collisions with nettle library
  - dist: fix reproducible build from release tarball
  - http2: fix GOAWAY message sent to server
  - http2: improve rate limiting of downloads
  - INSTALL.md: MultiSSL and QUIC are mutually exclusive
  - lib: add eos flag to send methods
  - lib: make SSPI global symbols use Curl_ prefix
  - lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name
  - lib: remove the final strncpy() calls
  - lib: remove use of RANDOM_FILE
  - Makefile.mk: fixup enabling libidn2
  - max-filesize.md: mention zero disables the limit
  - mime: avoid inifite loop in client reader
  - ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks
  - openssl quic: fix memory leak
  - openssl: certinfo errors now fail correctly
  - openssl: fix the data race when sharing an SSL session between threads
  - openssl: improve shutdown handling
  - POP3: fix multi-line responses
  - pop3: use the protocol handler ->write_resp
  - progress: ratelimit/progress tweaks
  - rand: only provide weak random when needed
  - sectransp: fix setting tls version
  - setopt: make CURLOPT_TFTP_BLKSIZE accept bad values
  - sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL
  - sigpipe: init the struct so that first apply ignores
  - smb: convert superflous assign into assert
  - smtp: add tracing feature
  - spnego_gssapi: implement TLS channel bindings for openssl
  - src: delete `curlx_m*printf()` aliases
  - ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)
  - tool_operhlp: fix "potentially uninitialized local variable 'pc' used"
  - tool_paramhlp: bump maximum post data size in memory to 16GB
  - transfer: skip EOS read when download done
  - url: fix connection reuse for HTTP/2 upgrades
  - urlapi: verify URL *decoded* hostname when set
  - urldata: introduce `data->mid`, a unique identifier inside a multi
  - vtls: add SSLSUPP_CIPHER_LIST
  - vtls: fix static function name collisions between TLS backends
  - vtls: init ssl peer only once
  - websocket: introduce blocking sends
  - ws: flags to opcodes should ignore CURLWS_CONT flag
  - x509asn1: raise size limit for x509 certification information
    * Remove curl-sigpipe.patch upstream
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to version 8.10.0:
    * Security fixes:
  - [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS
    * Changes:
  - curl: make --rate accept "number of units"
  - curl: make --show-headers the same as --include
  - curl: support --dump-header % to direct to stderr
  - curl: support embedding a CA bundle and --dump-ca-embed
  - curl: support repeated use of the verbose option; -vv etc
  - curl: use libuv for parallel transfers with --test-event
  - vtls: stop offering alpn http/1.1 for http2-prior-knowledge
    * Bugfixes:
  - curl: allow 500MB data URL encode strings
  - curl: warn on unsupported SSL options
  - Curl_rand_bytes to control env override
  - curl_sha512_256: fix symbol collisions with nettle library
  - dist: fix reproducible build from release tarball
  - http2: fix GOAWAY message sent to server
  - http2: improve rate limiting of downloads
  - INSTALL.md: MultiSSL and QUIC are mutually exclusive
  - lib: add eos flag to send methods
  - lib: make SSPI global symbols use Curl_ prefix
  - lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name
  - lib: remove the final strncpy() calls
  - lib: remove use of RANDOM_FILE
  - Makefile.mk: fixup enabling libidn2
  - max-filesize.md: mention zero disables the limit
  - mime: avoid inifite loop in client reader
  - ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks
  - openssl quic: fix memory leak
  - openssl: certinfo errors now fail correctly
  - openssl: fix the data race when sharing an SSL session between threads
  - openssl: improve shutdown handling
  - POP3: fix multi-line responses
  - pop3: use the protocol handler ->write_resp
  - progress: ratelimit/progress tweaks
  - rand: only provide weak random when needed
  - sectransp: fix setting tls version
  - setopt: make CURLOPT_TFTP_BLKSIZE accept bad values
  - sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL
  - sigpipe: init the struct so that first apply ignores
  - smb: convert superflous assign into assert
  - smtp: add tracing feature
  - spnego_gssapi: implement TLS channel bindings for openssl
  - src: delete `curlx_m*printf()` aliases
  - ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)
  - tool_operhlp: fix "potentially uninitialized local variable 'pc' used"
  - tool_paramhlp: bump maximum post data size in memory to 16GB
  - transfer: skip EOS read when download done
  - url: fix connection reuse for HTTP/2 upgrades
  - urlapi: verify URL *decoded* hostname when set
  - urldata: introduce `data->mid`, a unique identifier inside a multi
  - vtls: add SSLSUPP_CIPHER_LIST
  - vtls: fix static function name collisions between TLS backends
  - vtls: init ssl peer only once
  - websocket: introduce blocking sends
  - ws: flags to opcodes should ignore CURLWS_CONT flag
  - x509asn1: raise size limit for x509 certification information
    * Remove curl-sigpipe.patch upstream
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to version 8.10.0:
    * Security fixes:
  - [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS
    * Changes:
  - curl: make --rate accept "number of units"
  - curl: make --show-headers the same as --include
  - curl: support --dump-header % to direct to stderr
  - curl: support embedding a CA bundle and --dump-ca-embed
  - curl: support repeated use of the verbose option; -vv etc
  - curl: use libuv for parallel transfers with --test-event
  - vtls: stop offering alpn http/1.1 for http2-prior-knowledge
    * Bugfixes:
  - curl: allow 500MB data URL encode strings
  - curl: warn on unsupported SSL options
  - Curl_rand_bytes to control env override
  - curl_sha512_256: fix symbol collisions with nettle library
  - dist: fix reproducible build from release tarball
  - http2: fix GOAWAY message sent to server
  - http2: improve rate limiting of downloads
  - INSTALL.md: MultiSSL and QUIC are mutually exclusive
  - lib: add eos flag to send methods
  - lib: make SSPI global symbols use Curl_ prefix
  - lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name
  - lib: remove the final strncpy() calls
  - lib: remove use of RANDOM_FILE
  - Makefile.mk: fixup enabling libidn2
  - max-filesize.md: mention zero disables the limit
  - mime: avoid inifite loop in client reader
  - ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks
  - openssl quic: fix memory leak
  - openssl: certinfo errors now fail correctly
  - openssl: fix the data race when sharing an SSL session between threads
  - openssl: improve shutdown handling
  - POP3: fix multi-line responses
  - pop3: use the protocol handler ->write_resp
  - progress: ratelimit/progress tweaks
  - rand: only provide weak random when needed
  - sectransp: fix setting tls version
  - setopt: make CURLOPT_TFTP_BLKSIZE accept bad values
  - sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL
  - sigpipe: init the struct so that first apply ignores
  - smb: convert superflous assign into assert
  - smtp: add tracing feature
  - spnego_gssapi: implement TLS channel bindings for openssl
  - src: delete `curlx_m*printf()` aliases
  - ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)
  - tool_operhlp: fix "potentially uninitialized local variable 'pc' used"
  - tool_paramhlp: bump maximum post data size in memory to 16GB
  - transfer: skip EOS read when download done
  - url: fix connection reuse for HTTP/2 upgrades
  - urlapi: verify URL *decoded* hostname when set
  - urldata: introduce `data->mid`, a unique identifier inside a multi
  - vtls: add SSLSUPP_CIPHER_LIST
  - vtls: fix static function name collisions between TLS backends
  - vtls: init ssl peer only once
  - websocket: introduce blocking sends
  - ws: flags to opcodes should ignore CURLWS_CONT flag
  - x509asn1: raise size limit for x509 certification information
    * Remove curl-sigpipe.patch upstream
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to version 8.10.0:
    * Security fixes:
  - [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS
    * Changes:
  - curl: make --rate accept "number of units"
  - curl: make --show-headers the same as --include
  - curl: support --dump-header % to direct to stderr
  - curl: support embedding a CA bundle and --dump-ca-embed
  - curl: support repeated use of the verbose option; -vv etc
  - curl: use libuv for parallel transfers with --test-event
  - vtls: stop offering alpn http/1.1 for http2-prior-knowledge
    * Bugfixes:
  - curl: allow 500MB data URL encode strings
  - curl: warn on unsupported SSL options
  - Curl_rand_bytes to control env override
  - curl_sha512_256: fix symbol collisions with nettle library
  - dist: fix reproducible build from release tarball
  - http2: fix GOAWAY message sent to server
  - http2: improve rate limiting of downloads
  - INSTALL.md: MultiSSL and QUIC are mutually exclusive
  - lib: add eos flag to send methods
  - lib: make SSPI global symbols use Curl_ prefix
  - lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name
  - lib: remove the final strncpy() calls
  - lib: remove use of RANDOM_FILE
  - Makefile.mk: fixup enabling libidn2
  - max-filesize.md: mention zero disables the limit
  - mime: avoid inifite loop in client reader
  - ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks
  - openssl quic: fix memory leak
  - openssl: certinfo errors now fail correctly
  - openssl: fix the data race when sharing an SSL session between threads
  - openssl: improve shutdown handling
  - POP3: fix multi-line responses
  - pop3: use the protocol handler ->write_resp
  - progress: ratelimit/progress tweaks
  - rand: only provide weak random when needed
  - sectransp: fix setting tls version
  - setopt: make CURLOPT_TFTP_BLKSIZE accept bad values
  - sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL
  - sigpipe: init the struct so that first apply ignores
  - smb: convert superflous assign into assert
  - smtp: add tracing feature
  - spnego_gssapi: implement TLS channel bindings for openssl
  - src: delete `curlx_m*printf()` aliases
  - ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)
  - tool_operhlp: fix "potentially uninitialized local variable 'pc' used"
  - tool_paramhlp: bump maximum post data size in memory to 16GB
  - transfer: skip EOS read when download done
  - url: fix connection reuse for HTTP/2 upgrades
  - urlapi: verify URL *decoded* hostname when set
  - urldata: introduce `data->mid`, a unique identifier inside a multi
  - vtls: add SSLSUPP_CIPHER_LIST
  - vtls: fix static function name collisions between TLS backends
  - vtls: init ssl peer only once
  - websocket: introduce blocking sends
  - ws: flags to opcodes should ignore CURLWS_CONT flag
  - x509asn1: raise size limit for x509 certification information
    * Remove curl-sigpipe.patch upstream
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to version 8.10.0:
    * Security fixes:
  - [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS
    * Changes:
  - curl: make --rate accept "number of units"
  - curl: make --show-headers the same as --include
  - curl: support --dump-header % to direct to stderr
  - curl: support embedding a CA bundle and --dump-ca-embed
  - curl: support repeated use of the verbose option; -vv etc
  - curl: use libuv for parallel transfers with --test-event
  - vtls: stop offering alpn http/1.1 for http2-prior-knowledge
    * Bugfixes:
  - curl: allow 500MB data URL encode strings
  - curl: warn on unsupported SSL options
  - Curl_rand_bytes to control env override
  - curl_sha512_256: fix symbol collisions with nettle library
  - dist: fix reproducible build from release tarball
  - http2: fix GOAWAY message sent to server
  - http2: improve rate limiting of downloads
  - INSTALL.md: MultiSSL and QUIC are mutually exclusive
  - lib: add eos flag to send methods
  - lib: make SSPI global symbols use Curl_ prefix
  - lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name
  - lib: remove the final strncpy() calls
  - lib: remove use of RANDOM_FILE
  - Makefile.mk: fixup enabling libidn2
  - max-filesize.md: mention zero disables the limit
  - mime: avoid inifite loop in client reader
  - ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks
  - openssl quic: fix memory leak
  - openssl: certinfo errors now fail correctly
  - openssl: fix the data race when sharing an SSL session between threads
  - openssl: improve shutdown handling
  - POP3: fix multi-line responses
  - pop3: use the protocol handler ->write_resp
  - progress: ratelimit/progress tweaks
  - rand: only provide weak random when needed
  - sectransp: fix setting tls version
  - setopt: make CURLOPT_TFTP_BLKSIZE accept bad values
  - sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL
  - sigpipe: init the struct so that first apply ignores
  - smb: convert superflous assign into assert
  - smtp: add tracing feature
  - spnego_gssapi: implement TLS channel bindings for openssl
  - src: delete `curlx_m*printf()` aliases
  - ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)
  - tool_operhlp: fix "potentially uninitialized local variable 'pc' used"
  - tool_paramhlp: bump maximum post data size in memory to 16GB
  - transfer: skip EOS read when download done
  - url: fix connection reuse for HTTP/2 upgrades
  - urlapi: verify URL *decoded* hostname when set
  - urldata: introduce `data->mid`, a unique identifier inside a multi
  - vtls: add SSLSUPP_CIPHER_LIST
  - vtls: fix static function name collisions between TLS backends
  - vtls: init ssl peer only once
  - websocket: introduce blocking sends
  - ws: flags to opcodes should ignore CURLWS_CONT flag
  - x509asn1: raise size limit for x509 certification information
    * Remove curl-sigpipe.patch upstream
    * Rebase curl-secure-getenv.patch

++++ curl:

  - Update to version 8.10.0:
    * Security fixes:
  - [bsc#1230093, CVE-2024-8096] curl: OCSP stapling bypass with GnuTLS
    * Changes:
  - curl: make --rate accept "number of units"
  - curl: make --show-headers the same as --include
  - curl: support --dump-header % to direct to stderr
  - curl: support embedding a CA bundle and --dump-ca-embed
  - curl: support repeated use of the verbose option; -vv etc
  - curl: use libuv for parallel transfers with --test-event
  - vtls: stop offering alpn http/1.1 for http2-prior-knowledge
    * Bugfixes:
  - curl: allow 500MB data URL encode strings
  - curl: warn on unsupported SSL options
  - Curl_rand_bytes to control env override
  - curl_sha512_256: fix symbol collisions with nettle library
  - dist: fix reproducible build from release tarball
  - http2: fix GOAWAY message sent to server
  - http2: improve rate limiting of downloads
  - INSTALL.md: MultiSSL and QUIC are mutually exclusive
  - lib: add eos flag to send methods
  - lib: make SSPI global symbols use Curl_ prefix
  - lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name
  - lib: remove the final strncpy() calls
  - lib: remove use of RANDOM_FILE
  - Makefile.mk: fixup enabling libidn2
  - max-filesize.md: mention zero disables the limit
  - mime: avoid inifite loop in client reader
  - ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks
  - openssl quic: fix memory leak
  - openssl: certinfo errors now fail correctly
  - openssl: fix the data race when sharing an SSL session between threads
  - openssl: improve shutdown handling
  - POP3: fix multi-line responses
  - pop3: use the protocol handler ->write_resp
  - progress: ratelimit/progress tweaks
  - rand: only provide weak random when needed
  - sectransp: fix setting tls version
  - setopt: make CURLOPT_TFTP_BLKSIZE accept bad values
  - sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL
  - sigpipe: init the struct so that first apply ignores
  - smb: convert superflous assign into assert
  - smtp: add tracing feature
  - spnego_gssapi: implement TLS channel bindings for openssl
  - src: delete `curlx_m*printf()` aliases
  - ssh: deduplicate SSH backend includes (and fix libssh cmake unity build)
  - tool_operhlp: fix "potentially uninitialized local variable 'pc' used"
  - tool_paramhlp: bump maximum post data size in memory to 16GB
  - transfer: skip EOS read when download done
  - url: fix connection reuse for HTTP/2 upgrades
  - urlapi: verify URL *decoded* hostname when set
  - urldata: introduce `data->mid`, a unique identifier inside a multi
  - vtls: add SSLSUPP_CIPHER_LIST
  - vtls: fix static function name collisions between TLS backends
  - vtls: init ssl peer only once
  - websocket: introduce blocking sends
  - ws: flags to opcodes should ignore CURLWS_CONT flag
  - x509asn1: raise size limit for x509 certification information
    * Remove curl-sigpipe.patch upstream
    * Rebase curl-secure-getenv.patch

++++ python-kiwi:

  - limit eif_build requires to fedora >= 42
  - Bump version: 10.1.8 → 10.1.9
  - Added sshd to nitro-enclave integration test
  - Fixed container sync options
    Do not exclude/filter any security/xattr capabilities.
  - Update container integration test
    Add getcap to check on filesystem capabilities
  - Add new build type provides for enclave
    Add a provides tag (read by the open buildservice) for the new
    enclave builder. Also add a recommends to eif_builder in
    the systemdeps-core meta package

++++ python-kiwi:

  - limit eif_build requires to fedora >= 42
  - Bump version: 10.1.8 → 10.1.9
  - Added sshd to nitro-enclave integration test
  - Fixed container sync options
    Do not exclude/filter any security/xattr capabilities.
  - Update container integration test
    Add getcap to check on filesystem capabilities
  - Add new build type provides for enclave
    Add a provides tag (read by the open buildservice) for the new
    enclave builder. Also add a recommends to eif_builder in
    the systemdeps-core meta package

++++ python-kiwi:

  - limit eif_build requires to fedora >= 42
  - Bump version: 10.1.8 → 10.1.9
  - Added sshd to nitro-enclave integration test
  - Fixed container sync options
    Do not exclude/filter any security/xattr capabilities.
  - Update container integration test
    Add getcap to check on filesystem capabilities
  - Add new build type provides for enclave
    Add a provides tag (read by the open buildservice) for the new
    enclave builder. Also add a recommends to eif_builder in
    the systemdeps-core meta package

++++ kernel-default:

  - bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989 bsc#1230193)
  - commit 5caf0d2
  - perf arch events: Fix duplicate RISC-V SBI firmware event name
    (git-fixes).
  - commit 4570763
  - perf tool: fix dereferencing NULL al->maps (git-fixes).
  - commit 5e4751b
  - perf intel-pt: Fix exclude_guest setting (git-fixes).
  - commit e69b63b
  - perf intel-pt: Fix aux_watermark calculation for 64-bit size
    (git-fixes).
  - commit e3b3bca
  - perf report: Fix condition in sort__sym_cmp() (git-fixes).
  - commit c3e65ee
  - perf pmus: Fixes always false when compare duplicates aliases
    (git-fixes).
  - commit 8eeac69
  - tools/perf: Fix the string match for "/tmp/perf-$PID.map"
    files in dso__load (git-fixes).
  - commit 9a7d0fb
  - bonding: fix null pointer deref in bond_ipsec_offload_ok
    (CVE-2024-44990 bsc#1230194).
  - media: aspeed: Fix memory overwrite if timing is 1600x900
    (CVE-2023-52916 bsc#1230269).
  - commit 7cce3c7
  - perf test: Make test_arm_callgraph_fp.sh more robust
    (git-fixes).
  - commit 8d430e5
  - perf stat: Fix the hard-coded metrics calculation on the hybrid
    (git-fixes).
  - commit 0fe6062
  - perf pmu: Assume sysfs events are always the same case
    (git-fixes).
  - Refresh
    patches.suse/perf-pmu-Count-sys-and-cpuid-JSON-events-separately.patch.
  - commit 0eb9b05
  - rtla/osnoise: Prevent NULL dereference in error handling
    (CVE-2024-45002 bsc#1230169).
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink
    (CVE-2024-44970 bsc#1230209).
  - commit 33e2b5d
  - lirc: rc_dev_get_from_fd(): fix file leak (git-fixes).
  - commit b3b20de
  - thunderbolt: Fix calculation of consumed USB3 bandwidth on a
    path (git-fixes).
  - commit c3642e6
  - Move fixes into sorted section (bsc#1230119)
  - commit c8d5e3a
  - Refresh patches.suse/ipmi-ssif-Improve-detecting-during-probing.patch
    Add commit id and move away from out-of-tree section
  - commit ceb6869
  - Move upstreamed kaslr patch into sorted section
  - commit 554594b
  - net: dsa: mv88e6xxx: Fix out-of-bound access (CVE-2024-44988 bsc#1230192)
  - commit 5ca3065
  - ipv6: prevent UAF in ip6_send_skb() (CVE-2024-44987 bsc#1230185)
  - commit 075c292
  - perf tools: Add/use PMU reverse lookup from config to name
    (git-fixes).
  - commit 62632fc
  - perf tools: Use pmus to describe type from attribute
    (git-fixes).
  - commit 3dc616b
  - perf: script: add raw|disasm arguments to --insn-trace option
    (git-fixes).
  - Refresh
    patches.suse/perf-script-Show-also-errors-for-insn-trace-option.patch.
  - commit f716aa4
  - perf annotate: Use global annotation_options (git-fixes).
  - Refresh
    patches.suse/perf-annotate-Fix-annotation_calc_lines-to-pass-correct-address-to-get_srcline.patch.
  - commit b70a6bc
  - perf top: Convert to the global annotation_options (git-fixes).
  - commit c12ae1d
  - perf report: Convert to the global annotation_options
    (git-fixes).
  - commit e5bcc3a
  - perf annotate: Introduce global annotation_options (git-fixes).
  - commit b458961
  - perf maps: Move symbol maps functions to maps.c (git-fixes).
  - Refresh
    patches.suse/perf-symbols-Fix-ownership-of-string-in-dso__load_vmlinux.patch.
  - commit 93caf35
  - perf annotate: Split branch stack cycles information out of
    'struct annotation_line' (git-fixes).
  - commit 733d4c0
  - perf machine thread: Remove exited threads by default
    (git-fixes).
  - commit 3c4b077
  - Update references for patches.suse/ipv6-fix-possible-UAF-in-ip6_finish_output2.patch (CVE-2024-44986 bsc#1230230 bsc#1230206)
  - commit 814e7ee
  - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (CVE-2024-44984 bsc#1230240)
  - commit 43e2e07
  - gtp: pull network headers in gtp_dev_xmit() (CVE-2024-44999 bsc#1230233)
  - commit 057aaf8

++++ kernel-firmware:

  - Update to version 20240911 (git commit 59def907425d):
    * rtl_bt: Update RTL8852B BT USB FW to 0x0447_9301 (bsc#1229272)

++++ kernel-firmware:

  - Update to version 20240911 (git commit 59def907425d):
    * rtl_bt: Update RTL8852B BT USB FW to 0x0447_9301 (bsc#1229272)

++++ systemd:

  - Import commit 87f11f092e2a63f6b9af98871ea716dab54f8b58 (merge of v254.18)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/0512d0d1fc0b54a84964281708036a46ab39c153...87f11f092e2a63f6b9af98871ea716dab54f8b58

++++ systemd:

  - Import commit 87f11f092e2a63f6b9af98871ea716dab54f8b58 (merge of v254.18)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/0512d0d1fc0b54a84964281708036a46ab39c153...87f11f092e2a63f6b9af98871ea716dab54f8b58

++++ systemd:

  - Import commit 87f11f092e2a63f6b9af98871ea716dab54f8b58 (merge of v254.18)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/0512d0d1fc0b54a84964281708036a46ab39c153...87f11f092e2a63f6b9af98871ea716dab54f8b58

++++ systemd:

  - Import commit 87f11f092e2a63f6b9af98871ea716dab54f8b58 (merge of v254.18)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/0512d0d1fc0b54a84964281708036a46ab39c153...87f11f092e2a63f6b9af98871ea716dab54f8b58

++++ systemd:

  - Import commit 87f11f092e2a63f6b9af98871ea716dab54f8b58 (merge of v254.18)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/0512d0d1fc0b54a84964281708036a46ab39c153...87f11f092e2a63f6b9af98871ea716dab54f8b58

++++ systemd:

  - Import commit 87f11f092e2a63f6b9af98871ea716dab54f8b58 (merge of v254.18)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/0512d0d1fc0b54a84964281708036a46ab39c153...87f11f092e2a63f6b9af98871ea716dab54f8b58

++++ systemd:

  - Import commit 87f11f092e2a63f6b9af98871ea716dab54f8b58 (merge of v254.18)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/0512d0d1fc0b54a84964281708036a46ab39c153...87f11f092e2a63f6b9af98871ea716dab54f8b58

++++ nvidia-open-driver-G06-signed:

  - CUDA build: removed entries from pci_ids-555.42.06 since this is
    doing more harm than benefit (bsc#1230368)

------------------------------------------------------------------
------------------  2024-9-10  -  Sep 10 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update enclave documentation
    Fixup repo setup in the build documentation
  - Bump version: 10.1.7 → 10.1.8
  - Fixed enclave documentation
    Path to the build test was not correct
  - Update test-image-nitro-enclave package list
    Fixup package list to match Fedora rawhide
  - Move test-image-nitro-enclave to rawhide
  - Fix ppc64 chrp bootinfo generation

++++ python-kiwi:

  - Update enclave documentation
    Fixup repo setup in the build documentation
  - Bump version: 10.1.7 → 10.1.8
  - Fixed enclave documentation
    Path to the build test was not correct
  - Update test-image-nitro-enclave package list
    Fixup package list to match Fedora rawhide
  - Move test-image-nitro-enclave to rawhide
  - Fix ppc64 chrp bootinfo generation

++++ python-kiwi:

  - Update enclave documentation
    Fixup repo setup in the build documentation
  - Bump version: 10.1.7 → 10.1.8
  - Fixed enclave documentation
    Path to the build test was not correct
  - Update test-image-nitro-enclave package list
    Fixup package list to match Fedora rawhide
  - Move test-image-nitro-enclave to rawhide
  - Fix ppc64 chrp bootinfo generation

++++ kernel-default:

  - Drop soundwire patch that caused a regression (bsc#1230350)
    Deleted:
    patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
  - commit 5c05eeb

++++ kernel-default:

  - perf record: Lazy load kernel symbols (git-fixes).
  - commit 84efd43
  - Detect memory allocation failure in
    annotated_source__alloc_histograms (bsc#1227962).
  - commit 6424d7a
  - Add alternate commit id for git-fixes.
    Refresh
    patches.suse/perf-evlist-Fix-evlist__new_default-for-1-core-PMU.patch.
  - commit 3b7c481
  - thunderbolt: There are only 5 basic router registers in pre-USB4
    routers (git-fixes).
  - commit 065ac58
  - thunderbolt: Fix rollback in tb_port_lane_bonding_enable()
    for lane 1 (git-fixes).
  - commit 108e81e
  - ipmi:ssif: Improve detecting during probing (bsc#1228771)
  - commit db0a09e
  - thunderbolt: Fix XDomain rx_lanes_show and tx_lanes_show
    (git-fixes).
  - commit b11c099
  - Drop soundwire patch that caused a regression (bsc#1230350)
    Deleted:
    patches.suse/soundwire-stream-fix-programming-slave-ports-for-non.patch
  - commit 5c05eeb
  - btrfs: fix race between direct IO write and fsync when using
    same fd (git-fixes).
  - commit dc59ebc
  - mm/swap: fix race when skipping swapcache (CVE-2024-26759
    bsc#1230340).
  - commit 990c0c6
  - kABI workaround for cros_ec stuff (git-fixes).
  - commit cb01b4e
  - platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
    (stable-fixes).
  - commit d9de020

++++ kernel-firmware:

  - Update to version 20240910 (git commit 2a7b69a3fa30):
    * realtek: rt1320: Add patch firmware of MCU
    * i915: Update MTL DMC v2.23
    * cirrus: cs35l56: Add firmware for Cirrus CS35L54 for some HP laptops

++++ kernel-firmware:

  - Update to version 20240910 (git commit 2a7b69a3fa30):
    * realtek: rt1320: Add patch firmware of MCU
    * i915: Update MTL DMC v2.23
    * cirrus: cs35l56: Add firmware for Cirrus CS35L54 for some HP laptops

------------------------------------------------------------------
------------------  2024-9-9  -  Sep 9 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed documentation header
    Fixed double H1 headers from the boxbuild tweaks chapter.
  - Bump version: 10.1.6 → 10.1.7
  - Move EXEC log message to the right place
    The log information of the command execution was not printed
    directly before the actual command invocation. There are other
    actions after the log information (e.g Path.which) which itself
    produce log information prior the real subprocess execution.
    This is very misleading when reading the log file and fixed
    in this commit.
  - Add support for architectures in deb source file
    When apt resolves packages on a multiarch repo it can happen
    that dependencies for packages from other architectures are
    pulled into the solver process but are not provided by any
    repository. To overcome this behavior the repository can
    be setup to serve packages only for a specified architecture
    or list of architectures. This is related to
    OSInside/kiwi-descriptions#102

++++ python-kiwi:

  - Fixed documentation header
    Fixed double H1 headers from the boxbuild tweaks chapter.
  - Bump version: 10.1.6 → 10.1.7
  - Move EXEC log message to the right place
    The log information of the command execution was not printed
    directly before the actual command invocation. There are other
    actions after the log information (e.g Path.which) which itself
    produce log information prior the real subprocess execution.
    This is very misleading when reading the log file and fixed
    in this commit.
  - Add support for architectures in deb source file
    When apt resolves packages on a multiarch repo it can happen
    that dependencies for packages from other architectures are
    pulled into the solver process but are not provided by any
    repository. To overcome this behavior the repository can
    be setup to serve packages only for a specified architecture
    or list of architectures. This is related to
    OSInside/kiwi-descriptions#102

++++ python-kiwi:

  - Fixed documentation header
    Fixed double H1 headers from the boxbuild tweaks chapter.
  - Bump version: 10.1.6 → 10.1.7
  - Move EXEC log message to the right place
    The log information of the command execution was not printed
    directly before the actual command invocation. There are other
    actions after the log information (e.g Path.which) which itself
    produce log information prior the real subprocess execution.
    This is very misleading when reading the log file and fixed
    in this commit.
  - Add support for architectures in deb source file
    When apt resolves packages on a multiarch repo it can happen
    that dependencies for packages from other architectures are
    pulled into the solver process but are not provided by any
    repository. To overcome this behavior the repository can
    be setup to serve packages only for a specified architecture
    or list of architectures. This is related to
    OSInside/kiwi-descriptions#102

++++ kernel-default:

  - Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic
    (git-fixes).
  - uio_hv_generic: Fix kernel NULL pointer dereference in
    hv_uio_rescind (git-fixes).
  - net: mana: Fix error handling in mana_create_txq/rxq's NAPI
    cleanup (git-fixes).
  - commit 27572d4
  - x86/pat: Fix W^X violation false-positives when running as
    Xen PV guest (bsc#1221527).
  - commit 9acf0ca
  - x86/pat: Restructure _lookup_address_cpa() (bsc#1221527).
  - commit 56f7c9c
  - powerpc/qspinlock: Fix deadlock in MCS queue (bac#1230295
    ltc#206656).
  - commit c4a2ba1
  - Refresh
    patches.kabi/kabi-dm_blk_ioctl-implement-path-failover-for-SG_IO.patch.
  - Refresh
    patches.suse/dm_blk_ioctl-implement-path-failover-for-SG_IO.patch.
  - commit 73c5a36
  - x86/mm: Use lookup_address_in_pgd_attr() in show_fault_oops()
    (bsc#1221527).
  - commit 84d383c
  - x86/pat: Introduce lookup_address_in_pgd_attr() (bsc#1221527).
  - commit 09ca5ca
  - drm/amd/display: Replace dm_execute_dmub_cmd with
    dc_wake_and_execute_dmub_cmd (git-fixes).
  - commit 6d87705
  - wifi: cfg80211: make hash table duplicates more survivable
    (stable-fixes).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 62f6e12
  - VMCI: Fix use-after-free when removing resource in
    vmci_resource_remove() (git-fixes).
  - misc: fastrpc: Fix double free of 'buf' in error path
    (git-fixes).
  - iio: fix scale application in
    iio_convert_raw_to_processed_unlocked (git-fixes).
  - iio: adc: ad7124: fix config comparison (git-fixes).
  - iio: adc: ad7124: fix chip ID mismatch (git-fixes).
  - iio: buffer-dmaengine: fix releasing dma channel on error
    (git-fixes).
  - iio: adc: ad7606: remove frstdata check for serial mode
    (git-fixes).
  - staging: iio: frequency: ad9834: Validate frequency parameter
    value (git-fixes).
  - usb: dwc3: Avoid waking up gadget during startxfer (git-fixes).
  - net: usb: qmi_wwan: add MeiG Smart SRM825L (stable-fixes).
  - drm/gpuvm: fix missing dependency to DRM_EXEC (git-fixes).
  - drm: panel-orientation-quirks: Add quirk for OrangePi Neo
    (stable-fixes).
  - drm/fb-helper: Don't schedule_work() to flush frame buffer
    during panic() (stable-fixes).
  - PCI: al: Check IORESOURCE_BUS existence during probe
    (stable-fixes).
  - usb: typec: ucsi: Fix null pointer dereference in trace
    (stable-fixes).
  - usbip: Don't submit special requests twice (stable-fixes).
  - media: uvcvideo: Enforce alignment of frame and interval
    (stable-fixes).
  - wifi: ath12k: initialize 'ret' in
    ath12k_dp_rxdma_ring_sel_config_wcn7850() (stable-fixes).
  - wifi: ath11k: initialize 'ret' in
    ath11k_qmi_load_file_target_mem() (stable-fixes).
  - wifi: ath12k: initialize 'ret' in
    ath12k_qmi_load_file_target_mem() (stable-fixes).
  - wifi: rtw89: ser: avoid multiple deinit on same CAM
    (stable-fixes).
  - wifi: mac80211: check ieee80211_bss_info_change_notify()
    against MLD (stable-fixes).
  - wifi: cfg80211: restrict operation during radar detection
    (stable-fixes).
  - pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode
    (stable-fixes).
  - hwmon: (k10temp) Check return value of amd_smn_read()
    (stable-fixes).
  - regmap: spi: Fix potential off-by-one when calculating reserved
    size (stable-fixes).
  - commit 73bbd93
  - clocksource/drivers/imx-tpm: Fix next event not taking effect
    sometime (git-fixes).
  - clocksource/drivers/imx-tpm: Fix return -ETIME when delta
    exceeds INT_MAX (git-fixes).
  - dma-debug: avoid deadlock between dma debug vs printk and
    netconsole (stable-fixes).
  - drm/amdgpu: fix contiguous handling for IB parsing v2
    (git-fixes).
  - dmaengine: altera-msgdma: properly free descriptor in
    msgdma_free_descriptor (stable-fixes).
  - dmaengine: altera-msgdma: use irq variant of spin_lock/unlock
    while invoking callbacks (stable-fixes).
  - driver: iio: add missing checks on iio_info's callback access
    (stable-fixes).
  - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
    (stable-fixes).
  - drm/amd/display: Check BIOS images before it is used
    (stable-fixes).
  - drm/amd/display: Avoid overflow from uint32_t to uint8_t
    (stable-fixes).
  - drm/amd/display: use preferred link settings for dp signal only
    (stable-fixes).
  - drm/amd/display: Remove register from DCN35 DMCUB diagnostic
    collection (stable-fixes).
  - drm/amd/display: Correct the defined value for
    AMDGPU_DMUB_NOTIFICATION_MAX (stable-fixes).
  - drm/amd/display: added NULL check at start of dc_validate_stream
    (stable-fixes).
  - drm/amd/display: Wake DMCUB before sending a command for replay
    feature (stable-fixes).
  - drm/amd/display: Don't use fsleep for PSR exit waits on dmub
    replay (stable-fixes).
  - drm/amdgpu: fix overflowed constant warning in
    mmhub_set_clockgating() (stable-fixes).
  - drm/amdgpu: add lock in kfd_process_dequeue_from_device
    (stable-fixes).
  - drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
    (stable-fixes).
  - drm/amdgpu: add skip_hw_access checks for sriov (stable-fixes).
  - drm/bridge: tc358767: Check if fully initialized before
    signalling HPD event via IRQ (stable-fixes).
  - drm/meson: plane: Add error handling (stable-fixes).
  - drm/drm-bridge: Drop conditionals around of_node pointers
    (stable-fixes).
  - drm/amd/display: Add null checks for 'stream' and 'plane'
    before dereferencing (stable-fixes).
  - drm/amdgu: fix Unintentional integer overflow for mall size
    (stable-fixes).
  - drm/amdgpu: update type of buf size to u32 for eeprom functions
    (stable-fixes).
  - drm/amd/display: Fix pipe addition logic in
    calc_blocks_to_ungate DCN35 (stable-fixes).
  - drm/kfd: Correct pinned buffer handling at kfd restore and
    validate process (stable-fixes).
  - drm/amd/pm: check negtive return for table entries
    (stable-fixes).
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4
    (stable-fixes).
  - drm/amd/pm: check specific index for smu13 (stable-fixes).
  - drm/amd/pm: check specific index for aldebaran (stable-fixes).
  - drm/amdgpu: fix the waring dereferencing hive (stable-fixes).
  - drm/amdgpu: fix dereference after null check (stable-fixes).
  - drm/amdgpu: Fix the warning division or modulo by zero
    (stable-fixes).
  - drm/amdgpu/pm: Check input value for CUSTOM profile mode
    setting on legacy SOCs (stable-fixes).
  - drm/amdkfd: Reconcile the definition and use of oem_id in
    struct kfd_topology_device (stable-fixes).
  - drm/amdgpu: fix mc_data out-of-bounds read warning
    (stable-fixes).
  - drm/amdgpu: fix ucode out-of-bounds read warning (stable-fixes).
  - drm/amdgpu: Fix uninitialized variable warning in
    amdgpu_info_ioctl (stable-fixes).
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
    (stable-fixes).
  - drm/amdkfd: Check debug trap enable before write dbg_ev_file
    (stable-fixes).
  - drm/amdgpu: Fix out-of-bounds write warning (stable-fixes).
  - drm/amdgpu: Fix the uninitialized variable warning
    (stable-fixes).
  - drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
    (stable-fixes).
  - drm/amdgpu/pm: Fix uninitialized variable warning for smu10
    (stable-fixes).
  - drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
    (stable-fixes).
  - drm/amd/amdgpu: Check tbo resource pointer (stable-fixes).
  - drm/amd/display: Fix index may exceed array range within
    fpu_update_bw_bounding_box (stable-fixes).
  - drm/amd/display: Skip inactive planes within
    ModeSupportAndSystemConfiguration (stable-fixes).
  - drm/amd/display: Ensure index calculation will not overflow
    (stable-fixes).
  - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
    decide_fallback_link_setting_max_bw_policy (stable-fixes).
  - drm/amd/display: Spinlock before reading event (stable-fixes).
  - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
    dal_gpio_service_create (stable-fixes).
  - drm/amd/display: Fix Coverity INTERGER_OVERFLOW within
    construct_integrated_info (stable-fixes).
  - drm/amd/display: Check msg_id before processing transcation
    (stable-fixes).
  - drm/amd/display: Check num_valid_sets before accessing
    reader_wm_sets[] (stable-fixes).
  - drm/amd/display: Add array index check for hdcp ddc access
    (stable-fixes).
  - drm/amd/display: Check index for aux_rd_interval before using
    (stable-fixes).
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums
    greater than 6 (stable-fixes).
  - drm/amd/display: Check gpio_id before used as array index
    (stable-fixes).
  - drm/amd/display: Ensure array index tg_inst won't be -1
    (stable-fixes).
  - drm/amdgpu: avoid reading vf2pf info size from FB
    (stable-fixes).
  - drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
    (stable-fixes).
  - drm/amdgpu: fix uninitialized scalar variable warning
    (stable-fixes).
  - drm/amd/pm: fix the Out-of-bounds read warning (stable-fixes).
  - drm/amd/pm: Fix negative array index read (stable-fixes).
  - drm/amd/pm: fix warning using uninitialized value of
    max_vid_step (stable-fixes).
  - drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
    (stable-fixes).
  - drm/amd/pm: fix uninitialized variable warning (stable-fixes).
  - drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
    (stable-fixes).
  - drm/amdgpu: fix overflowed array index read warning
    (stable-fixes).
  - drm/amdgpu: Handle sg size limit for contiguous allocation
    (stable-fixes).
  - drm/amd/display: Assign linear_pitch_alignment even for VM
    (stable-fixes).
  - drm/amd/display: Handle the case which quad_part is equal 0
    (stable-fixes).
  - drm/amdgpu: Fix uninitialized variable warning in
    amdgpu_afmt_acr (stable-fixes).
  - cpufreq: scmi: Avoid overflow of target_freq in fast switch
    (stable-fixes).
  - commit e23c4dc
  - RDMA/efa: Properly handle unexpected AQ completions (git-fixes)
  - commit 8c8b9e5

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311-core:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ nvidia-open-driver-G06-signed:

  - For CUDA (preamble file):
    * added: Provides: nvidia-open-driver-G06-signed-cuda-kmp-$flavor = %version
    which is needed for 'zypper install <package> = <version>'
    * added: Provides/Conflicts: nvidia-open-driver-G06-signed-kmp-$flavor = %version
    useful for containers

++++ perl-Bootloader:

  - 0001-bootloader_entry-script-can-have-an-optional-force-d.patch
    bootloader_entry script can have an optional 'force-default' argument (bsc#1215064)

++++ perl-Bootloader:

  - 0001-bootloader_entry-script-can-have-an-optional-force-d.patch
    bootloader_entry script can have an optional 'force-default' argument (bsc#1215064)

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

++++ python311:

  - Update to 3.11.10:
  - Security
  - gh-123678: Upgrade libexpat to 2.6.3
  - gh-121957: Fixed missing audit events around interactive
    use of Python, now also properly firing for ``python -i``,
    as well as for ``python -m asyncio``. The event in question
    is ``cpython.run_stdin``.
  - gh-122133: Authenticate the socket connection for the
    ``socket.socketpair()`` fallback on platforms where
    ``AF_UNIX`` is not available like Windows. Patch by
    Gregory P. Smith <greg@krypto.org> and Seth Larson
    <seth@python.org>. Reported by Ellie <el@horse64.org>
  - gh-121285: Remove backtracking from tarfile header parsing
    for ``hdrcharset``, PAX, and GNU sparse headers
    (bsc#1230227, CVE-2024-6232).
  - gh-118486: :func:`os.mkdir` on Windows now accepts
    * mode* of ``0o700`` to restrict the new directory to
    the current user. This fixes CVE-2024-4030 affecting
    :func:`tempfile.mkdtemp` in scenarios where the base
    temporary directory is more permissive than the default.
  - gh-116741: Update bundled libexpat to 2.6.2
  - Library
  - gh-123270: Applied a more surgical fix for malformed
    payloads in :class:`zipfile.Path` causing infinite loops
    (gh-122905) without breaking contents using legitimate
    characters (bsc#1229704, CVE-2024-8088).
  - gh-123067: Fix quadratic complexity in parsing ``"``-quoted
    cookie values with backslashes by :mod:`http.cookies`
    (bsc#1229596, CVE-2024-7592).
  - gh-122905: :class:`zipfile.Path` objects now sanitize names
    from the zipfile.
  - gh-121650: :mod:`email` headers with embedded newlines are
    now quoted on output. The :mod:`~email.generator` will now
    refuse to serialize (write) headers that are unsafely folded
    or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`.
    (Contributed by Bas Bloemsaat and Petr Viktorin in
    :gh:`121650`; CVE-2024-6923, bsc#1228780).
  - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method
    breaks internal buffer when the method is called again
    during flushing internal buffer.
  - gh-118643: Fix an AttributeError in the :mod:`email` module
    when re-fold a long address list. Also fix more cases of
    incorrect encoding of the address separator in the address
    list.
  - gh-113171: Fixed various false positives and false
    negatives in * :attr:`ipaddress.IPv4Address.is_private`
    (see these docs for details) *
    :attr:`ipaddress.IPv4Address.is_global` *
    :attr:`ipaddress.IPv6Address.is_private` *
    :attr:`ipaddress.IPv6Address.is_global` Also in the
    corresponding :class:`ipaddress.IPv4Network` and
    :class:`ipaddress.IPv6Network` attributes.
    Fixes bsc#1226448 (CVE-2024-4032).
  - gh-102988: :func:`email.utils.getaddresses` and
    :func:`email.utils.parseaddr` now return ``('', '')``
    2-tuples in more situations where invalid email addresses
    are encountered instead of potentially inaccurate
    values. Add optional *strict* parameter to these two
    functions: use ``strict=False`` to get the old behavior,
    accept malformed inputs. ``getattr(email.utils,
    'supports_strict_parsing', False)`` can be use to check if
    the *strict* paramater is available. Patch by Thomas Dwyer
    and Victor Stinner to improve the CVE-2023-27043 fix
    (bsc#1210638).
  - gh-67693: Fix :func:`urllib.parse.urlunparse` and
    :func:`urllib.parse.urlunsplit` for URIs with path starting
    with multiple slashes and no authority. Based on patch by
    Ashwin Ramaswami.
  - Core and Builtins
  - gh-112275: A deadlock involving ``pystate.c``'s
    ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now
    fixed. Patch by ChuBoning based on previous Python 3.12 fix
    by Victor Stinner.
  - gh-109120: Added handle of incorrect star expressions, e.g
    ``f(3, *)``. Patch by Grigoryev Semyon
  - Removed upstreamed patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - CVE-2024-4032-private-IP-addrs.patch
  - CVE-2024-6923-email-hdr-inject.patch
  - CVE-2024-8088-inf-loop-zipfile_Path.patch
    (renamed from CVE-2024-8088-zipfile-Path-sanitization.patch)
  - CVE-2024-6232-ReDOS-backtrack-tarfile.patch
  - CVE-2024-7592-quad-complex-cookies.patch

------------------------------------------------------------------
------------------  2024-9-8  -  Sep 8 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - clk: qcom: gcc-sc8280xp: don't use parking clk_ops for QUPs
    (git-fixes).
  - clk: qcom: gcc-sm8550: Don't park the USB RCG at registration
    time (git-fixes).
  - clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
    (git-fixes).
  - clk: qcom: ipq9574: Update the alpha PLL type for GPLLs
    (git-fixes).
  - clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL
    is disabled (git-fixes).
  - clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate
    API (git-fixes).
  - clk: qcom: clk-alpha-pll: Fix the pll post div mask (git-fixes).
  - commit 060a67a

------------------------------------------------------------------
------------------  2024-9-7  -  Sep 7 2024  -------------------
------------------------------------------------------------------

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ docker:

  - Mark docker-buildx as required since classic "docker build" has been
    deprecated since Docker 23.0. bsc#1230331
  - Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate
    package, but with docker-stable it will be necessary to maintain the packages
    together and it makes more sense to have them live in the same OBS package.
    bsc#1230333
  - Make some minor name macro updates to help with the docker-stable package
    fork.

++++ kernel-default:

  - ALSA: hda/realtek - Fix inactive headset mic jack for ASUS
    Vivobook 15 X1504VAP (stable-fixes).
  - ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx
    (stable-fixes).
  - ALSA: hda/realtek: Enable Mute Led for HP Victus 15-fb1xxx
    (stable-fixes).
  - ALSA: hda/realtek: extend quirks for Clevo V5[46]0
    (stable-fixes).
  - ALSA: hda/realtek: add patch for internal mic in Lenovo V145
    (stable-fixes).
  - ALSA: hda/conexant: Add pincfg quirk to enable top speakers
    on Sirius devices (stable-fixes).
  - commit 5538dd8
  - ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode
    (git-fixes).
  - ASoc: SOF: topology: Clear SOF link platform name upon unload
    (git-fixes).
  - ASoC: tegra: Fix CBB error during probe() (git-fixes).
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object (git-fixes).
  - mmc: cqhci: Fix checking of CQHCI_HALT state (git-fixes).
  - mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
    (git-fixes).
  - mmc: sdhci-of-aspeed: fix module autoloading (git-fixes).
  - mmc: core: apply SD quirks earlier during probe (git-fixes).
  - gpio: modepin: Enable module autoloading (git-fixes).
  - gpio: rockchip: fix OF node leak in probe() (git-fixes).
  - Revert "drm/amdgpu: align pp_power_profile_mode with kernel
    docs" (stable-fixes).
  - nouveau: fix the fwsec sb verification register (git-fixes).
  - drm/i915/fence: Mark debug_fence_free() with __maybe_unused
    (git-fixes).
  - drm/i915/fence: Mark debug_fence_init_onstack() with
    __maybe_unused (git-fixes).
  - drm/i915: Do not attempt to load the GSC multiple times
    (git-fixes).
  - commit 7a89765

------------------------------------------------------------------
------------------  2024-9-6  -  Sep 6 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240906.742565b:
    * yama-enable-ptrace: enforce changed behavior upon installation (bsc#1221763)
    * Avoid unnecessary /bin/bash dependency
    * sysctl: Fixup of not setting kernel.pid_max on 32b archs (bsc#1227117)

++++ python-kiwi:

  - Bump version: 10.1.5 → 10.1.6

++++ python-kiwi:

  - Bump version: 10.1.5 → 10.1.6

++++ python-kiwi:

  - Bump version: 10.1.5 → 10.1.6

++++ kernel-default:

  - blacklist.conf: CVE-2024-43886 bsc#1229748: not applicable, functionality not present
    The fix adds a NULL check but it is already there in this codebase. The
    upstream fix is for patch 5db346c256bbac ("drm/amd/display: update pipe
    topology log to support subvp") that adds a secondary display and
    refactors code so the NULL check gets lost in
    resource_log_pipe_topology_update().
  - commit b9c5bf2
  - ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230206)
  - commit 64f6ea9
  - ipv6: prevent possible UAF in ip6_xmit() (CVE-2024-44985 bsc#1230206)
  - commit 209198a
  - vfs: Don't evict inode under the inode lru traversing context
    (CVE-2024-45003 bsc#1230245).
  - commit 630b67a
  - Restore dropped fields for bluetooth MGMT/SMP structs
    (git-fixes).
  - commit 5313ecb
  - usbnet: modern method to get random MAC (git-fixes).
  - net: phy: Fix missing of_node_put() for leds (git-fixes).
  - Bluetooth: MGMT: Ignore keys being loaded with invalid type
    (git-fixes).
  - Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP
    over BREDR/LE" (git-fixes).
  - can: mcp251x: fix deadlock if an interrupt occurs during
    mcp251x_open (git-fixes).
  - can: mcp251xfd: fix ring configuration when switching from
    CAN-CC to CAN-FD mode (git-fixes).
  - can: m_can: Release irq on error in m_can_open (git-fixes).
  - can: bcm: Remove proc entry when dev is unregistered
    (git-fixes).
  - spi: rockchip: Resolve unbalanced runtime PM / system PM
    handling (git-fixes).
  - regulator: core: Stub devm_regulator_bulk_get_const() if
    !CONFIG_REGULATOR (git-fixes).
  - platform/x86: dell-smbios: Fix error path in dell_smbios_init()
    (git-fixes).
  - commit b6769e6
  - serial: sc16is7xx: fix invalid FIFO access with special register
    set (CVE-2024-44950 bsc#1230180).
  - serial: sc16is7xx: fix TX fifo corruption (CVE-2024-44951
    bsc#1230181).
  - serial: sc16is7xx: refactor FIFO access functions to increase
    commonality (CVE-2024-44951 bsc#1230181).
  - commit 4ab54b2
  - NFS: never reuse a NFSv4.0 lock-owner (bsc#1227726).
  - commit ed692a4

++++ libpcap:

  - Security fix: [bsc#1230034, CVE-2024-8006]
    * libpcap: NULL pointer derefence in pcap_findalldevs_ex()
    * Add libpcap-CVE-2024-8006.patch
  - Security fix: [bsc#1230020, CVE-2023-7256]
    * libpcap: double free via addrinfo in sock_initaddress()
    * Add libpcap-CVE-2023-7256.patch

++++ libpcap:

  - Security fix: [bsc#1230034, CVE-2024-8006]
    * libpcap: NULL pointer derefence in pcap_findalldevs_ex()
    * Add libpcap-CVE-2024-8006.patch
  - Security fix: [bsc#1230020, CVE-2023-7256]
    * libpcap: double free via addrinfo in sock_initaddress()
    * Add libpcap-CVE-2023-7256.patch

++++ libzypp:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - Conflicts: zypper <= 1.14.76
  - version 17.35.10 (35)

++++ libzypp:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - Conflicts: zypper <= 1.14.76
  - version 17.35.10 (35)

++++ libzypp:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - Conflicts: zypper <= 1.14.76
  - version 17.35.10 (35)

++++ libzypp:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - Conflicts: zypper <= 1.14.76
  - version 17.35.10 (35)

++++ libzypp:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - Conflicts: zypper <= 1.14.76
  - version 17.35.10 (35)

++++ zypper:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - BuildRequires:  libzypp-devel >= 17.35.10.
  - Fix wrong numbers used in CommitSummary skipped/failed messages.
  - version 1.14.77

++++ zypper:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - BuildRequires:  libzypp-devel >= 17.35.10.
  - Fix wrong numbers used in CommitSummary skipped/failed messages.
  - version 1.14.77

++++ zypper:

  - API refactoring. Prevent zypper from using now private libzypp
    symbols (bsc#1230267)
  - BuildRequires:  libzypp-devel >= 17.35.10.
  - Fix wrong numbers used in CommitSummary skipped/failed messages.
  - version 1.14.77

------------------------------------------------------------------
------------------  2024-9-5  -  Sep 5 2024  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.21. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.21>
    Fixes CVE-2023-47108. bsc#1217070
    Fixes CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.21. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.21>
    Fixes CVE-2023-47108. bsc#1217070
    Fixes CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.21. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.21>
    Fixes CVE-2023-47108. bsc#1217070
    Fixes CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ containerd:

  - Update to containerd v1.7.21. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.21>
    Fixes CVE-2023-47108. bsc#1217070
    Fixes CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

++++ python-kiwi:

  - add allowExtraConfig and exportFlags to ovftool options
    Add allowExtraConfig and exportFlags to ovftool options
  - Bump version: 10.1.4 → 10.1.5

++++ python-kiwi:

  - add allowExtraConfig and exportFlags to ovftool options
    Add allowExtraConfig and exportFlags to ovftool options
  - Bump version: 10.1.4 → 10.1.5

++++ python-kiwi:

  - add allowExtraConfig and exportFlags to ovftool options
    Add allowExtraConfig and exportFlags to ovftool options
  - Bump version: 10.1.4 → 10.1.5

++++ kernel-default:

  - atm: idt77252: prevent use after free in dequeue_rx()
    (CVE-2024-44998 bsc#1230171).
  - commit fd57936
  - tcp: add sanity checks to rx zerocopy (CVE-2024-26640
    bsc#1221650).
  - commit 21286c2
  - USB: serial: option: add MeiG Smart SRM825L (git-fixes).
  - commit 047a639
  - nilfs2: fix state management in error path of log writing
    function (git-fixes).
  - commit 9b55988
  - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
    (git-fixes).
  - commit a322b71
  - usb: dwc3: core: Prevent USB core invalid event buffer address
    access (git-fixes).
  - commit de7b6b3
  - nilfs2: fix missing cleanup on rollforward recovery error
    (git-fixes).
  - commit b4149d3
  - nilfs2: protect references to superblock parameters exposed
    in sysfs (git-fixes).
  - commit e7215f6
  - arm64: tlb: Allow range operation for MAX_TLBI_RANGE_PAGES (bsc#1229585)
  - commit a52467b
  - arm64: tlb: Improve __TLBI_VADDR_RANGE() (bsc#1229585)
  - commit 26752eb
  - arm64: tlb: Fix TLBI RANGE operand (bsc#1229585)
  - commit 24bd468
  - blacklist.conf: ("KVM: arm64: Use TLBI_TTL_UNKNOWN in __kvm_tlb_flush_vmid_range()") (bsc#1229585)
  - commit 29fbf2b
  - arm64/mm: Update tlb invalidation routines for FEAT_LPA2 (bsc#1229585)
  - commit b8ec0d4
  - arm64/mm: Modify range-based tlbi to decrement scale (bsc#1229585)
  - commit e08c708
  - USB: serial: option: add MeiG Smart SRM825L (stable-fixes).
  - cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
    (stable-fixes).
  - usb: dwc3: core: Prevent USB core invalid event buffer address
    access (stable-fixes).
  - selinux,smack: don't bypass permissions check in inode_setsecctx
    hook (stable-fixes).
  - drm/amdgpu/swsmu: always force a state reprogram on init
    (stable-fixes).
  - drm/amdgpu: align pp_power_profile_mode with kernel docs
    (stable-fixes).
  - commit 1d64229

++++ expat:

  - Update to 2.6.3:
    * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len < 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
    * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio <=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do

++++ expat:

  - Update to 2.6.3:
    * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len < 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
    * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio <=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do

++++ expat:

  - Update to 2.6.3:
    * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len < 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
    * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio <=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do

++++ expat:

  - Update to 2.6.3:
    * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len < 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
    * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio <=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do

------------------------------------------------------------------
------------------  2024-9-4  -  Sep 4 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ curl:

  - Security fix: [bsc#1230093, CVE-2024-8096]
    * curl: OCSP stapling bypass with GnuTLS
    * Add curl-CVE-2024-8096.patch

++++ docker-compose:

  - Build with go 1.22 to avoid issues when processing go.mod per
    https://github.com/golang/go/issues/62278#issuecomment-1698829945

++++ docker-compose:

  - Build with go 1.22 to avoid issues when processing go.mod per
    https://github.com/golang/go/issues/62278#issuecomment-1698829945

++++ docker-compose:

  - Build with go 1.22 to avoid issues when processing go.mod per
    https://github.com/golang/go/issues/62278#issuecomment-1698829945

++++ python-kiwi:

  - create EFI/BOOT only if UEFI boot is intended
  - Fix boot support for ISO media on ppc64
    add CHRP boot support for ppc64 and add xorriso option to avoid
    file name reduction to MS-DOS compatible 8.3 format

++++ python-kiwi:

  - create EFI/BOOT only if UEFI boot is intended
  - Fix boot support for ISO media on ppc64
    add CHRP boot support for ppc64 and add xorriso option to avoid
    file name reduction to MS-DOS compatible 8.3 format

++++ python-kiwi:

  - create EFI/BOOT only if UEFI boot is intended
  - Fix boot support for ISO media on ppc64
    add CHRP boot support for ppc64 and add xorriso option to avoid
    file name reduction to MS-DOS compatible 8.3 format

++++ kernel-default:

  - Resort io_uring kABI patches
    These ended up in the wrong section.  Push them to the right place, next
    to the other io_uring kabi patches.
  - commit f218522
  - kABI: Split kABI out of 'io_uring: Re-add dummy_ubuf for kABI purposes'
    When introducing this patch, I merged the kABI patch with the actual
    backport, which is not recommended.  Split it up, such that the backport
    is similar to the upstream patch and handle the kABI issue exactly the
    same way, but through a separate kABI patch.
  - commit 5b3aa8f
  - kABI: Split kABI out of 'io_uring/kbuf: get rid of bl->is_ready'
    When introducing this patch, I merged the kABI patch with the actual
    backport, which is not recommended.  Split it up, such that the backport
    is similar to the upstream patch and handle the kABI issue exactly the
    same way, but through a separate kABI patch.
  - commit d39d376
  - ext4: sanity check for NULL pointer after ext4_force_shutdown
    (bsc#1229753 CVE-2024-43898).
  - commit d9361cb
  - udf: Fix bogus checksum computation in udf_rename() (bsc#1229389
    CVE-2024-43845).
  - commit 985c73e
  - ext4: fix infinite loop when replaying fast_commit (bsc#1229394
    CVE-2024-43828).
  - commit c9c168b
  - block: fix deadlock between sd_remove & sd_release (bsc#1229371
    CVE-2024-42294).
  - commit a556834
  - udf: Avoid using corrupted block bitmap buffer (bsc#1229362
    CVE-2024-42306).
  - commit 26b3a5d
  - ext4: check dot and dotdot of dx_root before making dir indexed
    (bsc#1229363 CVE-2024-42305).
  - commit d42c7e5
  - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
    (bsc#1229001 CVE-2024-42243).
  - commit 962c57e
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions
    (bsc#1229334 CVE-2024-42265).
  - commit 1088a58
  - ext4: make sure the first directory block is not a hole
    (bsc#1229364 CVE-2024-42304).
  - commit 0ee54f7
  - netfilter: ctnetlink: use helper function to calculate expect ID
    (CVE-2024-44944 bsc#1229899).
  - commit da9b5c6
  - sctp: Fix null-ptr-deref in reuseport_add_sock()
    (CVE-2024-44935 bsc#1229810).
  - commit c34ddb2
  - perf/x86/uncore: Cleanup unused unit structure (bsc#1230119).
  - commit 48a66a6
  - perf/x86/uncore: Apply the unit control RB tree to PCI uncore
    units (bsc#1230119).
  - commit e202e9f
  - perf/x86/uncore: Apply the unit control RB tree to MSR uncore
    units (bsc#1230119).
  - commit 8a1e34d
  - perf/x86/uncore: Apply the unit control RB tree to MMIO uncore
    units (bsc#1230119).
  - commit 956825c
  - perf/x86/uncore: Retrieve the unit ID from the unit control
    RB tree (bsc#1230119).
  - commit 81ab2f7
  - perf/x86/uncore: Support per PMU cpumask (bsc#1230119).
  - commit e0b1be5
  - perf/x86/uncore: Save the unit control address of all units
    (bsc#1230119).
  - commit 3062251
  - perf/x86/intel/uncore: Support HBM and CXL PMON counters
    (bsc#1230119).
  - commit a4c2665
  - fuse: update stats for pages in dropped aux writeback list
    (bsc#1230125).
  - fuse: fix memory leak in fuse_create_open (bsc#1230124).
  - fuse: use unsigned type for getxattr/listxattr size truncation
    (bsc#1230123).
  - commit c8902bc
  - Split kabi part of dm_blk_ioctl-implement-path-failover-for-SG_IO.patch
  - kabi: dm_blk_ioctl: implement path failover for SG_IO
    (bsc#1183045, bsc#1216776).
  - Refresh
    patches.suse/dm_blk_ioctl-implement-path-failover-for-SG_IO.patch.
  - commit 9a2ecb0
  - NFSD: Fix frame size warning in svc_export_parse() (git-fixes).
  - NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
    (git-fixes).
  - commit 3ab58b8
  - blacklist.conf: These aren't wanted for various reasons.
  - commit 39478da
  - kABI: Split kABI out of io_uring/kbuf: protect io_buffer_list teardown with a
    reference
    When introducing this patch, I merged the kABI patch with the actual
    backport, which is not recommended.  Split it up, such that the backport
    is similar to the upstream patch and handle the kABI issue exactly the
    same way, but through a separate kABI patch.
  - commit 08e57d6

++++ kernel-firmware:

  - Update to version 20240903 (git commit 96af55bd3d0b):
    * amdgpu: Revert sienna cichlid dmcub firmware update (bsc#1230007)
    * iwlwifi: add Bz FW for core89-58 release
    * rtl_nic: add firmware rtl8126a-3
    * linux-firmware: update firmware for MT7921 WiFi device
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7921)

++++ kernel-firmware:

  - Update to version 20240903 (git commit 96af55bd3d0b):
    * amdgpu: Revert sienna cichlid dmcub firmware update (bsc#1230007)
    * iwlwifi: add Bz FW for core89-58 release
    * rtl_nic: add firmware rtl8126a-3
    * linux-firmware: update firmware for MT7921 WiFi device
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7921)

++++ selinux-policy:

  - Update to version 20230523+git25.ad22dd7f:
    * Backport wtmpdb label change to have the same wtmpdb label
    as in SL Micro 6.1 (bsc#1229132)
    * Add auth_rw_wtmpdb_login_records to domains using auth_manage_login_records
    * Add auth_rw_wtmpdb_login_records to modules
    * Allow xdm_t to read-write to wtmpdb (bsc#1225984)
    * Introduce types for wtmpdb and rw interface
    * Introduce wtmp_file_type attribute
    * Revert "Add policy for wtmpdb (bsc#1210717)"

++++ selinux-policy:

  - Update to version 20230523+git25.ad22dd7f:
    * Backport wtmpdb label change to have the same wtmpdb label
    as in SL Micro 6.1 (bsc#1229132)
    * Add auth_rw_wtmpdb_login_records to domains using auth_manage_login_records
    * Add auth_rw_wtmpdb_login_records to modules
    * Allow xdm_t to read-write to wtmpdb (bsc#1225984)
    * Introduce types for wtmpdb and rw interface
    * Introduce wtmp_file_type attribute
    * Revert "Add policy for wtmpdb (bsc#1210717)"

++++ selinux-policy:

  - Update to version 20230523+git25.ad22dd7f:
    * Backport wtmpdb label change to have the same wtmpdb label
    as in SL Micro 6.1 (bsc#1229132)
    * Add auth_rw_wtmpdb_login_records to domains using auth_manage_login_records
    * Add auth_rw_wtmpdb_login_records to modules
    * Allow xdm_t to read-write to wtmpdb (bsc#1225984)
    * Introduce types for wtmpdb and rw interface
    * Introduce wtmp_file_type attribute
    * Revert "Add policy for wtmpdb (bsc#1210717)"

++++ selinux-policy:

  - Update to version 20230523+git25.ad22dd7f:
    * Backport wtmpdb label change to have the same wtmpdb label
    as in SL Micro 6.1 (bsc#1229132)
    * Add auth_rw_wtmpdb_login_records to domains using auth_manage_login_records
    * Add auth_rw_wtmpdb_login_records to modules
    * Allow xdm_t to read-write to wtmpdb (bsc#1225984)
    * Introduce types for wtmpdb and rw interface
    * Introduce wtmp_file_type attribute
    * Revert "Add policy for wtmpdb (bsc#1210717)"

++++ selinux-policy:

  - Update to version 20230523+git25.ad22dd7f:
    * Backport wtmpdb label change to have the same wtmpdb label
    as in SL Micro 6.1 (bsc#1229132)
    * Add auth_rw_wtmpdb_login_records to domains using auth_manage_login_records
    * Add auth_rw_wtmpdb_login_records to modules
    * Allow xdm_t to read-write to wtmpdb (bsc#1225984)
    * Introduce types for wtmpdb and rw interface
    * Introduce wtmp_file_type attribute
    * Revert "Add policy for wtmpdb (bsc#1210717)"

++++ selinux-policy:

  - Update to version 20230523+git25.ad22dd7f:
    * Backport wtmpdb label change to have the same wtmpdb label
    as in SL Micro 6.1 (bsc#1229132)
    * Add auth_rw_wtmpdb_login_records to domains using auth_manage_login_records
    * Add auth_rw_wtmpdb_login_records to modules
    * Allow xdm_t to read-write to wtmpdb (bsc#1225984)
    * Introduce types for wtmpdb and rw interface
    * Introduce wtmp_file_type attribute
    * Revert "Add policy for wtmpdb (bsc#1210717)"

++++ strace:

  - Change the license to the correct LGPL-2.1-or-later
    (bsc#1228216).

------------------------------------------------------------------
------------------  2024-9-3  -  Sep 3 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix initrd permissions
    kiwi stored the initrd for ISO images as 600 which might
    be too restrictive. This commit makes sure the initrd is
    stored as 644 and Fixes bsc#1229257
  - Fixed ramdisk size setup
    For setting up the brd rd_size option kiwi creates
    99-brd.conf used at load time of the kernel brd driver.
    The location for the conf file is set to /etc/modprobe.d/
    However, in newer versions the location has changed to
    /usr/lib/modprobe.d/ and /etc/modprobe.d is no longer
    expected to exist. This commit makes sure /etc/modprobe.d
    is created if not present.
  - Bump version: 10.1.3 → 10.1.4

++++ python-kiwi:

  - Fix initrd permissions
    kiwi stored the initrd for ISO images as 600 which might
    be too restrictive. This commit makes sure the initrd is
    stored as 644 and Fixes bsc#1229257
  - Fixed ramdisk size setup
    For setting up the brd rd_size option kiwi creates
    99-brd.conf used at load time of the kernel brd driver.
    The location for the conf file is set to /etc/modprobe.d/
    However, in newer versions the location has changed to
    /usr/lib/modprobe.d/ and /etc/modprobe.d is no longer
    expected to exist. This commit makes sure /etc/modprobe.d
    is created if not present.
  - Bump version: 10.1.3 → 10.1.4

++++ python-kiwi:

  - Fix initrd permissions
    kiwi stored the initrd for ISO images as 600 which might
    be too restrictive. This commit makes sure the initrd is
    stored as 644 and Fixes bsc#1229257
  - Fixed ramdisk size setup
    For setting up the brd rd_size option kiwi creates
    99-brd.conf used at load time of the kernel brd driver.
    The location for the conf file is set to /etc/modprobe.d/
    However, in newer versions the location has changed to
    /usr/lib/modprobe.d/ and /etc/modprobe.d is no longer
    expected to exist. This commit makes sure /etc/modprobe.d
    is created if not present.
  - Bump version: 10.1.3 → 10.1.4

++++ kernel-default:

  - blacklist.conf: Add cf3f9a593dab mm: optimize the redundant loop of mm_update_owner_next()
  - commit 3184f0b
  - blacklist.conf: d24f05987ce8 cgroup: Avoid extra dereference in css_populate_dir()
  - commit 922f944
  - usb: typec: ucsi: Wait 20ms before reading CCI after a reset
    (git-fixes).
  - commit 26d16be

++++ kernel-firmware:

  - Update to version 20240830 (git commit d6c600d46981):
    * amdgpu: update DMCUB to v0.0.232.0 for DCN314 and DCN351
    * qcom: vpu: restore compatibility with kernels before 6.6

++++ kernel-firmware:

  - Update to version 20240830 (git commit d6c600d46981):
    * amdgpu: update DMCUB to v0.0.232.0 for DCN314 and DCN351
    * qcom: vpu: restore compatibility with kernels before 6.6

++++ util-linux:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

++++ util-linux:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

++++ util-linux:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

++++ util-linux:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

++++ expat:

  - Security fix (bsc#1229932, CVE-2024-45492): detect integer
    overflow in function nextScaffoldPart
    * Added expat-CVE-2024-45492.patch
  - Security fix (bsc#1229931, CVE-2024-45491): detect integer
    overflow in dtdCopy
    * Added expat-CVE-2024-45491.patch
  - Security fix (bsc#1229930, CVE-2024-45490): reject negative
    len for XML_ParseBuffer
    * Added expat-CVE-2024-45490.patch

++++ expat:

  - Security fix (bsc#1229932, CVE-2024-45492): detect integer
    overflow in function nextScaffoldPart
    * Added expat-CVE-2024-45492.patch
  - Security fix (bsc#1229931, CVE-2024-45491): detect integer
    overflow in dtdCopy
    * Added expat-CVE-2024-45491.patch
  - Security fix (bsc#1229930, CVE-2024-45490): reject negative
    len for XML_ParseBuffer
    * Added expat-CVE-2024-45490.patch

++++ runc:

    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.14. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.14>.
    Includes the patch for CVE-2024-45310. bsc#1230092
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
    * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

  - Update to runc v1.2.0~rc3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.3>.
    Includes the patch for CVE-2024-45310. bsc#1230092
    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.14. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.14>.
    Includes the patch for CVE-2024-45310. bsc#1230092
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
    * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

  - Update to runc v1.2.0~rc3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.3>.
    Includes the patch for CVE-2024-45310. bsc#1230092
    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.14. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.14>.
    Includes the patch for CVE-2024-45310. bsc#1230092
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
    * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

  - Update to runc v1.2.0~rc3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.3>.
    Includes the patch for CVE-2024-45310. bsc#1230092
    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.14. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.14>.
    Includes the patch for CVE-2024-45310. bsc#1230092
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
    * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

  - Update to runc v1.2.0~rc3. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.3>.
    Includes the patch for CVE-2024-45310. bsc#1230092
    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.14. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.14>.
    Includes the patch for CVE-2024-45310. bsc#1230092
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
    * 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ util-linux-systemd:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

++++ util-linux-systemd:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

++++ util-linux-systemd:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

++++ util-linux-systemd:

  - Skip aarch64 decode path for rest of the architectures
    (bsc#1229476, util-linux-lscpu-skip-aarch64-decode.patch).

------------------------------------------------------------------
------------------  2024-9-2  -  Sep 2 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add note about guestOS values for vmware ovftools.
  - Add note about guestOS values for vmware platform.
  - Fixed resize of dos table type on s390
    On s390, parted is used to detect the partition table type.
    In contrast to blkid the name for DOS tables is reported
    as 'msdos' and not 'dos' which impacts several conditions
    in the kiwi initrd code which checks for 'dos'. This commit
    fixes the get_partition_table_type() method to return a
    consistent table name for DOS tables. This Fixes bsc#1228729
  - Revert "remove dependency on /usr/bin/python"
    This reverts commit 15b450188483b567ca10bb459bf50ed90e905bb7.
    The change provided here entirely broke kiwi in OBS. With this
    patch applied every image build in OBS fails with the following
    message: 'line 1: /usr/sbin/kiwi: No such file or directory'
  - Bump version: 10.1.2 → 10.1.3

++++ python-kiwi:

  - Add note about guestOS values for vmware ovftools.
  - Add note about guestOS values for vmware platform.
  - Fixed resize of dos table type on s390
    On s390, parted is used to detect the partition table type.
    In contrast to blkid the name for DOS tables is reported
    as 'msdos' and not 'dos' which impacts several conditions
    in the kiwi initrd code which checks for 'dos'. This commit
    fixes the get_partition_table_type() method to return a
    consistent table name for DOS tables. This Fixes bsc#1228729
  - Revert "remove dependency on /usr/bin/python"
    This reverts commit 15b450188483b567ca10bb459bf50ed90e905bb7.
    The change provided here entirely broke kiwi in OBS. With this
    patch applied every image build in OBS fails with the following
    message: 'line 1: /usr/sbin/kiwi: No such file or directory'
  - Bump version: 10.1.2 → 10.1.3

++++ python-kiwi:

  - Add note about guestOS values for vmware ovftools.
  - Add note about guestOS values for vmware platform.
  - Fixed resize of dos table type on s390
    On s390, parted is used to detect the partition table type.
    In contrast to blkid the name for DOS tables is reported
    as 'msdos' and not 'dos' which impacts several conditions
    in the kiwi initrd code which checks for 'dos'. This commit
    fixes the get_partition_table_type() method to return a
    consistent table name for DOS tables. This Fixes bsc#1228729
  - Revert "remove dependency on /usr/bin/python"
    This reverts commit 15b450188483b567ca10bb459bf50ed90e905bb7.
    The change provided here entirely broke kiwi in OBS. With this
    patch applied every image build in OBS fails with the following
    message: 'line 1: /usr/sbin/kiwi: No such file or directory'
  - Bump version: 10.1.2 → 10.1.3

++++ kernel-default:

  - ceph: periodically flush the cap releases (bsc#1230056).
  - commit e22b6e0
  - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
  - commit 1bec58d
  - Bluetooth: L2CAP: Fix deadlock (git-fixes).
  - commit 13aba13
  - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
    CVE-2024-41062).
  - commit 6553526
  - mm: prevent derefencing NULL ptr in pfn_section_valid()
    (git-fixes).
  - commit 35f619d
  - mm, kmsan: fix infinite recursion due to RCU critical section
    (git-fixes).
  - commit 16ad73a
  - mm/sparsemem: fix race in accessing memory_section->usage
    (bsc#1221326 CVE-2023-52489).
  - commit 6aa8957
  - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
  - commit 4dc1da1

++++ kernel-default:

  - ceph: periodically flush the cap releases (bsc#1230056).
  - commit e22b6e0
  - Bluetooth: Fix usage of __hci_cmd_sync_status (git-fixes).
  - commit 1bec58d
  - Bluetooth: L2CAP: Fix deadlock (git-fixes).
  - commit 13aba13
  - net/sched: act_ct: fix skb leak and crash on ooo frags
    (CVE-2023-52610 bsc#1221610).
  - commit 7a32533
  - bluetooth/l2cap: sync sock recv cb and release (bsc#1228576
    CVE-2024-41062).
  - commit 6553526
  - mm: prevent derefencing NULL ptr in pfn_section_valid()
    (git-fixes).
  - commit 35f619d
  - mm, kmsan: fix infinite recursion due to RCU critical section
    (git-fixes).
  - commit 16ad73a
  - mm/sparsemem: fix race in accessing memory_section->usage
    (bsc#1221326 CVE-2023-52489).
  - commit 6aa8957
  - net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response (git-fixes).
  - commit 4dc1da1

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311-core:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ python311:

  - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid
    failing test_sendfile_close_peer_in_the_middle_of_receiving
    tests on Linux >= 6.10 (GH-120227).

++++ rust-keylime:

  - Update vendored crates (bsc#1229952, bsc#1230029)
    * rustix 0.37.25
    * rustix 0.38.34
    * shlex  1.3.0
  - Update to version 0.2.6+13:
    * Enable test functional/iak-idevid-persisted-and-protected
    * build(deps): bump uuid from 1.7.0 to 1.10.0
    * build(deps): bump openssl from 0.10.64 to 0.10.66
    * keylime-agent/src/revocation: Fix comment indentation
    * keylime/crypto: Fix indentation of documentation comment
    * build(deps): bump thiserror from 1.0.59 to 1.0.63
    * build(deps): bump serde_json from 1.0.116 to 1.0.120
    * dependabot: Extend to also monitor workflow actions
    * ci: Disable Packit CI on CentOS Stream 9
    * ci: use CODECOV_TOKEN when submitting coverage data
    * revocation: Use into() for unfallible transformation
    * secure_mount: Fix possible infinite loop
    * error: Rename enum variants to avoid clippy warning

++++ rust-keylime:

  - Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
    * rustix 0.37.25
    * rustix 0.38.34
    * shlex  1.3.0
  - Update to version 0.2.6+13:
    * Enable test functional/iak-idevid-persisted-and-protected
    * build(deps): bump uuid from 1.7.0 to 1.10.0
    * build(deps): bump openssl from 0.10.64 to 0.10.66
    * keylime-agent/src/revocation: Fix comment indentation
    * keylime/crypto: Fix indentation of documentation comment
    * build(deps): bump thiserror from 1.0.59 to 1.0.63
    * build(deps): bump serde_json from 1.0.116 to 1.0.120
    * dependabot: Extend to also monitor workflow actions
    * ci: Disable Packit CI on CentOS Stream 9
    * ci: use CODECOV_TOKEN when submitting coverage data
    * revocation: Use into() for unfallible transformation
    * secure_mount: Fix possible infinite loop
    * error: Rename enum variants to avoid clippy warning

++++ rust-keylime:

  - Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
    * rustix 0.37.25
    * rustix 0.38.34
    * shlex  1.3.0
  - Update to version 0.2.6+13:
    * Enable test functional/iak-idevid-persisted-and-protected
    * build(deps): bump uuid from 1.7.0 to 1.10.0
    * build(deps): bump openssl from 0.10.64 to 0.10.66
    * keylime-agent/src/revocation: Fix comment indentation
    * keylime/crypto: Fix indentation of documentation comment
    * build(deps): bump thiserror from 1.0.59 to 1.0.63
    * build(deps): bump serde_json from 1.0.116 to 1.0.120
    * dependabot: Extend to also monitor workflow actions
    * ci: Disable Packit CI on CentOS Stream 9
    * ci: use CODECOV_TOKEN when submitting coverage data
    * revocation: Use into() for unfallible transformation
    * secure_mount: Fix possible infinite loop
    * error: Rename enum variants to avoid clippy warning

++++ rust-keylime:

  - Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
    * rustix 0.37.25
    * rustix 0.38.34
    * shlex  1.3.0
  - Update to version 0.2.6+13:
    * Enable test functional/iak-idevid-persisted-and-protected
    * build(deps): bump uuid from 1.7.0 to 1.10.0
    * build(deps): bump openssl from 0.10.64 to 0.10.66
    * keylime-agent/src/revocation: Fix comment indentation
    * keylime/crypto: Fix indentation of documentation comment
    * build(deps): bump thiserror from 1.0.59 to 1.0.63
    * build(deps): bump serde_json from 1.0.116 to 1.0.120
    * dependabot: Extend to also monitor workflow actions
    * ci: Disable Packit CI on CentOS Stream 9
    * ci: use CODECOV_TOKEN when submitting coverage data
    * revocation: Use into() for unfallible transformation
    * secure_mount: Fix possible infinite loop
    * error: Rename enum variants to avoid clippy warning

++++ rust-keylime:

  - Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
    * rustix 0.37.25
    * rustix 0.38.34
    * shlex  1.3.0
  - Update to version 0.2.6+13:
    * Enable test functional/iak-idevid-persisted-and-protected
    * build(deps): bump uuid from 1.7.0 to 1.10.0
    * build(deps): bump openssl from 0.10.64 to 0.10.66
    * keylime-agent/src/revocation: Fix comment indentation
    * keylime/crypto: Fix indentation of documentation comment
    * build(deps): bump thiserror from 1.0.59 to 1.0.63
    * build(deps): bump serde_json from 1.0.116 to 1.0.120
    * dependabot: Extend to also monitor workflow actions
    * ci: Disable Packit CI on CentOS Stream 9
    * ci: use CODECOV_TOKEN when submitting coverage data
    * revocation: Use into() for unfallible transformation
    * secure_mount: Fix possible infinite loop
    * error: Rename enum variants to avoid clippy warning

------------------------------------------------------------------
------------------  2024-9-1  -  Sep 1 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix bundle extension for archive types
    When bundling result files that uses an archive type like
    tbz or docker, kiwi creates them with the extension tar.xz/tar.gz
    The bundler code only uses the extension from the last tuple
    in a "." split which is wrong for "tar." filenames. This commit
    adds an exception to the prefix rule for this output filenames
    and Fixes #2628
  - Fix ImageSystem mount procedure
    The mount() method did not take custom partitions into account.
    This commit fixes it. This Fixes #2619

++++ python-kiwi:

  - Fix bundle extension for archive types
    When bundling result files that uses an archive type like
    tbz or docker, kiwi creates them with the extension tar.xz/tar.gz
    The bundler code only uses the extension from the last tuple
    in a "." split which is wrong for "tar." filenames. This commit
    adds an exception to the prefix rule for this output filenames
    and Fixes #2628
  - Fix ImageSystem mount procedure
    The mount() method did not take custom partitions into account.
    This commit fixes it. This Fixes #2619

++++ python-kiwi:

  - Fix bundle extension for archive types
    When bundling result files that uses an archive type like
    tbz or docker, kiwi creates them with the extension tar.xz/tar.gz
    The bundler code only uses the extension from the last tuple
    in a "." split which is wrong for "tar." filenames. This commit
    adds an exception to the prefix rule for this output filenames
    and Fixes #2628
  - Fix ImageSystem mount procedure
    The mount() method did not take custom partitions into account.
    This commit fixes it. This Fixes #2619

++++ kernel-default:

  - xfs: Fix missing interval for missing_owner in xfs fsmap
    (git-fixes).
  - commit 5448ab5
  - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
    (git-fixes).
  - commit 288ad9b
  - xfs: Fix the owner setting issue for rmap query in xfs fsmap
    (git-fixes).
  - commit 49b5eec
  - usb: cdnsp: fix for Link TRB with TC (git-fixes).
  - usb: dwc3: st: add missing depopulate in probe error path
    (git-fixes).
  - usb: dwc3: st: fix probed platform device ref count on probe
    error path (git-fixes).
  - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
    remove_power_attributes() (git-fixes).
  - usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
  - usb: dwc3: omap: add missing depopulate in probe error path
    (git-fixes).
  - usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
    (git-fixes).
  - soc: qcom: pmic_glink: Actually communicate when remote goes
    down (git-fixes).
  - soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
  - commit 7121142

++++ kernel-default:

  - xfs: Fix missing interval for missing_owner in xfs fsmap
    (git-fixes).
  - commit 5448ab5
  - xfs: use XFS_BUF_DADDR_NULL for daddrs in getfsmap code
    (git-fixes).
  - commit 288ad9b
  - xfs: Fix the owner setting issue for rmap query in xfs fsmap
    (git-fixes).
  - commit 49b5eec
  - usb: cdnsp: fix for Link TRB with TC (git-fixes).
  - usb: dwc3: st: add missing depopulate in probe error path
    (git-fixes).
  - usb: dwc3: st: fix probed platform device ref count on probe
    error path (git-fixes).
  - usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in
    remove_power_attributes() (git-fixes).
  - usb: typec: fsa4480: Relax CHIP_ID check (git-fixes).
  - usb: dwc3: omap: add missing depopulate in probe error path
    (git-fixes).
  - usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
    (git-fixes).
  - soc: qcom: pmic_glink: Actually communicate when remote goes
    down (git-fixes).
  - soc: qcom: cmd-db: Map shared memory as WC, not WB (git-fixes).
  - commit 7121142

------------------------------------------------------------------
------------------  2024-8-31  -  Aug 31 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - dmaengine: dw: Add memory bus width verification (git-fixes).
  - dmaengine: dw: Add peripheral bus width verification
    (git-fixes).
  - soundwire: stream: fix programming slave ports for non-continous
    port maps (git-fixes).
  - commit b7e9784

++++ kernel-default:

  - dmaengine: dw: Add memory bus width verification (git-fixes).
  - dmaengine: dw: Add peripheral bus width verification
    (git-fixes).
  - soundwire: stream: fix programming slave ports for non-continous
    port maps (git-fixes).
  - commit b7e9784

------------------------------------------------------------------
------------------  2024-8-30  -  Aug 30 2024  -------------------
------------------------------------------------------------------

++++ transactional-update:

  - Version 4.8.1
  - tukit: fix --drop-if-no-change after apply [bsc#1229900]

++++ transactional-update:

  - Version 4.8.1
  - tukit: fix --drop-if-no-change after apply [bsc#1229900]

++++ ignition:

  - Drop "go clean" from the upstream build script: since we build in
    clean environments, we don't have caches. Additionally, the way
    it is used does not even work and reports:
    go: clean -cache cannot be used with package arguments
    The error was masked until GO 1.23, as the test wether go
    supported caching was checking for go 1.23 formatted output.

++++ ignition:

  - Drop "go clean" from the upstream build script: since we build in
    clean environments, we don't have caches. Additionally, the way
    it is used does not even work and reports:
    go: clean -cache cannot be used with package arguments
    The error was masked until GO 1.23, as the test wether go
    supported caching was checking for go 1.23 formatted output.

++++ ignition:

  - Drop "go clean" from the upstream build script: since we build in
    clean environments, we don't have caches. Additionally, the way
    it is used does not even work and reports:
    go: clean -cache cannot be used with package arguments
    The error was masked until GO 1.23, as the test wether go
    supported caching was checking for go 1.23 formatted output.

++++ kernel-default:

  - Update
    patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
    (git-fixes CVE-2024-35902 bsc#1224496).
  - Update
    patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
    (git-fixes CVE-2024-42278 bsc#1229403).
  - Update
    patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
    (git-fixes CVE-2024-43818 bsc#1229296).
  - Update
    patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
    (git-fixes CVE-2024-42298 bsc#1229369).
  - Update
    patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
    (git-fixes CVE-2024-43884 bsc#1229739).
  - Update
    patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
    (git-fixes CVE-2024-26976 bsc#1223635).
  - Update
    patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
    (git-fixes CVE-2024-42302 bsc#1229366).
  - Update
    patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
    (git-fixes CVE-2024-43875 bsc#1229486).
  - Update
    patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
    (git-fixes CVE-2024-43824 bsc#1229320).
  - Update
    patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
    (git-fixes CVE-2024-43823 bsc#1229303).
  - Update
    patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
    (git-fixes CVE-2024-43876 bsc#1229485).
  - Update
    patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
    (git-fixes CVE-2024-43872 bsc#1229489).
  - Update
    patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
    (git-fixes CVE-2024-42285 bsc#1229381).
  - Update
    patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
    (bsc#1208783 CVE-2024-42274 bsc#1229417).
  - Update
    patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
    (git-fixes CVE-2024-36907 bsc#1225751).
  - Update
    patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
    (git-fixes CVE-2024-43840 bsc#1229344).
  - Update
    patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
    (git-fixes CVE-2024-43885 bsc#1229747).
  - Update
    patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
    (git-fixes CVE-2024-42314 bsc#1229355).
  - Update
    patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
    (bsc#1228801 CVE-2024-43853 bsc#1229292).
  - Update
    patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
    (git-fixes CVE-2024-43874 bsc#1229487).
  - Update
    patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
    (git-fixes CVE-2024-43871 bsc#1229490).
  - Update
    patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
    (git-fixes CVE-2024-43856 bsc#1229346).
  - Update
    patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
    (stable-fixes CVE-2024-43906 bsc#1229785).
  - Update
    patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
    (stable-fixes CVE-2024-43903 bsc#1229781).
  - Update
    patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
    (stable-fixes CVE-2024-43902 bsc#1229767).
  - Update
    patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
    (stable-fixes CVE-2024-43895 bsc#1229755).
  - Update
    patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
    (stable-fixes CVE-2024-43905 bsc#1229784).
  - Update
    patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
    (stable-fixes CVE-2024-43908 bsc#1229788).
  - Update
    patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
    (stable-fixes CVE-2024-43909 bsc#1229789).
  - Update
    patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
    (stable-fixes CVE-2024-43907 bsc#1229787).
  - Update
    patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
    (git-fixes CVE-2024-43894 bsc#1229746).
  - Update
    patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
    (git-fixes CVE-2024-42310 bsc#1229358).
  - Update
    patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
    (git-fixes CVE-2024-42309 bsc#1229359).
  - Update
    patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
    (git-fixes CVE-2024-43867 bsc#1229493).
  - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
    (git-fixes CVE-2024-43829 bsc#1229341).
  - Update
    patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
    (git-fixes CVE-2024-43863 bsc#1229497).
  - Update
    patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
    (git-fixes CVE-2024-42315 bsc#1229354).
  - Update
    patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
    (stable-fixes CVE-2024-44931 bsc#1229837).
  - Update
    patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
    (git-fixes CVE-2024-42311 bsc#1229413).
  - Update
    patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
    (git-fixes CVE-2024-43825 bsc#1229298).
  - Update
    patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
    (git-fixes CVE-2024-43858 bsc#1229414).
  - Update
    patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
    (git-fixes CVE-2024-44938 bsc#1229792).
  - Update
    patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
    (git-fixes CVE-2024-44939 bsc#1229820).
  - Update
    patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
    (git-fixes CVE-2024-42292 bsc#1229373).
  - Update
    patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
    (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
  - Update
    patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
    (git-fixes CVE-2024-43830 bsc#1229305).
  - Update
    patches.suse/lib-objagg-Fix-general-protection-fault.patch
    (git-fixes CVE-2024-43846 bsc#1229360).
  - Update
    patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
    (git-fixes CVE-2024-27050 bsc#1223767).
  - Update
    patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
    (git-fixes CVE-2024-42280 bsc#1229388).
  - Update
    patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
    (git-fixes CVE-2024-42319 bsc#1229350).
  - Update
    patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
    (git-fixes CVE-2024-39476 bsc#1227437).
  - Update
    patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
    (git-fixes CVE-2024-42303 bsc#1229365).
  - Update
    patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
    (git-fixes CVE-2024-43877 bsc#1229484).
  - Update
    patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
    (git-fixes CVE-2024-43833 bsc#1229299).
  - Update
    patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
    (git-fixes CVE-2024-42313 bsc#1229356).
  - Update
    patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
    (stable-fixes CVE-2024-43900 bsc#1229756).
  - Update
    patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
    (git-fixes CVE-2024-43892 bsc#1229761).
  - Update
    patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
    (git-fixes CVE-2024-43897 bsc#1229752).
  - Update
    patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
    (bsc#1228973 CVE-2024-42271 bsc#1229400).
  - Update patches.suse/net-missing-check-virtio.patch (git-fixes
    CVE-2024-43817 bsc#1229312).
  - Update
    patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
    (git-fixes CVE-2024-43861 bsc#1229500).
  - Update
    patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
    (git-fixes CVE-2024-43826 bsc#1229294).
  - Update
    patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
    (git-fixes CVE-2024-42276 bsc#1229410).
  - Update
    patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
    (git-fixes CVE-2024-43889 bsc#1229743).
  - Update
    patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
    (git-fixes CVE-2024-43860 bsc#1229319).
  - Update
    patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
    (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
  - Update
    patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
    (bsc#1228857 CVE-2024-43816 bsc#1229318).
  - Update
    patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
    (bsc#1228850 CVE-2024-42287 bsc#1229392).
  - Update
    patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
    (bsc#1228850 CVE-2024-42289 bsc#1229399).
  - Update
    patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
    (bsc#1228850 CVE-2024-42288 bsc#1229398).
  - Update
    patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
    (bsc#1228850 CVE-2024-42286 bsc#1229395).
  - Update
    patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
    (stable-fixes CVE-2024-43893 bsc#1229759).
  - Update
    patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
    (git-fixes CVE-2024-43849 bsc#1229307).
  - Update
    patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
    (git-fixes CVE-2024-43851 bsc#1229313).
  - Update
    patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
    (git-fixes CVE-2024-42279 bsc#1229390).
  - Update
    patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
    (stable-fixes CVE-2024-43883 bsc#1229707).
  - Update
    patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
    (git-fixes CVE-2024-43873 bsc#1229488).
  - Update
    patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
    (git-fixes CVE-2024-43881 bsc#1229480).
  - Update
    patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
    (git-fixes CVE-2024-43847 bsc#1229291).
  - Update
    patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
    (git-fixes CVE-2024-43879 bsc#1229482).
  - Update
    patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
    (stable-fixes CVE-2024-43912 bsc#1229830).
  - Update
    patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
    (git-fixes CVE-2024-43842 bsc#1229317).
  - Update
    patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
    (git-fixes CVE-2024-43841 bsc#1229304).
  - commit 140ec33
  - iommu/amd: Convert comma to semicolon (git-fixes).
  - commit 2714d8b
  - scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
    CVE-2024-43821).
  - commit eb73e94
  - iommu/vt-d: Fix identity map bounds in si_domain_init()
    (git-fixes).
  - commit b4d27e5
  - iommufd/device: Fix hwpt at err_unresv in
    iommufd_device_do_replace() (git-fixes).
  - commit bbc9a65
  - blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
    This commit breaks kABI and the data structure has no free room for the
    extra field, i.e. memcpy would fail to copy the additional member added by
    this patch.
  - commit 941b81c
  - virtiofs: forbid newlines in tags (bsc#1229940).
  - commit 61514ce
  - trace/pid_list: Change gfp flags in pid_list_fill_irq()
    (git-fixes).
  - commit 88d1dac
  - blacklist.conf: add a not-relevant tracing commit
  - commit 9e3013e
  - evm: don't copy up 'security.evm' xattr (git-fixes).
  - commit d3bb5af
  - afs: fix __afs_break_callback() / afs_drop_open_mmap() race
    (git-fixes).
  - commit 150e615
  - jfs: define xtree root and page independently (git-fixes).
  - commit fc62e49
  - kernfs: fix false-positive WARN(nr_mmapped) in
    kernfs_drain_open_files (git-fixes).
  - commit 7fa46d1
  - gfs2: setattr_chown: Add missing initialization (git-fixes).
  - commit 9b6ef3b
  - nfc: pn533: Add poll mod list filling check (git-fixes).
  - wifi: wfx: repair open network AP mode (git-fixes).
  - wifi: iwlwifi: fw: fix wgds rev 3 exact size (git-fixes).
  - wifi: mwifiex: duplicate static structs used in driver instances
    (git-fixes).
  - Input: i8042 - use new forcenorestore quirk to replace old
    buggy quirk combination (stable-fixes).
  - Input: i8042 - add forcenorestore quirk to leave controller
    untouched even on s3 (stable-fixes).
  - platform/surface: aggregator: Fix warning when controller is
    destroyed in probe (git-fixes).
  - thunderbolt: Mark XDomain as unplugged when router is removed
    (stable-fixes).
  - Input: MT - limit max slots (stable-fixes).
  - usb: dwc3: core: Skip setting event buffers for host only
    controllers (stable-fixes).
  - platform/x86: lg-laptop: fix %s null argument warning
    (stable-fixes).
  - rtc: nct3018y: fix possible NULL dereference (stable-fixes).
  - usb: gadget: fsl: Increase size of name buffer for endpoints
    (stable-fixes).
  - media: drivers/media/dvb-core: copy user arrays safely
    (stable-fixes).
  - media: pci: cx23885: check cx23885_vdev_init() return
    (stable-fixes).
  - memory: stm32-fmc2-ebi: check regmap_read return value
    (stable-fixes).
  - memory: tegra: Skip SID programming if SID registers aren't set
    (stable-fixes).
  - Revert "usb: gadget: uvc: cleanup request when not in correct
    state" (stable-fixes).
  - usb: gadget: uvc: cleanup request when not in correct state
    (stable-fixes).
  - staging: ks7010: disable bh on tx_dev_lock (stable-fixes).
  - staging: iio: resolver: ad2s1210: fix use before initialization
    (stable-fixes).
  - ssb: Fix division by zero issue in ssb_calc_clock_rate
    (stable-fixes).
  - commit b84d799
  - drm/vmwgfx: Fix prime with external buffers (git-fixes).
  - drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict
    (git-fixes).
  - drm/amd/display: avoid using null object of framebuffer
    (git-fixes).
  - Bluetooth: hci_core: Fix not handling hibernation actions
    (git-fixes).
  - drm/amdgpu: Validate TA binary size (stable-fixes).
  - drm/msm/dpu: take plane rotation into account for wide planes
    (git-fixes).
  - drm/msm/dpu: move dpu_encoder's connector assignment to
    atomic_enable() (git-fixes).
  - char: xillybus: Refine workqueue handling (git-fixes).
  - char: xillybus: Don't destroy workqueue from work item running
    on it (stable-fixes).
  - drm/amdgpu: Actually check flags for all context ops
    (stable-fixes).
  - drm/amdgpu/jpeg4: properly set atomics vmid field
    (stable-fixes).
  - drm/amdgpu/jpeg2: properly set atomics vmid field
    (stable-fixes).
  - drm/amd/display: fix s2idle entry for DCN3.5+ (stable-fixes).
  - drm/amdgpu: fix dereference null return value for the function
    amdgpu_vm_pt_parent (stable-fixes).
  - hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
    (git-fixes).
  - firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid
    (stable-fixes).
  - drm/msm/dpu: capture snapshot on the first commit_done timeout
    (stable-fixes).
  - drm/msm/dpu: split dpu_encoder_wait_for_event into two functions
    (stable-fixes).
  - drm/lima: set gp bus_stop bit before hard reset (stable-fixes).
  - drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
    (stable-fixes).
  - gpio: sysfs: extend the critical section for unregistering
    sysfs devices (stable-fixes).
  - Bluetooth: bnep: Fix out-of-bound access (stable-fixes).
  - hwmon: (pc87360) Bounds check data->innr usage (stable-fixes).
  - ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data
    (stable-fixes).
  - drm/msm/dpu: drop MSM_ENC_VBLANK support (stable-fixes).
  - drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys
    (stable-fixes).
  - drm/msm/mdss: Rename path references to mdp_path (stable-fixes).
  - drm/msm/mdss: switch mdss to use devm_of_icc_get()
    (stable-fixes).
  - drm/msm/dpu: try multirect based on mdp clock limits
    (stable-fixes).
  - drm/msm: Reduce fallout of fence signaling vs reclaim hangs
    (stable-fixes).
  - drm/rockchip: vop2: clear afbc en and transform bit for cluster
    window at linear mode (stable-fixes).
  - Bluetooth: hci_conn: Check non NULL function before calling
    for HFP offload (stable-fixes).
  - i2c: stm32f7: Add atomic_xfer method to driver (stable-fixes).
  - i2c: riic: avoid potential division by zero (stable-fixes).
  - i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
    (stable-fixes).
  - i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times
    out (stable-fixes).
  - ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is
    pending before suspend (stable-fixes).
  - ASoC: cs35l45: Checks index of cs35l45_irqs[] (stable-fixes).
  - clk: visconti: Add bounds-checking coverage for struct
    visconti_pll_provider (stable-fixes).
  - hwmon: (ltc2992) Avoid division by zero (stable-fixes).
  - commit 1b92ddd

++++ kernel-default:

  - Update
    patches.suse/0001-net-rds-fix-possible-cp-null-dereference.patch
    (git-fixes CVE-2024-35902 bsc#1224496).
  - Update
    patches.suse/ASoC-TAS2781-Fix-tasdev_load_calibrated_data.patch
    (git-fixes CVE-2024-42278 bsc#1229403).
  - Update
    patches.suse/ASoC-amd-Adjust-error-handling-in-case-of-absent-cod.patch
    (git-fixes CVE-2024-43818 bsc#1229296).
  - Update
    patches.suse/ASoC-fsl-fsl_qmc_audio-Check-devm_kasprintf-returned.patch
    (git-fixes CVE-2024-42298 bsc#1229369).
  - Update
    patches.suse/Bluetooth-MGMT-Add-error-handling-to-pair_device.patch
    (git-fixes CVE-2024-43884 bsc#1229739).
  - Update
    patches.suse/KVM-Always-flush-async-PF-workqueue-when-vCPU-is-bei.patch
    (git-fixes CVE-2024-26976 bsc#1223635).
  - Update
    patches.suse/PCI-DPC-Fix-use-after-free-on-concurrent-DPC-and-hot.patch
    (git-fixes CVE-2024-42302 bsc#1229366).
  - Update
    patches.suse/PCI-endpoint-Clean-up-error-handling-in-vpci_scan_bu.patch
    (git-fixes CVE-2024-43875 bsc#1229486).
  - Update
    patches.suse/PCI-endpoint-pci-epf-test-Make-use-of-cached-epc_fea.patch
    (git-fixes CVE-2024-43824 bsc#1229320).
  - Update
    patches.suse/PCI-keystone-Fix-NULL-pointer-dereference-in-case-of.patch
    (git-fixes CVE-2024-43823 bsc#1229303).
  - Update
    patches.suse/PCI-rcar-Demote-WARN-to-dev_warn_ratelimited-in-rcar.patch
    (git-fixes CVE-2024-43876 bsc#1229485).
  - Update
    patches.suse/RDMA-hns-Fix-soft-lockup-under-heavy-CEQE-load.patch
    (git-fixes CVE-2024-43872 bsc#1229489).
  - Update
    patches.suse/RDMA-iwcm-Fix-a-use-after-free-related-to-destroying.patch
    (git-fixes CVE-2024-42285 bsc#1229381).
  - Update
    patches.suse/Revert-ALSA-firewire-lib-operate-for-period-elapse-e.patch
    (bsc#1208783 CVE-2024-42274 bsc#1229417).
  - Update
    patches.suse/SUNRPC-add-a-missing-rpc_stat-for-TCP-TLS.patch
    (git-fixes CVE-2024-36907 bsc#1225751).
  - Update
    patches.suse/bpf-arm64-Fix-trampoline-for-BPF_TRAMP_F_CALL_ORIG.patch
    (git-fixes CVE-2024-43840 bsc#1229344).
  - Update
    patches.suse/btrfs-fix-double-inode-unlock-for-direct-IO-sync-wri.patch
    (git-fixes CVE-2024-43885 bsc#1229747).
  - Update
    patches.suse/btrfs-fix-extent-map-use-after-free-when-adding-page.patch
    (git-fixes CVE-2024-42314 bsc#1229355).
  - Update
    patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch
    (bsc#1228801 CVE-2024-43853 bsc#1229292).
  - Update
    patches.suse/crypto-ccp-Fix-null-pointer-dereference-in-__sev_snp.patch
    (git-fixes CVE-2024-43874 bsc#1229487).
  - Update
    patches.suse/devres-Fix-memory-leakage-caused-by-driver-API-devm_.patch
    (git-fixes CVE-2024-43871 bsc#1229490).
  - Update
    patches.suse/dma-fix-call-order-in-dmam_free_coherent.patch
    (git-fixes CVE-2024-43856 bsc#1229346).
  - Update
    patches.suse/drm-admgpu-fix-dereferencing-null-pointer-context.patch
    (stable-fixes CVE-2024-43906 bsc#1229785).
  - Update
    patches.suse/drm-amd-display-Add-NULL-check-for-afb-before-derefe.patch
    (stable-fixes CVE-2024-43903 bsc#1229781).
  - Update
    patches.suse/drm-amd-display-Add-null-checker-before-passing-vari.patch
    (stable-fixes CVE-2024-43902 bsc#1229767).
  - Update
    patches.suse/drm-amd-display-Skip-Recompute-DSC-Params-if-no-Stre.patch
    (stable-fixes CVE-2024-43895 bsc#1229755).
  - Update
    patches.suse/drm-amd-pm-Fix-the-null-pointer-dereference-for-vega.patch
    (stable-fixes CVE-2024-43905 bsc#1229784).
  - Update
    patches.suse/drm-amdgpu-Fix-the-null-pointer-dereference-to-ras_m.patch
    (stable-fixes CVE-2024-43908 bsc#1229788).
  - Update
    patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-for-s.patch
    (stable-fixes CVE-2024-43909 bsc#1229789).
  - Update
    patches.suse/drm-amdgpu-pm-Fix-the-null-pointer-dereference-in-ap.patch
    (stable-fixes CVE-2024-43907 bsc#1229787).
  - Update
    patches.suse/drm-client-fix-null-pointer-dereference-in-drm_clien.patch
    (git-fixes CVE-2024-43894 bsc#1229746).
  - Update
    patches.suse/drm-gma500-fix-null-pointer-dereference-in-cdv_intel.patch
    (git-fixes CVE-2024-42310 bsc#1229358).
  - Update
    patches.suse/drm-gma500-fix-null-pointer-dereference-in-psb_intel.patch
    (git-fixes CVE-2024-42309 bsc#1229359).
  - Update
    patches.suse/drm-nouveau-prime-fix-refcount-underflow.patch
    (git-fixes CVE-2024-43867 bsc#1229493).
  - Update patches.suse/drm-qxl-Add-check-for-drm_cvt_mode.patch
    (git-fixes CVE-2024-43829 bsc#1229341).
  - Update
    patches.suse/drm-vmwgfx-Fix-a-deadlock-in-dma-buf-fence-polling.patch
    (git-fixes CVE-2024-43863 bsc#1229497).
  - Update
    patches.suse/exfat-fix-potential-deadlock-on-__exfat_get_dentry_set.patch
    (git-fixes CVE-2024-42315 bsc#1229354).
  - Update
    patches.suse/gpio-prevent-potential-speculation-leaks-in-gpio_dev.patch
    (stable-fixes CVE-2024-44931 bsc#1229837).
  - Update
    patches.suse/hfs-fix-to-initialize-fields-of-hfs_inode_info-after-hfs_alloc_inode.patch
    (git-fixes CVE-2024-42311 bsc#1229413).
  - Update
    patches.suse/iio-Fix-the-sorting-functionality-in-iio_gts_build_a.patch
    (git-fixes CVE-2024-43825 bsc#1229298).
  - Update
    patches.suse/jfs-Fix-array-index-out-of-bounds-in-diFree.patch
    (git-fixes CVE-2024-43858 bsc#1229414).
  - Update
    patches.suse/jfs-Fix-shift-out-of-bounds-in-dbDiscardAG.patch
    (git-fixes CVE-2024-44938 bsc#1229792).
  - Update
    patches.suse/jfs-fix-null-ptr-deref-in-dtInsertEntry.patch
    (git-fixes CVE-2024-44939 bsc#1229820).
  - Update
    patches.suse/kobject_uevent-Fix-OOB-access-within-zap_modalias_en.patch
    (git-fixes CVE-2024-42292 bsc#1229373).
  - Update
    patches.suse/kvm-s390-Reject-memory-region-operations-for-ucontrol-VMs.patch
    (git-fixes bsc#1229168 CVE-2024-43819 bsc#1229290).
  - Update
    patches.suse/leds-trigger-Unregister-sysfs-attributes-before-call.patch
    (git-fixes CVE-2024-43830 bsc#1229305).
  - Update
    patches.suse/lib-objagg-Fix-general-protection-fault.patch
    (git-fixes CVE-2024-43846 bsc#1229360).
  - Update
    patches.suse/libbpf-Use-OPTS_SET-macro-in-bpf_xdp_query.patch
    (git-fixes CVE-2024-27050 bsc#1223767).
  - Update
    patches.suse/mISDN-Fix-a-use-after-free-in-hfcmulti_tx.patch
    (git-fixes CVE-2024-42280 bsc#1229388).
  - Update
    patches.suse/mailbox-mtk-cmdq-Move-devm_mbox_controller_register-.patch
    (git-fixes CVE-2024-42319 bsc#1229350).
  - Update
    patches.suse/md-raid5-fix-deadlock-that-raid5d-wait-for-itself-to-clear-MD_SB_CHANGE_PENDING-151f.patch
    (git-fixes CVE-2024-39476 bsc#1227437).
  - Update
    patches.suse/media-imx-pxp-Fix-ERR_PTR-dereference-in-pxp_probe.patch
    (git-fixes CVE-2024-42303 bsc#1229365).
  - Update
    patches.suse/media-pci-ivtv-Add-check-for-DMA-map-result.patch
    (git-fixes CVE-2024-43877 bsc#1229484).
  - Update
    patches.suse/media-v4l-async-Fix-NULL-pointer-dereference-in-addi.patch
    (git-fixes CVE-2024-43833 bsc#1229299).
  - Update
    patches.suse/media-venus-fix-use-after-free-in-vdec_close.patch
    (git-fixes CVE-2024-42313 bsc#1229356).
  - Update
    patches.suse/media-xc2028-avoid-use-after-free-in-load_firmware_c.patch
    (stable-fixes CVE-2024-43900 bsc#1229756).
  - Update
    patches.suse/memcg-protect-concurrent-access-to-mem_cgroup_idr.patch
    (git-fixes CVE-2024-43892 bsc#1229761).
  - Update
    patches.suse/net-drop-bad-gso-csum_start-and-offset-in-virtio_net.patch
    (git-fixes CVE-2024-43897 bsc#1229752).
  - Update
    patches.suse/net-iucv-fix-use-after-free-in-iucv_sock_close.patch
    (bsc#1228973 CVE-2024-42271 bsc#1229400).
  - Update patches.suse/net-missing-check-virtio.patch (git-fixes
    CVE-2024-43817 bsc#1229312).
  - Update
    patches.suse/net-usb-qmi_wwan-fix-memory-leak-for-not-ip-packets.patch
    (git-fixes CVE-2024-43861 bsc#1229500).
  - Update
    patches.suse/nfs-pass-explicit-offset-count-to-trace-events.patch
    (git-fixes CVE-2024-43826 bsc#1229294).
  - Update
    patches.suse/nvme-pci-add-missing-condition-check-for-existence-o.patch
    (git-fixes CVE-2024-42276 bsc#1229410).
  - Update
    patches.suse/padata-Fix-possible-divide-by-0-panic-in-padata_mt_h.patch
    (git-fixes CVE-2024-43889 bsc#1229743).
  - Update
    patches.suse/remoteproc-imx_rproc-Skip-over-memory-region-when-no.patch
    (git-fixes CVE-2024-43860 bsc#1229319).
  - Update
    patches.suse/s390-dasd-fix-error-checks-in-dasd_copy_pair_store.patch
    (git-fixes bsc#1229173 CVE-2024-42320 bsc#1229349).
  - Update
    patches.suse/scsi-lpfc-Revise-lpfc_prep_embed_io-routine-with-pro.patch
    (bsc#1228857 CVE-2024-43816 bsc#1229318).
  - Update
    patches.suse/scsi-qla2xxx-Complete-command-early-within-lock.patch
    (bsc#1228850 CVE-2024-42287 bsc#1229392).
  - Update
    patches.suse/scsi-qla2xxx-During-vport-delete-send-async-logout-e.patch
    (bsc#1228850 CVE-2024-42289 bsc#1229399).
  - Update
    patches.suse/scsi-qla2xxx-Fix-for-possible-memory-corruption.patch
    (bsc#1228850 CVE-2024-42288 bsc#1229398).
  - Update
    patches.suse/scsi-qla2xxx-validate-nvme_local_port-correctly.patch
    (bsc#1228850 CVE-2024-42286 bsc#1229395).
  - Update
    patches.suse/serial-core-check-uartclk-for-zero-to-avoid-divide-b.patch
    (stable-fixes CVE-2024-43893 bsc#1229759).
  - Update
    patches.suse/soc-qcom-pdr-protect-locator_addr-with-the-main-mute.patch
    (git-fixes CVE-2024-43849 bsc#1229307).
  - Update
    patches.suse/soc-xilinx-rename-cpu_number1-to-dummy_cpu_number.patch
    (git-fixes CVE-2024-43851 bsc#1229313).
  - Update
    patches.suse/spi-microchip-core-ensure-TX-and-RX-FIFOs-are-empty-.patch
    (git-fixes CVE-2024-42279 bsc#1229390).
  - Update
    patches.suse/usb-vhci-hcd-Do-not-drop-references-before-new-refer.patch
    (stable-fixes CVE-2024-43883 bsc#1229707).
  - Update
    patches.suse/vhost-vsock-always-initialize-seqpacket_allow.patch
    (git-fixes CVE-2024-43873 bsc#1229488).
  - Update
    patches.suse/wifi-ath12k-change-DMA-direction-while-mapping-reinj.patch
    (git-fixes CVE-2024-43881 bsc#1229480).
  - Update
    patches.suse/wifi-ath12k-fix-invalid-memory-access-while-processi.patch
    (git-fixes CVE-2024-43847 bsc#1229291).
  - Update
    patches.suse/wifi-cfg80211-handle-2x996-RU-allocation-in-cfg80211.patch
    (git-fixes CVE-2024-43879 bsc#1229482).
  - Update
    patches.suse/wifi-nl80211-disallow-setting-special-AP-channel-wid.patch
    (stable-fixes CVE-2024-43912 bsc#1229830).
  - Update
    patches.suse/wifi-rtw89-Fix-array-index-mistake-in-rtw89_sta_info.patch
    (git-fixes CVE-2024-43842 bsc#1229317).
  - Update
    patches.suse/wifi-virt_wifi-avoid-reporting-connection-success-wi.patch
    (git-fixes CVE-2024-43841 bsc#1229304).
  - commit 140ec33
  - iommu/amd: Convert comma to semicolon (git-fixes).
  - commit 2714d8b
  - scsi: lpfc: Fix a possible null pointer dereference (bsc#1229315
    CVE-2024-43821).
  - commit eb73e94
  - iommu/vt-d: Fix identity map bounds in si_domain_init()
    (git-fixes).
  - commit b4d27e5
  - iommufd/device: Fix hwpt at err_unresv in
    iommufd_device_do_replace() (git-fixes).
  - commit bbc9a65
  - blacklist.conf: add 053fc4f755ad fuse: fix UAF in rcu pathwalks
    This commit breaks kABI and the data structure has no free room for the
    extra field, i.e. memcpy would fail to copy the additional member added by
    this patch.
  - commit 941b81c
  - virtiofs: forbid newlines in tags (bsc#1229940).
  - commit 61514ce
  - trace/pid_list: Change gfp flags in pid_list_fill_irq()
    (git-fixes).
  - commit 88d1dac
  - blacklist.conf: add a not-relevant tracing commit
  - commit 9e3013e
  - evm: don't copy up 'security.evm' xattr (git-fixes).
  - commit d3bb5af
  - afs: fix __afs_break_callback() / afs_drop_open_mmap() race
    (git-fixes).
  - commit 150e615
  - jfs: define xtree root and page independently (git-fixes).
  - commit fc62e49
  - kernfs: fix false-positive WARN(nr_mmapped) in
    kernfs_drain_open_files (git-fixes).
  - commit 7fa46d1
  - gfs2: setattr_chown: Add missing initialization (git-fixes).
  - commit 9b6ef3b
  - nfc: pn533: Add poll mod list filling check (git-fixes).
  - wifi: wfx: repair open network AP mode (git-fixes).
  - wifi: iwlwifi: fw: fix wgds rev 3 exact size (git-fixes).
  - wifi: mwifiex: duplicate static structs used in driver instances
    (git-fixes).
  - Input: i8042 - use new forcenorestore quirk to replace old
    buggy quirk combination (stable-fixes).
  - Input: i8042 - add forcenorestore quirk to leave controller
    untouched even on s3 (stable-fixes).
  - platform/surface: aggregator: Fix warning when controller is
    destroyed in probe (git-fixes).
  - thunderbolt: Mark XDomain as unplugged when router is removed
    (stable-fixes).
  - Input: MT - limit max slots (stable-fixes).
  - usb: dwc3: core: Skip setting event buffers for host only
    controllers (stable-fixes).
  - platform/x86: lg-laptop: fix %s null argument warning
    (stable-fixes).
  - rtc: nct3018y: fix possible NULL dereference (stable-fixes).
  - usb: gadget: fsl: Increase size of name buffer for endpoints
    (stable-fixes).
  - media: drivers/media/dvb-core: copy user arrays safely
    (stable-fixes).
  - media: pci: cx23885: check cx23885_vdev_init() return
    (stable-fixes).
  - memory: stm32-fmc2-ebi: check regmap_read return value
    (stable-fixes).
  - memory: tegra: Skip SID programming if SID registers aren't set
    (stable-fixes).
  - Revert "usb: gadget: uvc: cleanup request when not in correct
    state" (stable-fixes).
  - usb: gadget: uvc: cleanup request when not in correct state
    (stable-fixes).
  - staging: ks7010: disable bh on tx_dev_lock (stable-fixes).
  - staging: iio: resolver: ad2s1210: fix use before initialization
    (stable-fixes).
  - ssb: Fix division by zero issue in ssb_calc_clock_rate
    (stable-fixes).
  - commit b84d799
  - drm/vmwgfx: Fix prime with external buffers (git-fixes).
  - drm/i915/dsi: Make Lenovo Yoga Tab 3 X90F DMI match less strict
    (git-fixes).
  - drm/amd/display: avoid using null object of framebuffer
    (git-fixes).
  - Bluetooth: hci_core: Fix not handling hibernation actions
    (git-fixes).
  - drm/amdgpu: Validate TA binary size (stable-fixes).
  - drm/msm/dpu: take plane rotation into account for wide planes
    (git-fixes).
  - drm/msm/dpu: move dpu_encoder's connector assignment to
    atomic_enable() (git-fixes).
  - char: xillybus: Refine workqueue handling (git-fixes).
  - char: xillybus: Don't destroy workqueue from work item running
    on it (stable-fixes).
  - drm/amdgpu: Actually check flags for all context ops
    (stable-fixes).
  - drm/amdgpu/jpeg4: properly set atomics vmid field
    (stable-fixes).
  - drm/amdgpu/jpeg2: properly set atomics vmid field
    (stable-fixes).
  - drm/amd/display: fix s2idle entry for DCN3.5+ (stable-fixes).
  - drm/amdgpu: fix dereference null return value for the function
    amdgpu_vm_pt_parent (stable-fixes).
  - hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
    (git-fixes).
  - firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid
    (stable-fixes).
  - drm/msm/dpu: capture snapshot on the first commit_done timeout
    (stable-fixes).
  - drm/msm/dpu: split dpu_encoder_wait_for_event into two functions
    (stable-fixes).
  - drm/lima: set gp bus_stop bit before hard reset (stable-fixes).
  - drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
    (stable-fixes).
  - gpio: sysfs: extend the critical section for unregistering
    sysfs devices (stable-fixes).
  - Bluetooth: bnep: Fix out-of-bound access (stable-fixes).
  - hwmon: (pc87360) Bounds check data->innr usage (stable-fixes).
  - ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data
    (stable-fixes).
  - drm/msm/dpu: drop MSM_ENC_VBLANK support (stable-fixes).
  - drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys
    (stable-fixes).
  - drm/msm/mdss: Rename path references to mdp_path (stable-fixes).
  - drm/msm/mdss: switch mdss to use devm_of_icc_get()
    (stable-fixes).
  - drm/msm/dpu: try multirect based on mdp clock limits
    (stable-fixes).
  - drm/msm: Reduce fallout of fence signaling vs reclaim hangs
    (stable-fixes).
  - drm/rockchip: vop2: clear afbc en and transform bit for cluster
    window at linear mode (stable-fixes).
  - Bluetooth: hci_conn: Check non NULL function before calling
    for HFP offload (stable-fixes).
  - i2c: stm32f7: Add atomic_xfer method to driver (stable-fixes).
  - i2c: riic: avoid potential division by zero (stable-fixes).
  - i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
    (stable-fixes).
  - i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times
    out (stable-fixes).
  - ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is
    pending before suspend (stable-fixes).
  - ASoC: cs35l45: Checks index of cs35l45_irqs[] (stable-fixes).
  - clk: visconti: Add bounds-checking coverage for struct
    visconti_pll_provider (stable-fixes).
  - hwmon: (ltc2992) Avoid division by zero (stable-fixes).
  - commit 1b92ddd

------------------------------------------------------------------
------------------  2024-8-29  -  Aug 29 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - jump_label: Fix the fix, brown paper bags galore (git-fixes).
  - commit 89b2827
  - jump_label: Simplify and clarify
    static_key_fast_inc_cpus_locked() (git-fixes).
  - commit 954eaa3
  - jump_label: Clarify condition in
    static_key_fast_inc_not_disabled() (git-fixes).
  - commit eb457dc
  - jump_label: Fix concurrency issues in static_key_slow_dec()
    (git-fixes).
  - commit 6e92a06
  - tracing: Return from tracing_buffers_read() if the file has
    been closed (bsc#1229136 git-fixes).
  - commit 8dc8510
  - kprobes: Fix to check symbol prefixes correctly (git-fixes).
  - commit e8b168b
  - kprobes: Prohibit probing on CFI preamble symbol (git-fixes).
  - commit 2f9e2b1
  - bpf: kprobe: remove unused declaring of bpf_kprobe_override
    (git-fixes).
  - commit 4045c94
  - wifi: mac80211: fix NULL dereference at band check in starting
    tx ba session (CVE-2024-43911 bsc#1229827).
  - commit 0892b94
  - syscalls: fix compat_sys_io_pgetevents_time64 usage (git-fixes).
  - commit b90dd07
  - iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
    (CVE-2024-42277 bsc#1229409).
  - commit ede2511

++++ kernel-default:

  - jump_label: Fix the fix, brown paper bags galore (git-fixes).
  - commit 89b2827
  - jump_label: Simplify and clarify
    static_key_fast_inc_cpus_locked() (git-fixes).
  - commit 954eaa3
  - jump_label: Clarify condition in
    static_key_fast_inc_not_disabled() (git-fixes).
  - commit eb457dc
  - jump_label: Fix concurrency issues in static_key_slow_dec()
    (git-fixes).
  - commit 6e92a06
  - tracing: Return from tracing_buffers_read() if the file has
    been closed (bsc#1229136 git-fixes).
  - commit 8dc8510
  - kprobes: Fix to check symbol prefixes correctly (git-fixes).
  - commit e8b168b
  - kprobes: Prohibit probing on CFI preamble symbol (git-fixes).
  - commit 2f9e2b1
  - bpf: kprobe: remove unused declaring of bpf_kprobe_override
    (git-fixes).
  - commit 4045c94
  - wifi: mac80211: fix NULL dereference at band check in starting
    tx ba session (CVE-2024-43911 bsc#1229827).
  - commit 0892b94
  - syscalls: fix compat_sys_io_pgetevents_time64 usage (git-fixes).
  - commit b90dd07
  - iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
    (CVE-2024-42277 bsc#1229409).
  - commit ede2511

++++ systemd:

  - Add 5003-99-systemd.rules-rework-SYSTEMD_READY-logic-for-devi.patch (bsc#1229518)
  - Import commit 0512d0d1fc0b54a84964281708036a46ab39c153
    0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659)
    765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659)
    e29909088b test: Add effective cgroup limits testing (jsc#PED-5659)
    beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659)
    e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659)
    5aa063ae16 bus-print-properties: prettify more unset properties
    a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak}
    8418791441 cgroup: rename TasksMax structure to CGroupTasksMax
  - Drop 5003-cgroup-rename-TasksMax-structure-to-CGroupTasksMax.patch
    5004-bus-print-properties-ignore-CGROUP_LIMIT_MAX-for-Mem.patch
    5005-bus-print-properties-prettify-more-unset-properties.patch
    5006-cgroup-Add-EffectiveMemoryMax-EffectiveMemoryHigh-an.patch
    5007-test-Convert-rlimit-test-to-subtest-of-generic-limit.patch
    5008-test-Add-effective-cgroup-limits-testing.patch
    5009-cgroup-Restrict-effective-limits-with-global-resourc.patch
    5010-cgroup-Rename-effective-limits-internal-table.patch
    These patches have been merged in the SUSE/254 branch.

++++ systemd:

  - Add 5003-99-systemd.rules-rework-SYSTEMD_READY-logic-for-devi.patch (bsc#1229518)
  - Import commit 0512d0d1fc0b54a84964281708036a46ab39c153
    0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659)
    765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659)
    e29909088b test: Add effective cgroup limits testing (jsc#PED-5659)
    beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659)
    e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659)
    5aa063ae16 bus-print-properties: prettify more unset properties
    a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak}
    8418791441 cgroup: rename TasksMax structure to CGroupTasksMax
  - Drop 5003-cgroup-rename-TasksMax-structure-to-CGroupTasksMax.patch
    5004-bus-print-properties-ignore-CGROUP_LIMIT_MAX-for-Mem.patch
    5005-bus-print-properties-prettify-more-unset-properties.patch
    5006-cgroup-Add-EffectiveMemoryMax-EffectiveMemoryHigh-an.patch
    5007-test-Convert-rlimit-test-to-subtest-of-generic-limit.patch
    5008-test-Add-effective-cgroup-limits-testing.patch
    5009-cgroup-Restrict-effective-limits-with-global-resourc.patch
    5010-cgroup-Rename-effective-limits-internal-table.patch
    These patches have been merged in the SUSE/254 branch.

++++ systemd:

  - Add 5003-99-systemd.rules-rework-SYSTEMD_READY-logic-for-devi.patch (bsc#1229518)
  - Import commit 0512d0d1fc0b54a84964281708036a46ab39c153
    0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659)
    765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659)
    e29909088b test: Add effective cgroup limits testing (jsc#PED-5659)
    beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659)
    e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659)
    5aa063ae16 bus-print-properties: prettify more unset properties
    a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak}
    8418791441 cgroup: rename TasksMax structure to CGroupTasksMax
  - Drop 5003-cgroup-rename-TasksMax-structure-to-CGroupTasksMax.patch
    5004-bus-print-properties-ignore-CGROUP_LIMIT_MAX-for-Mem.patch
    5005-bus-print-properties-prettify-more-unset-properties.patch
    5006-cgroup-Add-EffectiveMemoryMax-EffectiveMemoryHigh-an.patch
    5007-test-Convert-rlimit-test-to-subtest-of-generic-limit.patch
    5008-test-Add-effective-cgroup-limits-testing.patch
    5009-cgroup-Restrict-effective-limits-with-global-resourc.patch
    5010-cgroup-Rename-effective-limits-internal-table.patch
    These patches have been merged in the SUSE/254 branch.

++++ systemd:

  - Add 5003-99-systemd.rules-rework-SYSTEMD_READY-logic-for-devi.patch (bsc#1229518)
  - Import commit 0512d0d1fc0b54a84964281708036a46ab39c153
    0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659)
    765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659)
    e29909088b test: Add effective cgroup limits testing (jsc#PED-5659)
    beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659)
    e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659)
    5aa063ae16 bus-print-properties: prettify more unset properties
    a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak}
    8418791441 cgroup: rename TasksMax structure to CGroupTasksMax
  - Drop 5003-cgroup-rename-TasksMax-structure-to-CGroupTasksMax.patch
    5004-bus-print-properties-ignore-CGROUP_LIMIT_MAX-for-Mem.patch
    5005-bus-print-properties-prettify-more-unset-properties.patch
    5006-cgroup-Add-EffectiveMemoryMax-EffectiveMemoryHigh-an.patch
    5007-test-Convert-rlimit-test-to-subtest-of-generic-limit.patch
    5008-test-Add-effective-cgroup-limits-testing.patch
    5009-cgroup-Restrict-effective-limits-with-global-resourc.patch
    5010-cgroup-Rename-effective-limits-internal-table.patch
    These patches have been merged in the SUSE/254 branch.

++++ systemd:

  - Add 5003-99-systemd.rules-rework-SYSTEMD_READY-logic-for-devi.patch (bsc#1229518)
  - Import commit 0512d0d1fc0b54a84964281708036a46ab39c153
    0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659)
    765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659)
    e29909088b test: Add effective cgroup limits testing (jsc#PED-5659)
    beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659)
    e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659)
    5aa063ae16 bus-print-properties: prettify more unset properties
    a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak}
    8418791441 cgroup: rename TasksMax structure to CGroupTasksMax
  - Drop 5003-cgroup-rename-TasksMax-structure-to-CGroupTasksMax.patch
    5004-bus-print-properties-ignore-CGROUP_LIMIT_MAX-for-Mem.patch
    5005-bus-print-properties-prettify-more-unset-properties.patch
    5006-cgroup-Add-EffectiveMemoryMax-EffectiveMemoryHigh-an.patch
    5007-test-Convert-rlimit-test-to-subtest-of-generic-limit.patch
    5008-test-Add-effective-cgroup-limits-testing.patch
    5009-cgroup-Restrict-effective-limits-with-global-resourc.patch
    5010-cgroup-Rename-effective-limits-internal-table.patch
    These patches have been merged in the SUSE/254 branch.

++++ systemd:

  - Add 5003-99-systemd.rules-rework-SYSTEMD_READY-logic-for-devi.patch (bsc#1229518)
  - Import commit 0512d0d1fc0b54a84964281708036a46ab39c153
    0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659)
    765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659)
    e29909088b test: Add effective cgroup limits testing (jsc#PED-5659)
    beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659)
    e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659)
    5aa063ae16 bus-print-properties: prettify more unset properties
    a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak}
    8418791441 cgroup: rename TasksMax structure to CGroupTasksMax
  - Drop 5003-cgroup-rename-TasksMax-structure-to-CGroupTasksMax.patch
    5004-bus-print-properties-ignore-CGROUP_LIMIT_MAX-for-Mem.patch
    5005-bus-print-properties-prettify-more-unset-properties.patch
    5006-cgroup-Add-EffectiveMemoryMax-EffectiveMemoryHigh-an.patch
    5007-test-Convert-rlimit-test-to-subtest-of-generic-limit.patch
    5008-test-Add-effective-cgroup-limits-testing.patch
    5009-cgroup-Restrict-effective-limits-with-global-resourc.patch
    5010-cgroup-Rename-effective-limits-internal-table.patch
    These patches have been merged in the SUSE/254 branch.

++++ systemd:

  - Add 5003-99-systemd.rules-rework-SYSTEMD_READY-logic-for-devi.patch (bsc#1229518)
  - Import commit 0512d0d1fc0b54a84964281708036a46ab39c153
    0512d0d1fc cgroup: Rename effective limits internal table (jsc#PED-5659)
    765846b70b cgroup: Restrict effective limits with global resource provision (jsc#PED-5659)
    e29909088b test: Add effective cgroup limits testing (jsc#PED-5659)
    beacac6df0 test: Convert rlimit test to subtest of generic limit testing (jsc#PED-5659)
    e3b789e512 cgroup: Add EffectiveMemoryMax=, EffectiveMemoryHigh= and EffectiveTasksMax= properties (jsc#PED-5659)
    5aa063ae16 bus-print-properties: prettify more unset properties
    a53122c9bd bus-print-properties: ignore CGROUP_LIMIT_MAX for Memory*{Current, Peak}
    8418791441 cgroup: rename TasksMax structure to CGroupTasksMax
  - Drop 5003-cgroup-rename-TasksMax-structure-to-CGroupTasksMax.patch
    5004-bus-print-properties-ignore-CGROUP_LIMIT_MAX-for-Mem.patch
    5005-bus-print-properties-prettify-more-unset-properties.patch
    5006-cgroup-Add-EffectiveMemoryMax-EffectiveMemoryHigh-an.patch
    5007-test-Convert-rlimit-test-to-subtest-of-generic-limit.patch
    5008-test-Add-effective-cgroup-limits-testing.patch
    5009-cgroup-Restrict-effective-limits-with-global-resourc.patch
    5010-cgroup-Rename-effective-limits-internal-table.patch
    These patches have been merged in the SUSE/254 branch.

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ podman:

  - Add patch to fix bsc#1227052 / CVE-2024-6104:
    * 0001-Backport-fix-for-CVE-2024-6104.patch
  - Update to version 4.9.5:
    * Bump to v4.9.5
    * Update release notes for v4.9.5
    * fix "concurrent map writes" in network ls compat endpoint
    * [v4.9] Fix for CVE-2024-3727
    * Disable failing bud test
    * CI Maintenance: Disable machine tests
    * [CI:DOCS] Allow downgrade of WiX
    * [CI:DOCS] Force WiX 3.11
    * [CI:DOCS] Fix windows installer action
    * Bump to v4.9.5-dev
    * Bump to v4.9.4
    * Update release notes for v4.9.4
    * [v4.9] Bump Buildah to v1.33.7, CVE-2024-1753, CVE-2024-24786
    * Add farm command to commands list
    * Bump to FreeBSD 13.3 (13.2 vanished)
    * Update health-start-periods docs
    * Don't update health check status during initialDelaySeconds
    * image scp: don't require port for ssh URL
    * Ignore docker's end point config when the final network mode isn't bridge.
    * Fix running container from docker client with rootful in rootless podman.
    * [skip-ci] Packit: remove koji and bodhi tasks for v4.9
    * Bump to v4.9.4-dev
    * Remove gitleaks scanning

++++ python-requests:

  - Remove Requires on python-py, it should have been removed earlier.

++++ python-requests:

  - Remove Requires on python-py, it should have been removed earlier.

++++ python-requests:

  - Remove Requires on python-py, it should have been removed earlier.

------------------------------------------------------------------
------------------  2024-8-28  -  Aug 28 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to 10.3.4
    + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
    + Inform the user that LTSS registration takes a little longer
    + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
  - From 10.3.3 (bsc#1229472)
    + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
  - From 10.3.2
    + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
  - From 10.3.1 (jsc#PCT-400)
    + Add support for LTSS registration
    + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12

++++ cloud-regionsrv-client:

  - Update to 10.3.4
    + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
    + Inform the user that LTSS registration takes a little longer
    + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
  - From 10.3.3 (bsc#1229472)
    + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
  - From 10.3.2
    + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
  - From 10.3.1 (jsc#PCT-400)
    + Add support for LTSS registration
    + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12

++++ cloud-regionsrv-client:

  - Update to 10.3.4
    + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
    + Inform the user that LTSS registration takes a little longer
    + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
  - From 10.3.3 (bsc#1229472)
    + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
  - From 10.3.2
    + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
  - From 10.3.1 (jsc#PCT-400)
    + Add support for LTSS registration
    + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12

++++ cloud-regionsrv-client:

  - Update to 10.3.4
    + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
    + Inform the user that LTSS registration takes a little longer
    + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
  - From 10.3.3 (bsc#1229472)
    + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
  - From 10.3.2
    + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
  - From 10.3.1 (jsc#PCT-400)
    + Add support for LTSS registration
    + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12

++++ cloud-regionsrv-client:

  - Update to 10.3.4
    + Modify the message when network access over a specific IP version does
    not work. This is an informational message and should not look like
    an error
    + Inform the user that LTSS registration takes a little longer
    + Add fix-for-sles12-no-trans_update.patch
    + SLE 12 family has no products with transactional-update we do not
    need to look for this condition
  - From 10.3.3 (bsc#1229472)
    + Handle changes in process structure to properly identify the running
    zypper parent process and only check for 1 PID
  - From 10.3.2
    + Remove rgnsrv-clnt-fix-docker-setup.patch included upstream
  - From 10.3.1 (jsc#PCT-400)
    + Add support for LTSS registration
    + Add fix-for-sles12-disable-registry.patch
    ~ No container support in SLE 12

++++ git:

  - Change less requirement to path to allow for use with BusyBox

++++ kernel-default:

  - kabi: lib: objagg: Put back removed metod in struct objagg_ops
    (CVE-2024-43880 bsc#1229481).
  - commit 9566f2d
  - net/sched: initialize noop_qdisc owner (git-fixes).
  - commit 66e8d18
  - drm/amd/display: Fix null pointer deref in dcn20_resource.c (CVE-2024-43899 bsc#1229754).
  - commit 1811990
  - blacklist.conf: add 56769ba4b297a629148eb24d554aef72d1ddfd9e
  - commit e1cb2aa
  - exec: Fix ToCToU between perm check and set-uid/gid usage
    (CVE-2024-43882 bsc#1229503).
  - commit 7a21b9d
  - ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED
    (stable-fixes).
  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy
    Book3 Ultra (stable-fixes).
  - ASoC: allow module autoloading for table board_ids
    (stable-fixes).
  - ASoC: allow module autoloading for table db1200_pids
    (stable-fixes).
  - ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile
    (stable-fixes).
  - ASoC: SOF: mediatek: Add missing board compatible
    (stable-fixes).
  - ALSA: hda/realtek - FIxed ALC285 headphone no sound
    (stable-fixes).
  - ALSA: hda/realtek - Fixed ALC256 headphone no sound
    (stable-fixes).
  - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop
    14-ey0xxx (stable-fixes).
  - ALSA: hda/realtek: Implement sound init sequence for Samsung
    Galaxy Book3 Pro 360 (stable-fixes).
  - commit 97adcb2
  - ip6_tunnel: Fix broken GRO (bsc#1229444).
  - net/mlx5: Always drain health in shutdown callback
    (CVE-2024-43866 bsc#1229495).
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
    (CVE-2024-43880 bsc#1229481).
  - commit d9a404d
  - pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B
    pins (git-fixes).
  - pinctrl: starfive: jh7110: Correct the level trigger
    configuration of iev register (git-fixes).
  - pinctrl: mediatek: common-v2: Fix broken bias-disable for
    PULL_PU_PD_RSEL_TYPE (git-fixes).
  - pinctrl: single: fix potential NULL dereference in
    pcs_get_function() (git-fixes).
  - ASoC: SOF: amd: Fix for acp init sequence (git-fixes).
  - ASoC: amd: acp: fix module autoloading (git-fixes).
  - ALSA: seq: Skip event type filtering for UMP events (git-fixes).
  - commit 3fa4a0b

++++ kernel-default:

  - Update references patches.suse/drm-amd-display-Add-null-checks-for-stream-and-plane.patch (CVE-2024-43904 bsc#1229768 stable-fixes)
  - commit aaa26ef
  - kabi: lib: objagg: Put back removed metod in struct objagg_ops
    (CVE-2024-43880 bsc#1229481).
  - commit 9566f2d
  - net/sched: initialize noop_qdisc owner (git-fixes).
  - commit 66e8d18
  - drm/amd/display: Fix null pointer deref in dcn20_resource.c (CVE-2024-43899 bsc#1229754).
  - commit 1811990
  - blacklist.conf: add 56769ba4b297a629148eb24d554aef72d1ddfd9e
  - commit e1cb2aa
  - exec: Fix ToCToU between perm check and set-uid/gid usage
    (CVE-2024-43882 bsc#1229503).
  - commit 7a21b9d
  - ALSA: hda/realtek: support HP Pavilion Aero 13-bg0xxx Mute LED
    (stable-fixes).
  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy
    Book3 Ultra (stable-fixes).
  - ASoC: allow module autoloading for table board_ids
    (stable-fixes).
  - ASoC: allow module autoloading for table db1200_pids
    (stable-fixes).
  - ASoC: mediatek: mt8188: Mark AFE_DAC_CON0 register as volatile
    (stable-fixes).
  - ASoC: SOF: mediatek: Add missing board compatible
    (stable-fixes).
  - ALSA: hda/realtek - FIxed ALC285 headphone no sound
    (stable-fixes).
  - ALSA: hda/realtek - Fixed ALC256 headphone no sound
    (stable-fixes).
  - ALSA: hda/realtek: Enable mute/micmute LEDs on HP Laptop
    14-ey0xxx (stable-fixes).
  - ALSA: hda/realtek: Implement sound init sequence for Samsung
    Galaxy Book3 Pro 360 (stable-fixes).
  - commit 97adcb2
  - ip6_tunnel: Fix broken GRO (bsc#1229444).
  - net/mlx5: Always drain health in shutdown callback
    (CVE-2024-43866 bsc#1229495).
  - mlxsw: spectrum_acl_erp: Fix object nesting warning
    (CVE-2024-43880 bsc#1229481).
  - commit d9a404d
  - pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B
    pins (git-fixes).
  - pinctrl: starfive: jh7110: Correct the level trigger
    configuration of iev register (git-fixes).
  - pinctrl: mediatek: common-v2: Fix broken bias-disable for
    PULL_PU_PD_RSEL_TYPE (git-fixes).
  - pinctrl: single: fix potential NULL dereference in
    pcs_get_function() (git-fixes).
  - ASoC: SOF: amd: Fix for acp init sequence (git-fixes).
  - ASoC: amd: acp: fix module autoloading (git-fixes).
  - ALSA: seq: Skip event type filtering for UMP events (git-fixes).
  - commit 3fa4a0b

++++ kernel-firmware:

  - Update to version 20240826 (git commit bec4fd18cc57):
    (including ath11k f/w updates for bsc#1234027)
    * amdgpu: DMCUB updates forvarious AMDGPU ASICs
    * rtw89: 8922a: add fw format-1 v0.35.41.0
    * linux-firmware: update firmware for MT7925 WiFi device
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7925)
    * rtl_bt: Add firmware and config files for RTL8922A
    * rtl_bt: Add firmware file for the the RTL8723CS Bluetooth part
    * rtl_bt: de-dupe identical config.bin files
    * rename rtl8723bs_config-OBDA8723.bin -> rtl_bt/rtl8723bs_config.bin
    * linux-firmware: Update AMD SEV firmware
    * linux-firmware: update firmware for MT7996
    * Revert "i915: Update MTL DMC v2.22"
    * ath12k: WCN7850 hw2.0: update board-2.bin
    * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
    * ath11k: WCN6855 hw2.0: update board-2.bin
    * ath11k: QCA2066 hw2.1: add to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.3
    * ath11k: QCA2066 hw2.1: add board-2.bin
    * ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01291-QCAHKSWPL_SILICONZ-1
    * qcom: vpu: add video firmware for sa8775p
    * amdgpu: DMCUB updates for various AMDGPU ASICs

++++ kernel-firmware:

  - Update to version 20240826 (git commit bec4fd18cc57):
    (including ath11k f/w updates for bsc#1234027)
    * amdgpu: DMCUB updates forvarious AMDGPU ASICs
    * rtw89: 8922a: add fw format-1 v0.35.41.0
    * linux-firmware: update firmware for MT7925 WiFi device
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7925)
    * rtl_bt: Add firmware and config files for RTL8922A
    * rtl_bt: Add firmware file for the the RTL8723CS Bluetooth part
    * rtl_bt: de-dupe identical config.bin files
    * rename rtl8723bs_config-OBDA8723.bin -> rtl_bt/rtl8723bs_config.bin
    * linux-firmware: Update AMD SEV firmware
    * linux-firmware: update firmware for MT7996
    * Revert "i915: Update MTL DMC v2.22"
    * ath12k: WCN7850 hw2.0: update board-2.bin
    * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
    * ath11k: WCN6855 hw2.0: update board-2.bin
    * ath11k: QCA2066 hw2.1: add to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.3
    * ath11k: QCA2066 hw2.1: add board-2.bin
    * ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01291-QCAHKSWPL_SILICONZ-1
    * qcom: vpu: add video firmware for sa8775p
    * amdgpu: DMCUB updates for various AMDGPU ASICs

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311-core:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ nvidia-open-driver-G06-signed:

  - reverted CUDA update version to 560.x.y due to changes in CUDA
    repository with CUDA 12.6/560.x.y drivers
  - kernel-6.10.patch:
    * fixes build of 555.42.06 against Kernel 6.10

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

++++ python311:

  - Add CVE-2024-8088-inf-loop-zipfile_Path.patch to prevent
    malformed payload to cause infinite loops in zipfile.Path
    (bsc#1229704, CVE-2024-8088).

------------------------------------------------------------------
------------------  2024-8-27  -  Aug 27 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - remove dependency on /usr/bin/python

++++ python-kiwi:

  - remove dependency on /usr/bin/python

++++ python-kiwi:

  - remove dependency on /usr/bin/python

++++ kernel-default:

  - ice: Fix NULL pointer access, if PF doesn't support SRIOV_LAG
    (bsc#1228737).
  - commit f1a9730
  - kABI: vfio: struct virqfd kABI workaround (CVE-2024-26812
    bsc#1222808).
  - commit ae735c0
  - net/sched: Fix mirred deadlock on device recursion
    (CVE-2024-27010 bsc#1223720).
  - commit 8c34ee8
  - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798)
  - commit 052d917
  - net: qdisc: preserve kabi for struct QDisc (CVE-2024-27010 bsc#1223720).
  - commit e31d466
  - mm/userfaultfd: reset ptes when close() for wr-protected ones
    (CVE-2024-36881 bsc#1225718).
  - commit 2267d46
  - mm/mglru: fix div-by-zero in vmpressure_calc_level()
    (CVE-2024-42316 bsc#1229353).
  - commit ba00671
  - md/raid1: set max_sectors during early return from
    choose_slow_rdev() (git-fixes).
  - md/raid5: recheck if reshape has finished with device_lock held
    (git-fixes).
  - md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl
    (git-fixes).
  - md/raid5: fix spares errors about rcu usage (git-fixes).
  - md/md-bitmap: fix writing non bitmap pages (git-fixes).
  - md: fix deadlock between mddev_suspend and flush bio
    (bsc#1229342, CVE-2024-43855).
  - md: change the return value type of md_write_start to void
    (git-fixes).
  - md: do not delete safemode_timer in mddev_suspend (git-fixes).
  - md: don't account sync_io if iostats of the disk is disabled
    (git-fixes).
  - md: add check for sleepers in md_wakeup_thread() (git-fixes).
  - md/raid5: fix deadlock that raid5d() wait for itself to clear
    MD_SB_CHANGE_PENDING (git-fixes).
  - md: add a mddev_add_trace_msg helper (git-fixes).
  - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in
    raid5d"" (git-fixes).
  - md: fix a suspicious RCU usage warning (git-fixes).
  - md/raid1: support read error check (git-fixes).
  - commit f1ec0d4
  - md: factor out a helper exceed_read_errors() to check
    read_errors (git-fixes).
  - Refresh for the above change,
    patches.suse/md-display-timeout-error.patch.
    patches.suse/md-raid1-10-add-a-helper-raid1_check_read_range-f298.patch.
  - commit 035e3f0
  - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
    (git-fixes).
  - commit 5cc0fdd

++++ kernel-default:

  - ice: Fix NULL pointer access, if PF doesn't support SRIOV_LAG
    (bsc#1228737).
  - commit f1a9730
  - kABI: vfio: struct virqfd kABI workaround (CVE-2024-26812
    bsc#1222808).
  - commit ae735c0
  - net/sched: Fix mirred deadlock on device recursion
    (CVE-2024-27010 bsc#1223720).
  - commit 8c34ee8
  - Fix reference in patches.suse/netfilter-tproxy-bail-out-if-IP-has-been-disabled-on.patch (CVE-2024-36270 bsc#1226798)
  - commit 052d917
  - net: qdisc: preserve kabi for struct QDisc (CVE-2024-27010 bsc#1223720).
  - commit e31d466
  - mm/userfaultfd: reset ptes when close() for wr-protected ones
    (CVE-2024-36881 bsc#1225718).
  - commit 2267d46
  - mm/mglru: fix div-by-zero in vmpressure_calc_level()
    (CVE-2024-42316 bsc#1229353).
  - commit ba00671
  - md/raid1: set max_sectors during early return from
    choose_slow_rdev() (git-fixes).
  - md/raid5: recheck if reshape has finished with device_lock held
    (git-fixes).
  - md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl
    (git-fixes).
  - md/raid5: fix spares errors about rcu usage (git-fixes).
  - md/md-bitmap: fix writing non bitmap pages (git-fixes).
  - md: fix deadlock between mddev_suspend and flush bio
    (bsc#1229342, CVE-2024-43855).
  - md: change the return value type of md_write_start to void
    (git-fixes).
  - md: do not delete safemode_timer in mddev_suspend (git-fixes).
  - md: don't account sync_io if iostats of the disk is disabled
    (git-fixes).
  - md: add check for sleepers in md_wakeup_thread() (git-fixes).
  - md/raid5: fix deadlock that raid5d() wait for itself to clear
    MD_SB_CHANGE_PENDING (git-fixes).
  - md: add a mddev_add_trace_msg helper (git-fixes).
  - Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in
    raid5d"" (git-fixes).
  - md: fix a suspicious RCU usage warning (git-fixes).
  - md/raid1: support read error check (git-fixes).
  - commit f1ec0d4
  - md: factor out a helper exceed_read_errors() to check
    read_errors (git-fixes).
  - Refresh for the above change,
    patches.suse/md-display-timeout-error.patch.
    patches.suse/md-raid1-10-add-a-helper-raid1_check_read_range-f298.patch.
  - commit 035e3f0
  - Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
    (git-fixes).
  - commit 5cc0fdd

++++ systemd:

  - Don't try to restart the udev socket units anymore (bsc#1228809)
    There's currently no way to restart a socket activable service and its socket
    units "atomically" and safely.

++++ systemd:

  - Don't try to restart the udev socket units anymore (bsc#1228809)
    There's currently no way to restart a socket activable service and its socket
    units "atomically" and safely.

++++ systemd:

  - Don't try to restart the udev socket units anymore (bsc#1228809)
    There's currently no way to restart a socket activable service and its socket
    units "atomically" and safely.

++++ systemd:

  - Don't try to restart the udev socket units anymore (bsc#1228809)
    There's currently no way to restart a socket activable service and its socket
    units "atomically" and safely.

++++ systemd:

  - Don't try to restart the udev socket units anymore (bsc#1228809)
    There's currently no way to restart a socket activable service and its socket
    units "atomically" and safely.

++++ systemd:

  - Don't try to restart the udev socket units anymore (bsc#1228809)
    There's currently no way to restart a socket activable service and its socket
    units "atomically" and safely.

++++ systemd:

  - Don't try to restart the udev socket units anymore (bsc#1228809)
    There's currently no way to restart a socket activable service and its socket
    units "atomically" and safely.

++++ qemu:

  - Fix bsc#1221812:
    * [openSUSE] block: Reschedule query-block during qcow2 invalidation (bsc#1221812)
  - Fixup old patches and infra issues:
    * [openSUSE] fixup patch "pc: q35: Allow 1024 cpus for old machine types"
    * [openSUSE] Point submodule branches to gitlab

++++ qemu:

  - Fix bsc#1221812:
    * [openSUSE] block: Reschedule query-block during qcow2 invalidation (bsc#1221812)
  - Fixup old patches and infra issues:
    * [openSUSE] fixup patch "pc: q35: Allow 1024 cpus for old machine types"
    * [openSUSE] Point submodule branches to gitlab

++++ qemu:

  - Fix bsc#1221812:
    * [openSUSE] block: Reschedule query-block during qcow2 invalidation (bsc#1221812)
  - Fixup old patches and infra issues:
    * [openSUSE] fixup patch "pc: q35: Allow 1024 cpus for old machine types"
    * [openSUSE] Point submodule branches to gitlab

++++ qemu:

  - Fix bsc#1221812:
    * [openSUSE] block: Reschedule query-block during qcow2 invalidation (bsc#1221812)
  - Fixup old patches and infra issues:
    * [openSUSE] fixup patch "pc: q35: Allow 1024 cpus for old machine types"
    * [openSUSE] Point submodule branches to gitlab

++++ qemu:

  - Fix bsc#1221812:
    * [openSUSE] block: Reschedule query-block during qcow2 invalidation (bsc#1221812)
  - Fixup old patches and infra issues:
    * [openSUSE] fixup patch "pc: q35: Allow 1024 cpus for old machine types"
    * [openSUSE] Point submodule branches to gitlab

------------------------------------------------------------------
------------------  2024-8-26  -  Aug 26 2024  -------------------
------------------------------------------------------------------

++++ transactional-update:

  - Version 4.8.0
  - Add sd-boot (systemd-boot) support for most commands
  - Add support for specifying migration arguments
    [gh#openSUSE/transactional-update#127] [jsc#PED-10375]
  - Support kdump setup on platforms without kdump high/low
    settings (e.g. S/390 or PPC64le [bsc#1229138]
  - Preserve current working directory if possible when entering
    transactional-update environment [bsc#1227452]; also adds the
    current path to the Bash prompt
  - Fix plugin system to support special characters in commands

++++ transactional-update:

  - Version 4.8.0
  - Add sd-boot (systemd-boot) support for most commands
  - Add support for specifying migration arguments
    [gh#openSUSE/transactional-update#127] [jsc#PED-10375]
    [jsc#PED-9786]
  - Support kdump setup on platforms without kdump high/low
    settings (e.g. S/390 or PPC64le [bsc#1229138]
  - Preserve current working directory if possible when entering
    transactional-update environment [bsc#1227452]; also adds the
    current path to the Bash prompt
  - Fix plugin system to support special characters in commands

++++ kernel-default:

  - net/mlx5e: Fix CT entry update leaks of modify header context (CVE-2024-43864 bsc#1229496)
  - commit 316a4fe
  - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
    (CVE-2024-26631 bsc#1221630).
  - commit 317a097
  - netfilter: nf_tables: unconditionally flush pending work before notifier (CVE-2024-42109 bsc#1228505)
  - commit 7a6a06c
  - cxl/region: Avoid null pointer dereference in region lookup (CVE-2024-41084 bsc#1228472)
  - commit fc1408b
  - cxl/region: Move cxl_dpa_to_region() work to the region driver (bsc#1228472)
  - commit ac0e984
  - ipv6: fix possible race in __fib6_drop_pcpu_from() (CVE-2024-40905 bsc#1227761)
  - commit 6fcd399
  - ipv6: sr: fix memleak in seg6_hmac_init_algo (CVE-2024-39489 bsc#1227623)
  - commit c55beb2
  - swiotlb: do not set total_used to 0 in
    swiotlb_create_debugfs_files() (git-fixes).
  - swiotlb: fix swiotlb_bounce() to do partial sync's correctly
    (git-fixes).
  - commit 99fe6bb
  - tls: fix missing memory barrier in tls_init (CVE-2024-36489 bsc#1226874)
  - commit 67db543
  - iommu: Add kABI workaround patch (bsc#1223742
    CVE-2024-27079).
  - commit c4ebc76
  - btrfs: copy dir permission and time when creating a stub
    subvolume (bsc#1228321).
  - commit 46e95d1

++++ kernel-default:

  - net/mlx5e: Fix CT entry update leaks of modify header context (CVE-2024-43864 bsc#1229496)
  - commit 316a4fe
  - rpm/check-for-config-changes: Exclude ARCH_USING_PATCHABLE_FUNCTION_ENTRY
    gcc version dependent, at least on ppc
  - commit 16da158
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg
    (bsc#1226846 CVE-2024-38596).
  - Update
    patches.suse/af_unix-Fix-data-races-around-sk-sk_shutdown.patch
    (git-fixes bsc#1226846).
  - commit 7ceb0cd
  - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
    (CVE-2024-26631 bsc#1221630).
  - commit 317a097
  - netfilter: nf_tables: unconditionally flush pending work before notifier (CVE-2024-42109 bsc#1228505)
  - commit 7a6a06c
  - cxl/region: Avoid null pointer dereference in region lookup (CVE-2024-41084 bsc#1228472)
  - commit fc1408b
  - cxl/region: Move cxl_dpa_to_region() work to the region driver (bsc#1228472)
  - commit ac0e984
  - ipv6: fix possible race in __fib6_drop_pcpu_from() (CVE-2024-40905 bsc#1227761)
  - commit 6fcd399
  - ipv6: sr: fix memleak in seg6_hmac_init_algo (CVE-2024-39489 bsc#1227623)
  - commit c55beb2
  - swiotlb: do not set total_used to 0 in
    swiotlb_create_debugfs_files() (git-fixes).
  - swiotlb: fix swiotlb_bounce() to do partial sync's correctly
    (git-fixes).
  - commit 99fe6bb
  - x86/kaslr: Expose and use the end of the physical memory
    address space (bsc#1229443).
  - commit 5b98c4e
  - tls: fix missing memory barrier in tls_init (CVE-2024-36489 bsc#1226874)
  - commit 67db543
  - iommu: Add kABI workaround patch (bsc#1223742
    CVE-2024-27079).
  - commit c4ebc76
  - btrfs: copy dir permission and time when creating a stub
    subvolume (bsc#1228321).
  - commit 46e95d1

------------------------------------------------------------------
------------------  2024-8-25  -  Aug 25 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add support for isomd5sum for tagging iso files
    The isomd5sum tool suite is used and available on all supported
    distributions except SUSE distributions, and is necessary to produce
    conformant ISOs for most Linux distributions.
    This change adds support for isomd5sum tool suite for kiwi, though
    it does not extend the kiwi-live dracut module to use it. The upstream
    dracut dmsquash-live module must be used instead.
    Co-authored-by: Dan Čermák <dcermak@suse.com>

++++ python-kiwi:

  - Add support for isomd5sum for tagging iso files
    The isomd5sum tool suite is used and available on all supported
    distributions except SUSE distributions, and is necessary to produce
    conformant ISOs for most Linux distributions.
    This change adds support for isomd5sum tool suite for kiwi, though
    it does not extend the kiwi-live dracut module to use it. The upstream
    dracut dmsquash-live module must be used instead.
    Co-authored-by: Dan Čermák <dcermak@suse.com>

++++ python-kiwi:

  - Add support for isomd5sum for tagging iso files
    The isomd5sum tool suite is used and available on all supported
    distributions except SUSE distributions, and is necessary to produce
    conformant ISOs for most Linux distributions.
    This change adds support for isomd5sum tool suite for kiwi, though
    it does not extend the kiwi-live dracut module to use it. The upstream
    dracut dmsquash-live module must be used instead.
    Co-authored-by: Dan Čermák <dcermak@suse.com>

++++ nvidia-open-driver-G06-signed:

  - For CUDA update version to 560.35.03

------------------------------------------------------------------
------------------  2024-8-24  -  Aug 24 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - kiwi/builder/live: Log the correct value for Application ID
    Since it is now possible to set a custom application ID, we want
    to see this when it is being used for the image.
  - kiwi/builder/live: Clean up leftover dracut configuration file
    The existence of this file breaks installers on live media that
    sync the full filesystem to disk and are not aware of this configuration
    before generating the target system initramfs.

++++ python-kiwi:

  - kiwi/builder/live: Log the correct value for Application ID
    Since it is now possible to set a custom application ID, we want
    to see this when it is being used for the image.
  - kiwi/builder/live: Clean up leftover dracut configuration file
    The existence of this file breaks installers on live media that
    sync the full filesystem to disk and are not aware of this configuration
    before generating the target system initramfs.

++++ python-kiwi:

  - kiwi/builder/live: Log the correct value for Application ID
    Since it is now possible to set a custom application ID, we want
    to see this when it is being used for the image.
  - kiwi/builder/live: Clean up leftover dracut configuration file
    The existence of this file breaks installers on live media that
    sync the full filesystem to disk and are not aware of this configuration
    before generating the target system initramfs.

++++ kernel-default:

  - nouveau/firmware: use dma non-coherent allocator (git-fixes).
  - drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1
    (git-fixes).
  - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
    (git-fixes).
  - drm/msm/dp: reset the link phy params before link training
    (git-fixes).
  - drm/msm/dp: fix the max supported bpp logic (git-fixes).
  - drm/msm/dpu: don't play tricks with debug macros (git-fixes).
  - mmc: mmc_test: Fix NULL dereference on allocation failure
    (git-fixes).
  - mmc: dw_mmc: allow biu and ciu clocks to defer (git-fixes).
  - mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
    (git-fixes).
  - commit ec72baf

++++ kernel-default:

  - nouveau/firmware: use dma non-coherent allocator (git-fixes).
  - drm/amdgpu/sdma5.2: limit wptr workaround to sdma 5.2.1
    (git-fixes).
  - drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
    (git-fixes).
  - drm/msm/dp: reset the link phy params before link training
    (git-fixes).
  - drm/msm/dp: fix the max supported bpp logic (git-fixes).
  - drm/msm/dpu: don't play tricks with debug macros (git-fixes).
  - mmc: mmc_test: Fix NULL dereference on allocation failure
    (git-fixes).
  - mmc: dw_mmc: allow biu and ciu clocks to defer (git-fixes).
  - mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
    (git-fixes).
  - commit ec72baf

------------------------------------------------------------------
------------------  2024-8-23  -  Aug 23 2024  -------------------
------------------------------------------------------------------

++++ dracut:

  - Update to version 059+suse.571.g32b61281:
    * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
    * fix(convertfs): error in conditional expressions (bsc#1228847)

++++ dracut:

  - Update to version 059+suse.571.g32b61281:
    * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
    * fix(convertfs): error in conditional expressions (bsc#1228847)

++++ dracut:

  - Update to version 059+suse.571.g32b61281:
    * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
    * fix(convertfs): error in conditional expressions (bsc#1228847)

++++ dracut:

  - Update to version 059+suse.571.g32b61281:
    * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
    * fix(convertfs): error in conditional expressions (bsc#1228847)

++++ dracut:

  - Update to version 059+suse.571.g32b61281:
    * feat(systemd*): include systemd config files from /usr/lib/systemd (bsc#1228398)
    * fix(convertfs): error in conditional expressions (bsc#1228847)

++++ python-kiwi:

  - Allow string versions and test "word" versions
    There are descriptions out in the wild that use "non-numeric" versions
    in their descriptions, particularly without separators for splitting.
    This change switches all of this to strings rather than assuming
    numbers and gracefully handles the single word case.

++++ python-kiwi:

  - Allow string versions and test "word" versions
    There are descriptions out in the wild that use "non-numeric" versions
    in their descriptions, particularly without separators for splitting.
    This change switches all of this to strings rather than assuming
    numbers and gracefully handles the single word case.

++++ python-kiwi:

  - Allow string versions and test "word" versions
    There are descriptions out in the wild that use "non-numeric" versions
    in their descriptions, particularly without separators for splitting.
    This change switches all of this to strings rather than assuming
    numbers and gracefully handles the single word case.

++++ kernel-default:

  - filelock: Fix fcntl/close race recovery compat path (bsc#1228427
    CVE-2024-41020).
  - commit 2c615e8
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
    (git-fixes).
  - commit 45c2786
  - vfio: Introduce interface to flush virqfd inject workqueue
    (CVE-2024-26812 bsc#1222808).
  - commit 0704da7
  - vfio/pci: Create persistent INTx handler (CVE-2024-26812
    bsc#1222808).
  - commit c0eeff7
  - netfilter: nf_tables: discard table flag update with pending
    basechain deletion (CVE-2024-35897 bsc#1224510).
  - netfilter: nf_tables: reject table flag and netdev basechain
    updates (CVE-2024-35897 bsc#1224510).
  - commit bc3bca5
  - kabi: restore const specifier in flow_offload_route_init()
    (CVE-2024-27403 bsc#1224415).
  - netfilter: nft_flow_offload: reset dst in route object after
    setting up flow (CVE-2024-27403 bsc#1224415).
  - commit f1d28bc
  - Bluetooth: MGMT: Add error handling to pair_device()
    (git-fixes).
  - Bluetooth: SMP: Fix assumption of Central always being Initiator
    (git-fixes).
  - Bluetooth: hci_core: Fix LE quote calculation (git-fixes).
  - commit 82ede4a
  - netfilter: nf_tables: fix memleak in map from abort path
    (CVE-2024-27011 bsc#1223803).
  - commit df3e052
  - KVM: Reject overly excessive IDs in KVM_CREATE_VCPU (git-fixes).
  - commit acfc6dd
  - KVM: arm64: Fix __pkvm_init_switch_pgd call ABI (git-fixes).
  - commit ca5dde8
  - KVM: Stop processing *all* memslots when "null" mmu_notifier
    handler is found (git-fixes).
  - commit edcaf30
  - virt: guest_memfd: fix reference leak on hwpoisoned page
    (git-fixes).
  - commit 7ac89c3
  - KVM: arm64: AArch32: Fix spurious trapping of conditional
    instructions (git-fixes).
  - commit 6b4a32b
  - KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
    (git-fixes).
  - commit d2c979d

++++ kernel-default:

  - filelock: Fix fcntl/close race recovery compat path (bsc#1228427
    CVE-2024-41020).
  - commit 2c615e8
  - vfio/pci: fix potential memory leak in vfio_intx_enable()
    (git-fixes).
  - commit 45c2786
  - vfio: Introduce interface to flush virqfd inject workqueue
    (CVE-2024-26812 bsc#1222808).
  - commit 0704da7
  - vfio/pci: Create persistent INTx handler (CVE-2024-26812
    bsc#1222808).
  - commit c0eeff7
  - netfilter: nf_tables: discard table flag update with pending
    basechain deletion (CVE-2024-35897 bsc#1224510).
  - netfilter: nf_tables: reject table flag and netdev basechain
    updates (CVE-2024-35897 bsc#1224510).
  - commit bc3bca5
  - kabi: restore const specifier in flow_offload_route_init()
    (CVE-2024-27403 bsc#1224415).
  - netfilter: nft_flow_offload: reset dst in route object after
    setting up flow (CVE-2024-27403 bsc#1224415).
  - commit f1d28bc
  - Bluetooth: MGMT: Add error handling to pair_device()
    (git-fixes).
  - Bluetooth: SMP: Fix assumption of Central always being Initiator
    (git-fixes).
  - Bluetooth: hci_core: Fix LE quote calculation (git-fixes).
  - commit 82ede4a
  - netfilter: nf_tables: fix memleak in map from abort path
    (CVE-2024-27011 bsc#1223803).
  - commit df3e052
  - KVM: Reject overly excessive IDs in KVM_CREATE_VCPU (git-fixes).
  - commit acfc6dd
  - KVM: arm64: Fix __pkvm_init_switch_pgd call ABI (git-fixes).
  - commit ca5dde8
  - KVM: Stop processing *all* memslots when "null" mmu_notifier
    handler is found (git-fixes).
  - commit edcaf30
  - virt: guest_memfd: fix reference leak on hwpoisoned page
    (git-fixes).
  - commit 7ac89c3
  - KVM: arm64: AArch32: Fix spurious trapping of conditional
    instructions (git-fixes).
  - commit 6b4a32b
  - KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode
    (git-fixes).
  - commit d2c979d

------------------------------------------------------------------
------------------  2024-8-22  -  Aug 22 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - KVM: arm64: Fix AArch32 register narrowing on userspace write
    (git-fixes).
  - commit c002253
  - KVM: fix kvm_mmu_memory_cache allocation warning (git-fixes).
  - commit 9570c83
  - KVM: Always flush async #PF workqueue when vCPU is being
    destroyed (git-fixes).
  - commit bbeeae4
  - iommu: Add static iommu_ops->release_domain (bsc#1223742
    CVE-2024-27079).
  - iommu/vt-d: Fix NULL domain on device release (bsc#1223742
    CVE-2024-27079).
  - Refresh
    patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch.
  - commit 5ddde3c
  - KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with
    KVM_MEM_READONLY (git-fixes).
  - commit 7a71a2a
  - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
    (git-fixes).
  - commit ebc54df
  - KVM: arm64: vgic-its: Test for valid IRQ in
    its_sync_lpi_pending_table() (git-fixes).
  - commit 989930f
  - KVM: arm64: Add missing memory barriers when switching to
    pKVM's hyp pgd (git-fixes).
  - commit 5599b84
  - KVM: arm64: vgic-v4: Restore pending state on host userspace
    write (git-fixes).
  - commit ba9826d
  - KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
    (git-fixes).
  - commit 26e04aa
  - KVM: arm64: vgic: Add a non-locking primitive for
    kvm_vgic_vcpu_destroy() (git-fixes).
  - commit 686bc1c
  - netfilter: nft_limit: reject configurations that cause integer
    overflow (CVE-2024-26668 bsc#1222335).
  - commit 8ea214b
  - netfilter: nf_tables: set dormant flag on hook register failure
    (CVE-2024-26835 bsc#1222967).
  - commit 8f4d028
  - KVM: arm64: vgic: Simplify kvm_vgic_destroy() (git-fixes).
  - commit 3a96863
  - Revert "KVM: Prevent module exit until all VMs are freed"
    (git-fixes).
  - commit c075225
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for
    inet/ingress basechain (CVE-2024-26808 bsc#1222634).
  - commit 7f0379b
  - KVM: arm64: GICv4: Do not perform a map to a mapped vLPI
    (git-fixes).
  - commit 919175d
  - netfilter: nft_set_pipapo: release elements in clone only from
    destroy path (CVE-2024-26809 bsc#1222633).
  - commit d3a3287
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
    (git-fixes).
  - commit 7b3deae
  - KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2
    (git-fixes).
  - commit 48c0cad
  - netfilter: nf_tables: fix memleak when more than 255 elements
    expired (CVE-2023-52581 bsc#1220877).
  - commit 26441fd
  - KVM: Protect vcpu->pid dereference via debugfs with RCU
    (git-fixes).
  - commit 55ae2a6
  - KVM: arm64: timers: Fix resource leaks in kvm_timer_hyp_init()
    (git-fixes).
  - commit f80cefe
  - bpf: Fix updating attached freplace prog in prog_array map
    (bsc#1229297 CVE-2024-43837).
  - commit a9d7d77
  - dma-direct: Leak pages on dma_set_decrypted() failure (bsc#1224535 CVE-2024-35939).
  - commit 7de8166
  - ice: Add a per-VF limit on number of FDIR filters
    (CVE-2024-42291 bsc#1229374).
  - commit ee2b93b
  - net/mlx5: Fix missing lock on sync reset reload (CVE-2024-42268
    bsc#1229391).
  - commit 268cdf6
  - selftests/bpf: Add a test to verify previous stacksafe() fix
    (bsc#1225903).
  - bpf: Fix a kernel verifier crash in stacksafe() (bsc#1225903).
  - commit dab2844
  - xdp: fix invalid wait context of page_pool_destroy() (CVE-2024-43834 bsc#1229314)
  - commit 6348ec4
  - clk: mediatek: mt7622-apmixedsys: Fix an error handling path
    in clk_mt8135_apmixed_probe() (bsc#1224711 CVE-2024-27433).
  - commit 30e1ef1
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (CVE-2024-36286 bsc#1226801)
  - commit 3278d5d
  - netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270 1226798)
  - commit 26814d6
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851 bsc#1223074)
  - commit 6ad2cbe

++++ kernel-default:

  - KVM: arm64: Fix AArch32 register narrowing on userspace write
    (git-fixes).
  - commit c002253
  - KVM: fix kvm_mmu_memory_cache allocation warning (git-fixes).
  - commit 9570c83
  - KVM: Always flush async #PF workqueue when vCPU is being
    destroyed (git-fixes).
  - commit bbeeae4
  - iommu: Add static iommu_ops->release_domain (bsc#1223742
    CVE-2024-27079).
  - iommu/vt-d: Fix NULL domain on device release (bsc#1223742
    CVE-2024-27079).
  - Refresh
    patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch.
  - commit 5ddde3c
  - KVM: Make KVM_MEM_GUEST_MEMFD mutually exclusive with
    KVM_MEM_READONLY (git-fixes).
  - commit 7a71a2a
  - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler
    (git-fixes).
  - commit ebc54df
  - KVM: arm64: vgic-its: Test for valid IRQ in
    its_sync_lpi_pending_table() (git-fixes).
  - commit 989930f
  - KVM: arm64: Add missing memory barriers when switching to
    pKVM's hyp pgd (git-fixes).
  - commit 5599b84
  - KVM: arm64: vgic-v4: Restore pending state on host userspace
    write (git-fixes).
  - commit ba9826d
  - KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
    (git-fixes).
  - commit 26e04aa
  - KVM: arm64: vgic: Add a non-locking primitive for
    kvm_vgic_vcpu_destroy() (git-fixes).
  - commit 686bc1c
  - netfilter: nft_limit: reject configurations that cause integer
    overflow (CVE-2024-26668 bsc#1222335).
  - commit 8ea214b
  - netfilter: nf_tables: set dormant flag on hook register failure
    (CVE-2024-26835 bsc#1222967).
  - commit 8f4d028
  - KVM: arm64: vgic: Simplify kvm_vgic_destroy() (git-fixes).
  - commit 3a96863
  - Revert "KVM: Prevent module exit until all VMs are freed"
    (git-fixes).
  - commit c075225
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for
    inet/ingress basechain (CVE-2024-26808 bsc#1222634).
  - commit 7f0379b
  - KVM: arm64: GICv4: Do not perform a map to a mapped vLPI
    (git-fixes).
  - commit 919175d
  - netfilter: nft_set_pipapo: release elements in clone only from
    destroy path (CVE-2024-26809 bsc#1222633).
  - commit d3a3287
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id
    (git-fixes).
  - commit 7b3deae
  - KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2
    (git-fixes).
  - commit 48c0cad
  - netfilter: nf_tables: fix memleak when more than 255 elements
    expired (CVE-2023-52581 bsc#1220877).
  - commit 26441fd
  - KVM: Protect vcpu->pid dereference via debugfs with RCU
    (git-fixes).
  - commit 55ae2a6
  - KVM: arm64: timers: Fix resource leaks in kvm_timer_hyp_init()
    (git-fixes).
  - commit f80cefe
  - bpf: Fix updating attached freplace prog in prog_array map
    (bsc#1229297 CVE-2024-43837).
  - commit a9d7d77
  - dma-direct: Leak pages on dma_set_decrypted() failure (bsc#1224535 CVE-2024-35939).
  - commit 7de8166
  - ice: Add a per-VF limit on number of FDIR filters
    (CVE-2024-42291 bsc#1229374).
  - commit ee2b93b
  - net/mlx5: Fix missing lock on sync reset reload (CVE-2024-42268
    bsc#1229391).
  - commit 268cdf6
  - selftests/bpf: Add a test to verify previous stacksafe() fix
    (bsc#1225903).
  - bpf: Fix a kernel verifier crash in stacksafe() (bsc#1225903).
  - commit dab2844
  - xdp: fix invalid wait context of page_pool_destroy() (CVE-2024-43834 bsc#1229314)
  - commit 6348ec4
  - clk: mediatek: mt7622-apmixedsys: Fix an error handling path
    in clk_mt8135_apmixed_probe() (bsc#1224711 CVE-2024-27433).
  - commit 30e1ef1
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (CVE-2024-36286 bsc#1226801)
  - commit 3278d5d
  - netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270 1226798)
  - commit 26814d6
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851 bsc#1223074)
  - commit 6ad2cbe

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

++++ openssl-3:

  - Security fix: [bsc#1229465, CVE-2024-6119]
    * possible denial of service in X.509 name checks
    * openssl-CVE-2024-6119.patch

------------------------------------------------------------------
------------------  2024-8-21  -  Aug 21 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240821.fbabe1d:
    * Add helper service for soft-reboot

++++ kernel-default:

  - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
    (CVE-2024-40920 bsc#1227781).
  - net: bridge: mst: pass vlan group directly to
    br_mst_vlan_set_state (CVE-2024-40921 bsc#1227784).
  - net: bridge: mst: fix vlan use-after-free (CVE-2024-36979
    bsc#1226604).
  - commit 7beae73
  - blacklist.conf: git-fixes f2eaed1565acc2bdeb5c433f5f6c7bd7a0d62db1
    blacklisted since it involves backporting many other commits not
    that are relevnat only to gdb debug scripts and whose dependent
    commits may break kABI.
  - commit 323e420
  - erofs: fix inconsistent per-file compression format (bsc#1220252, CVE-2024-26590).
  - commit 4f99bd1
  - perf: hisi: Fix use-after-free when register pmu fails
    (bsc#1225582 CVE-2023-52859).
  - commit a50ce06
  - printk/panic: Allow cpu backtraces to be written into ringbuffer
    during panic (bsc#1225607).
  - commit 1ebfff4
  - net: drop bad gso csum_start and offset in virtio_net_hdr
    (git-fixes).
  - commit 6d27b13
  - selftests/bpf: Test for null-pointer-deref bugfix in
    resolve_prog_type() (bsc#1229297 CVE-2024-43837).
  - bpf: Fix null pointer dereference in resolve_prog_type()
    for BPF_PROG_TYPE_EXT (bsc#1229297 CVE-2024-43837).
  - commit 37e60d8
  - bpf: simplify btf_get_prog_ctx_type() into
    btf_is_prog_ctx_type() (git-fixes).
  - Refresh patches.suse/bpf-don-t-infer-PTR_TO_CTX-for-programs-with-unnamed.patch
  - Refresh patches.suse/bpf-handle-bpf_user_pt_regs_t-typedef-explicitly-for.patch
  - bpf: extract bpf_ctx_convert_map logic and make it more reusable
    (git-fixes).
  - Refresh patches.suse/bpf-handle-bpf_user_pt_regs_t-typedef-explicitly-for.patch
  - commit a1a0c24
  - vhost: Release worker mutex during flushes (git-fixes).
  - commit be0d4d9
  - virtio: reenable config if freezing device failed (git-fixes).
  - commit d96d64e
  - kabi fix for SUNRPC: add a missing rpc_stat for TCP TLS
    (git-fixes).
  - SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).
  - commit 4fa6f6d
  - netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (CVE-2024-42270 bsc#1229404)
  - commit eb407e1
  - netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (CVE-2024-42269 bsc#1229402)
  - commit 6f31e8c
  - tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284 bsc#1229382)
  - commit 003e7ab
  - net: nexthop: Initialize all fields in dumped nexthops (CVE-2024-42283 bsc#1229383)
  - commit dd830eb
  - sysctl: always initialize i_uid/i_gid (CVE-2024-42312 bsc#1229357)
  - commit 683a109
  - block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854 bsc#1229345)
  - commit bc065ac

++++ kernel-default:

  - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state
    (CVE-2024-40920 bsc#1227781).
  - net: bridge: mst: pass vlan group directly to
    br_mst_vlan_set_state (CVE-2024-40921 bsc#1227784).
  - net: bridge: mst: fix vlan use-after-free (CVE-2024-36979
    bsc#1226604).
  - commit 7beae73
  - blacklist.conf: git-fixes f2eaed1565acc2bdeb5c433f5f6c7bd7a0d62db1
    blacklisted since it involves backporting many other commits not
    that are relevnat only to gdb debug scripts and whose dependent
    commits may break kABI.
  - commit 323e420
  - erofs: fix inconsistent per-file compression format (bsc#1220252, CVE-2024-26590).
  - commit 4f99bd1
  - perf: hisi: Fix use-after-free when register pmu fails
    (bsc#1225582 CVE-2023-52859).
  - commit a50ce06
  - printk/panic: Allow cpu backtraces to be written into ringbuffer
    during panic (bsc#1225607).
  - commit 1ebfff4
  - net: drop bad gso csum_start and offset in virtio_net_hdr
    (git-fixes).
  - commit 6d27b13
  - selftests/bpf: Test for null-pointer-deref bugfix in
    resolve_prog_type() (bsc#1229297 CVE-2024-43837).
  - bpf: Fix null pointer dereference in resolve_prog_type()
    for BPF_PROG_TYPE_EXT (bsc#1229297 CVE-2024-43837).
  - commit 37e60d8
  - bpf: simplify btf_get_prog_ctx_type() into
    btf_is_prog_ctx_type() (git-fixes).
  - Refresh patches.suse/bpf-don-t-infer-PTR_TO_CTX-for-programs-with-unnamed.patch
  - Refresh patches.suse/bpf-handle-bpf_user_pt_regs_t-typedef-explicitly-for.patch
  - bpf: extract bpf_ctx_convert_map logic and make it more reusable
    (git-fixes).
  - Refresh patches.suse/bpf-handle-bpf_user_pt_regs_t-typedef-explicitly-for.patch
  - commit a1a0c24
  - vhost: Release worker mutex during flushes (git-fixes).
  - commit be0d4d9
  - virtio: reenable config if freezing device failed (git-fixes).
  - commit d96d64e
  - kabi fix for SUNRPC: add a missing rpc_stat for TCP TLS
    (git-fixes).
  - SUNRPC: add a missing rpc_stat for TCP TLS (git-fixes).
  - commit 4fa6f6d
  - netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init() (CVE-2024-42270 bsc#1229404)
  - commit eb407e1
  - netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init() (CVE-2024-42269 bsc#1229402)
  - commit 6f31e8c
  - tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284 bsc#1229382)
  - commit 003e7ab
  - net: nexthop: Initialize all fields in dumped nexthops (CVE-2024-42283 bsc#1229383)
  - commit dd830eb
  - sysctl: always initialize i_uid/i_gid (CVE-2024-42312 bsc#1229357)
  - commit 683a109
  - block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854 bsc#1229345)
  - commit bc065ac

++++ systemd:

  - Make the 32bit version of libudev.so available again (bsc#1228223)
    The symlink for building 32bit applications was mistakenly dropped when the
    content of libudev-devel was merged into systemd-devel.
    Provide the 32bit flavor of systemd-devel again, which should restore the plug
    and play support in Wine for 32bit windows applications.

++++ systemd:

  - Make the 32bit version of libudev.so available again (bsc#1228223)
    The symlink for building 32bit applications was mistakenly dropped when the
    content of libudev-devel was merged into systemd-devel.
    Provide the 32bit flavor of systemd-devel again, which should restore the plug
    and play support in Wine for 32bit windows applications.

++++ systemd:

  - Make the 32bit version of libudev.so available again (bsc#1228223)
    The symlink for building 32bit applications was mistakenly dropped when the
    content of libudev-devel was merged into systemd-devel.
    Provide the 32bit flavor of systemd-devel again, which should restore the plug
    and play support in Wine for 32bit windows applications.

++++ systemd:

  - Make the 32bit version of libudev.so available again (bsc#1228223)
    The symlink for building 32bit applications was mistakenly dropped when the
    content of libudev-devel was merged into systemd-devel.
    Provide the 32bit flavor of systemd-devel again, which should restore the plug
    and play support in Wine for 32bit windows applications.

++++ systemd:

  - Make the 32bit version of libudev.so available again (bsc#1228223)
    The symlink for building 32bit applications was mistakenly dropped when the
    content of libudev-devel was merged into systemd-devel.
    Provide the 32bit flavor of systemd-devel again, which should restore the plug
    and play support in Wine for 32bit windows applications.

++++ systemd:

  - Make the 32bit version of libudev.so available again (bsc#1228223)
    The symlink for building 32bit applications was mistakenly dropped when the
    content of libudev-devel was merged into systemd-devel.
    Provide the 32bit flavor of systemd-devel again, which should restore the plug
    and play support in Wine for 32bit windows applications.

++++ systemd:

  - Make the 32bit version of libudev.so available again (bsc#1228223)
    The symlink for building 32bit applications was mistakenly dropped when the
    content of libudev-devel was merged into systemd-devel.
    Provide the 32bit flavor of systemd-devel again, which should restore the plug
    and play support in Wine for 32bit windows applications.

------------------------------------------------------------------
------------------  2024-8-20  -  Aug 20 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - ipvs: properly dereference pe in ip_vs_add_service (CVE-2024-42322 bsc#1229347)
  - commit 5abcd51
  - vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
    (git-fixes).
  - commit efaee02
  - net: missing check virtio (git-fixes).
  - commit 547a4d8
  - vhost/vsock: always initialize seqpacket_allow (git-fixes).
  - commit 1501797
  - vhost: Use virtqueue mutex for swapping worker (git-fixes).
  - commit ee31e9d
  - nvme-sysfs: add 'tls_keyring' attribute (bsc#1221857).
  - nvme-sysfs: add 'tls_configured_key' sysfs attribute
    (bsc#1221857).
  - nvme: split off TLS sysfs attributes into a separate group
    (bsc#1221857).
  - nvme: add a newline to the 'tls_key' sysfs attribute
    (bsc#1221857).
  - nvme-tcp: check for invalidated or revoked key (bsc#1221857).
  - nvme-tcp: sanitize TLS key handling (bsc#1221857).
  - nvme: tcp: remove unnecessary goto statement (bsc#1221857).
  - commit 95902b1
  - Refresh patches.suse/nvme-fabrics-typo-in-nvmf_parse_key.patch.
    Move into sorted section.
  - commit 24e43c3
  - vhost-scsi: Handle vhost_vq_work_queue failures for events
    (git-fixes).
  - commit bb54ef9
  - Update DRM patch reference (CVE-2024-42308 bsc#1229411)
  - commit ddc1933
  - Update
    patches.suse/nvme-tcp-fix-compile-time-checks-for-TLS-mode.patch
    (jsc#PED-6252 jsc#PED-5728 jsc#PED-5062 jsc#PED-3535
    bsc#1221857).
    Fix backporting error.
  - commit 35c7df3
  - Update parport patch reference (CVE-2024-42301 bsc#1229407)
  - commit 6707829
  - Refresh
    patches.suse/nvme-tcp-strict-pdu-pacing-to-avoid-send-stalls-on-T.patch.
    Use the version which got upload upstream.
  - commit 4896f98
  - blacklist.conf: add ffe6176b7f53 ("virtio: store owner from modules
    with register_virtio_driver()")
  - commit 08df841
  - virtio_net: use u64_stats_t infra to avoid data-races
    (git-fixes).
  - commit 1825530
  - usb: typec: fsa4480: Check if the chip is really there
    (git-fixes).
  - commit 771af75
  - usb: typec: fsa4480: Add support to swap SBU orientation
    (git-fixes).
  - commit b744e01
  - usb: typec: fsa4480: add support for Audio Accessory Mode
    (git-fixes).
  - commit 471d14e
  - usb: typec: fsa4480: rework mux & switch setup to handle more
    states (git-fixes).
  - commit dc03605
  - irqchip/imx-irqsteer: Handle runtime power management correctly
    (CVE-2024-42290 bsc#1229379).
  - commit a3bbc63
  - landlock: Don't lose track of restrictions on cred_transfer
    (bsc#1229351 CVE-2024-42318).
  - commit e161e74
  - apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287, CVE-2023-52889).
  - commit 7a47d08
  - kABI fix of: virtio-crypto: handle config changed by work queue
    (git-fixes).
  - commit 2e4646f
  - nvme-multipath: implement "queue-depth" iopolicy (bsc#1227706).
  - nvme-multipath: prepare for "queue-depth" iopolicy
    (bsc#1227706).
  - commit 796fd31
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
    (bsc#1229370 CVE-2024-42295).
  - commit 34231c4
  - arm64: dts: imx8mp: Fix pgc vpu locations (git-fixes)
  - commit 6f29859
  - arm64: dts: imx8mp: Fix pgc_mlmix location (git-fixes)
  - commit 6b6ab8a
  - soc: qcom: icc-bwmon: Fix refcount imbalance seen during
    bwmon_remove (CVE-2024-43850 bsc#1229316).
  - soc: qcom: icc-bwmon: Set default thresholds dynamically
    (CVE-2024-43850 bsc#1229316).
  - commit e842a77
  - arm64: dts: imx8mp: add HDMI power-domains (git-fixes)
  - commit 88b7cca
  - arm64: dts: imx8mp: Add NPU Node (git-fixes)
  - commit 55a2e84
  - media: mediatek: vcodec: Handle invalid decoder vsi
    (CVE-2024-43831 bsc#1229309).
  - commit a7b1ec0
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
    (CVE-2024-43839 bsc#1229301).
  - net: mana: Add support for page sizes other than 4KB on ARM64
    (jsc#PED-8491 bsc#1226530).
  - commit 24750b5
  - Squashfs: fix variable overflow triggered by sysbot (git-fixes).
  - commit 90b77e5
  - squashfs: squashfs_read_data need to check if the length is 0
    (git-fixes).
  - commit 1ab3d64
  - jfs: Fix shift-out-of-bounds in dbDiscardAG (git-fixes).
  - commit f862c1b
  - jfs: fix null ptr deref in dtInsertEntry (git-fixes).
  - commit 72d65ab
  - reiserfs: fix uninit-value in comp_keys (git-fixes).
  - commit aeea4b8
  - Update
    patches.suse/0001-netlink-add-nla-be16-32-types-to-minlen-array.patch
    (CVE-2024-26849 bsc#1223053).
    Fixes: 2747893c94d9b55340403026d9430f2f93947449
  - commit 4cf09d7
  - virtio-crypto: handle config changed by work queue (git-fixes).
  - Refresh
    patches.suse/crypto-virtio-Wait-for-tasklet-to-complete-on-device.patch.
  - commit 3719b45
  - fuse: Initialize beyond-EOF page contents before setting
    uptodate (bsc#1229456).
  - fs/netfs/fscache_cookie: add missing "n_accesses" check
    (bsc#1229455).
  - commit 1ffdccd
  - s390/dasd: fix error recovery leading to data corruption on
    ESE devices (git-fixes bsc#1229452).
  - commit 421d882
  - blacklist.conf: Change entry to alt-commit
  - Refresh patches.suse/tools-Disable-__packed-attribute-compiler-warning-due-to-Werror-attributes.patch.
  - commit a7c7d40
  - net/iucv: fix the allocation size of iucv_path_table array
    (git-fixes bsc#1229451).
  - commit 4e0b259
  - blacklist.conf: we don't enable CONFIG_CPUMASK_OFFSTACK on s390
  - commit 8a36035
  - Refresh patches.suse/0001-drm-mst-Fix-NULL-pointer-dereference-at-drm_dp_add_p.patch (git-fixes)
    Alt-commit
  - commit 98e41cf
  - Refresh patches.suse/drm-i915-vma-Fix-UAF-on-destroy-against-retire-race.patch (git-fixes)
    Alt-commit
  - commit 11ef901
  - Refresh patches.suse/drm-amd-display-Send-DTBCLK-disable-message-on-first.patch (git-fixes)
    Alt-commit
  - commit 6d9aa0a
  - Refresh patches.suse/drm-amd-display-Fix-DPSTREAM-CLK-on-and-off-sequence.patch (git-fixes)
    Alt-commit
  - commit 24768b9
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
    (CVE-2024-41007 bsc#1227863).
  - commit 35aaaf5
  - HID: wacom: Defer calculation of resolution until
    resolution_code is known (git-fixes).
  - ALSA: usb: Fix UBSAN warning in parse_audio_unit()
    (stable-fixes).
  - commit a485c9b
  - blacklist.conf: Add libata upstream revert entry (bsc#1229054)
  - commit 5ded40a
  - bpf: Fix a segment issue when downgrading gso_size (bsc#1229386
    CVE-2024-42281).
  - commit f593f1f

++++ kernel-default:

  - ipvs: properly dereference pe in ip_vs_add_service (CVE-2024-42322 bsc#1229347)
  - commit 5abcd51
  - vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler
    (git-fixes).
  - commit efaee02
  - net: missing check virtio (git-fixes).
  - commit 547a4d8
  - vhost/vsock: always initialize seqpacket_allow (git-fixes).
  - commit 1501797
  - vhost: Use virtqueue mutex for swapping worker (git-fixes).
  - commit ee31e9d
  - nvme-sysfs: add 'tls_keyring' attribute (bsc#1221857).
  - nvme-sysfs: add 'tls_configured_key' sysfs attribute
    (bsc#1221857).
  - nvme: split off TLS sysfs attributes into a separate group
    (bsc#1221857).
  - nvme: add a newline to the 'tls_key' sysfs attribute
    (bsc#1221857).
  - nvme-tcp: check for invalidated or revoked key (bsc#1221857).
  - nvme-tcp: sanitize TLS key handling (bsc#1221857).
  - nvme: tcp: remove unnecessary goto statement (bsc#1221857).
  - commit 95902b1
  - Refresh patches.suse/nvme-fabrics-typo-in-nvmf_parse_key.patch.
    Move into sorted section.
  - commit 24e43c3
  - vhost-scsi: Handle vhost_vq_work_queue failures for events
    (git-fixes).
  - commit bb54ef9
  - Update DRM patch reference (CVE-2024-42308 bsc#1229411)
  - commit ddc1933
  - Update
    patches.suse/nvme-tcp-fix-compile-time-checks-for-TLS-mode.patch
    (jsc#PED-6252 jsc#PED-5728 jsc#PED-5062 jsc#PED-3535
    bsc#1221857).
    Fix backporting error.
  - commit 35c7df3
  - Update parport patch reference (CVE-2024-42301 bsc#1229407)
  - commit 6707829
  - Refresh
    patches.suse/nvme-tcp-strict-pdu-pacing-to-avoid-send-stalls-on-T.patch.
    Use the version which got upload upstream.
  - commit 4896f98
  - blacklist.conf: add ffe6176b7f53 ("virtio: store owner from modules
    with register_virtio_driver()")
  - commit 08df841
  - virtio_net: use u64_stats_t infra to avoid data-races
    (git-fixes).
  - commit 1825530
  - usb: typec: fsa4480: Check if the chip is really there
    (git-fixes).
  - commit 771af75
  - usb: typec: fsa4480: Add support to swap SBU orientation
    (git-fixes).
  - commit b744e01
  - usb: typec: fsa4480: add support for Audio Accessory Mode
    (git-fixes).
  - commit 471d14e
  - usb: typec: fsa4480: rework mux & switch setup to handle more
    states (git-fixes).
  - commit dc03605
  - irqchip/imx-irqsteer: Handle runtime power management correctly
    (CVE-2024-42290 bsc#1229379).
  - commit a3bbc63
  - landlock: Don't lose track of restrictions on cred_transfer
    (bsc#1229351 CVE-2024-42318).
  - commit e161e74
  - apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287, CVE-2023-52889).
  - commit 7a47d08
  - kABI fix of: virtio-crypto: handle config changed by work queue
    (git-fixes).
  - commit 2e4646f
  - nvme-multipath: implement "queue-depth" iopolicy (bsc#1227706).
  - nvme-multipath: prepare for "queue-depth" iopolicy
    (bsc#1227706).
  - commit 796fd31
  - nilfs2: handle inconsistent state in nilfs_btnode_create_block()
    (bsc#1229370 CVE-2024-42295).
  - commit 34231c4
  - arm64: dts: imx8mp: Fix pgc vpu locations (git-fixes)
  - commit 6f29859
  - arm64: dts: imx8mp: Fix pgc_mlmix location (git-fixes)
  - commit 6b6ab8a
  - soc: qcom: icc-bwmon: Fix refcount imbalance seen during
    bwmon_remove (CVE-2024-43850 bsc#1229316).
  - soc: qcom: icc-bwmon: Set default thresholds dynamically
    (CVE-2024-43850 bsc#1229316).
  - commit e842a77
  - arm64: dts: imx8mp: add HDMI power-domains (git-fixes)
  - commit 88b7cca
  - arm64: dts: imx8mp: Add NPU Node (git-fixes)
  - commit 55a2e84
  - media: mediatek: vcodec: Handle invalid decoder vsi
    (CVE-2024-43831 bsc#1229309).
  - commit a7b1ec0
  - bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
    (CVE-2024-43839 bsc#1229301).
  - net: mana: Add support for page sizes other than 4KB on ARM64
    (jsc#PED-8491 bsc#1226530).
  - commit 24750b5
  - Squashfs: fix variable overflow triggered by sysbot (git-fixes).
  - commit 90b77e5
  - squashfs: squashfs_read_data need to check if the length is 0
    (git-fixes).
  - commit 1ab3d64
  - jfs: Fix shift-out-of-bounds in dbDiscardAG (git-fixes).
  - commit f862c1b
  - jfs: fix null ptr deref in dtInsertEntry (git-fixes).
  - commit 72d65ab
  - reiserfs: fix uninit-value in comp_keys (git-fixes).
  - commit aeea4b8
  - Update
    patches.suse/0001-netlink-add-nla-be16-32-types-to-minlen-array.patch
    (CVE-2024-26849 bsc#1223053).
    Fixes: 2747893c94d9b55340403026d9430f2f93947449
  - commit 4cf09d7
  - virtio-crypto: handle config changed by work queue (git-fixes).
  - Refresh
    patches.suse/crypto-virtio-Wait-for-tasklet-to-complete-on-device.patch.
  - commit 3719b45
  - fuse: Initialize beyond-EOF page contents before setting
    uptodate (bsc#1229456).
  - fs/netfs/fscache_cookie: add missing "n_accesses" check
    (bsc#1229455).
  - commit 1ffdccd
  - s390/dasd: fix error recovery leading to data corruption on
    ESE devices (git-fixes bsc#1229452).
  - commit 421d882
  - blacklist.conf: Change entry to alt-commit
  - Refresh patches.suse/tools-Disable-__packed-attribute-compiler-warning-due-to-Werror-attributes.patch.
  - commit a7c7d40
  - net/iucv: fix the allocation size of iucv_path_table array
    (git-fixes bsc#1229451).
  - commit 4e0b259
  - blacklist.conf: we don't enable CONFIG_CPUMASK_OFFSTACK on s390
  - commit 8a36035
  - Refresh patches.suse/0001-drm-mst-Fix-NULL-pointer-dereference-at-drm_dp_add_p.patch (git-fixes)
    Alt-commit
  - commit 98e41cf
  - Refresh patches.suse/drm-i915-vma-Fix-UAF-on-destroy-against-retire-race.patch (git-fixes)
    Alt-commit
  - commit 11ef901
  - Refresh patches.suse/drm-amd-display-Send-DTBCLK-disable-message-on-first.patch (git-fixes)
    Alt-commit
  - commit 6d9aa0a
  - Refresh patches.suse/drm-amd-display-Fix-DPSTREAM-CLK-on-and-off-sequence.patch (git-fixes)
    Alt-commit
  - commit 24768b9
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
    (CVE-2024-41007 bsc#1227863).
  - commit 35aaaf5
  - HID: wacom: Defer calculation of resolution until
    resolution_code is known (git-fixes).
  - ALSA: usb: Fix UBSAN warning in parse_audio_unit()
    (stable-fixes).
  - commit a485c9b
  - blacklist.conf: Add libata upstream revert entry (bsc#1229054)
  - commit 5ded40a
  - bpf: Fix a segment issue when downgrading gso_size (bsc#1229386
    CVE-2024-42281).
  - commit f593f1f

------------------------------------------------------------------
------------------  2024-8-19  -  Aug 19 2024  -------------------
------------------------------------------------------------------

++++ glib2:

  - Add patches to fix CVE-2024-34397 (boo#1224044):
    glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268)
    glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)

++++ glib2:

  - Add patches to fix CVE-2024-34397 (boo#1224044):
    glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268)
    glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)

++++ glib2:

  - Add patches to fix CVE-2024-34397 (boo#1224044):
    glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268)
    glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)
  - Add patches to fix CVE-2024-34397 (boo#1224044):
    glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268)
    glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)

++++ glib2:

  - Add patches to fix CVE-2024-34397 (boo#1224044):
    glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268)
    glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)

++++ glib2:

  - Add patches to fix CVE-2024-34397 (boo#1224044):
    glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268)
    glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)

++++ glib2:

  - Add patches to fix CVE-2024-34397 (boo#1224044):
    glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268)
    glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)

++++ kernel-default:

  - kABI fix for net/sched: flower: Fix chain template offload
    (CVE-2024-26669 bsc#1222350).
  - net/sched: flower: Fix chain template offload (CVE-2024-26669
    bsc#1222350).
  - commit 43f1cd6
  - kABI fix for rxrpc: Fix delayed ACKs to not set the reference
    serial number (CVE-2024-26677 bsc#1222387).
  - rxrpc: Fix delayed ACKs to not set the reference serial number
    (CVE-2024-26677 bsc#1222387).
  - commit c3c3a27
  - Update patches.suse/cpu-SMT-Enable-SMT-only-if-a-core-is-online.patch
    (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes
    bsc#1229327 ltc#206365).
  - Update patches.suse/powerpc-topology-Check-if-a-core-is-online.patch
    (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes
    bsc#1229327 ltc#206365).
  - commit fd7ec4b
  - xprtrdma: Fix rpcrdma_reqs_reset() (git-fixes).
  - gss_krb5: Fix the error handling path for
    crypto_sync_skcipher_setkey (git-fixes).
  - commit c717fae
  - SUNRPC: Fix a race to wake a sync task (git-fixes).
  - nfs: pass explicit offset/count to trace events (git-fixes).
  - commit 6f41a0a
  - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
    (git-fixes).
  - NFSD: Support write delegations in LAYOUTGET (git-fixes).
  - nfs: don't invalidate dentries on transient errors (git-fixes).
  - nfs: propagate readlink errors in nfs_symlink_filler
    (git-fixes).
  - nfs: make the rpc_stat per net namespace (git-fixes).
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces (git-fixes).
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
    (git-fixes).
  - commit 6ab4001
  - Update
    patches.suse/ata-libata-core-Fix-double-free-on-error.patch
    (git-fixes CVE-2024-41087 bsc#1228740 bsc#1228466).
  - Update
    patches.suse/cachefiles-add-missing-lock-protection-when-polling.patch
    (bsc#1229256 CVE-2024-42250 bsc#1228977).
  - Update
    patches.suse/cachefiles-defer-exposing-anon_fd-until-after-copy_to.patch
    (bsc#1229251 CVE-2024-40913 bsc#1227839).
  - Update
    patches.suse/cachefiles-fix-slab-use-after-free-in-cachefiles_onde.patch
    (bsc#1229247 CVE-2024-39510 bsc#1227734).
  - Update
    patches.suse/cachefiles-fix-slab-use-after-free-in-cachefiles_ondemand_daemon_read.patch
    (bsc#1229246 CVE-2024-40899 bsc#1227758).
  - Update
    patches.suse/drm-i915-gem-Fix-Virtual-Memory-mapping-boundaries-c.patch
    (git-fixes CVE-2024-42259 bsc#1229156).
  - Update
    patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch
    (bsc#1194869 CVE-2024-41065 bsc#1228636).
  - commit 3fec826
  - char: xillybus: Check USB endpoints when probing device
    (git-fixes).
  - Revert "misc: fastrpc: Restrict untrusted app to attach to
    privileged PD" (git-fixes).
  - tty: atmel_serial: use the correct RTS flag (git-fixes).
  - tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
    (git-fixes).
  - xhci: Fix Panther point NULL pointer deref at full-speed
    re-enumeration (git-fixes).
  - Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
    (git-fixes).
  - commit e3fe681
  - blacklist.conf: add unwanted nfs/sunrpc patch
  - commit 405ec89
  - Refresh patches.suse/SUNRPC-avoid-soft-lockup-when-transmitting-UDP-to-re.patch.
    Add git-commit
  - commit 7a1e763

++++ kernel-default:

  - kABI fix for net/sched: flower: Fix chain template offload
    (CVE-2024-26669 bsc#1222350).
  - net/sched: flower: Fix chain template offload (CVE-2024-26669
    bsc#1222350).
  - commit 43f1cd6
  - kABI fix for rxrpc: Fix delayed ACKs to not set the reference
    serial number (CVE-2024-26677 bsc#1222387).
  - rxrpc: Fix delayed ACKs to not set the reference serial number
    (CVE-2024-26677 bsc#1222387).
  - commit c3c3a27
  - Update patches.suse/cpu-SMT-Enable-SMT-only-if-a-core-is-online.patch
    (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes
    bsc#1229327 ltc#206365).
  - Update patches.suse/powerpc-topology-Check-if-a-core-is-online.patch
    (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes
    bsc#1229327 ltc#206365).
  - commit fd7ec4b
  - xprtrdma: Fix rpcrdma_reqs_reset() (git-fixes).
  - gss_krb5: Fix the error handling path for
    crypto_sync_skcipher_setkey (git-fixes).
  - commit c717fae
  - SUNRPC: Fix a race to wake a sync task (git-fixes).
  - nfs: pass explicit offset/count to trace events (git-fixes).
  - commit 6f41a0a
  - NFSv4.1 another fix for EXCHGID4_FLAG_USE_PNFS_DS for DS server
    (git-fixes).
  - NFSD: Support write delegations in LAYOUTGET (git-fixes).
  - nfs: don't invalidate dentries on transient errors (git-fixes).
  - nfs: propagate readlink errors in nfs_symlink_filler
    (git-fixes).
  - nfs: make the rpc_stat per net namespace (git-fixes).
  - nfs: expose /proc/net/sunrpc/nfs in net namespaces (git-fixes).
  - sunrpc: add a struct rpc_stats arg to rpc_create_args
    (git-fixes).
  - commit 6ab4001
  - Update
    patches.suse/ata-libata-core-Fix-double-free-on-error.patch
    (git-fixes CVE-2024-41087 bsc#1228740 bsc#1228466).
  - Update
    patches.suse/cachefiles-add-missing-lock-protection-when-polling.patch
    (bsc#1229256 CVE-2024-42250 bsc#1228977).
  - Update
    patches.suse/cachefiles-defer-exposing-anon_fd-until-after-copy_to.patch
    (bsc#1229251 CVE-2024-40913 bsc#1227839).
  - Update
    patches.suse/cachefiles-fix-slab-use-after-free-in-cachefiles_onde.patch
    (bsc#1229247 CVE-2024-39510 bsc#1227734).
  - Update
    patches.suse/cachefiles-fix-slab-use-after-free-in-cachefiles_ondemand_daemon_read.patch
    (bsc#1229246 CVE-2024-40899 bsc#1227758).
  - Update
    patches.suse/drm-i915-gem-Fix-Virtual-Memory-mapping-boundaries-c.patch
    (git-fixes CVE-2024-42259 bsc#1229156).
  - Update
    patches.suse/powerpc-pseries-Whitelist-dtl-slub-object-for-copyin.patch
    (bsc#1194869 CVE-2024-41065 bsc#1228636).
  - commit 3fec826
  - char: xillybus: Check USB endpoints when probing device
    (git-fixes).
  - Revert "misc: fastrpc: Restrict untrusted app to attach to
    privileged PD" (git-fixes).
  - tty: atmel_serial: use the correct RTS flag (git-fixes).
  - tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
    (git-fixes).
  - xhci: Fix Panther point NULL pointer deref at full-speed
    re-enumeration (git-fixes).
  - Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
    (git-fixes).
  - commit e3fe681
  - blacklist.conf: add unwanted nfs/sunrpc patch
  - commit 405ec89
  - Refresh patches.suse/SUNRPC-avoid-soft-lockup-when-transmitting-UDP-to-re.patch.
    Add git-commit
  - commit 7a1e763

++++ systemd:

  - Import commit 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/981815f400481fc28508e4de7395e8c1632f3c60...5aa182660dff86fe9d5cba61b0c6542bb2f2db23
  - Import commit 981815f400481fc28508e4de7395e8c1632f3c60 (merge of v254.16)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f...981815f400481fc28508e4de7395e8c1632f3c60

++++ systemd:

  - Import commit 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/981815f400481fc28508e4de7395e8c1632f3c60...5aa182660dff86fe9d5cba61b0c6542bb2f2db23
  - Import commit 981815f400481fc28508e4de7395e8c1632f3c60 (merge of v254.16)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f...981815f400481fc28508e4de7395e8c1632f3c60

++++ systemd:

  - Import commit 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/981815f400481fc28508e4de7395e8c1632f3c60...5aa182660dff86fe9d5cba61b0c6542bb2f2db23
  - Import commit 981815f400481fc28508e4de7395e8c1632f3c60 (merge of v254.16)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f...981815f400481fc28508e4de7395e8c1632f3c60

++++ systemd:

  - Import commit 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/981815f400481fc28508e4de7395e8c1632f3c60...5aa182660dff86fe9d5cba61b0c6542bb2f2db23
  - Import commit 981815f400481fc28508e4de7395e8c1632f3c60 (merge of v254.16)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f...981815f400481fc28508e4de7395e8c1632f3c60

++++ systemd:

  - Import commit 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/981815f400481fc28508e4de7395e8c1632f3c60...5aa182660dff86fe9d5cba61b0c6542bb2f2db23
  - Import commit 981815f400481fc28508e4de7395e8c1632f3c60 (merge of v254.16)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f...981815f400481fc28508e4de7395e8c1632f3c60

++++ systemd:

  - Import commit 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/981815f400481fc28508e4de7395e8c1632f3c60...5aa182660dff86fe9d5cba61b0c6542bb2f2db23
  - Import commit 981815f400481fc28508e4de7395e8c1632f3c60 (merge of v254.16)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f...981815f400481fc28508e4de7395e8c1632f3c60

++++ systemd:

  - Import commit 5aa182660dff86fe9d5cba61b0c6542bb2f2db23 (merge of v254.17)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/981815f400481fc28508e4de7395e8c1632f3c60...5aa182660dff86fe9d5cba61b0c6542bb2f2db23
  - Import commit 981815f400481fc28508e4de7395e8c1632f3c60 (merge of v254.16)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f...981815f400481fc28508e4de7395e8c1632f3c60

++++ tiff:

  - security update:
    * CVE-2024-7006 [bsc#1228924]
    Fix pointer deref in tif_dirinfo.c
    + tiff-CVE-2024-7006.patch

++++ tiff:

  - security update:
    * CVE-2024-7006 [bsc#1228924]
    Fix pointer deref in tif_dirinfo.c
    + tiff-CVE-2024-7006.patch

------------------------------------------------------------------
------------------  2024-8-18  -  Aug 18 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - xfs: attr forks require attr, not attr2 (git-fixes).
  - commit d1644af
  - i2c: qcom-geni: Add missing geni_icc_disable in
    geni_i2c_runtime_resume (git-fixes).
  - i2c: Use IS_REACHABLE() for substituting empty ACPI functions
    (git-fixes).
  - commit 37fcb0e
  - Move upstreamed powerpc patches into sorted section
  - commit 7bdd775
  - xfs: journal geometry is not properly bounds checked
    (git-fixes).
  - commit 7680aeb

++++ kernel-default:

  - xfs: attr forks require attr, not attr2 (git-fixes).
  - commit d1644af
  - i2c: qcom-geni: Add missing geni_icc_disable in
    geni_i2c_runtime_resume (git-fixes).
  - i2c: Use IS_REACHABLE() for substituting empty ACPI functions
    (git-fixes).
  - commit 37fcb0e
  - Move upstreamed powerpc patches into sorted section
  - commit 7bdd775
  - xfs: journal geometry is not properly bounds checked
    (git-fixes).
  - commit 7680aeb

------------------------------------------------------------------
------------------  2024-8-17  -  Aug 17 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add documentation for boxbuild tweaks

++++ python-kiwi:

  - Add documentation for boxbuild tweaks

++++ python-kiwi:

  - Add documentation for boxbuild tweaks

++++ kernel-default:

  - arm64: Fix KASAN random tag seed initialization (git-fixes)
  - commit a300263
  - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to (git-fixes)
  - commit a089c62
  - spi: Add empty versions of ACPI functions (stable-fixes).
  - i2c: Fix conditional for substituting empty ACPI functions
    (stable-fixes).
  - commit 3dc083c
  - gpio: mlxbf3: Support shutdown() function (git-fixes).
  - ALSA: hda/tas2781: Use correct endian conversion (git-fixes).
  - ALSA: usb-audio: Support Yamaha P-125 quirk entry
    (stable-fixes).
  - ALSA: hda/tas2781: fix wrong calibrated data order (git-fixes).
  - ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
    (stable-fixes).
  - ALSA: hda/realtek: Add support for new HP G12 laptops
    (stable-fixes).
  - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad
    3 15IAU7 (git-fixes).
  - ALSA: timer: Relax start tick time check for slave timer
    elements (git-fixes).
  - drm/amd/display: Adjust cursor position (git-fixes).
  - drm/amd/display: fix cursor offset on rotation 180 (git-fixes).
  - device property: Add cleanup.h based fwnode_handle_put()
    scope based cleanup (stable-fixes).
  - commit 51be9a0

++++ kernel-default:

  - arm64: Fix KASAN random tag seed initialization (git-fixes)
  - commit a300263
  - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to (git-fixes)
  - commit a089c62
  - spi: Add empty versions of ACPI functions (stable-fixes).
  - i2c: Fix conditional for substituting empty ACPI functions
    (stable-fixes).
  - commit 3dc083c
  - gpio: mlxbf3: Support shutdown() function (git-fixes).
  - ALSA: hda/tas2781: Use correct endian conversion (git-fixes).
  - ALSA: usb-audio: Support Yamaha P-125 quirk entry
    (stable-fixes).
  - ALSA: hda/tas2781: fix wrong calibrated data order (git-fixes).
  - ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
    (stable-fixes).
  - ALSA: hda/realtek: Add support for new HP G12 laptops
    (stable-fixes).
  - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad
    3 15IAU7 (git-fixes).
  - ALSA: timer: Relax start tick time check for slave timer
    elements (git-fixes).
  - drm/amd/display: Adjust cursor position (git-fixes).
  - drm/amd/display: fix cursor offset on rotation 180 (git-fixes).
  - device property: Add cleanup.h based fwnode_handle_put()
    scope based cleanup (stable-fixes).
  - commit 51be9a0

------------------------------------------------------------------
------------------  2024-8-16  -  Aug 16 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed wrong log level on --logfile
    When using --logfile, the log generated there matches the
    stdout log (which without --debug, does not include any debug info).
    This is in contrast to the automatically generated one in the
    output directory, which always does and also not following the
    way how it is documented. This Fixes #2503

++++ python-kiwi:

  - Fixed wrong log level on --logfile
    When using --logfile, the log generated there matches the
    stdout log (which without --debug, does not include any debug info).
    This is in contrast to the automatically generated one in the
    output directory, which always does and also not following the
    way how it is documented. This Fixes #2503

++++ python-kiwi:

  - Fixed wrong log level on --logfile
    When using --logfile, the log generated there matches the
    stdout log (which without --debug, does not include any debug info).
    This is in contrast to the automatically generated one in the
    output directory, which always does and also not following the
    way how it is documented. This Fixes #2503

++++ kernel-default:

  - xfs: allow cross-linking special files without project quota
    (git-fixes).
  - commit 8d26aca
  - KVM: nVMX: Check for pending posted interrupts when looking
    for nested events (git-fixes).
  - commit 0b1027c
  - KVM: VMX: Split out the non-virtualization part of
    vmx_interrupt_blocked() (git-fixes).
  - commit 47fc351
  - xfs: use consistent uid/gid when grabbing dquots for inodes
    (git-fixes).
  - commit c1c88ce
  - xfs: honor init_xattrs in xfs_init_new_inode for !ATTR fs
    (git-fixes).
  - commit fae2711
  - xfs: allow unlinked symlinks and dirs with zero size
    (git-fixes).
  - commit 184b713
  - blacklist.conf: add f99b052256f1 ("KVM: SNP: Fix LBR Virtualization for SNP guest")
  - commit c9ad47e
  - KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE
    (git-fixes).
  - commit 96acab8
  - xfs: fix unlink vs cluster buffer instantiation race
    (git-fixes).
  - commit 0ae592b
  - xfs: upgrade the extent counters in xfs_reflink_end_cow_extent
    later (git-fixes).
  - commit 730a4f0
  - xfs: match lock mode in xfs_buffered_write_iomap_begin()
    (git-fixes).
  - commit e70a195
  - xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log
    intent item recovery (git-fixes).
  - commit 85919a1
  - xfs: don't use current->journal_info (git-fixes).
  - commit d96f684
  - KVM: nVMX: Request immediate exit iff pending nested event
    needs injection (git-fixes).
  - commit 9d306b8
  - cachefiles: add missing lock protection when polling
    (bsc#1229256).
  - cachefiles: cyclic allocation of msg_id to avoid reuse
    (bsc#1228499 CVE-2024-41050).
  - cachefiles: wait for ondemand_object_worker to finish when
    dropping  object (bsc#1228468 CVE-2024-41051).
  - cachefiles: cancel all requests for the object that is being
    dropped (bsc#1229255).
  - cachefiles: stop sending new request when dropping object
    (bsc#1229254).
  - cachefiles: propagate errors from vfs_getxattr() to avoid
    infinite  loop (bsc#1229253).
  - cachefiles: make on-demand read killable (bsc#1229252).
  - cachefiles: Set object to close if ondemand_id < 0 in copen
    (bsc#1228643 CVE-2024-41074).
  - cachefiles: defer exposing anon_fd until after copy_to_user()
    succeeds (bsc#1229251).
  - cachefiles: never get a new anonymous fd if ondemand_id is valid
    (bsc#1229250).
  - cachefiles: add spin_lock for cachefiles_ondemand_info
    (bsc#1229249).
  - cachefiles: add consistency check for copen/cread (bsc#1228646
    CVE-2024-41075).
  - cachefiles: remove err_put_fd label in
    cachefiles_ondemand_daemon_read() (bsc#1229248).
  - cachefiles: fix slab-use-after-free in
    cachefiles_ondemand_daemon_read() (bsc#1229247).
  - cachefiles: fix slab-use-after-free in
    cachefiles_ondemand_get_fd() (bsc#1229246).
  - cachefiles, erofs: Fix NULL deref in when cachefiles is not
    doing  ondemand-mode (bsc#1229245).
  - cachefiles: add restore command to recover inflight ondemand
    read  requests (bsc#1229244).
  - cachefiles: narrow the scope of triggering EPOLLIN events in
    ondemand  mode (bsc#1229243).
  - cachefiles: resend an open request if the read request's object
    is  closed (bsc#1229241).
  - cachefiles: extract ondemand info field from cachefiles_object
    (bsc#1229240).
  - cachefiles: introduce object ondemand state (bsc#1229239).
  - commit 3d893c5
  - KVM: nVMX: Add a helper to get highest pending from Posted
    Interrupt vector (git-fixes).
  - commit ebf04ff
  - KVM: VMX: Switch __vmx_exit() and kvm_x86_vendor_exit() in
    vmx_exit() (git-fixes).
  - commit 8ef91ee
  - KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID (git-fixes).
  - commit 395837f
  - KVM: VMX: Move posted interrupt descriptor out of VMX code
    (git-fixes).
  - commit feb966b
  - xfs: allow symlinks with short remote targets (bsc#1229160).
  - commit e82d4ad
  - blacklist.conf: add 1c682593096a ("xen: privcmd: Switch from mutex to spinlock for irqfds")
  - commit 46d4480
  - x86/xen: Convert comma to semicolon (git-fixes).
  - commit c8d2d16
  - net: mana: Fix doorbell out of order violation and avoid
    unnecessary doorbell rings (bsc#1229154).
  - net: mana: Fix RX buf alloc_size alignment and atomic op panic
    (bsc#1229086).
  - commit 59cb1c7
  - wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
    (git-fixes).
  - net: ethernet: mtk_wed: fix use-after-free panic in
    mtk_wed_setup_tc_block_cb() (git-fixes).
  - media: Revert "media: dvb-usb: Fix unexpected infinite loop
    in dvb_usb_read_remote_control()" (git-fixes).
  - commit daf04e2

++++ kernel-default:

  - xfs: allow cross-linking special files without project quota
    (git-fixes).
  - commit 8d26aca
  - KVM: nVMX: Check for pending posted interrupts when looking
    for nested events (git-fixes).
  - commit 0b1027c
  - KVM: VMX: Split out the non-virtualization part of
    vmx_interrupt_blocked() (git-fixes).
  - commit 47fc351
  - xfs: use consistent uid/gid when grabbing dquots for inodes
    (git-fixes).
  - commit c1c88ce
  - xfs: honor init_xattrs in xfs_init_new_inode for !ATTR fs
    (git-fixes).
  - commit fae2711
  - xfs: allow unlinked symlinks and dirs with zero size
    (git-fixes).
  - commit 184b713
  - blacklist.conf: add f99b052256f1 ("KVM: SNP: Fix LBR Virtualization for SNP guest")
  - commit c9ad47e
  - KVM: x86/mmu: Bug the VM if KVM tries to split a !hugepage SPTE
    (git-fixes).
  - commit 96acab8
  - xfs: fix unlink vs cluster buffer instantiation race
    (git-fixes).
  - commit 0ae592b
  - xfs: upgrade the extent counters in xfs_reflink_end_cow_extent
    later (git-fixes).
  - commit 730a4f0
  - xfs: match lock mode in xfs_buffered_write_iomap_begin()
    (git-fixes).
  - commit e70a195
  - xfs: require XFS_SB_FEAT_INCOMPAT_LOG_XATTRS for attr log
    intent item recovery (git-fixes).
  - commit 85919a1
  - xfs: don't use current->journal_info (git-fixes).
  - commit d96f684
  - KVM: nVMX: Request immediate exit iff pending nested event
    needs injection (git-fixes).
  - commit 9d306b8
  - cachefiles: add missing lock protection when polling
    (bsc#1229256).
  - cachefiles: cyclic allocation of msg_id to avoid reuse
    (bsc#1228499 CVE-2024-41050).
  - cachefiles: wait for ondemand_object_worker to finish when
    dropping  object (bsc#1228468 CVE-2024-41051).
  - cachefiles: cancel all requests for the object that is being
    dropped (bsc#1229255).
  - cachefiles: stop sending new request when dropping object
    (bsc#1229254).
  - cachefiles: propagate errors from vfs_getxattr() to avoid
    infinite  loop (bsc#1229253).
  - cachefiles: make on-demand read killable (bsc#1229252).
  - cachefiles: Set object to close if ondemand_id < 0 in copen
    (bsc#1228643 CVE-2024-41074).
  - cachefiles: defer exposing anon_fd until after copy_to_user()
    succeeds (bsc#1229251).
  - cachefiles: never get a new anonymous fd if ondemand_id is valid
    (bsc#1229250).
  - cachefiles: add spin_lock for cachefiles_ondemand_info
    (bsc#1229249).
  - cachefiles: add consistency check for copen/cread (bsc#1228646
    CVE-2024-41075).
  - cachefiles: remove err_put_fd label in
    cachefiles_ondemand_daemon_read() (bsc#1229248).
  - cachefiles: fix slab-use-after-free in
    cachefiles_ondemand_daemon_read() (bsc#1229247).
  - cachefiles: fix slab-use-after-free in
    cachefiles_ondemand_get_fd() (bsc#1229246).
  - cachefiles, erofs: Fix NULL deref in when cachefiles is not
    doing  ondemand-mode (bsc#1229245).
  - cachefiles: add restore command to recover inflight ondemand
    read  requests (bsc#1229244).
  - cachefiles: narrow the scope of triggering EPOLLIN events in
    ondemand  mode (bsc#1229243).
  - cachefiles: resend an open request if the read request's object
    is  closed (bsc#1229241).
  - cachefiles: extract ondemand info field from cachefiles_object
    (bsc#1229240).
  - cachefiles: introduce object ondemand state (bsc#1229239).
  - commit 3d893c5
  - KVM: nVMX: Add a helper to get highest pending from Posted
    Interrupt vector (git-fixes).
  - commit ebf04ff
  - KVM: VMX: Switch __vmx_exit() and kvm_x86_vendor_exit() in
    vmx_exit() (git-fixes).
  - commit 8ef91ee
  - KVM: x86: Limit check IDs for KVM_SET_BOOT_CPU_ID (git-fixes).
  - commit 395837f
  - KVM: VMX: Move posted interrupt descriptor out of VMX code
    (git-fixes).
  - commit feb966b
  - xfs: allow symlinks with short remote targets (bsc#1229160).
  - commit e82d4ad
  - blacklist.conf: add 1c682593096a ("xen: privcmd: Switch from mutex to spinlock for irqfds")
  - commit 46d4480
  - x86/xen: Convert comma to semicolon (git-fixes).
  - commit c8d2d16
  - net: mana: Fix doorbell out of order violation and avoid
    unnecessary doorbell rings (bsc#1229154).
  - net: mana: Fix RX buf alloc_size alignment and atomic op panic
    (bsc#1229086).
  - commit 59cb1c7
  - wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
    (git-fixes).
  - net: ethernet: mtk_wed: fix use-after-free panic in
    mtk_wed_setup_tc_block_cb() (git-fixes).
  - media: Revert "media: dvb-usb: Fix unexpected infinite loop
    in dvb_usb_read_remote_control()" (git-fixes).
  - commit daf04e2

------------------------------------------------------------------
------------------  2024-8-15  -  Aug 15 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
    + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.

++++ cloud-regionsrv-client:

  - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
    + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.

++++ cloud-regionsrv-client:

  - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
    + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.

++++ cloud-regionsrv-client:

  - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
    + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.

++++ cloud-regionsrv-client:

  - Add rgnsrv-clnt-fix-docker-setup.patch (bsc#1229137)
    + The entry for the update infrastructure registry mirror was written
    incorrectly causing docker daemon startup to fail.

++++ kernel-default:

  - filelock: Remove locks reliably when fcntl/close race is
    detected (CVE-2024-41012 bsc#1228247).
  - commit a736b9b
  - io_uring: fix possible deadlock in
    io_register_iowq_max_workers() (bsc#1228616 CVE-2024-41080).
  - commit eae6448
  - io_uring: fix io_match_task must_hold (git-fixes).
  - io_uring: tighten task exit cancellations (git-fixes).
  - commit f9ce2d8
  - io_uring: Fix probe of disabled operations (git-fixes).
  - io_uring/advise: support 64-bit lengths (git-fixes).
  - commit 7566a8d
  - io_uring: Drop per-ctx dummy_ubuf (git-fixes).
  - commit 2717cc1
  - powerpc/kexec_file: fix cpus node update to FDT (bsc#1194869).
  - powerpc/pseries: Whitelist dtl slub object for copying to
    userspace (bsc#1194869).
  - powerpc/kexec: make the update_cpus_node() function public
    (bsc#1194869).
  - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
    (bsc#1194869).
  - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for
    CONFIG_PCI=n (bsc#1194869).
  - powerpc/io: Avoid clang null pointer arithmetic warnings
    (bsc#1194869).
  - powerpc/pseries: Add failure related checks for h_get_mpp and
    h_get_ppp (bsc#1194869).
  - powerpc/kexec: split CONFIG_KEXEC_FILE and CONFIG_CRASH_DUMP
    (bsc#1194869).
  - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (bsc#1194869).
  - powerpc/radix: Move some functions into #ifdef
    CONFIG_KVM_BOOK3S_HV_POSSIBLE (bsc#1194869).
  - commit 4e7f0fe
  - blacklist.conf: Add a bunch of superfluous ppc changes reported by
    git-fixes.
  - commit 7c2a851
  - blacklist.conf: Add ppc more ppc unsupported arch paths and commits.
  - commit 66e06b4
  - blacklist.conf: Add more ppc 32bit paths.
  - commit 013a9db
  - arm64: errata: Expand speculative SSBS workaround (again) (git-fixes)
  - commit e589bbc
  - arm64: cputype: Add Cortex-A725 definitions (git-fixes)
  - commit 0d04176
  - arm64: cputype: Add Cortex-X1C definitions (git-fixes)
  - commit 6a5ea61
  - arm64: errata: Expand speculative SSBS workaround (git-fixes)
  - commit f75d6ba
  - arm64: errata: Unify speculative SSBS errata logic (git-fixes).
    Update config files.
  - commit ffaab08
  - arm64: cputype: Add Cortex-X925 definitions (git-fixes)
  - commit 3c8ddb7
  - arm64: cputype: Add Cortex-A720 definitions (git-fixes)
  - commit f5fd7c6
  - arm64: cputype: Add Cortex-X3 definitions (git-fixes)
  - commit d87d988
  - arm64: errata: Add workaround for Arm errata 3194386 and 3312417 (git-fixes)
    Refresh patches.suse/kabi-arm64-reserve-space-in-cpu_hwcaps-and-cpu_hwcap.patch
    and enable around.
  - commit b3747ef
  - arm64: cputype: Add Neoverse-V3 definitions (git-fixes)
  - commit 78aeee9
  - arm64: cputype: Add Cortex-X4 definitions (git-fixes)
  - commit 2841965
  - arm64: barrier: Restore spec_bar() macro (git-fixes)
  - commit 5c935b6
  - arm64: Add Neoverse-V2 part (git-fixes)
  - commit 0f9f30b
  - net/rds: fix possible cp null dereference (git-fixes).
  - commit cac3126
  - s390/pci: Add missing virt_to_phys() for directed DIBV
    (git-fixes bsc#1229174).
  - commit ea8e3e7
  - s390/dasd: fix error checks in dasd_copy_pair_store()
    (git-fixes bsc#1229173).
  - commit f5c4fe8
  - s390/pci: Allow allocation of more than 1 MSI interrupt
    (git-fixes bsc#1229172).
  - s390/pci: Refactor arch_setup_msi_irqs() (git-fixes
    bsc#1229172).
  - commit ad8c54b
  - s390/cpum_cf: Fix endless loop in CF_DIAG event stop (git-fixes
    bsc#1229171).
  - commit 94c7469
  - s390/uv: Panic for set and remove shared access UVC errors
    (git-fixes bsc#1229170).
  - commit 447c271
  - s390/sclp: Prevent release of buffer in I/O (git-fixes
    bsc#1229169).
  - commit 9daf007
  - kvm: s390: Reject memory region operations for ucontrol VMs
    (git-fixes bsc#1229168).
  - commit 14a9742
  - KVM: s390: fix validity interception issue when gisa is switched
    off (git-fixes bsc#1229167).
  - commit 5c4e348
  - Update patch reference of USB patch (jsc#PED-10108)
  - commit edfa08b
  - USB: serial: debug: do not echo input by default (stable-fixes).
  - usb: vhci-hcd: Do not drop references before new references
    are gained (stable-fixes).
  - serial: core: check uartclk for zero to avoid divide by zero
    (stable-fixes).
  - media: xc2028: avoid use-after-free in load_firmware_cb()
    (stable-fixes).
  - media: uvcvideo: Fix the bandwdith quirk on USB 3.x
    (stable-fixes).
  - media: uvcvideo: Ignore empty TS packets (stable-fixes).
  - media: amphion: Remove lock in s_ctrl callback (stable-fixes).
  - wifi: nl80211: don't give key data to userspace (stable-fixes).
  - PCI: Add Edimax Vendor ID to pci_ids.h (stable-fixes).
  - wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup()
    (stable-fixes).
  - wifi: nl80211: disallow setting special AP channel widths
    (stable-fixes).
  - gpio: prevent potential speculation leaks in
    gpio_device_get_desc() (stable-fixes).
  - commit 2335bf9
  - docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).
  - drm/i915/gem: Adjust vma offset for framebuffer mmap offset
    (stable-fixes).
  - drm/amd/display: Skip Recompute DSC Params if no Stream on Link
    (stable-fixes).
  - drm/amdgpu: Forward soft recovery errors to userspace
    (stable-fixes).
  - drm/dp_mst: Skip CSN if topology probing is not done yet
    (stable-fixes).
  - drm/mediatek/dp: Fix spurious kfree() (git-fixes).
  - drm/amd/display: Add null checker before passing variables
    (stable-fixes).
  - Revert "drm/amd/display: Add NULL check for 'afb' before
    dereferencing in amdgpu_dm_plane_handle_cursor_update"
    (stable-fixes).
  - drm/amd/display: Add NULL check for 'afb' before dereferencing
    in amdgpu_dm_plane_handle_cursor_update (stable-fixes).
  - drm/bridge: analogix_dp: properly handle zero sized AUX
    transactions (stable-fixes).
  - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
    (stable-fixes).
  - drm/radeon: Remove __counted_by from StateArray.states[]
    (git-fixes).
  - drm/amdgpu: Add lock around VF RLCG interface (stable-fixes).
  - drm/admgpu: fix dereferencing null pointer context
    (stable-fixes).
  - drm/amdgpu/pm: Fix the null pointer dereference in
    apply_state_adjust_rules (stable-fixes).
  - drm/amdgpu: Fix the null pointer dereference to ras_manager
    (stable-fixes).
  - drm/amdgpu/pm: Fix the null pointer dereference for smu7
    (stable-fixes).
  - drm/amdgpu/pm: Fix the param type of set_power_profile_mode
    (stable-fixes).
  - drm/amdgpu: fix potential resource leak warning (stable-fixes).
  - drm/amd/display: Add delay to improve LTTPR UHBR interop
    (stable-fixes).
  - Bluetooth: btnxpuart: Shutdown timer and prevent rearming when
    driver unloading (stable-fixes).
  - can: mcp251xfd: tef: update workaround for erratum DS80000789E
    6 of mcp2518fd (stable-fixes).
  - can: mcp251xfd: tef: prepare to workaround broken TEF FIFO
    tail index erratum (stable-fixes).
  - ACPI: SBS: manage alarm sysfs attribute through psy core
    (stable-fixes).
  - ACPI: battery: create alarm sysfs attribute atomically
    (stable-fixes).
  - clocksource/drivers/sh_cmt: Address race condition for clock
    events (stable-fixes).
  - commit 2a8ca72

++++ kernel-default:

  - filelock: Remove locks reliably when fcntl/close race is
    detected (CVE-2024-41012 bsc#1228247).
  - commit a736b9b
  - io_uring: fix possible deadlock in
    io_register_iowq_max_workers() (bsc#1228616 CVE-2024-41080).
  - commit eae6448
  - io_uring: fix io_match_task must_hold (git-fixes).
  - io_uring: tighten task exit cancellations (git-fixes).
  - commit f9ce2d8
  - io_uring: Fix probe of disabled operations (git-fixes).
  - io_uring/advise: support 64-bit lengths (git-fixes).
  - commit 7566a8d
  - io_uring: Drop per-ctx dummy_ubuf (git-fixes).
  - commit 2717cc1
  - powerpc/kexec_file: fix cpus node update to FDT (bsc#1194869).
  - powerpc/pseries: Whitelist dtl slub object for copying to
    userspace (bsc#1194869).
  - powerpc/kexec: make the update_cpus_node() function public
    (bsc#1194869).
  - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
    (bsc#1194869).
  - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for
    CONFIG_PCI=n (bsc#1194869).
  - powerpc/io: Avoid clang null pointer arithmetic warnings
    (bsc#1194869).
  - powerpc/pseries: Add failure related checks for h_get_mpp and
    h_get_ppp (bsc#1194869).
  - powerpc/kexec: split CONFIG_KEXEC_FILE and CONFIG_CRASH_DUMP
    (bsc#1194869).
  - powerpc: xor_vmx: Add '-mhard-float' to CFLAGS (bsc#1194869).
  - powerpc/radix: Move some functions into #ifdef
    CONFIG_KVM_BOOK3S_HV_POSSIBLE (bsc#1194869).
  - commit 4e7f0fe
  - blacklist.conf: Add a bunch of superfluous ppc changes reported by
    git-fixes.
  - commit 7c2a851
  - blacklist.conf: Add ppc more ppc unsupported arch paths and commits.
  - commit 66e06b4
  - blacklist.conf: Add more ppc 32bit paths.
  - commit 013a9db
  - arm64: errata: Expand speculative SSBS workaround (again) (git-fixes)
  - commit e589bbc
  - arm64: cputype: Add Cortex-A725 definitions (git-fixes)
  - commit 0d04176
  - arm64: cputype: Add Cortex-X1C definitions (git-fixes)
  - commit 6a5ea61
  - arm64: errata: Expand speculative SSBS workaround (git-fixes)
  - commit f75d6ba
  - arm64: errata: Unify speculative SSBS errata logic (git-fixes).
    Update config files.
  - commit ffaab08
  - arm64: cputype: Add Cortex-X925 definitions (git-fixes)
  - commit 3c8ddb7
  - arm64: cputype: Add Cortex-A720 definitions (git-fixes)
  - commit f5fd7c6
  - arm64: cputype: Add Cortex-X3 definitions (git-fixes)
  - commit d87d988
  - arm64: errata: Add workaround for Arm errata 3194386 and 3312417 (git-fixes)
    Refresh patches.suse/kabi-arm64-reserve-space-in-cpu_hwcaps-and-cpu_hwcap.patch
    and enable around.
  - commit b3747ef
  - arm64: cputype: Add Neoverse-V3 definitions (git-fixes)
  - commit 78aeee9
  - arm64: cputype: Add Cortex-X4 definitions (git-fixes)
  - commit 2841965
  - arm64: barrier: Restore spec_bar() macro (git-fixes)
  - commit 5c935b6
  - arm64: Add Neoverse-V2 part (git-fixes)
  - commit 0f9f30b
  - net/rds: fix possible cp null dereference (git-fixes).
  - commit cac3126
  - s390/pci: Add missing virt_to_phys() for directed DIBV
    (git-fixes bsc#1229174).
  - commit ea8e3e7
  - s390/dasd: fix error checks in dasd_copy_pair_store()
    (git-fixes bsc#1229173).
  - commit f5c4fe8
  - s390/pci: Allow allocation of more than 1 MSI interrupt
    (git-fixes bsc#1229172).
  - s390/pci: Refactor arch_setup_msi_irqs() (git-fixes
    bsc#1229172).
  - commit ad8c54b
  - s390/cpum_cf: Fix endless loop in CF_DIAG event stop (git-fixes
    bsc#1229171).
  - commit 94c7469
  - s390/uv: Panic for set and remove shared access UVC errors
    (git-fixes bsc#1229170).
  - commit 447c271
  - s390/sclp: Prevent release of buffer in I/O (git-fixes
    bsc#1229169).
  - commit 9daf007
  - kvm: s390: Reject memory region operations for ucontrol VMs
    (git-fixes bsc#1229168).
  - commit 14a9742
  - KVM: s390: fix validity interception issue when gisa is switched
    off (git-fixes bsc#1229167).
  - commit 5c4e348
  - Update patch reference of USB patch (jsc#PED-10108)
  - commit edfa08b
  - USB: serial: debug: do not echo input by default (stable-fixes).
  - usb: vhci-hcd: Do not drop references before new references
    are gained (stable-fixes).
  - serial: core: check uartclk for zero to avoid divide by zero
    (stable-fixes).
  - media: xc2028: avoid use-after-free in load_firmware_cb()
    (stable-fixes).
  - media: uvcvideo: Fix the bandwdith quirk on USB 3.x
    (stable-fixes).
  - media: uvcvideo: Ignore empty TS packets (stable-fixes).
  - media: amphion: Remove lock in s_ctrl callback (stable-fixes).
  - wifi: nl80211: don't give key data to userspace (stable-fixes).
  - PCI: Add Edimax Vendor ID to pci_ids.h (stable-fixes).
  - wifi: ath12k: fix memory leak in ath12k_dp_rx_peer_frag_setup()
    (stable-fixes).
  - wifi: nl80211: disallow setting special AP channel widths
    (stable-fixes).
  - gpio: prevent potential speculation leaks in
    gpio_device_get_desc() (stable-fixes).
  - commit 2335bf9
  - docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).
  - drm/i915/gem: Adjust vma offset for framebuffer mmap offset
    (stable-fixes).
  - drm/amd/display: Skip Recompute DSC Params if no Stream on Link
    (stable-fixes).
  - drm/amdgpu: Forward soft recovery errors to userspace
    (stable-fixes).
  - drm/dp_mst: Skip CSN if topology probing is not done yet
    (stable-fixes).
  - drm/mediatek/dp: Fix spurious kfree() (git-fixes).
  - drm/amd/display: Add null checker before passing variables
    (stable-fixes).
  - Revert "drm/amd/display: Add NULL check for 'afb' before
    dereferencing in amdgpu_dm_plane_handle_cursor_update"
    (stable-fixes).
  - drm/amd/display: Add NULL check for 'afb' before dereferencing
    in amdgpu_dm_plane_handle_cursor_update (stable-fixes).
  - drm/bridge: analogix_dp: properly handle zero sized AUX
    transactions (stable-fixes).
  - drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
    (stable-fixes).
  - drm/radeon: Remove __counted_by from StateArray.states[]
    (git-fixes).
  - drm/amdgpu: Add lock around VF RLCG interface (stable-fixes).
  - drm/admgpu: fix dereferencing null pointer context
    (stable-fixes).
  - drm/amdgpu/pm: Fix the null pointer dereference in
    apply_state_adjust_rules (stable-fixes).
  - drm/amdgpu: Fix the null pointer dereference to ras_manager
    (stable-fixes).
  - drm/amdgpu/pm: Fix the null pointer dereference for smu7
    (stable-fixes).
  - drm/amdgpu/pm: Fix the param type of set_power_profile_mode
    (stable-fixes).
  - drm/amdgpu: fix potential resource leak warning (stable-fixes).
  - drm/amd/display: Add delay to improve LTTPR UHBR interop
    (stable-fixes).
  - Bluetooth: btnxpuart: Shutdown timer and prevent rearming when
    driver unloading (stable-fixes).
  - can: mcp251xfd: tef: update workaround for erratum DS80000789E
    6 of mcp2518fd (stable-fixes).
  - can: mcp251xfd: tef: prepare to workaround broken TEF FIFO
    tail index erratum (stable-fixes).
  - ACPI: SBS: manage alarm sysfs attribute through psy core
    (stable-fixes).
  - ACPI: battery: create alarm sysfs attribute atomically
    (stable-fixes).
  - clocksource/drivers/sh_cmt: Address race condition for clock
    events (stable-fixes).
  - commit 2a8ca72

++++ unbound:

  - Update to 1.21.0:
    Security Fixes:
    * Merge #1073: fix null pointer dereference issue in function
    ub_ctx_set_fwd.
    [CVE-2024-43167, bsc#1229068]
    Features:
    * Fix #1071: [FR] Clear both in-memory and cachedb module cache
    with `unbound-control flush*` commands.
    * Fix #144: Port ipset to BSD pf tables.
    * Add dnstap-sample-rate that logs only 1/N messages, for high
    volume server environments. Thanks Dan Luther.
    * Add root key 38696 from 2024 for DNSSEC validation. It is added
    to the default root keys in unbound-anchor. The content can be
    inspected with `unbound-anchor -l`.
    * Merge #1090: Cookie secret file. Adds `cookie-secret-file:
    "unbound_cookiesecrets.txt"` option to store cookie secrets for
    EDNS COOKIE secret rollover. The remote control
    add_cookie_secret, activate_cookie_secret and
    drop_cookie_secret commands can be used for rollover, the
    command print_cookie_secrets shows the values in use.
    Bug Fixes:
    * Fix CAMP issues with global quota. Thanks to Huayi
    Duan, Marco Bearzi, Jodok Vieli, and Cagin Tanir from NetSec
    group, ETH Zurich.
    * Fix CacheFlush issues with limit on NS RRs. Thanks to Yehuda
    Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt
    (Tel-Aviv University and Reichman University).
    * Merge #1062: Fix potential overflow bug while parsing port in
    function cfg_mark_ports.
    * Fix for #1062: declaration before statement, avoid print of
    null, and redundant check for array size.
    * Fix to squelch udp connect errors in the log at low verbosity
    about invalid argument for IPv6 link local addresses.
    * Fix when the mesh jostle is exceeded that nameserver targets
    are marked as resolved, so that the lookup is not stuck on the
    requestlist.
    * Add missing common functions to tdir tests.
    * Merge #1070: Fix rtt assignement for low values of
    infra-cache-max-rtt.
    * Merge #1069: Fix unbound-control stdin commands for
    multi-process Unbounds.
    * Fix unbound-control commands that read stdin in multi-process
    operation (local_zones_remove, local_zones, local_datas_remove,
    local_datas, view_local_datas_remove, view_local_datas). They
    will be properly distributed to all processes. dump_cache and
    load_cache are no longer supported in multi-process operation.
    * Remove testdata/remote-threaded.tdir.
    testdata/09-unbound-control.tdir now checks both single and
    multi process/thread operation.
    * Fix to print a parse error when config is read with no name for
    a forward-zone, stub-zone or view.
    * Fix for parse end of forward-zone, stub-zone and view.
    * Fix for #1064: Fix that cachedb expired messages are considered
    insecure, and thus can be served to clients when dnssec is
    enabled.
    * Fix #1059: Intermittent DNS blocking failure with local-zone
    and always_nxdomain. Addition of local_zones dynamically via
    unbound-control was not finding the zone's parent correctly.
    * Fix #1064: Unbound 1.20 Cachedb broken?
    * Fix unused variable warning on compilation with no thread
    support.
    * unbound-control-setup: check openssl availability before doing
    anything, patch from Michael Tokarev.
    * Update patch to remove 'command' shell builtin and update error
    text.
    * Fix to enable that SERVFAIL is cached, for a short period, for
    more cases. In the cases where limits are exceeded.
    * Fix spelling of tcp-idle-timeout docs, from Michael Tokarev.
    * Merge #1078: Only check old pid if no username.
    * Fix #1079: tags from tagged rpz zones are no longer honored
    after upgrade from 1.19.3 to 1.20.0.
    * Fix for #1079: fix RPZ taglist in iterator callback that no
    client info is like no taglist intersection.
    * Fix to squelch connection reset by peer errors from log. And
    fix that the tcp read errors are labeled as initial for the
    first calls.
    * Merge #1080: AddressSanitizer detection in tdir tests and
    memory leak fixes.
    * Fix memory leak when reload_keep_cache is used and num-threads
    changes.
    * Fix memory leak on exit for unbound-dnstap-socket; creates
    false negatives during testing.
    * Fix memory leak in setup of dsa sig.
    * Fix typos for 'the the' in text.
    * Fix validation for repeated use of a DNAME record.
    * Add unit test for validation of repeated use of a DNAME record.
    * Fix #1091: Build fails with OpenSSL >= 3.0 built with
    OPENSSL_NO_DEPRECATED.
    * Fix #1092: Ubuntu 22.04 Jammy fails to compile unbound 1.20.0;
    by adding helpful text for the Python interpreter version and
    allowing the default pkg-config unavailability error message to
    be shown.
    * Fix pkg-config availability check in dnstap/dnstap.m4 and
    systemd.m4.
    * Explicitly set the RD bit for the mesh query flags when
    prefetching. These queries have no waiting client but they need
    to be treated as recursive.
    * Fix ip-ratelimit-cookie setting, it was not applied.
    * Fix to remove unused include from the readzone test program.
    * Fix unused variable warning in do_cache_remove.
    * Fix compile warning in worker pthread id printout.
    * Add unit test skip files and bison and flex output to
    gitignore.
    * Fix to use modstack_init in zonemd unit test.
    * Fix to remove unneeded linebreak in fptr_wlist.c.
    * Fix compile warnings in fptr_wlist.c.
    * Fix for repeated use of a DNAME record: first overallocate and
    then move the exact size of the init value to avoid false
    positive heap overflow reads from address sanitizers.
    * Fix to print details about the failure to lookup a DNSKEY
    record when validation fails due to the missing DNSKEY. Also
    for key prime and DS lookups.
    * Fix for neater printout for error for missing DS response.
    * Fix neater printout.
    * Fix #1099: Unbound core dump on SIGSEGV.
    * Fix for #1099: Fix to check for deleted RRset when the contents
    is updated and fetched after it is stored, and also check for a
    changed RRset.
    * Don't check for message TTL changes if the RRsets remain the
    same.
    * Fix that validation reason failure that uses string print uses
    separate buffer that is passed, from the scratch validation
    buffer.
    * Fixup algo_needs_reason string buffer length.
    * Fix shadowed error string variable in validator dnskey
    handling.
    * Update list of known EDE codes.
    * For #773: In contrib/unbound.service.in set unbound to start
    after network-online.target. Also for
    contrib/unbound_portable.service.in.
    * Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.
    * For #1103: fix to also drop mesh state reference when a h2
    reply is dropped.
    * Add RPZ tag tests in acl_interface.tdir.
    * For #1102: clearer text for using interface-* options for the
    loopback interface.
    * For #1103: fix to also drop mesh state reference when the
    discard limit is reached, when there is an error making a new
    recursion state and when the connection is dropped with
    is_drop.
    * For #1103: Fix to drop mesh state reference for the http2
    stream associated with the reply, not the currently active
    stream. And it does not remove it twice on a mesh_send_reply
    call. The reply h2_stream is NULL when not in use, for more
    initialisation.
    * Fix dnstap wakeup, a running wakeup timer is left to expire and
    not increased, a timer is started when the dtio thread is
    sleeping, the timer set disabled when the dtio thread goes to
    sleep, and after sleep the thread checks to see if there are
    messages to log immediately.
    * Merge #1110: Make fallthrough explicit for libworker.c.
    * For #1110: Test for fallthrough attribute in configure and add
    fallthrough attribute annotations.
    * Fix compile when the compiler does not support the noreturn
    attribute.
    * Fix to have empty definition when not supported for weak
    attribute.
    * Fix uninitialized variable warning in create_tcp_accept_sock.
    * Fix link of dnstap without openssl.
    * Fix link of unbound-dnstap-socket without openssl.
    * Fix #1106: ratelimit-below-domain logs the wrong FROM address.
    * Cleanup ede.tdir test.
    * For #935 and #1104, clarify RPZ order and semantics.
    * Fix to document parameters of auth_zone_verify_zonemd_with_key.
    * Fix for #1114: Fix that cache fill for forward-host names is
    performed, so that with nonzero target-fetch-policy it fetches
    forwarder addresses and uses them from cache. Also updated that
    delegation point cache fill routines use CDflag for AAAA
    message lookups, so that its negative lookup stops a recursion
    since the cache uses the bit for disambiguation for dns64 but
    the recursion uses CDflag for the AAAA target lookups, so the
    check correctly stops a useless recursion by its cache lookup.
    * Fix dnstap test program, cleans up to have clean memory on
    exit, for tap_data_free, does not delete NULL items. Also it
    does not try to free the tail, specifically in the free of the
    list since that picked up the next item in the list for its
    loop causing invalid free. Added internal unit test to
    unbound-dnstap-socket for that.
    * Fix that the worker mem report with alloc stats does not
    attempt to print memory use of forwards and hints if they have
    been deleted already.
    * Fix that alloc stats has strdup checks, it stops debuggers from
    complaining about mismatch at free time.
    * Fix testbound for alloc stats strdup in util/alloc.c.
    * Fix that alloc stats for forwards and hints are printed, and
    when alloc stats is enabled, the unit test for unbound control
    waits for reloads to complete.
    * Fix that for windows the module startup is called and sets up
    the module-config.
    * Fix spelling for the cache-min-negative-ttl entry in the
    example.conf.

++++ unbound:

  - Update to 1.21.0:
    Security Fixes:
    * Merge #1073: fix null pointer dereference issue in function
    ub_ctx_set_fwd.
    [CVE-2024-43167, bsc#1229068]
    Features:
    * Fix #1071: [FR] Clear both in-memory and cachedb module cache
    with `unbound-control flush*` commands.
    * Fix #144: Port ipset to BSD pf tables.
    * Add dnstap-sample-rate that logs only 1/N messages, for high
    volume server environments. Thanks Dan Luther.
    * Add root key 38696 from 2024 for DNSSEC validation. It is added
    to the default root keys in unbound-anchor. The content can be
    inspected with `unbound-anchor -l`.
    * Merge #1090: Cookie secret file. Adds `cookie-secret-file:
    "unbound_cookiesecrets.txt"` option to store cookie secrets for
    EDNS COOKIE secret rollover. The remote control
    add_cookie_secret, activate_cookie_secret and
    drop_cookie_secret commands can be used for rollover, the
    command print_cookie_secrets shows the values in use.
    Bug Fixes:
    * Fix CAMP issues with global quota. Thanks to Huayi
    Duan, Marco Bearzi, Jodok Vieli, and Cagin Tanir from NetSec
    group, ETH Zurich.
    * Fix CacheFlush issues with limit on NS RRs. Thanks to Yehuda
    Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt
    (Tel-Aviv University and Reichman University).
    * Merge #1062: Fix potential overflow bug while parsing port in
    function cfg_mark_ports.
    * Fix for #1062: declaration before statement, avoid print of
    null, and redundant check for array size.
    * Fix to squelch udp connect errors in the log at low verbosity
    about invalid argument for IPv6 link local addresses.
    * Fix when the mesh jostle is exceeded that nameserver targets
    are marked as resolved, so that the lookup is not stuck on the
    requestlist.
    * Add missing common functions to tdir tests.
    * Merge #1070: Fix rtt assignement for low values of
    infra-cache-max-rtt.
    * Merge #1069: Fix unbound-control stdin commands for
    multi-process Unbounds.
    * Fix unbound-control commands that read stdin in multi-process
    operation (local_zones_remove, local_zones, local_datas_remove,
    local_datas, view_local_datas_remove, view_local_datas). They
    will be properly distributed to all processes. dump_cache and
    load_cache are no longer supported in multi-process operation.
    * Remove testdata/remote-threaded.tdir.
    testdata/09-unbound-control.tdir now checks both single and
    multi process/thread operation.
    * Fix to print a parse error when config is read with no name for
    a forward-zone, stub-zone or view.
    * Fix for parse end of forward-zone, stub-zone and view.
    * Fix for #1064: Fix that cachedb expired messages are considered
    insecure, and thus can be served to clients when dnssec is
    enabled.
    * Fix #1059: Intermittent DNS blocking failure with local-zone
    and always_nxdomain. Addition of local_zones dynamically via
    unbound-control was not finding the zone's parent correctly.
    * Fix #1064: Unbound 1.20 Cachedb broken?
    * Fix unused variable warning on compilation with no thread
    support.
    * unbound-control-setup: check openssl availability before doing
    anything, patch from Michael Tokarev.
    * Update patch to remove 'command' shell builtin and update error
    text.
    * Fix to enable that SERVFAIL is cached, for a short period, for
    more cases. In the cases where limits are exceeded.
    * Fix spelling of tcp-idle-timeout docs, from Michael Tokarev.
    * Merge #1078: Only check old pid if no username.
    * Fix #1079: tags from tagged rpz zones are no longer honored
    after upgrade from 1.19.3 to 1.20.0.
    * Fix for #1079: fix RPZ taglist in iterator callback that no
    client info is like no taglist intersection.
    * Fix to squelch connection reset by peer errors from log. And
    fix that the tcp read errors are labeled as initial for the
    first calls.
    * Merge #1080: AddressSanitizer detection in tdir tests and
    memory leak fixes.
    * Fix memory leak when reload_keep_cache is used and num-threads
    changes.
    * Fix memory leak on exit for unbound-dnstap-socket; creates
    false negatives during testing.
    * Fix memory leak in setup of dsa sig.
    * Fix typos for 'the the' in text.
    * Fix validation for repeated use of a DNAME record.
    * Add unit test for validation of repeated use of a DNAME record.
    * Fix #1091: Build fails with OpenSSL >= 3.0 built with
    OPENSSL_NO_DEPRECATED.
    * Fix #1092: Ubuntu 22.04 Jammy fails to compile unbound 1.20.0;
    by adding helpful text for the Python interpreter version and
    allowing the default pkg-config unavailability error message to
    be shown.
    * Fix pkg-config availability check in dnstap/dnstap.m4 and
    systemd.m4.
    * Explicitly set the RD bit for the mesh query flags when
    prefetching. These queries have no waiting client but they need
    to be treated as recursive.
    * Fix ip-ratelimit-cookie setting, it was not applied.
    * Fix to remove unused include from the readzone test program.
    * Fix unused variable warning in do_cache_remove.
    * Fix compile warning in worker pthread id printout.
    * Add unit test skip files and bison and flex output to
    gitignore.
    * Fix to use modstack_init in zonemd unit test.
    * Fix to remove unneeded linebreak in fptr_wlist.c.
    * Fix compile warnings in fptr_wlist.c.
    * Fix for repeated use of a DNAME record: first overallocate and
    then move the exact size of the init value to avoid false
    positive heap overflow reads from address sanitizers.
    * Fix to print details about the failure to lookup a DNSKEY
    record when validation fails due to the missing DNSKEY. Also
    for key prime and DS lookups.
    * Fix for neater printout for error for missing DS response.
    * Fix neater printout.
    * Fix #1099: Unbound core dump on SIGSEGV.
    * Fix for #1099: Fix to check for deleted RRset when the contents
    is updated and fetched after it is stored, and also check for a
    changed RRset.
    * Don't check for message TTL changes if the RRsets remain the
    same.
    * Fix that validation reason failure that uses string print uses
    separate buffer that is passed, from the scratch validation
    buffer.
    * Fixup algo_needs_reason string buffer length.
    * Fix shadowed error string variable in validator dnskey
    handling.
    * Update list of known EDE codes.
    * For #773: In contrib/unbound.service.in set unbound to start
    after network-online.target. Also for
    contrib/unbound_portable.service.in.
    * Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.
    * For #1103: fix to also drop mesh state reference when a h2
    reply is dropped.
    * Add RPZ tag tests in acl_interface.tdir.
    * For #1102: clearer text for using interface-* options for the
    loopback interface.
    * For #1103: fix to also drop mesh state reference when the
    discard limit is reached, when there is an error making a new
    recursion state and when the connection is dropped with
    is_drop.
    * For #1103: Fix to drop mesh state reference for the http2
    stream associated with the reply, not the currently active
    stream. And it does not remove it twice on a mesh_send_reply
    call. The reply h2_stream is NULL when not in use, for more
    initialisation.
    * Fix dnstap wakeup, a running wakeup timer is left to expire and
    not increased, a timer is started when the dtio thread is
    sleeping, the timer set disabled when the dtio thread goes to
    sleep, and after sleep the thread checks to see if there are
    messages to log immediately.
    * Merge #1110: Make fallthrough explicit for libworker.c.
    * For #1110: Test for fallthrough attribute in configure and add
    fallthrough attribute annotations.
    * Fix compile when the compiler does not support the noreturn
    attribute.
    * Fix to have empty definition when not supported for weak
    attribute.
    * Fix uninitialized variable warning in create_tcp_accept_sock.
    * Fix link of dnstap without openssl.
    * Fix link of unbound-dnstap-socket without openssl.
    * Fix #1106: ratelimit-below-domain logs the wrong FROM address.
    * Cleanup ede.tdir test.
    * For #935 and #1104, clarify RPZ order and semantics.
    * Fix to document parameters of auth_zone_verify_zonemd_with_key.
    * Fix for #1114: Fix that cache fill for forward-host names is
    performed, so that with nonzero target-fetch-policy it fetches
    forwarder addresses and uses them from cache. Also updated that
    delegation point cache fill routines use CDflag for AAAA
    message lookups, so that its negative lookup stops a recursion
    since the cache uses the bit for disambiguation for dns64 but
    the recursion uses CDflag for the AAAA target lookups, so the
    check correctly stops a useless recursion by its cache lookup.
    * Fix dnstap test program, cleans up to have clean memory on
    exit, for tap_data_free, does not delete NULL items. Also it
    does not try to free the tail, specifically in the free of the
    list since that picked up the next item in the list for its
    loop causing invalid free. Added internal unit test to
    unbound-dnstap-socket for that.
    * Fix that the worker mem report with alloc stats does not
    attempt to print memory use of forwards and hints if they have
    been deleted already.
    * Fix that alloc stats has strdup checks, it stops debuggers from
    complaining about mismatch at free time.
    * Fix testbound for alloc stats strdup in util/alloc.c.
    * Fix that alloc stats for forwards and hints are printed, and
    when alloc stats is enabled, the unit test for unbound control
    waits for reloads to complete.
    * Fix that for windows the module startup is called and sets up
    the module-config.
    * Fix spelling for the cache-min-negative-ttl entry in the
    example.conf.

++++ unbound:

  - Update to 1.21.0:
    Security Fixes:
    * Merge #1073: fix null pointer dereference issue in function
    ub_ctx_set_fwd.
    [CVE-2024-43167, bsc#1229068]
    Features:
    * Fix #1071: [FR] Clear both in-memory and cachedb module cache
    with `unbound-control flush*` commands.
    * Fix #144: Port ipset to BSD pf tables.
    * Add dnstap-sample-rate that logs only 1/N messages, for high
    volume server environments. Thanks Dan Luther.
    * Add root key 38696 from 2024 for DNSSEC validation. It is added
    to the default root keys in unbound-anchor. The content can be
    inspected with `unbound-anchor -l`.
    * Merge #1090: Cookie secret file. Adds `cookie-secret-file:
    "unbound_cookiesecrets.txt"` option to store cookie secrets for
    EDNS COOKIE secret rollover. The remote control
    add_cookie_secret, activate_cookie_secret and
    drop_cookie_secret commands can be used for rollover, the
    command print_cookie_secrets shows the values in use.
    Bug Fixes:
    * Fix CAMP issues with global quota. Thanks to Huayi
    Duan, Marco Bearzi, Jodok Vieli, and Cagin Tanir from NetSec
    group, ETH Zurich.
    * Fix CacheFlush issues with limit on NS RRs. Thanks to Yehuda
    Afek, Anat Bremler-Barr, Shoham Danino and Yuval Shavitt
    (Tel-Aviv University and Reichman University).
    * Merge #1062: Fix potential overflow bug while parsing port in
    function cfg_mark_ports.
    * Fix for #1062: declaration before statement, avoid print of
    null, and redundant check for array size.
    * Fix to squelch udp connect errors in the log at low verbosity
    about invalid argument for IPv6 link local addresses.
    * Fix when the mesh jostle is exceeded that nameserver targets
    are marked as resolved, so that the lookup is not stuck on the
    requestlist.
    * Add missing common functions to tdir tests.
    * Merge #1070: Fix rtt assignement for low values of
    infra-cache-max-rtt.
    * Merge #1069: Fix unbound-control stdin commands for
    multi-process Unbounds.
    * Fix unbound-control commands that read stdin in multi-process
    operation (local_zones_remove, local_zones, local_datas_remove,
    local_datas, view_local_datas_remove, view_local_datas). They
    will be properly distributed to all processes. dump_cache and
    load_cache are no longer supported in multi-process operation.
    * Remove testdata/remote-threaded.tdir.
    testdata/09-unbound-control.tdir now checks both single and
    multi process/thread operation.
    * Fix to print a parse error when config is read with no name for
    a forward-zone, stub-zone or view.
    * Fix for parse end of forward-zone, stub-zone and view.
    * Fix for #1064: Fix that cachedb expired messages are considered
    insecure, and thus can be served to clients when dnssec is
    enabled.
    * Fix #1059: Intermittent DNS blocking failure with local-zone
    and always_nxdomain. Addition of local_zones dynamically via
    unbound-control was not finding the zone's parent correctly.
    * Fix #1064: Unbound 1.20 Cachedb broken?
    * Fix unused variable warning on compilation with no thread
    support.
    * unbound-control-setup: check openssl availability before doing
    anything, patch from Michael Tokarev.
    * Update patch to remove 'command' shell builtin and update error
    text.
    * Fix to enable that SERVFAIL is cached, for a short period, for
    more cases. In the cases where limits are exceeded.
    * Fix spelling of tcp-idle-timeout docs, from Michael Tokarev.
    * Merge #1078: Only check old pid if no username.
    * Fix #1079: tags from tagged rpz zones are no longer honored
    after upgrade from 1.19.3 to 1.20.0.
    * Fix for #1079: fix RPZ taglist in iterator callback that no
    client info is like no taglist intersection.
    * Fix to squelch connection reset by peer errors from log. And
    fix that the tcp read errors are labeled as initial for the
    first calls.
    * Merge #1080: AddressSanitizer detection in tdir tests and
    memory leak fixes.
    * Fix memory leak when reload_keep_cache is used and num-threads
    changes.
    * Fix memory leak on exit for unbound-dnstap-socket; creates
    false negatives during testing.
    * Fix memory leak in setup of dsa sig.
    * Fix typos for 'the the' in text.
    * Fix validation for repeated use of a DNAME record.
    * Add unit test for validation of repeated use of a DNAME record.
    * Fix #1091: Build fails with OpenSSL >= 3.0 built with
    OPENSSL_NO_DEPRECATED.
    * Fix #1092: Ubuntu 22.04 Jammy fails to compile unbound 1.20.0;
    by adding helpful text for the Python interpreter version and
    allowing the default pkg-config unavailability error message to
    be shown.
    * Fix pkg-config availability check in dnstap/dnstap.m4 and
    systemd.m4.
    * Explicitly set the RD bit for the mesh query flags when
    prefetching. These queries have no waiting client but they need
    to be treated as recursive.
    * Fix ip-ratelimit-cookie setting, it was not applied.
    * Fix to remove unused include from the readzone test program.
    * Fix unused variable warning in do_cache_remove.
    * Fix compile warning in worker pthread id printout.
    * Add unit test skip files and bison and flex output to
    gitignore.
    * Fix to use modstack_init in zonemd unit test.
    * Fix to remove unneeded linebreak in fptr_wlist.c.
    * Fix compile warnings in fptr_wlist.c.
    * Fix for repeated use of a DNAME record: first overallocate and
    then move the exact size of the init value to avoid false
    positive heap overflow reads from address sanitizers.
    * Fix to print details about the failure to lookup a DNSKEY
    record when validation fails due to the missing DNSKEY. Also
    for key prime and DS lookups.
    * Fix for neater printout for error for missing DS response.
    * Fix neater printout.
    * Fix #1099: Unbound core dump on SIGSEGV.
    * Fix for #1099: Fix to check for deleted RRset when the contents
    is updated and fetched after it is stored, and also check for a
    changed RRset.
    * Don't check for message TTL changes if the RRsets remain the
    same.
    * Fix that validation reason failure that uses string print uses
    separate buffer that is passed, from the scratch validation
    buffer.
    * Fixup algo_needs_reason string buffer length.
    * Fix shadowed error string variable in validator dnskey
    handling.
    * Update list of known EDE codes.
    * For #773: In contrib/unbound.service.in set unbound to start
    after network-online.target. Also for
    contrib/unbound_portable.service.in.
    * Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.
    * For #1103: fix to also drop mesh state reference when a h2
    reply is dropped.
    * Add RPZ tag tests in acl_interface.tdir.
    * For #1102: clearer text for using interface-* options for the
    loopback interface.
    * For #1103: fix to also drop mesh state reference when the
    discard limit is reached, when there is an error making a new
    recursion state and when the connection is dropped with
    is_drop.
    * For #1103: Fix to drop mesh state reference for the http2
    stream associated with the reply, not the currently active
    stream. And it does not remove it twice on a mesh_send_reply
    call. The reply h2_stream is NULL when not in use, for more
    initialisation.
    * Fix dnstap wakeup, a running wakeup timer is left to expire and
    not increased, a timer is started when the dtio thread is
    sleeping, the timer set disabled when the dtio thread goes to
    sleep, and after sleep the thread checks to see if there are
    messages to log immediately.
    * Merge #1110: Make fallthrough explicit for libworker.c.
    * For #1110: Test for fallthrough attribute in configure and add
    fallthrough attribute annotations.
    * Fix compile when the compiler does not support the noreturn
    attribute.
    * Fix to have empty definition when not supported for weak
    attribute.
    * Fix uninitialized variable warning in create_tcp_accept_sock.
    * Fix link of dnstap without openssl.
    * Fix link of unbound-dnstap-socket without openssl.
    * Fix #1106: ratelimit-below-domain logs the wrong FROM address.
    * Cleanup ede.tdir test.
    * For #935 and #1104, clarify RPZ order and semantics.
    * Fix to document parameters of auth_zone_verify_zonemd_with_key.
    * Fix for #1114: Fix that cache fill for forward-host names is
    performed, so that with nonzero target-fetch-policy it fetches
    forwarder addresses and uses them from cache. Also updated that
    delegation point cache fill routines use CDflag for AAAA
    message lookups, so that its negative lookup stops a recursion
    since the cache uses the bit for disambiguation for dns64 but
    the recursion uses CDflag for the AAAA target lookups, so the
    check correctly stops a useless recursion by its cache lookup.
    * Fix dnstap test program, cleans up to have clean memory on
    exit, for tap_data_free, does not delete NULL items. Also it
    does not try to free the tail, specifically in the free of the
    list since that picked up the next item in the list for its
    loop causing invalid free. Added internal unit test to
    unbound-dnstap-socket for that.
    * Fix that the worker mem report with alloc stats does not
    attempt to print memory use of forwards and hints if they have
    been deleted already.
    * Fix that alloc stats has strdup checks, it stops debuggers from
    complaining about mismatch at free time.
    * Fix testbound for alloc stats strdup in util/alloc.c.
    * Fix that alloc stats for forwards and hints are printed, and
    when alloc stats is enabled, the unit test for unbound control
    waits for reloads to complete.
    * Fix that for windows the module startup is called and sets up
    the module-config.
    * Fix spelling for the cache-min-negative-ttl entry in the
    example.conf.

------------------------------------------------------------------
------------------  2024-8-14  -  Aug 14 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - Update patch reference for SPI patch (jsc#PED-10105)
  - commit a896d55
  - kabi fix for KVM: s390: fix LPSWEY handling (bsc#1227634
    git-fixes).
  - KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).
  - commit 576de67
  - kernfs: Convert kernfs_path_from_node_locked() from strlcpy()
    to strscpy() (bsc#1229134).
  - Refresh
    patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch.
  - commit bc8376b
  - Update patch reference for iwlwifi fix (jsc#PED-10055)
  - commit 73fda85
  - Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
    (bsc#1229056).
  - commit 0ae7f4e
  - bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
    (git-fixes).
  - bpf: don't infer PTR_TO_CTX for programs with unnamed context
    type (git-fixes).
  - bpf: handle bpf_user_pt_regs_t typedef explicitly for PTR_TO_CTX
    global arg (git-fixes).
  - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace
    correctly (git-fixes).
  - commit dd0591b
  - net, sunrpc: Remap EPERM in case of connection failure in
    xs_tcp_setup_socket (CVE-2024-42246 bsc#1228989).
  - commit 12865c8
  - tools/resolve_btfids: Fix comparison of distinct pointer types
    warning in resolve_btfids (git-fixes).
  - tools/resolve_btfids: fix build with musl libc (git-fixes).
  - commit f42b517

++++ kernel-default:

  - Update patch reference for SPI patch (jsc#PED-10105)
  - commit a896d55
  - kabi fix for KVM: s390: fix LPSWEY handling (bsc#1227634
    git-fixes).
  - KVM: s390: fix LPSWEY handling (bsc#1227634 git-fixes).
  - commit 576de67
  - kernfs: Convert kernfs_path_from_node_locked() from strlcpy()
    to strscpy() (bsc#1229134).
  - Refresh
    patches.suse/cgroup-cpuset-Prevent-UAF-in-proc_cpuset_show.patch.
  - commit bc8376b
  - Update patch reference for iwlwifi fix (jsc#PED-10055)
  - commit 73fda85
  - Input: i8042 - add Fujitsu Lifebook E756 to i8042 quirk table
    (bsc#1229056).
  - commit 0ae7f4e
  - bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
    (git-fixes).
  - bpf: don't infer PTR_TO_CTX for programs with unnamed context
    type (git-fixes).
  - bpf: handle bpf_user_pt_regs_t typedef explicitly for PTR_TO_CTX
    global arg (git-fixes).
  - bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace
    correctly (git-fixes).
  - commit dd0591b
  - net, sunrpc: Remap EPERM in case of connection failure in
    xs_tcp_setup_socket (CVE-2024-42246 bsc#1228989).
  - commit 12865c8
  - tools/resolve_btfids: Fix comparison of distinct pointer types
    warning in resolve_btfids (git-fixes).
  - tools/resolve_btfids: fix build with musl libc (git-fixes).
  - commit f42b517

------------------------------------------------------------------
------------------  2024-8-13  -  Aug 13 2024  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.29.2:
    * initial sync files that modified after image creation
    * initial sync for root directory
    * Removes redundant condition from toAPIBuildOptions in build.go
    * docs: Update docker compose kill usage
    * Fix stop on file chane for sync-restart action
    * bump engine and cli to v27.1.1, buildx to v0.16.1
    * remove all dependabot update PRs for OTel dependencies
    * gp.mod: github.com/gofrs/flock v0.12.1
    * go.mod: golang.org/x/sys v0.22.0
    * update to go1.21.12

++++ docker-compose:

  - Update to version 2.29.2:
    * initial sync files that modified after image creation
    * initial sync for root directory
    * Removes redundant condition from toAPIBuildOptions in build.go
    * docs: Update docker compose kill usage
    * Fix stop on file chane for sync-restart action
    * bump engine and cli to v27.1.1, buildx to v0.16.1
    * remove all dependabot update PRs for OTel dependencies
    * gp.mod: github.com/gofrs/flock v0.12.1
    * go.mod: golang.org/x/sys v0.22.0
    * update to go1.21.12

++++ docker-compose:

  - Update to version 2.29.2:
    * initial sync files that modified after image creation
    * initial sync for root directory
    * Removes redundant condition from toAPIBuildOptions in build.go
    * docs: Update docker compose kill usage
    * Fix stop on file chane for sync-restart action
    * bump engine and cli to v27.1.1, buildx to v0.16.1
    * remove all dependabot update PRs for OTel dependencies
    * gp.mod: github.com/gofrs/flock v0.12.1
    * go.mod: golang.org/x/sys v0.22.0
    * update to go1.21.12

++++ keepalived:

  - VUL-0: CVE-2024-41184: keepalived: integer overflow in vrrp_ipsets_handler
    (bsc#1228123) Apply upstream patches:
    bsc-1228123.patch

++++ kernel-default:

  - btrfs: fix leak of qgroup extent records after transaction abort
    (git-fixes).
  - btrfs: fix ordered extent split error handling in
    btrfs_dio_submit_io (git-fixes).
  - btrfs: use irq safe locking when running and adding delayed
    iputs (git-fixes).
  - commit 59b18df
  - btrfs: fix extent map use-after-free when adding pages to
    compressed bio (git-fixes).
  - commit b3e7c96
  - Drop libata patch that caused a regression (bsc#1229054)
  - commit 3d5faca
  - btrfs: fix double inode unlock for direct IO sync writes
    (git-fixes).
  - btrfs: fix corruption after buffer fault in during direct IO
    append write (git-fixes).
  - btrfs: use a btrfs_inode local variable at btrfs_sync_file()
    (git-fixes).
  - btrfs: pass a btrfs_inode to btrfs_wait_ordered_range()
    (git-fixes).
  - btrfs: pass a btrfs_inode to btrfs_fdatawrite_range()
    (git-fixes).
  - btrfs: use a btrfs_inode in the log context (struct
    btrfs_log_ctx) (git-fixes).
  - btrfs: make btrfs_finish_ordered_extent() return void
    (git-fixes).
  - btrfs: ensure fast fsync waits for ordered extents after a
    write failure (git-fixes).
  - btrfs: rename err to ret in btrfs_direct_write() (git-fixes).
  - btrfs: uninline some static inline helpers from tree-log.h
    (git-fixes).
  - btrfs: use btrfs_finish_ordered_extent to complete buffered
    writes (git-fixes).
  - btrfs: use btrfs_finish_ordered_extent to complete direct writes
    (git-fixes).
  - btrfs: use btrfs_finish_ordered_extent to complete compressed
    writes (git-fixes).
  - btrfs: open code end_extent_writepage in
    end_bio_extent_writepage (git-fixes).
  - btrfs: add a btrfs_finish_ordered_extent helper (git-fixes).
  - btrfs: factor out a btrfs_queue_ordered_fn helper (git-fixes).
  - btrfs: factor out a can_finish_ordered_extent helper
    (git-fixes).
  - btrfs: use bbio->ordered in btrfs_csum_one_bio (git-fixes).
  - btrfs: add an ordered_extent pointer to struct btrfs_bio
    (git-fixes).
  - btrfs: open code btrfs_bio_end_io in btrfs_dio_submit_io
    (git-fixes).
  - btrfs: add a is_data_bbio helper (git-fixes).
  - btrfs: remove btrfs_add_ordered_extent (git-fixes).
  - btrfs: pass an ordered_extent to btrfs_submit_compressed_write
    (git-fixes).
  - btrfs: pass an ordered_extent to btrfs_reloc_clone_csums
    (git-fixes).
  - btrfs: merge the two calls to btrfs_add_ordered_extent in
    run_delalloc_nocow (git-fixes).
  - btrfs: limit write bios to a single ordered extent (git-fixes).
  - commit 90ea198
  - powerpc/topology: Check if a core is online (bsc#1214285
    bsc#1205462 ltc#200161 ltc#200588 git-fixes).
  - cpu/SMT: Enable SMT only if a core is online (bsc#1214285
    bsc#1205462 ltc#200161 ltc#200588 git-fixes).
  - commit 3d340df
  - Update patch reference for MD patch (jsc#PED-10029 jsc#PED-10045)
  - commit 1bf8fd1
  - Update patch refefernce for MFD patch (jsc#PED-10029)
  - commit f36d989
  - platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (jsc#PED-8779).
  - commit c606582
  - platform/x86/amd/hsmp: switch to use device_add_groups() (jsc#PED-8779).
  - commit 4007799
  - platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (jsc#PED-8779).
  - commit 9854658
  - platform/x86/amd/hsmp: Remove extra parenthesis and add a space (jsc#PED-8779).
  - commit 0a84b39
  - platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (jsc#PED-8779).
  - commit 85ba4b7
  - platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (jsc#PED-8779).
  - commit 1b89039
  - platform/x86/amd/hsmp: Add support for ACPI based probing (jsc#PED-8779).
  - commit 73c2646
  - platform/x86/amd/hsmp: Restructure sysfs group creation (jsc#PED-8779).
  - commit 9e31807
  - platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (jsc#PED-8779).
  - commit f6baa58
  - platform/x86/amd/hsmp: Define a struct to hold mailbox regs (jsc#PED-8779).
  - commit 07f864e
  - platform/x86/amd/hsmp: Create static func to handle platdev (jsc#PED-8779).
  - commit d5ea9be
  - platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (jsc#PED-8779).
  - commit d314cb6
  - platform/x86/amd/hsmp: Move hsmp_test to probe (jsc#PED-8779).
  - commit b00829d
  - tools/resolve_btfids: Fix cross-compilation to non-host
    endianness (git-fixes).
  - tools/resolve_btfids: Refactor set sorting with types from
    btf_ids.h (git-fixes).
  - libbpf: Use OPTS_SET() macro in bpf_xdp_query() (git-fixes).
  - commit 6fc7b9e
  - libbpf: Add missing LIBBPF_API annotation to
    libbpf_set_memlock_rlim API (git-fixes).
  - selftests/bpf: Disable IPv6 for lwt_redirect test (git-fixes).
  - libbpf: Fix faccessat() usage on Android (git-fixes).
  - selftests/bpf: Wait for the netstamp_needed_key static key to
    be turned on (git-fixes).
  - commit 89d6f3b
  - selftests/bpf: Fix the flaky tc_redirect_dtime test (git-fixes).
  - selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY
    values (git-fixes).
  - libbpf: Apply map_set_def_max_entries() for inner_maps on
    creation (git-fixes).
  - selftests/bpf: Fix potential premature unload in bpf_testmod
    (git-fixes).
  - bpftool: Silence build warning about calloc() (git-fixes).
  - commit 7aaf2fc
  - x86/asm: Use %c/%n instead of %P operand modifier in asm  templates (git-fixes).
  - Refresh
    patches.suse/x86-uaccess-Fix-missed-zeroing-of-ia32-u64-get_user-range-.patch.
  - commit 97ffc68
  - selftests/bpf: Fix up xdp bonding test wrt feature flags
    (git-fixes).
  - selftests/bpf: fix compiler warnings in RELEASE=1 mode
    (git-fixes).
  - selftests/bpf: Relax time_tai test for equal timestamps in
    tai_forward (git-fixes).
  - bpf: Set uattr->batch.count as zero before batched update or
    deletion (git-fixes).
  - bpf: Remove unnecessary wait from bpf_map_copy_value()
    (git-fixes).
  - commit 19ebfe6
  - bpf: enforce precision of R0 on callback return (git-fixes).
  - selftests/bpf: Fix erroneous bitmask operation (git-fixes).
  - bpf/tests: Remove duplicate JSGT tests (git-fixes).
  - bpftool: mark orphaned programs during prog show (git-fixes).
  - commit 2b6a18e
  - bpf: Fix a few selftest failures due to llvm18 change
    (git-fixes).
  - selftests/bpf: Fix issues in setup_classid_environment()
    (git-fixes).
  - selftests/bpf: Add assert for user stacks in test_task_stack
    (git-fixes).
  - selftests/bpf: Fix pyperf180 compilation failure with clang18
    (git-fixes).
  - bpf: Add crosstask check to __bpf_get_stack (git-fixes).
  - commit fce00e9
  - bpf, lpm: Fix check prefixlen before walking trie (git-fixes).
  - selftests/bpf: satisfy compiler by having explicit return in
    btf test (git-fixes).
  - selftests/bpf: fix RELEASE=1 build for tc_opts (git-fixes).
  - bpf: Fix prog_array_map_poke_run map poke update (git-fixes).
  - commit ca200c8

++++ kernel-default:

  - btrfs: fix leak of qgroup extent records after transaction abort
    (git-fixes).
  - btrfs: fix ordered extent split error handling in
    btrfs_dio_submit_io (git-fixes).
  - btrfs: use irq safe locking when running and adding delayed
    iputs (git-fixes).
  - commit 59b18df
  - btrfs: fix extent map use-after-free when adding pages to
    compressed bio (git-fixes).
  - commit b3e7c96
  - Drop libata patch that caused a regression (bsc#1229054)
  - commit 3d5faca
  - btrfs: fix double inode unlock for direct IO sync writes
    (git-fixes).
  - btrfs: fix corruption after buffer fault in during direct IO
    append write (git-fixes).
  - btrfs: use a btrfs_inode local variable at btrfs_sync_file()
    (git-fixes).
  - btrfs: pass a btrfs_inode to btrfs_wait_ordered_range()
    (git-fixes).
  - btrfs: pass a btrfs_inode to btrfs_fdatawrite_range()
    (git-fixes).
  - btrfs: use a btrfs_inode in the log context (struct
    btrfs_log_ctx) (git-fixes).
  - btrfs: make btrfs_finish_ordered_extent() return void
    (git-fixes).
  - btrfs: ensure fast fsync waits for ordered extents after a
    write failure (git-fixes).
  - btrfs: rename err to ret in btrfs_direct_write() (git-fixes).
  - btrfs: uninline some static inline helpers from tree-log.h
    (git-fixes).
  - btrfs: use btrfs_finish_ordered_extent to complete buffered
    writes (git-fixes).
  - btrfs: use btrfs_finish_ordered_extent to complete direct writes
    (git-fixes).
  - btrfs: use btrfs_finish_ordered_extent to complete compressed
    writes (git-fixes).
  - btrfs: open code end_extent_writepage in
    end_bio_extent_writepage (git-fixes).
  - btrfs: add a btrfs_finish_ordered_extent helper (git-fixes).
  - btrfs: factor out a btrfs_queue_ordered_fn helper (git-fixes).
  - btrfs: factor out a can_finish_ordered_extent helper
    (git-fixes).
  - btrfs: use bbio->ordered in btrfs_csum_one_bio (git-fixes).
  - btrfs: add an ordered_extent pointer to struct btrfs_bio
    (git-fixes).
  - btrfs: open code btrfs_bio_end_io in btrfs_dio_submit_io
    (git-fixes).
  - btrfs: add a is_data_bbio helper (git-fixes).
  - btrfs: remove btrfs_add_ordered_extent (git-fixes).
  - btrfs: pass an ordered_extent to btrfs_submit_compressed_write
    (git-fixes).
  - btrfs: pass an ordered_extent to btrfs_reloc_clone_csums
    (git-fixes).
  - btrfs: merge the two calls to btrfs_add_ordered_extent in
    run_delalloc_nocow (git-fixes).
  - btrfs: limit write bios to a single ordered extent (git-fixes).
  - commit 90ea198
  - powerpc/topology: Check if a core is online (bsc#1214285
    bsc#1205462 ltc#200161 ltc#200588 git-fixes).
  - cpu/SMT: Enable SMT only if a core is online (bsc#1214285
    bsc#1205462 ltc#200161 ltc#200588 git-fixes).
  - commit 3d340df
  - Update patch reference for MD patch (jsc#PED-10029 jsc#PED-10045)
  - commit 1bf8fd1
  - Update patch refefernce for MFD patch (jsc#PED-10029)
  - commit f36d989
  - platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (jsc#PED-8779).
  - commit c606582
  - platform/x86/amd/hsmp: switch to use device_add_groups() (jsc#PED-8779).
  - commit 4007799
  - platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (jsc#PED-8779).
  - commit 9854658
  - platform/x86/amd/hsmp: Remove extra parenthesis and add a space (jsc#PED-8779).
  - commit 0a84b39
  - platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (jsc#PED-8779).
  - commit 85ba4b7
  - platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (jsc#PED-8779).
  - commit 1b89039
  - platform/x86/amd/hsmp: Add support for ACPI based probing (jsc#PED-8779).
  - commit 73c2646
  - platform/x86/amd/hsmp: Restructure sysfs group creation (jsc#PED-8779).
  - commit 9e31807
  - platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (jsc#PED-8779).
  - commit f6baa58
  - platform/x86/amd/hsmp: Define a struct to hold mailbox regs (jsc#PED-8779).
  - commit 07f864e
  - platform/x86/amd/hsmp: Create static func to handle platdev (jsc#PED-8779).
  - commit d5ea9be
  - platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (jsc#PED-8779).
  - commit d314cb6
  - platform/x86/amd/hsmp: Move hsmp_test to probe (jsc#PED-8779).
  - commit b00829d
  - tools/resolve_btfids: Fix cross-compilation to non-host
    endianness (git-fixes).
  - tools/resolve_btfids: Refactor set sorting with types from
    btf_ids.h (git-fixes).
  - libbpf: Use OPTS_SET() macro in bpf_xdp_query() (git-fixes).
  - commit 6fc7b9e
  - libbpf: Add missing LIBBPF_API annotation to
    libbpf_set_memlock_rlim API (git-fixes).
  - selftests/bpf: Disable IPv6 for lwt_redirect test (git-fixes).
  - libbpf: Fix faccessat() usage on Android (git-fixes).
  - selftests/bpf: Wait for the netstamp_needed_key static key to
    be turned on (git-fixes).
  - commit 89d6f3b
  - selftests/bpf: Fix the flaky tc_redirect_dtime test (git-fixes).
  - selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY
    values (git-fixes).
  - libbpf: Apply map_set_def_max_entries() for inner_maps on
    creation (git-fixes).
  - selftests/bpf: Fix potential premature unload in bpf_testmod
    (git-fixes).
  - bpftool: Silence build warning about calloc() (git-fixes).
  - commit 7aaf2fc
  - x86/asm: Use %c/%n instead of %P operand modifier in asm  templates (git-fixes).
  - Refresh
    patches.suse/x86-uaccess-Fix-missed-zeroing-of-ia32-u64-get_user-range-.patch.
  - commit 97ffc68
  - selftests/bpf: Fix up xdp bonding test wrt feature flags
    (git-fixes).
  - selftests/bpf: fix compiler warnings in RELEASE=1 mode
    (git-fixes).
  - selftests/bpf: Relax time_tai test for equal timestamps in
    tai_forward (git-fixes).
  - bpf: Set uattr->batch.count as zero before batched update or
    deletion (git-fixes).
  - bpf: Remove unnecessary wait from bpf_map_copy_value()
    (git-fixes).
  - commit 19ebfe6
  - bpf: enforce precision of R0 on callback return (git-fixes).
  - selftests/bpf: Fix erroneous bitmask operation (git-fixes).
  - bpf/tests: Remove duplicate JSGT tests (git-fixes).
  - bpftool: mark orphaned programs during prog show (git-fixes).
  - commit 2b6a18e
  - bpf: Fix a few selftest failures due to llvm18 change
    (git-fixes).
  - selftests/bpf: Fix issues in setup_classid_environment()
    (git-fixes).
  - selftests/bpf: Add assert for user stacks in test_task_stack
    (git-fixes).
  - selftests/bpf: Fix pyperf180 compilation failure with clang18
    (git-fixes).
  - bpf: Add crosstask check to __bpf_get_stack (git-fixes).
  - commit fce00e9
  - bpf, lpm: Fix check prefixlen before walking trie (git-fixes).
  - selftests/bpf: satisfy compiler by having explicit return in
    btf test (git-fixes).
  - selftests/bpf: fix RELEASE=1 build for tc_opts (git-fixes).
  - bpf: Fix prog_array_map_poke_run map poke update (git-fixes).
  - commit ca200c8

++++ kernel-firmware:

  - Update to version 20240809 (git commit 36db650dae03):
    * qcom: update path for video firmware for vpu-1/2/3.0
    * QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00642
    * rtw89: 8852c: add fw format-1 v0.27.97.0
    * rtw89: 8852bt: add firmware 0.29.91.0
    * amdgpu: Update ISP FW for isp v4.1.1
    * mediatek: Update mt8195 SOF firmware
    * amdgpu: DMCUB updates for DCN314
    * xe: First GuC release v70.29.2 for BMG
    * xe: Add GuC v70.29.2 for LNL
    * i915: Add GuC v70.29.2 for ADL-P, DG1, DG2, MTL, and TGL
    * i915: Update MTL DMC v2.22
    * i915: update MTL GSC to v102.0.10.1878
    * xe: Add BMG HuC 8.2.10
    * xe: Add GSC 104.0.0.1161 for LNL
    * xe: Add LNL HuC 9.4.13
    * i915: update DG2 HuC to v7.10.16
    * amdgpu: Update ISP FW for isp v4.1.1
    * QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00641

++++ kernel-firmware:

  - Update to version 20240809 (git commit 36db650dae03):
    * qcom: update path for video firmware for vpu-1/2/3.0
    * QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00642
    * rtw89: 8852c: add fw format-1 v0.27.97.0
    * rtw89: 8852bt: add firmware 0.29.91.0
    * amdgpu: Update ISP FW for isp v4.1.1
    * mediatek: Update mt8195 SOF firmware
    * amdgpu: DMCUB updates for DCN314
    * xe: First GuC release v70.29.2 for BMG
    * xe: Add GuC v70.29.2 for LNL
    * i915: Add GuC v70.29.2 for ADL-P, DG1, DG2, MTL, and TGL
    * i915: Update MTL DMC v2.22
    * i915: update MTL GSC to v102.0.10.1878
    * xe: Add BMG HuC 8.2.10
    * xe: Add GSC 104.0.0.1161 for LNL
    * xe: Add LNL HuC 9.4.13
    * i915: update DG2 HuC to v7.10.16
    * amdgpu: Update ISP FW for isp v4.1.1
    * QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00641

++++ python-PyJWT:

  - Skip failing test gh#jpadilla/pyjwt#802

++++ python-PyJWT:

  - Skip failing test gh#jpadilla/pyjwt#802

++++ qemu:

  - Fix bsc#1229007, CVE-2024-7409:
    * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
    * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
    * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
    * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409)
    * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)

++++ qemu:

  - Fix bsc#1229007, CVE-2024-7409:
    * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
    * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
    * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
    * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409)
    * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)

++++ qemu:

  - Fix bsc#1229007, CVE-2024-7409:
    * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
    * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
    * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
    * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409)
    * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)

++++ qemu:

  - Fix bsc#1229007, CVE-2024-7409:
    * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
    * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
    * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
    * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409)
    * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)

++++ qemu:

  - Fix bsc#1229007, CVE-2024-7409:
    * nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
    * nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
    * nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
    * nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409)
    * nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)

------------------------------------------------------------------
------------------  2024-8-12  -  Aug 12 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Fix regression introduced in version 8.9.1:
    * sigpipe: init the struct so that first apply ignores
    * Add curl-sigpipe.patch

++++ curl:

  - Fix regression introduced in version 8.9.1:
    * sigpipe: init the struct so that first apply ignores
    * Add curl-sigpipe.patch

++++ curl:

  - Fix regression introduced in version 8.9.1:
    * sigpipe: init the struct so that first apply ignores
    * Add curl-sigpipe.patch

++++ curl:

  - Fix regression introduced in version 8.9.1:
    * sigpipe: init the struct so that first apply ignores
    * Add curl-sigpipe.patch

++++ curl:

  - Fix regression introduced in version 8.9.1:
    * sigpipe: init the struct so that first apply ignores
    * Add curl-sigpipe.patch

++++ curl:

  - Fix regression introduced in version 8.9.1:
    * sigpipe: init the struct so that first apply ignores
    * Add curl-sigpipe.patch

++++ python-kiwi:

  - Fixed arch flag for namedCollection
    The arch flag in a namedCollection was not taken into account.
    This commit fixes this and also makes sure the result information
    is sorted and unique like we have it for the package lists.
    This Fixes #2600

++++ python-kiwi:

  - Fixed arch flag for namedCollection
    The arch flag in a namedCollection was not taken into account.
    This commit fixes this and also makes sure the result information
    is sorted and unique like we have it for the package lists.
    This Fixes #2600

++++ python-kiwi:

  - Fixed arch flag for namedCollection
    The arch flag in a namedCollection was not taken into account.
    This commit fixes this and also makes sure the result information
    is sorted and unique like we have it for the package lists.
    This Fixes #2600

++++ kernel-default:

  - scsi: mpi3mr: Use proper format specifier in
    mpi3mr_sas_port_add() (bsc#1228754 CVE-2024-42159 git-fixes).
  - scsi: mpi3mr: Sanitise num_phys (bsc#1228754 CVE-2024-42159).
  - commit e024eb0
  - selftests/bpf: check if max number of bpf_loop iterations is
    tracked (git-fixes).
    Refresh
    patches.suse/selftests-bpf-test-case-for-callback_depth-states-pr.patch.
  - selftests/bpf: fix bpf_loop_bench for new callback verification
    scheme (git-fixes).
  - selftests/bpf: Add netkit to tc_redirect selftest (git-fixes).
  - selftests/bpf: De-veth-ize the tc_redirect test case
    (git-fixes).
  - bpf: fix control-flow graph checking in privileged mode
    (git-fixes).
  - commit 27db2c6
  - bpf: Fix check_stack_write_fixed_off() to correctly spill imm
    (git-fixes).
  - bpf: Fix unnecessary -EBUSY from htab_lock_bucket (git-fixes).
  - commit b5c430e
  - mm/shmem: disable PMD-sized page cache if needed (CVE-2024-42241
    bsc#1228986).
  - commit 8ecdd91
  - x86/mm: Fix pti_clone_pgtable() alignment assumption (git-fixes).
  - commit 1d041a1
  - x86/mm: Fix pti_clone_entry_text() for i386 (git-fixes).
  - commit 5407674
  - x86/pci: Skip early E820 check for ECAM region (git-fixes).
  - commit 7ac1bfc
  - x86/mtrr: Check if fixed MTRRs exist before saving them (git-fixes).
  - commit 03de6ee
  - x86/entry/64: Remove obsolete comment on tracing vs. SYSRET (git-fixes).
  - commit 41708c1
  - memcg: protect concurrent access to mem_cgroup_idr (git-fixes).
  - commit e9979b2
  - Revert "sched/fair: Make sure to try to detach at least one
    movable task" (CVE-2024-42245 bsc#1228978).
  - commit bff0dc0
  - selftests/bpf: Make linked_list failure test more robust
    (git-fixes).
  - bpf: Ensure proper register state printing for cond jumps
    (git-fixes).
  - commit 2ec4f49
  - ipv6: sr: fix incorrect unregister order (git-fixes).
  - commit f975fdd
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
    (CVE-2024-26735 bsc#1222372).
  - commit 75aaed9
  - bpftool: Align output skeleton ELF code (git-fixes).
  - samples/bpf: syscall_tp_user: Fix array out-of-bound access
    (git-fixes).
  - samples/bpf: syscall_tp_user: Rename num_progs into nr_tests
    (git-fixes).
  - bpf: Fix kfunc callback register type handling (git-fixes).
  - commit ee3cca0
  - bpf: Detect IP == ksym.end as part of BPF program (git-fixes).
  - commit b5b57d0
  - selftests/bpf: Skip module_fentry_shadow test when bpf_testmod
    is not available (git-fixes).
  - commit 85b5d5e
  - bpftool: Fix -Wcast-qual warning (git-fixes).
  - commit 0417873
  - net: bridge: switchdev: Skip MDB replays of deferred events
    on offload (CVE-2024-26837 bsc#1222973).
  - commit 2f55c98
  - s390/pkey: Wipe copies of protected- and secure-keys
    (CVE-2024-42155 bsc#1228733).
  - s390/pkey: Wipe copies of clear-key structures on failure
    (CVE-2024-42156 bsc#1228722).
  - s390/pkey: Wipe sensitive data on failure (CVE-2024-42157
    bsc#1228727).
  - s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
    (CVE-2024-42158 bsc#1228720).
  - s390/pkey: introduce dynamic debugging for pkey (bsc#1228720).
  - s390/pkey: harmonize pkey s390 debug feature calls
    (bsc#1228720).
  - commit 72f0617
  - usb: gadget: u_serial: Set start_delayed during suspend
    (git-fixes).
  - usb: gadget: core: Check for unset descriptor (git-fixes).
  - usb: gadget: u_audio: Check return codes from usb_ep_enable
    and config_ep_by_speed (git-fixes).
  - driver core: Fix uevent_show() vs driver detach race
    (git-fixes).
  - thermal/drivers/broadcom: Fix race between removal and clock
    disable (git-fixes).
  - thermal: bcm2835: Convert to platform remove callback returning
    void (stable-fixes).
  - commit 9bfd8af
  - selftests/bpf: Cover verifier checks for mutating
    sockmap/sockhash (bsc#1226885 CVE-2024-38662).
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map
    delete elem" (bsc#1226885 CVE-2024-38662).
  - bpf: Allow delete from sockmap/sockhash only if update is
    allowed (bsc#1226885 CVE-2024-38662).
  - commit 7f528cf
  - rpm/kernel-binary.spec.in: fix klp_symbols macro
    The commit below removed openSUSE filter from %ifs of the klp_symbols
    definition. But it removed -c of grep too and that causes:
    error: syntax error in expression:  01 && (  || 1 )
    error:                                        ^
    error: unmatched (:  01 && (  || 1 )
    error:                     ^
    error: kernel-default.spec:137: bad %if condition:  01 && (  || 1 )
    So reintroduce -c to the PTF's grep.
    Fixes: fd0b293bebaf (kernel-binary.spec.in: Enable klp_symbols on openSUSE Tumbleweed (boo#1229042).)
  - commit 4a36fe3

++++ kernel-default:

  - scsi: mpi3mr: Use proper format specifier in
    mpi3mr_sas_port_add() (bsc#1228754 CVE-2024-42159 git-fixes).
  - scsi: mpi3mr: Sanitise num_phys (bsc#1228754 CVE-2024-42159).
  - commit e024eb0
  - tcp_metrics: validate source addr length
    (CVE-2024-42154 bsc#1228507).
  - commit a83d949
  - selftests/bpf: check if max number of bpf_loop iterations is
    tracked (git-fixes).
    Refresh
    patches.suse/selftests-bpf-test-case-for-callback_depth-states-pr.patch.
  - selftests/bpf: fix bpf_loop_bench for new callback verification
    scheme (git-fixes).
  - selftests/bpf: Add netkit to tc_redirect selftest (git-fixes).
  - selftests/bpf: De-veth-ize the tc_redirect test case
    (git-fixes).
  - bpf: fix control-flow graph checking in privileged mode
    (git-fixes).
  - commit 27db2c6
  - bpf: Fix check_stack_write_fixed_off() to correctly spill imm
    (git-fixes).
  - bpf: Fix unnecessary -EBUSY from htab_lock_bucket (git-fixes).
  - commit b5c430e
  - mm/shmem: disable PMD-sized page cache if needed (CVE-2024-42241
    bsc#1228986).
  - commit 8ecdd91
  - x86/mm: Fix pti_clone_pgtable() alignment assumption (git-fixes).
  - commit 1d041a1
  - x86/mm: Fix pti_clone_entry_text() for i386 (git-fixes).
  - commit 5407674
  - x86/pci: Skip early E820 check for ECAM region (git-fixes).
  - commit 7ac1bfc
  - x86/mtrr: Check if fixed MTRRs exist before saving them (git-fixes).
  - commit 03de6ee
  - x86/entry/64: Remove obsolete comment on tracing vs. SYSRET (git-fixes).
  - commit 41708c1
  - memcg: protect concurrent access to mem_cgroup_idr (git-fixes).
  - commit e9979b2
  - Revert "sched/fair: Make sure to try to detach at least one
    movable task" (CVE-2024-42245 bsc#1228978).
  - commit bff0dc0
  - selftests/bpf: Make linked_list failure test more robust
    (git-fixes).
  - bpf: Ensure proper register state printing for cond jumps
    (git-fixes).
  - commit 2ec4f49
  - ipv6: sr: fix incorrect unregister order (git-fixes).
  - commit f975fdd
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
    (CVE-2024-26735 bsc#1222372).
  - commit 75aaed9
  - bpftool: Align output skeleton ELF code (git-fixes).
  - samples/bpf: syscall_tp_user: Fix array out-of-bound access
    (git-fixes).
  - samples/bpf: syscall_tp_user: Rename num_progs into nr_tests
    (git-fixes).
  - bpf: Fix kfunc callback register type handling (git-fixes).
  - commit ee3cca0
  - bpf: Detect IP == ksym.end as part of BPF program (git-fixes).
  - commit b5b57d0
  - selftests/bpf: Skip module_fentry_shadow test when bpf_testmod
    is not available (git-fixes).
  - commit 85b5d5e
  - bpftool: Fix -Wcast-qual warning (git-fixes).
  - commit 0417873
  - net: bridge: switchdev: Skip MDB replays of deferred events
    on offload (CVE-2024-26837 bsc#1222973).
  - commit 2f55c98
  - s390/pkey: Wipe copies of protected- and secure-keys
    (CVE-2024-42155 bsc#1228733).
  - s390/pkey: Wipe copies of clear-key structures on failure
    (CVE-2024-42156 bsc#1228722).
  - s390/pkey: Wipe sensitive data on failure (CVE-2024-42157
    bsc#1228727).
  - s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
    (CVE-2024-42158 bsc#1228720).
  - s390/pkey: introduce dynamic debugging for pkey (bsc#1228720).
  - s390/pkey: harmonize pkey s390 debug feature calls
    (bsc#1228720).
  - commit 72f0617
  - usb: gadget: u_serial: Set start_delayed during suspend
    (git-fixes).
  - usb: gadget: core: Check for unset descriptor (git-fixes).
  - usb: gadget: u_audio: Check return codes from usb_ep_enable
    and config_ep_by_speed (git-fixes).
  - driver core: Fix uevent_show() vs driver detach race
    (git-fixes).
  - thermal/drivers/broadcom: Fix race between removal and clock
    disable (git-fixes).
  - thermal: bcm2835: Convert to platform remove callback returning
    void (stable-fixes).
  - commit 9bfd8af
  - selftests/bpf: Cover verifier checks for mutating
    sockmap/sockhash (bsc#1226885 CVE-2024-38662).
  - Revert "bpf, sockmap: Prevent lock inversion deadlock in map
    delete elem" (bsc#1226885 CVE-2024-38662).
  - bpf: Allow delete from sockmap/sockhash only if update is
    allowed (bsc#1226885 CVE-2024-38662).
  - commit 7f528cf
  - rpm/kernel-binary.spec.in: fix klp_symbols macro
    The commit below removed openSUSE filter from %ifs of the klp_symbols
    definition. But it removed -c of grep too and that causes:
    error: syntax error in expression:  01 && (  || 1 )
    error:                                        ^
    error: unmatched (:  01 && (  || 1 )
    error:                     ^
    error: kernel-default.spec:137: bad %if condition:  01 && (  || 1 )
    So reintroduce -c to the PTF's grep.
    Fixes: fd0b293bebaf (kernel-binary.spec.in: Enable klp_symbols on openSUSE Tumbleweed (boo#1229042).)
  - commit 4a36fe3

++++ nvidia-open-driver-G06-signed:

  - Update to 550.107.02 (boo#1229716)

++++ python-setuptools:

  - Add patch CVE-2024-6345-code-execution-via-download-funcs.patch:
    * Sanitize any VCS URL we download. (CVE-2024-6345, bsc#1228105)

++++ python-setuptools:

  - Add patch CVE-2024-6345-code-execution-via-download-funcs.patch:
    * Sanitize any VCS URL we download. (CVE-2024-6345, bsc#1228105)

++++ qemu:

  - Update to version 8.2.6:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1721203806.547734.831464.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    hw/nvme: fix number of PIDs for FDP RUH update
    sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
    char-stdio: Restore blocking mode of stdout on exit
    virtio: remove virtio_tswap16s() call in vring_packed_event_read()
    virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()
    block: Parse filenames only when explicitly requested
    iotests/270: Don't store data-file with json: prefix in image
    iotests/244: Don't store data-file with protocol in image
    qcow2: Don't open data_file with BDRV_O_NO_IO (bsc#1227322, CVE-2024-4467)
    target/arm: Fix FJCVTZS vs flush-to-zero
    target/arm: Fix VCMLA Dd, Dn, Dm[idx]
    i386/cpu: fixup number of addressable IDs for processor cores in the physical package
    tests: Update our CI to use CentOS Stream 9 instead of 8
    migration: Fix file migration with fdset
    tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
    target/sparc: use signed denominator in sdiv helper
    linux-user: Make TARGET_NR_setgroups affect only the current thread
    accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
    stdvga: fix screen blanking
    hw/audio/virtio-snd: Always use little endian audio format
    ui/gtk: Draw guest frame at refresh cycle
    virtio-net: drop too short packets early
    target/i386: fix size of EBP writeback in gen_enter()

++++ qemu:

  - Update to version 8.2.6:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1721203806.547734.831464.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    hw/nvme: fix number of PIDs for FDP RUH update
    sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
    char-stdio: Restore blocking mode of stdout on exit
    virtio: remove virtio_tswap16s() call in vring_packed_event_read()
    virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()
    block: Parse filenames only when explicitly requested
    iotests/270: Don't store data-file with json: prefix in image
    iotests/244: Don't store data-file with protocol in image
    qcow2: Don't open data_file with BDRV_O_NO_IO (bsc#1227322, CVE-2024-4467)
    target/arm: Fix FJCVTZS vs flush-to-zero
    target/arm: Fix VCMLA Dd, Dn, Dm[idx]
    i386/cpu: fixup number of addressable IDs for processor cores in the physical package
    tests: Update our CI to use CentOS Stream 9 instead of 8
    migration: Fix file migration with fdset
    tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
    target/sparc: use signed denominator in sdiv helper
    linux-user: Make TARGET_NR_setgroups affect only the current thread
    accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
    stdvga: fix screen blanking
    hw/audio/virtio-snd: Always use little endian audio format
    ui/gtk: Draw guest frame at refresh cycle
    virtio-net: drop too short packets early
    target/i386: fix size of EBP writeback in gen_enter()

++++ qemu:

  - Update to version 8.2.6:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1721203806.547734.831464.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    hw/nvme: fix number of PIDs for FDP RUH update
    sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
    char-stdio: Restore blocking mode of stdout on exit
    virtio: remove virtio_tswap16s() call in vring_packed_event_read()
    virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()
    block: Parse filenames only when explicitly requested
    iotests/270: Don't store data-file with json: prefix in image
    iotests/244: Don't store data-file with protocol in image
    qcow2: Don't open data_file with BDRV_O_NO_IO (bsc#1227322, CVE-2024-4467)
    target/arm: Fix FJCVTZS vs flush-to-zero
    target/arm: Fix VCMLA Dd, Dn, Dm[idx]
    i386/cpu: fixup number of addressable IDs for processor cores in the physical package
    tests: Update our CI to use CentOS Stream 9 instead of 8
    migration: Fix file migration with fdset
    tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
    target/sparc: use signed denominator in sdiv helper
    linux-user: Make TARGET_NR_setgroups affect only the current thread
    accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
    stdvga: fix screen blanking
    hw/audio/virtio-snd: Always use little endian audio format
    ui/gtk: Draw guest frame at refresh cycle
    virtio-net: drop too short packets early
    target/i386: fix size of EBP writeback in gen_enter()

++++ qemu:

  - Update to version 8.2.6:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1721203806.547734.831464.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    hw/nvme: fix number of PIDs for FDP RUH update
    sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
    char-stdio: Restore blocking mode of stdout on exit
    virtio: remove virtio_tswap16s() call in vring_packed_event_read()
    virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()
    block: Parse filenames only when explicitly requested
    iotests/270: Don't store data-file with json: prefix in image
    iotests/244: Don't store data-file with protocol in image
    qcow2: Don't open data_file with BDRV_O_NO_IO (bsc#1227322, CVE-2024-4467)
    target/arm: Fix FJCVTZS vs flush-to-zero
    target/arm: Fix VCMLA Dd, Dn, Dm[idx]
    i386/cpu: fixup number of addressable IDs for processor cores in the physical package
    tests: Update our CI to use CentOS Stream 9 instead of 8
    migration: Fix file migration with fdset
    tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
    target/sparc: use signed denominator in sdiv helper
    linux-user: Make TARGET_NR_setgroups affect only the current thread
    accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
    stdvga: fix screen blanking
    hw/audio/virtio-snd: Always use little endian audio format
    ui/gtk: Draw guest frame at refresh cycle
    virtio-net: drop too short packets early
    target/i386: fix size of EBP writeback in gen_enter()

++++ qemu:

  - Update to version 8.2.6:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1721203806.547734.831464.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    hw/nvme: fix number of PIDs for FDP RUH update
    sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments
    char-stdio: Restore blocking mode of stdout on exit
    virtio: remove virtio_tswap16s() call in vring_packed_event_read()
    virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one()
    block: Parse filenames only when explicitly requested
    iotests/270: Don't store data-file with json: prefix in image
    iotests/244: Don't store data-file with protocol in image
    qcow2: Don't open data_file with BDRV_O_NO_IO (bsc#1227322, CVE-2024-4467)
    target/arm: Fix FJCVTZS vs flush-to-zero
    target/arm: Fix VCMLA Dd, Dn, Dm[idx]
    i386/cpu: fixup number of addressable IDs for processor cores in the physical package
    tests: Update our CI to use CentOS Stream 9 instead of 8
    migration: Fix file migration with fdset
    tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers
    target/sparc: use signed denominator in sdiv helper
    linux-user: Make TARGET_NR_setgroups affect only the current thread
    accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded
    stdvga: fix screen blanking
    hw/audio/virtio-snd: Always use little endian audio format
    ui/gtk: Draw guest frame at refresh cycle
    virtio-net: drop too short packets early
    target/i386: fix size of EBP writeback in gen_enter()

------------------------------------------------------------------
------------------  2024-8-11  -  Aug 11 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - i2c: qcom-geni: Add missing geni_icc_disable in
    geni_i2c_runtime_resume (git-fixes).
  - i2c: qcom-geni: Add missing clk_disable_unprepare in
    geni_i2c_runtime_resume (git-fixes).
  - i2c: smbus: Send alert notifications to all devices if source
    not found (git-fixes).
  - i2c: smbus: Improve handling of stuck alerts (git-fixes).
  - spi: spi-fsl-lpspi: Fix scldiv calculation (git-fixes).
  - spi: spidev: Add missing spi_device_id for bh2228fv (git-fixes).
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
    (git-fixes).
  - drm/client: fix null pointer dereference in
    drm_client_modeset_probe (git-fixes).
  - commit e093c66

++++ kernel-default:

  - i2c: qcom-geni: Add missing geni_icc_disable in
    geni_i2c_runtime_resume (git-fixes).
  - i2c: qcom-geni: Add missing clk_disable_unprepare in
    geni_i2c_runtime_resume (git-fixes).
  - i2c: smbus: Send alert notifications to all devices if source
    not found (git-fixes).
  - i2c: smbus: Improve handling of stuck alerts (git-fixes).
  - spi: spi-fsl-lpspi: Fix scldiv calculation (git-fixes).
  - spi: spidev: Add missing spi_device_id for bh2228fv (git-fixes).
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
    (git-fixes).
  - drm/client: fix null pointer dereference in
    drm_client_modeset_probe (git-fixes).
  - commit e093c66

------------------------------------------------------------------
------------------  2024-8-10  -  Aug 10 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - Update patch references for ASoC regression fixes (bsc#1229045 bsc#1229046)
  - commit 4e3f007
  - rpm/kernel-binary.spec.in: Fix build regression
    The previous fix forgot to take over grep -c option that broke the
    conditional expression
  - commit d29edf2
  - Moved upstreamed ASoC patch into sorted section
  - commit 3058bc3
  - ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
    (stable-fixes).
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
    (stable-fixes).
  - ASoC: cs35l56: Handle OTP read latency over SoundWire
    (stable-fixes).
  - ASoC: nau8822: Lower debug print priority (stable-fixes).
  - ASoC: fsl_micfil: Expand the range of FIFO watermark mask
    (stable-fixes).
  - ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).
  - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra)
    to quirks (stable-fixes).
  - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
    (stable-fixes).
  - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
    (stable-fixes).
  - ALSA: line6: Fix racy access to midibuf (stable-fixes).
  - ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
    (stable-fixes).
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
    (stable-fixes).
  - ASoC: cs35l56: Handle OTP read latency over SoundWire
    (stable-fixes).
  - ASoC: nau8822: Lower debug print priority (stable-fixes).
  - ASoC: fsl_micfil: Expand the range of FIFO watermark mask
    (stable-fixes).
  - ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).
  - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra)
    to quirks (stable-fixes).
  - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
    (stable-fixes).
  - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
    (stable-fixes).
  - ALSA: line6: Fix racy access to midibuf (stable-fixes).
  - commit a8c8868
  - ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
    (git-fixes).
  - ASoC: SOF: Remove libraries from topology lookups (git-fixes).
  - ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
    (git-fixes).
  - ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).
  - ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
    (git-fixes).
  - ASoC: SOF: Remove libraries from topology lookups (git-fixes).
  - ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
    (git-fixes).
  - ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).
  - commit cdc2939

++++ kernel-default:

  - Update patch references for ASoC regression fixes (bsc#1229045 bsc#1229046)
  - commit 4e3f007
  - rpm/kernel-binary.spec.in: Fix build regression
    The previous fix forgot to take over grep -c option that broke the
    conditional expression
  - commit d29edf2
  - Moved upstreamed ASoC patch into sorted section
  - commit 3058bc3
  - ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
    (stable-fixes).
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
    (stable-fixes).
  - ASoC: cs35l56: Handle OTP read latency over SoundWire
    (stable-fixes).
  - ASoC: nau8822: Lower debug print priority (stable-fixes).
  - ASoC: fsl_micfil: Expand the range of FIFO watermark mask
    (stable-fixes).
  - ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).
  - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra)
    to quirks (stable-fixes).
  - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
    (stable-fixes).
  - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
    (stable-fixes).
  - ALSA: line6: Fix racy access to midibuf (stable-fixes).
  - ASoC: cs35l56: Patch CS35L56_IRQ1_MASK_18 to the default value
    (stable-fixes).
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
    (stable-fixes).
  - ASoC: cs35l56: Handle OTP read latency over SoundWire
    (stable-fixes).
  - ASoC: nau8822: Lower debug print priority (stable-fixes).
  - ASoC: fsl_micfil: Expand the range of FIFO watermark mask
    (stable-fixes).
  - ASoC: amd: yc: Support mic on HP 14-em0002la (stable-fixes).
  - ALSA: hda/realtek: Add Framework Laptop 13 (Intel Core Ultra)
    to quirks (stable-fixes).
  - ALSA: hda/hdmi: Yet more pin fix for HP EliteDesk 800 G4
    (stable-fixes).
  - ALSA: hda: Add HP MP9 G4 Retail System AMS to force connect list
    (stable-fixes).
  - ALSA: line6: Fix racy access to midibuf (stable-fixes).
  - commit a8c8868
  - ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
    (git-fixes).
  - ASoC: SOF: Remove libraries from topology lookups (git-fixes).
  - ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
    (git-fixes).
  - ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).
  - ASoC: meson: axg-fifo: fix irq scheduling issue with PREEMPT_RT
    (git-fixes).
  - ASoC: SOF: Remove libraries from topology lookups (git-fixes).
  - ASoC: codecs: wsa884x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa883x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wsa881x: Correct Soundwire ports mask (git-fixes).
  - ASoC: codecs: wcd938x-sdw: Correct Soundwire ports mask
    (git-fixes).
  - ALSA: usb-audio: Re-add ScratchAmp quirk entries (git-fixes).
  - commit cdc2939

++++ nvidia-open-driver-G06-signed:

  - For CUDA update version to 560.28.03

++++ python-M2Crypto:

  - Update 0.42.0:
  - allow ASN1_{Integer,String} be initialized directly
  - minimal infrastructure for type hints for a C extension and
    some type hints for some basic modules
  - time_t on 32bit Linux is 32bit (integer) not 64bit (long)
  - EOS for CentOS 7
  - correct checking for OpenSSL version number on Windows
  - make compatible with Python 3.13 (replace PyEval_CallObject
    with PyObject_CallObject)
  - fix typo in extern function signature (and proper type of
    engine_ctrl_cmd_string())
  - move the package to Sorucehut
  - setup CI to use Sourcehut CI
  - setup CI on GitLab for Windows as well (remove Appveyor)
  - initial draft of documentation for migration to
    pyca/cryptography
  - fix Read the Docs configuration (contributed kindly by Facundo
    Tuesca)
  - Remove upstreamed 32bit_ASN1_Time.patch
  - Remove python-M2Crypto.keyring, because PyPI broke GPG support

------------------------------------------------------------------
------------------  2024-8-9  -  Aug 9 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240809.5d13eb4:
    * cleanup aaa_base.post and fold back into specfile

++++ python-kiwi:

  - Fix handling of zipl.conf in plain zipl bootloader
    When using the plain zipl bootloader kiwi created a /etc/zipl.conf
    file. However, this file was only useful during image build as it
    points to a loop target device and geometry but does not represent
    a proper config file to be used in the running system. In addition
    the different distributors provides their own version and layout
    of the zipl.conf to be used inside of the system and with their
    respective tools. Thus this commit changes the way how kiwi operates
    in a way that the zipl.conf used in the initial image only exists
    during the image build process. An eventual present /etc/zipl.conf
    will not be touched by kiwi. This Fixes #2597

++++ python-kiwi:

  - Fix handling of zipl.conf in plain zipl bootloader
    When using the plain zipl bootloader kiwi created a /etc/zipl.conf
    file. However, this file was only useful during image build as it
    points to a loop target device and geometry but does not represent
    a proper config file to be used in the running system. In addition
    the different distributors provides their own version and layout
    of the zipl.conf to be used inside of the system and with their
    respective tools. Thus this commit changes the way how kiwi operates
    in a way that the zipl.conf used in the initial image only exists
    during the image build process. An eventual present /etc/zipl.conf
    will not be touched by kiwi. This Fixes #2597

++++ python-kiwi:

  - Fix handling of zipl.conf in plain zipl bootloader
    When using the plain zipl bootloader kiwi created a /etc/zipl.conf
    file. However, this file was only useful during image build as it
    points to a loop target device and geometry but does not represent
    a proper config file to be used in the running system. In addition
    the different distributors provides their own version and layout
    of the zipl.conf to be used inside of the system and with their
    respective tools. Thus this commit changes the way how kiwi operates
    in a way that the zipl.conf used in the initial image only exists
    during the image build process. An eventual present /etc/zipl.conf
    will not be touched by kiwi. This Fixes #2597

++++ kernel-default:

  - kernel-binary.spec.in: Enable klp_symbols on openSUSE Tumbleweed (boo#1229042).
    After the Jump project the kernel used by SLE and openSUSE Leap are the
    same. As consequence the klp_symbols variable is set, enabling
    kernel-default-livepatch-devel on both SLE and openSUSE.
    The current rules to avoid enabling the package exclude openSUSE
    Tumbleweed alone, which doesn't makes sense for now. Enabling
    kernel-default-livepatch-devel on TW makes it easier to test the
    creation of kernel livepatches of the next SLE versions.
  - commit fd0b293
  - Split kABI workaround of recent hyperv fixes (bsc#1229040, bsc#1225745, CVE-2024-36911, bsc#1225717, CVE-2024-36910, bsc#1225744, CVE-2024-36909)
  - commit 3639306
  - Yet more build fix without patches.kabi (bsc#1226502)
  - commit 6bc3429
  - Fix build errors without patches.kabi (bsc#1226502)
    Now patches.suse/x86-Stop-using-weak-symbols-for-__iowrite32_copy.patch
    has a full backport and later partially reverted via
    patches.kabi/kabi-partial-revert-commit-20516d6e51dd.patch
  - commit 44c5e90
  - landlock: Fix d_parent walk (CVE-2024-40938 bsc#1227840).
  - commit 36de641
  - net: fix sk_memory_allocated_{add|sub} vs softirqs
    (bsc#1228757).
  - commit a963c0f
  - minmax: fix up min3() and max3() too (bsc#1229024).
  - minmax: improve macro expansion and type checking (bsc#1229024).
  - minmax: simplify min()/max()/clamp() implementation
    (bsc#1229024).
  - minmax: don't use max() in situations that want a C constant
    expression (bsc#1229024).
  - minmax: make generic MIN() and MAX() macros available everywhere
    (bsc#1229024).
  - minmax: simplify and clarify min_t()/max_t() implementation
    (bsc#1229024).
  - minmax: add a few more MIN_T/MAX_T users (bsc#1229024).
  - minmax: avoid overly complicated constant expressions in VM code
    (bsc#1229024).
  - drm/radeon/evergreen_cs: Clean up errors in evergreen_cs.c
    (bsc#1229024).
  - commit c64c296
  - Update
    patches.suse/ALSA-emux-improve-patch-ioctl-data-validation.patch
    (stable-fixes CVE-2024-42097 bsc#1228766).
  - Update
    patches.suse/ASoC-SOF-Intel-hda-fix-null-deref-on-system-suspend-.patch
    (git-fixes CVE-2024-41037 bsc#1228508).
  - Update
    patches.suse/ASoC-amd-acp-add-a-null-check-for-chip_pdev-structur.patch
    (git-fixes CVE-2024-42074 bsc#1228481).
  - Update
    patches.suse/ASoC-fsl-asoc-card-set-priv-pdev-before-using-it.patch
    (git-fixes CVE-2024-42089 bsc#1228450).
  - Update
    patches.suse/Bluetooth-ISO-Check-socket-flag-instead-of-hcon.patch
    (git-fixes CVE-2024-42141 bsc#1228502).
  - Update
    patches.suse/Bluetooth-Ignore-too-large-handle-values-in-BIG.patch
    (git-fixes CVE-2024-42133 bsc#1228511).
  - Update
    patches.suse/Bluetooth-hci_core-cancel-all-works-upon-hci_unregis.patch
    (stable-fixes CVE-2024-41063 bsc#1228580).
  - Update
    patches.suse/Bluetooth-qca-Fix-BT-enable-failure-again-for-QCA639.patch
    (git-fixes CVE-2024-42137 bsc#1228563).
  - Update patches.suse/PCI-MSI-Fix-UAF-in-msi_capability_init.patch
    (git-fixes CVE-2024-41096 bsc#1228479).
  - Update
    patches.suse/RDMA-restrack-Fix-potential-invalid-address-access.patch
    (git-fixes CVE-2024-42080 bsc#1228673).
  - Update
    patches.suse/USB-core-Fix-duplicate-endpoint-bug-by-clearing-rese.patch
    (git-fixes CVE-2024-41035 bsc#1228485).
  - Update patches.suse/USB-serial-mos7840-fix-crash-on-resume.patch
    (git-fixes CVE-2024-42244 bsc#1228967).
  - Update
    patches.suse/ata-libata-core-Fix-null-pointer-dereference-on-erro.patch
    (git-fixes CVE-2024-41098 bsc#1228467).
  - Update
    patches.suse/bluetooth-hci-disallow-setting-handle-bigger-than-HC.patch
    (git-fixes CVE-2024-42132 bsc#1228492).
  - Update
    patches.suse/bpf-Fail-bpf_timer_cancel-when-callback-is-being-can.patch
    (bsc#1228531 CVE-2024-41045 CVE-2024-42239 bsc#1228979).
  - Update
    patches.suse/can-mcp251xfd-fix-infinite-loop-when-xmit-fails.patch
    (git-fixes CVE-2024-41088 bsc#1228469).
  - Update
    patches.suse/cdrom-rearrange-last_media_change-check-to-avoid-uni.patch
    (stable-fixes CVE-2024-42136 bsc#1228758).
  - Update
    patches.suse/crypto-aead-cipher-zeroize-key-buffer-after-use.patch
    (stable-fixes CVE-2024-42229 bsc#1228708).
  - Update
    patches.suse/crypto-ecdh-explicitly-zeroize-private_key.patch
    (stable-fixes CVE-2024-42098 bsc#1228779).
  - Update
    patches.suse/drm-amd-display-ASSERT-when-failing-to-find-index-by.patch
    (stable-fixes CVE-2024-42117 bsc#1228582).
  - Update
    patches.suse/drm-amd-display-Check-index-msg_id-before-read-or-wr.patch
    (stable-fixes CVE-2024-42121 bsc#1228590).
  - Update
    patches.suse/drm-amd-display-Check-pipe-offset-before-setting-vbl.patch
    (stable-fixes CVE-2024-42120 bsc#1228588).
  - Update
    patches.suse/drm-amd-display-Fix-array-index-out-of-bounds-in-dml.patch
    (stable-fixes CVE-2024-41061 bsc#1228572).
  - Update
    patches.suse/drm-amd-display-Fix-overlapping-copy-within-dml_core.patch
    (stable-fixes CVE-2024-42227 bsc#1228707).
  - Update
    patches.suse/drm-amd-display-Skip-finding-free-audio-for-unknown-.patch
    (stable-fixes CVE-2024-42119 bsc#1228584).
  - Update
    patches.suse/drm-amd-display-Skip-pipe-if-the-pipe-idx-not-set-pr.patch
    (stable-fixes CVE-2024-42064 bsc#1228586).
  - Update
    patches.suse/drm-amdgpu-Fix-signedness-bug-in-sdma_v4_0_process_t.patch
    (git-fixes CVE-2024-41022 bsc#1228429).
  - Update
    patches.suse/drm-amdgpu-Using-uninitialized-value-size-when-calli.patch
    (stable-fixes CVE-2024-42228 bsc#1228667).
  - Update
    patches.suse/drm-amdgpu-avoid-using-null-object-of-framebuffer.patch
    (stable-fixes CVE-2024-41093 bsc#1228660).
  - Update
    patches.suse/drm-fbdev-dma-Only-set-smem_start-is-enable-per-modu.patch
    (git-fixes CVE-2024-41094 bsc#1228458).
  - Update
    patches.suse/drm-i915-gt-Fix-potential-UAF-by-revoke-of-fence-reg.patch
    (git-fixes CVE-2024-41092 bsc#1228483).
  - Update
    patches.suse/drm-lima-fix-shared-irq-handling-on-driver-remove.patch
    (stable-fixes CVE-2024-42127 bsc#1228721).
  - Update
    patches.suse/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-66edf3f.patch
    (stable-fixes CVE-2024-41095 bsc#1228662).
  - Update
    patches.suse/drm-nouveau-dispnv04-fix-null-pointer-dereference-in.patch
    (stable-fixes CVE-2024-41089 bsc#1228658).
  - Update
    patches.suse/drm-nouveau-fix-null-pointer-dereference-in-nouveau_.patch
    (git-fixes CVE-2024-42101 bsc#1228495).
  - Update
    patches.suse/drm-panel-ilitek-ili9881c-Fix-warning-with-GPIO-cont.patch
    (stable-fixes CVE-2024-42087 bsc#1228677).
  - Update
    patches.suse/drm-radeon-check-bo_va-bo-is-non-NULL-before-using-i.patch
    (stable-fixes CVE-2024-41060 bsc#1228567).
  - Update
    patches.suse/filelock-fix-potential-use-after-free-in-posix_lock_inode.patch
    (git-fixes CVE-2024-41049 bsc#1228486).
  - Update
    patches.suse/firmware-cs_dsp-Fix-overflow-checking-of-wmfw-header.patch
    (git-fixes CVE-2024-41039 bsc#1228515).
  - Update
    patches.suse/firmware-cs_dsp-Prevent-buffer-overrun-when-processi.patch
    (git-fixes CVE-2024-41038 bsc#1228509).
  - Update
    patches.suse/firmware-cs_dsp-Return-error-if-block-header-overflo.patch
    (git-fixes CVE-2024-42238 bsc#1228991).
  - Update
    patches.suse/firmware-cs_dsp-Use-strnlen-on-name-fields-in-V1-wmf.patch
    (git-fixes CVE-2024-41056 bsc#1228480).
  - Update
    patches.suse/firmware-cs_dsp-Validate-payload-length-before-proce.patch
    (git-fixes CVE-2024-42237 bsc#1228992).
  - Update
    patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch
    (git-fixes CVE-2024-31076 bsc#1226765).
  - Update
    patches.suse/gpio-davinci-Validate-the-obtained-number-of-IRQs.patch
    (git-fixes CVE-2024-42092 bsc#1228447).
  - Update
    patches.suse/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-race.patch
    (stable-fixes CVE-2024-42253 bsc#1229005).
  - Update
    patches.suse/i2c-pnx-Fix-potential-deadlock-warning-from-del_time.patch
    (git-fixes CVE-2024-42153 bsc#1228510).
  - Update
    patches.suse/iio-chemical-bme680-Fix-overflows-in-compensate-func.patch
    (git-fixes CVE-2024-42086 bsc#1228452).
  - Update
    patches.suse/jffs2-Fix-potential-illegal-address-access-in-jffs2_free_inode.patch
    (git-fixes CVE-2024-42115 bsc#1228656).
  - Update
    patches.suse/libceph-fix-race-between-delayed_work-and-ceph_monc_s.patch
    (bsc#1228192 CVE-2024-42232 bsc#1228959).
  - Update
    patches.suse/media-dvb-frontends-tda10048-Fix-integer-overflow.patch
    (stable-fixes CVE-2024-42223 bsc#1228726).
  - Update
    patches.suse/misc-fastrpc-Fix-memory-leak-in-audio-daemon-attach-.patch
    (git-fixes CVE-2024-41025 bsc#1228527).
  - Update
    patches.suse/misc-fastrpc-Restrict-untrusted-app-to-attach-to-pri.patch
    (git-fixes CVE-2024-41024 bsc#1228525).
  - Update
    patches.suse/mm-Avoid-overflows-in-dirty-throttling-logic.patch
    (bsc#1222364 CVE-2024-26720 CVE-2024-42131 bsc#1228650).
  - Update
    patches.suse/msft-hv-3022-net-mana-Fix-possible-double-free-in-error-handling-.patch
    (git-fixes CVE-2024-42069 bsc#1228463).
  - Update
    patches.suse/net-can-j1939-Initialize-unused-data-in-j1939_send_o.patch
    (git-fixes CVE-2024-42076 bsc#1228484).
  - Update
    patches.suse/net-can-j1939-enhanced-error-handling-for-tightly-re.patch
    (git-fixes CVE-2023-52887 bsc#1228426).
  - Update
    patches.suse/nfc-nci-Add-the-inconsistency-check-between-the-inpu.patch
    (stable-fixes CVE-2024-42130 bsc#1228687).
  - Update
    patches.suse/nilfs2-add-missing-check-for-inode-numbers-on-direct.patch
    (stable-fixes CVE-2024-42104 bsc#1228654).
  - Update patches.suse/nvme-avoid-double-free-special-payload.patch
    (git-fixes CVE-2024-41073 bsc#1228635).
  - Update patches.suse/nvmet-always-initialize-cqe.result.patch
    (git-fixes CVE-2024-41079 bsc#1228615).
  - Update
    patches.suse/nvmet-fix-a-possible-leak-when-destroy-a-ctrl-during.patch
    (git-fixes CVE-2024-42152 bsc#1228724).
  - Update
    patches.suse/ocfs2-fix-DIO-failure-due-to-insufficient-transaction-credits.patch
    (git-fixes CVE-2024-42077 bsc#1228516).
  - Update
    patches.suse/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch
    (bsc#1228410 CVE-2024-41016).
  - Update patches.suse/orangefs-fix-out-of-bounds-fsid-access.patch
    (git-fixes CVE-2024-42143 bsc#1228748).
  - Update
    patches.suse/pinctrl-fix-deadlock-in-create_pinctrl-when-handling.patch
    (git-fixes CVE-2024-42090 bsc#1228449).
  - Update
    patches.suse/platform-x86-toshiba_acpi-Fix-array-out-of-bounds-ac.patch
    (git-fixes CVE-2024-41028 bsc#1228539).
  - Update
    patches.suse/powerpc-Avoid-nmi_enter-nmi_exit-in-real-mode-interr.patch
    (bsc#1221645 ltc#205739 bsc#1223191 CVE-2024-42126 bsc#1228718).
  - Update
    patches.suse/powerpc-pseries-Fix-scv-instruction-crash-with-kexec.patch
    (bsc#1194869 CVE-2024-42230 bsc#1228489).
  - Update
    patches.suse/thermal-drivers-mediatek-lvts_thermal-Check-NULL-ptr.patch
    (stable-fixes CVE-2024-42144 bsc#1228666).
  - Update
    patches.suse/usb-atm-cxacru-fix-endpoint-checking-in-cxacru_bind.patch
    (git-fixes CVE-2024-41097 bsc#1228513).
  - Update
    patches.suse/usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-.patch
    (git-fixes CVE-2024-42085 bsc#1228456).
  - Update
    patches.suse/usb-gadget-configfs-Prevent-OOB-read-write-in-usb_st.patch
    (stable-fixes CVE-2024-42236 bsc#1228964).
  - Update
    patches.suse/usb-xhci-prevent-potential-failure-in-handle_tx_even.patch
    (stable-fixes CVE-2024-42226 bsc#1228709).
  - Update
    patches.suse/wifi-cfg80211-restrict-NL80211_ATTR_TXQ_QUANTUM-valu.patch
    (git-fixes CVE-2024-42114 bsc#1228564).
  - Update
    patches.suse/wifi-cfg80211-wext-add-extra-SIOCSIWSCAN-data-check.patch
    (stable-fixes CVE-2024-41072 bsc#1228626).
  - Update
    patches.suse/wifi-mac80211-Avoid-address-calculations-via-out-of-.patch
    (stable-fixes CVE-2024-41071 bsc#1228625).
  - Update
    patches.suse/wifi-mt76-replace-skb_put-with-skb_put_zero.patch
    (stable-fixes CVE-2024-42225 bsc#1228710).
  - Update
    patches.suse/wifi-rtw89-fw-scan-offload-prohibit-all-6-GHz-channe.patch
    (bsc#1227149 CVE-2024-42125 bsc#1228674).
  - Update
    patches.suse/x86-bhi-Avoid-warning-in-DB-handler-due-to-BHI-mitigation
    (git-fixes CVE-2024-42240 bsc#1228966).
    Add CVE references.
  - commit dfa8582
  - Bluetooth: hci_sync: avoid dup filtering when passive scanning
    with adv monitor (git-fixes).
  - Bluetooth: l2cap: always unlock channel in
    l2cap_conless_channel() (git-fixes).
  - net: usb: qmi_wwan: fix memory leak for not ip packets
    (git-fixes).
  - padata: Fix possible divide-by-0 panic in padata_mt_helper()
    (git-fixes).
  - kcov: properly check for softirq context (git-fixes).
  - commit fc99a65
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses
    (CVE-2024-42247 bsc#1228988).
  - commit 12abe6d
  - selftests/bpf: Add netlink helper library (bsc#1228021
    CVE-2024-41010).
  - Fix BPF selftest build failure
  - commit c3e9de4
  - x86/numa: Fix the sort compare func used in numa_fill_memblks()
    (git-fixes).
  - x86/numa: Fix the address overlap check in numa_fill_memblks()
    (git-fixes).
  - commit b42baa2

++++ kernel-default:

  - kernel-binary.spec.in: Enable klp_symbols on openSUSE Tumbleweed (boo#1229042).
    After the Jump project the kernel used by SLE and openSUSE Leap are the
    same. As consequence the klp_symbols variable is set, enabling
    kernel-default-livepatch-devel on both SLE and openSUSE.
    The current rules to avoid enabling the package exclude openSUSE
    Tumbleweed alone, which doesn't makes sense for now. Enabling
    kernel-default-livepatch-devel on TW makes it easier to test the
    creation of kernel livepatches of the next SLE versions.
  - commit fd0b293
  - Split kABI workaround of recent hyperv fixes (bsc#1229040, bsc#1225745, CVE-2024-36911, bsc#1225717, CVE-2024-36910, bsc#1225744, CVE-2024-36909)
  - commit 3639306
  - Yet more build fix without patches.kabi (bsc#1226502)
  - commit 6bc3429
  - Fix build errors without patches.kabi (bsc#1226502)
    Now patches.suse/x86-Stop-using-weak-symbols-for-__iowrite32_copy.patch
    has a full backport and later partially reverted via
    patches.kabi/kabi-partial-revert-commit-20516d6e51dd.patch
  - commit 44c5e90
  - landlock: Fix d_parent walk (CVE-2024-40938 bsc#1227840).
  - commit 36de641
  - net: fix sk_memory_allocated_{add|sub} vs softirqs
    (bsc#1228757).
  - commit a963c0f
  - minmax: fix up min3() and max3() too (bsc#1229024).
  - minmax: improve macro expansion and type checking (bsc#1229024).
  - minmax: simplify min()/max()/clamp() implementation
    (bsc#1229024).
  - minmax: don't use max() in situations that want a C constant
    expression (bsc#1229024).
  - minmax: make generic MIN() and MAX() macros available everywhere
    (bsc#1229024).
  - minmax: simplify and clarify min_t()/max_t() implementation
    (bsc#1229024).
  - minmax: add a few more MIN_T/MAX_T users (bsc#1229024).
  - minmax: avoid overly complicated constant expressions in VM code
    (bsc#1229024).
  - drm/radeon/evergreen_cs: Clean up errors in evergreen_cs.c
    (bsc#1229024).
  - commit c64c296
  - Update
    patches.suse/ALSA-emux-improve-patch-ioctl-data-validation.patch
    (stable-fixes CVE-2024-42097 bsc#1228766).
  - Update
    patches.suse/ASoC-SOF-Intel-hda-fix-null-deref-on-system-suspend-.patch
    (git-fixes CVE-2024-41037 bsc#1228508).
  - Update
    patches.suse/ASoC-amd-acp-add-a-null-check-for-chip_pdev-structur.patch
    (git-fixes CVE-2024-42074 bsc#1228481).
  - Update
    patches.suse/ASoC-fsl-asoc-card-set-priv-pdev-before-using-it.patch
    (git-fixes CVE-2024-42089 bsc#1228450).
  - Update
    patches.suse/Bluetooth-ISO-Check-socket-flag-instead-of-hcon.patch
    (git-fixes CVE-2024-42141 bsc#1228502).
  - Update
    patches.suse/Bluetooth-Ignore-too-large-handle-values-in-BIG.patch
    (git-fixes CVE-2024-42133 bsc#1228511).
  - Update
    patches.suse/Bluetooth-hci_core-cancel-all-works-upon-hci_unregis.patch
    (stable-fixes CVE-2024-41063 bsc#1228580).
  - Update
    patches.suse/Bluetooth-qca-Fix-BT-enable-failure-again-for-QCA639.patch
    (git-fixes CVE-2024-42137 bsc#1228563).
  - Update patches.suse/PCI-MSI-Fix-UAF-in-msi_capability_init.patch
    (git-fixes CVE-2024-41096 bsc#1228479).
  - Update
    patches.suse/RDMA-restrack-Fix-potential-invalid-address-access.patch
    (git-fixes CVE-2024-42080 bsc#1228673).
  - Update
    patches.suse/USB-core-Fix-duplicate-endpoint-bug-by-clearing-rese.patch
    (git-fixes CVE-2024-41035 bsc#1228485).
  - Update patches.suse/USB-serial-mos7840-fix-crash-on-resume.patch
    (git-fixes CVE-2024-42244 bsc#1228967).
  - Update
    patches.suse/ata-libata-core-Fix-null-pointer-dereference-on-erro.patch
    (git-fixes CVE-2024-41098 bsc#1228467).
  - Update
    patches.suse/bluetooth-hci-disallow-setting-handle-bigger-than-HC.patch
    (git-fixes CVE-2024-42132 bsc#1228492).
  - Update
    patches.suse/bpf-Fail-bpf_timer_cancel-when-callback-is-being-can.patch
    (bsc#1228531 CVE-2024-41045 CVE-2024-42239 bsc#1228979).
  - Update
    patches.suse/can-mcp251xfd-fix-infinite-loop-when-xmit-fails.patch
    (git-fixes CVE-2024-41088 bsc#1228469).
  - Update
    patches.suse/cdrom-rearrange-last_media_change-check-to-avoid-uni.patch
    (stable-fixes CVE-2024-42136 bsc#1228758).
  - Update
    patches.suse/crypto-aead-cipher-zeroize-key-buffer-after-use.patch
    (stable-fixes CVE-2024-42229 bsc#1228708).
  - Update
    patches.suse/crypto-ecdh-explicitly-zeroize-private_key.patch
    (stable-fixes CVE-2024-42098 bsc#1228779).
  - Update
    patches.suse/drm-amd-display-ASSERT-when-failing-to-find-index-by.patch
    (stable-fixes CVE-2024-42117 bsc#1228582).
  - Update
    patches.suse/drm-amd-display-Check-index-msg_id-before-read-or-wr.patch
    (stable-fixes CVE-2024-42121 bsc#1228590).
  - Update
    patches.suse/drm-amd-display-Check-pipe-offset-before-setting-vbl.patch
    (stable-fixes CVE-2024-42120 bsc#1228588).
  - Update
    patches.suse/drm-amd-display-Fix-array-index-out-of-bounds-in-dml.patch
    (stable-fixes CVE-2024-41061 bsc#1228572).
  - Update
    patches.suse/drm-amd-display-Fix-overlapping-copy-within-dml_core.patch
    (stable-fixes CVE-2024-42227 bsc#1228707).
  - Update
    patches.suse/drm-amd-display-Skip-finding-free-audio-for-unknown-.patch
    (stable-fixes CVE-2024-42119 bsc#1228584).
  - Update
    patches.suse/drm-amd-display-Skip-pipe-if-the-pipe-idx-not-set-pr.patch
    (stable-fixes CVE-2024-42064 bsc#1228586).
  - Update
    patches.suse/drm-amdgpu-Fix-signedness-bug-in-sdma_v4_0_process_t.patch
    (git-fixes CVE-2024-41022 bsc#1228429).
  - Update
    patches.suse/drm-amdgpu-Using-uninitialized-value-size-when-calli.patch
    (stable-fixes CVE-2024-42228 bsc#1228667).
  - Update
    patches.suse/drm-amdgpu-avoid-using-null-object-of-framebuffer.patch
    (stable-fixes CVE-2024-41093 bsc#1228660).
  - Update
    patches.suse/drm-fbdev-dma-Only-set-smem_start-is-enable-per-modu.patch
    (git-fixes CVE-2024-41094 bsc#1228458).
  - Update
    patches.suse/drm-i915-gt-Fix-potential-UAF-by-revoke-of-fence-reg.patch
    (git-fixes CVE-2024-41092 bsc#1228483).
  - Update
    patches.suse/drm-lima-fix-shared-irq-handling-on-driver-remove.patch
    (stable-fixes CVE-2024-42127 bsc#1228721).
  - Update
    patches.suse/drm-nouveau-dispnv04-fix-null-pointer-dereference-in-66edf3f.patch
    (stable-fixes CVE-2024-41095 bsc#1228662).
  - Update
    patches.suse/drm-nouveau-dispnv04-fix-null-pointer-dereference-in.patch
    (stable-fixes CVE-2024-41089 bsc#1228658).
  - Update
    patches.suse/drm-nouveau-fix-null-pointer-dereference-in-nouveau_.patch
    (git-fixes CVE-2024-42101 bsc#1228495).
  - Update
    patches.suse/drm-panel-ilitek-ili9881c-Fix-warning-with-GPIO-cont.patch
    (stable-fixes CVE-2024-42087 bsc#1228677).
  - Update
    patches.suse/drm-radeon-check-bo_va-bo-is-non-NULL-before-using-i.patch
    (stable-fixes CVE-2024-41060 bsc#1228567).
  - Update
    patches.suse/filelock-fix-potential-use-after-free-in-posix_lock_inode.patch
    (git-fixes CVE-2024-41049 bsc#1228486).
  - Update
    patches.suse/firmware-cs_dsp-Fix-overflow-checking-of-wmfw-header.patch
    (git-fixes CVE-2024-41039 bsc#1228515).
  - Update
    patches.suse/firmware-cs_dsp-Prevent-buffer-overrun-when-processi.patch
    (git-fixes CVE-2024-41038 bsc#1228509).
  - Update
    patches.suse/firmware-cs_dsp-Return-error-if-block-header-overflo.patch
    (git-fixes CVE-2024-42238 bsc#1228991).
  - Update
    patches.suse/firmware-cs_dsp-Use-strnlen-on-name-fields-in-V1-wmf.patch
    (git-fixes CVE-2024-41056 bsc#1228480).
  - Update
    patches.suse/firmware-cs_dsp-Validate-payload-length-before-proce.patch
    (git-fixes CVE-2024-42237 bsc#1228992).
  - Update
    patches.suse/genirq-cpuhotplug-x86-vector-Prevent-vector-leak-dur.patch
    (git-fixes CVE-2024-31076 bsc#1226765).
  - Update
    patches.suse/gpio-davinci-Validate-the-obtained-number-of-IRQs.patch
    (git-fixes CVE-2024-42092 bsc#1228447).
  - Update
    patches.suse/gpio-pca953x-fix-pca953x_irq_bus_sync_unlock-race.patch
    (stable-fixes CVE-2024-42253 bsc#1229005).
  - Update
    patches.suse/i2c-pnx-Fix-potential-deadlock-warning-from-del_time.patch
    (git-fixes CVE-2024-42153 bsc#1228510).
  - Update
    patches.suse/iio-chemical-bme680-Fix-overflows-in-compensate-func.patch
    (git-fixes CVE-2024-42086 bsc#1228452).
  - Update
    patches.suse/jffs2-Fix-potential-illegal-address-access-in-jffs2_free_inode.patch
    (git-fixes CVE-2024-42115 bsc#1228656).
  - Update
    patches.suse/libceph-fix-race-between-delayed_work-and-ceph_monc_s.patch
    (bsc#1228192 CVE-2024-42232 bsc#1228959).
  - Update
    patches.suse/media-dvb-frontends-tda10048-Fix-integer-overflow.patch
    (stable-fixes CVE-2024-42223 bsc#1228726).
  - Update
    patches.suse/misc-fastrpc-Fix-memory-leak-in-audio-daemon-attach-.patch
    (git-fixes CVE-2024-41025 bsc#1228527).
  - Update
    patches.suse/misc-fastrpc-Restrict-untrusted-app-to-attach-to-pri.patch
    (git-fixes CVE-2024-41024 bsc#1228525).
  - Update
    patches.suse/mm-Avoid-overflows-in-dirty-throttling-logic.patch
    (bsc#1222364 CVE-2024-26720 CVE-2024-42131 bsc#1228650).
  - Update
    patches.suse/msft-hv-3022-net-mana-Fix-possible-double-free-in-error-handling-.patch
    (git-fixes CVE-2024-42069 bsc#1228463).
  - Update
    patches.suse/net-can-j1939-Initialize-unused-data-in-j1939_send_o.patch
    (git-fixes CVE-2024-42076 bsc#1228484).
  - Update
    patches.suse/net-can-j1939-enhanced-error-handling-for-tightly-re.patch
    (git-fixes CVE-2023-52887 bsc#1228426).
  - Update
    patches.suse/nfc-nci-Add-the-inconsistency-check-between-the-inpu.patch
    (stable-fixes CVE-2024-42130 bsc#1228687).
  - Update
    patches.suse/nilfs2-add-missing-check-for-inode-numbers-on-direct.patch
    (stable-fixes CVE-2024-42104 bsc#1228654).
  - Update patches.suse/nvme-avoid-double-free-special-payload.patch
    (git-fixes CVE-2024-41073 bsc#1228635).
  - Update patches.suse/nvmet-always-initialize-cqe.result.patch
    (git-fixes CVE-2024-41079 bsc#1228615).
  - Update
    patches.suse/nvmet-fix-a-possible-leak-when-destroy-a-ctrl-during.patch
    (git-fixes CVE-2024-42152 bsc#1228724).
  - Update
    patches.suse/ocfs2-fix-DIO-failure-due-to-insufficient-transaction-credits.patch
    (git-fixes CVE-2024-42077 bsc#1228516).
  - Update
    patches.suse/ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch
    (bsc#1228410 CVE-2024-41016).
  - Update patches.suse/orangefs-fix-out-of-bounds-fsid-access.patch
    (git-fixes CVE-2024-42143 bsc#1228748).
  - Update
    patches.suse/pinctrl-fix-deadlock-in-create_pinctrl-when-handling.patch
    (git-fixes CVE-2024-42090 bsc#1228449).
  - Update
    patches.suse/platform-x86-toshiba_acpi-Fix-array-out-of-bounds-ac.patch
    (git-fixes CVE-2024-41028 bsc#1228539).
  - Update
    patches.suse/powerpc-Avoid-nmi_enter-nmi_exit-in-real-mode-interr.patch
    (bsc#1221645 ltc#205739 bsc#1223191 CVE-2024-42126 bsc#1228718).
  - Update
    patches.suse/powerpc-pseries-Fix-scv-instruction-crash-with-kexec.patch
    (bsc#1194869 CVE-2024-42230 bsc#1228489).
  - Update
    patches.suse/thermal-drivers-mediatek-lvts_thermal-Check-NULL-ptr.patch
    (stable-fixes CVE-2024-42144 bsc#1228666).
  - Update
    patches.suse/usb-atm-cxacru-fix-endpoint-checking-in-cxacru_bind.patch
    (git-fixes CVE-2024-41097 bsc#1228513).
  - Update
    patches.suse/usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-.patch
    (git-fixes CVE-2024-42085 bsc#1228456).
  - Update
    patches.suse/usb-gadget-configfs-Prevent-OOB-read-write-in-usb_st.patch
    (stable-fixes CVE-2024-42236 bsc#1228964).
  - Update
    patches.suse/usb-xhci-prevent-potential-failure-in-handle_tx_even.patch
    (stable-fixes CVE-2024-42226 bsc#1228709).
  - Update
    patches.suse/wifi-cfg80211-restrict-NL80211_ATTR_TXQ_QUANTUM-valu.patch
    (git-fixes CVE-2024-42114 bsc#1228564).
  - Update
    patches.suse/wifi-cfg80211-wext-add-extra-SIOCSIWSCAN-data-check.patch
    (stable-fixes CVE-2024-41072 bsc#1228626).
  - Update
    patches.suse/wifi-mac80211-Avoid-address-calculations-via-out-of-.patch
    (stable-fixes CVE-2024-41071 bsc#1228625).
  - Update
    patches.suse/wifi-mt76-replace-skb_put-with-skb_put_zero.patch
    (stable-fixes CVE-2024-42225 bsc#1228710).
  - Update
    patches.suse/wifi-rtw89-fw-scan-offload-prohibit-all-6-GHz-channe.patch
    (bsc#1227149 CVE-2024-42125 bsc#1228674).
  - Update
    patches.suse/x86-bhi-Avoid-warning-in-DB-handler-due-to-BHI-mitigation
    (git-fixes CVE-2024-42240 bsc#1228966).
    Add CVE references.
  - commit dfa8582
  - Bluetooth: hci_sync: avoid dup filtering when passive scanning
    with adv monitor (git-fixes).
  - Bluetooth: l2cap: always unlock channel in
    l2cap_conless_channel() (git-fixes).
  - net: usb: qmi_wwan: fix memory leak for not ip packets
    (git-fixes).
  - padata: Fix possible divide-by-0 panic in padata_mt_helper()
    (git-fixes).
  - kcov: properly check for softirq context (git-fixes).
  - commit fc99a65
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses
    (CVE-2024-42247 bsc#1228988).
  - commit 12abe6d
  - selftests/bpf: Add netlink helper library (bsc#1228021
    CVE-2024-41010).
  - Fix BPF selftest build failure
  - commit c3e9de4
  - x86/numa: Fix the sort compare func used in numa_fill_memblks()
    (git-fixes).
  - x86/numa: Fix the address overlap check in numa_fill_memblks()
    (git-fixes).
  - commit b42baa2

++++ selinux-policy:

  - Update to version 20230523+git18.f44daf8a:
    * Provide type for sysstat lock files (bsc#1228247)

++++ selinux-policy:

  - Update to version 20230523+git18.f44daf8a:
    * Provide type for sysstat lock files (bsc#1228247)

++++ selinux-policy:

  - Update to version 20230523+git18.f44daf8a:
    * Provide type for sysstat lock files (bsc#1228247)

++++ selinux-policy:

  - Update to version 20230523+git18.f44daf8a:
    * Provide type for sysstat lock files (bsc#1228247)

++++ selinux-policy:

  - Update to version 20230523+git18.f44daf8a:
    * Provide type for sysstat lock files (bsc#1228247)

++++ selinux-policy:

  - Update to version 20230523+git18.f44daf8a:
    * Provide type for sysstat lock files (bsc#1228247)

------------------------------------------------------------------
------------------  2024-8-8  -  Aug 8 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.1.1 → 10.1.2
  - Improve error reporting for remote deployment
    Add new method called show_log_and_quit which displays
    the written error log file as a file box to the user
  - Update test-image-orthos integration test
    Update the test such that you can also build it locally.
    Change the remote installation target to be a ramdisk
    for easy testing of remote deployments
  - Setup default minimum volume size per filesystem
    The former method provided a static value but there are huge
    differences for the minimum size requirement of a filesystem.
    For example extX is fine with 30MB whereas XFS requires 300MB.
    This commit adds a more dynamic default value based on the
    used filesystem.

++++ python-kiwi:

  - Bump version: 10.1.1 → 10.1.2
  - Improve error reporting for remote deployment
    Add new method called show_log_and_quit which displays
    the written error log file as a file box to the user
  - Update test-image-orthos integration test
    Update the test such that you can also build it locally.
    Change the remote installation target to be a ramdisk
    for easy testing of remote deployments
  - Setup default minimum volume size per filesystem
    The former method provided a static value but there are huge
    differences for the minimum size requirement of a filesystem.
    For example extX is fine with 30MB whereas XFS requires 300MB.
    This commit adds a more dynamic default value based on the
    used filesystem.

++++ python-kiwi:

  - Bump version: 10.1.1 → 10.1.2
  - Improve error reporting for remote deployment
    Add new method called show_log_and_quit which displays
    the written error log file as a file box to the user
  - Update test-image-orthos integration test
    Update the test such that you can also build it locally.
    Change the remote installation target to be a ramdisk
    for easy testing of remote deployments
  - Setup default minimum volume size per filesystem
    The former method provided a static value but there are huge
    differences for the minimum size requirement of a filesystem.
    For example extX is fine with 30MB whereas XFS requires 300MB.
    This commit adds a more dynamic default value based on the
    used filesystem.

++++ kernel-default:

  - inet_diag: Initialize pad field in struct inet_diag_req_v2
    (CVE-2024-42106 bsc#1228493).
  - commit 87d015b
  - x86/numa: Fix SRAT lookup of CFMWS ranges with
    numa_fill_memblks() (git-fixes).
  - ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window
    (git-fixes).
  - x86/numa: Introduce numa_fill_memblks() (git-fixes).
  - commit 7f40727
  - ACPI: processor_idle: use raw_safe_halt() in
    acpi_idle_play_dead() (git-fixes).
  - perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for
    HIP08/09 (git-fixes).
  - commit 23f94eb
  - Update
    patches.suse/crypto-hisilicon-debugfs-Fix-debugfs-uninit-process-.patch
    (bsc#1228764 CVE-2024-42147).
  - commit 9b42aa7
  - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
    (bsc#1228446 CVE-2024-42095).
  - commit 6d3406b
  - serial: 8250_omap: Implementation of Errata i2310 (bsc#1228446
    CVE-2024-42095).
  - commit a3bd324
  - net/iucv: fix use after free in iucv_sock_close() (bsc#1228973).
  - commit c3ed1a0
  - s390/sclp: Fix sclp_init() cleanup on failure (bsc#1228579
    CVE-2024-41068).
  - commit a8db9f2
  - config.sh: generate and install compile_commands.json (bsc#1228971)
    This file contains the command line options used to compile every C file.
    It's useful for the livepatching team.
  - kernel-binary: generate and install compile_commands.json (bsc#1228971)
    This file contains the command line options used to compile every C file.
    It's useful for the livepatching team.
  - commit 15eff3e
  - irqdomain: Fixed unbalanced fwnode get and put (git-fixes).
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU
    offline (git-fixes).
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain
    aware (git-fixes).
  - genirq/matrix: Exclude managed interrupts in
    irq_matrix_allocated() (git-fixes).
  - commit 592adb3
  - selftests/bpf: Test pinning bpf timer to a core (bsc#1228531
    CVE-2024-41045).
  - Refresh patches.suse/selftests-bpf-Test-racing-between-bpf_timer_cancel_a.patch
  - commit 1026c30
  - bpf: Add ability to pin bpf timer to calling CPU (bsc#1228531
    CVE-2024-41045).
  - commit 060adb3
  - power: supply: qcom_battmgr: return EAGAIN when firmware
    service is not up (git-fixes).
  - power: supply: axp288_charger: Round constant_charge_voltage
    writes down (git-fixes).
  - power: supply: axp288_charger: Fix constant_charge_voltage
    writes (git-fixes).
  - commit 5ff04d3
  - selftests/bpf: Add timer lockup selftest (bsc#1228531
    CVE-2024-41045).
  - bpf: Defer work in bpf_timer_cancel_and_free (bsc#1228531
    CVE-2024-41045).
  - bpf: Fail bpf_timer_cancel when callback is being cancelled
    (bsc#1228531 CVE-2024-41045).
  - bpf: replace bpf_timer_cancel_and_free with a generic helper
    (bsc#1228531 CVE-2024-41045).
  - bpf: replace bpf_timer_set_callback with a generic helper
    (bsc#1228531 CVE-2024-41045).
  - bpf: replace bpf_timer_init with a generic helper (bsc#1228531
    CVE-2024-41045).
  - bpf: make timer data struct more generic (bsc#1228531
    CVE-2024-41045).
  - bpf: Check map->usercnt after timer->timer is assigned
    (bsc#1228531 CVE-2024-41045).
  - commit a65dc5b

++++ kernel-default:

  - inet_diag: Initialize pad field in struct inet_diag_req_v2
    (CVE-2024-42106 bsc#1228493).
  - commit 87d015b
  - x86/numa: Fix SRAT lookup of CFMWS ranges with
    numa_fill_memblks() (git-fixes).
  - ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window
    (git-fixes).
  - x86/numa: Introduce numa_fill_memblks() (git-fixes).
  - commit 7f40727
  - ACPI: processor_idle: use raw_safe_halt() in
    acpi_idle_play_dead() (git-fixes).
  - perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for
    HIP08/09 (git-fixes).
  - commit 23f94eb
  - Update
    patches.suse/crypto-hisilicon-debugfs-Fix-debugfs-uninit-process-.patch
    (bsc#1228764 CVE-2024-42147).
  - commit 9b42aa7
  - serial: 8250_omap: Fix Errata i2310 with RX FIFO level check
    (bsc#1228446 CVE-2024-42095).
  - commit 6d3406b
  - serial: 8250_omap: Implementation of Errata i2310 (bsc#1228446
    CVE-2024-42095).
  - commit a3bd324
  - net/iucv: fix use after free in iucv_sock_close() (bsc#1228973).
  - commit c3ed1a0
  - s390/sclp: Fix sclp_init() cleanup on failure (bsc#1228579
    CVE-2024-41068).
  - commit a8db9f2
  - config.sh: generate and install compile_commands.json (bsc#1228971)
    This file contains the command line options used to compile every C file.
    It's useful for the livepatching team.
  - kernel-binary: generate and install compile_commands.json (bsc#1228971)
    This file contains the command line options used to compile every C file.
    It's useful for the livepatching team.
  - commit 15eff3e
  - irqdomain: Fixed unbalanced fwnode get and put (git-fixes).
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU
    offline (git-fixes).
  - genirq/generic_chip: Make irq_remove_generic_chip() irqdomain
    aware (git-fixes).
  - genirq/matrix: Exclude managed interrupts in
    irq_matrix_allocated() (git-fixes).
  - commit 592adb3
  - selftests/bpf: Test pinning bpf timer to a core (bsc#1228531
    CVE-2024-41045).
  - Refresh patches.suse/selftests-bpf-Test-racing-between-bpf_timer_cancel_a.patch
  - commit 1026c30
  - bpf: Add ability to pin bpf timer to calling CPU (bsc#1228531
    CVE-2024-41045).
  - commit 060adb3
  - power: supply: qcom_battmgr: return EAGAIN when firmware
    service is not up (git-fixes).
  - power: supply: axp288_charger: Round constant_charge_voltage
    writes down (git-fixes).
  - power: supply: axp288_charger: Fix constant_charge_voltage
    writes (git-fixes).
  - commit 5ff04d3
  - selftests/bpf: Add timer lockup selftest (bsc#1228531
    CVE-2024-41045).
  - bpf: Defer work in bpf_timer_cancel_and_free (bsc#1228531
    CVE-2024-41045).
  - bpf: Fail bpf_timer_cancel when callback is being cancelled
    (bsc#1228531 CVE-2024-41045).
  - bpf: replace bpf_timer_cancel_and_free with a generic helper
    (bsc#1228531 CVE-2024-41045).
  - bpf: replace bpf_timer_set_callback with a generic helper
    (bsc#1228531 CVE-2024-41045).
  - bpf: replace bpf_timer_init with a generic helper (bsc#1228531
    CVE-2024-41045).
  - bpf: make timer data struct more generic (bsc#1228531
    CVE-2024-41045).
  - bpf: Check map->usercnt after timer->timer is assigned
    (bsc#1228531 CVE-2024-41045).
  - commit a65dc5b

++++ liburing:

  - Skip test buf-ring-nommap.t if ENOMEM appears (happens in ppc64le arch).
    * test-buf-ring-nommap-skip-the-test-on-queue-init-ENO.patch

------------------------------------------------------------------
------------------  2024-8-7  -  Aug 7 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Increase default volume size
    So far 30MB was set as default volume size which is by far
    too small for a number of filesystems, e.g btrfs and also XFS.
    This commit increases the default volume size such that all
    modern filesystems builds if the default volume size is used.
  - Update test-image-raid
    Apart from testing raid this integration test also tests
    a certain LVM volume setup. The test has been updated
    to use the btrfs filesystem because it has the most strict
    size requirements.

++++ python-kiwi:

  - Increase default volume size
    So far 30MB was set as default volume size which is by far
    too small for a number of filesystems, e.g btrfs and also XFS.
    This commit increases the default volume size such that all
    modern filesystems builds if the default volume size is used.
  - Update test-image-raid
    Apart from testing raid this integration test also tests
    a certain LVM volume setup. The test has been updated
    to use the btrfs filesystem because it has the most strict
    size requirements.

++++ python-kiwi:

  - Increase default volume size
    So far 30MB was set as default volume size which is by far
    too small for a number of filesystems, e.g btrfs and also XFS.
    This commit increases the default volume size such that all
    modern filesystems builds if the default volume size is used.
  - Update test-image-raid
    Apart from testing raid this integration test also tests
    a certain LVM volume setup. The test has been updated
    to use the btrfs filesystem because it has the most strict
    size requirements.

++++ kernel-default:

  - Move upstreamed sound patches into sorted section
  - commit df9598d
  - ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop
    16-n0xxx (bsc#1227182).
  - commit 645364b
  - tcp: avoid too many retransmit packets (CVE-2024-41007
    bsc#1227863).
  - commit 8f47fe6
  - mlxsw: core_linecards: Fix double memory deallocation in case
    of invalid INI file (CVE-2024-42138 bsc#1228500).
  - ice: Don't process extts if PTP is disabled (CVE-2024-42107
    bsc#1228494).
  - ice: Fix improper extts handling (CVE-2024-42139 bsc#1228503).
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx()
    from __netif_rx() (CVE-2024-42110 bsc#1228501).
  - net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
    (CVE-2024-42113 bsc#1228568).
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
    (CVE-2024-42148 bsc#1228487).
  - net/mlx5: E-switch, Create ingress ACL when needed
    (CVE-2024-42142 bsc#1228491).
  - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4
    systems (CVE-2024-42073 bsc#1228457).
  - gve: Account for stopped queues when reading NIC stats
    (CVE-2024-42162 bsc#1228706).
  - commit e94d07a
  - blacklist.conf: add some IRQ HANDLING ones
  - commit 404c094
  - packaging: Add case-sensitive perl option parsing
    A recent change in Getopt::Long [1]:
    Changes in version 2.55
  - ----------------------
    * Fix long standing bug that duplicate options were not detected
    when the options differ in case while ignore_case is in effect.
    This will now yield a warning and become a fatal error in a future
    release.
    perl defaults to ignore_case by default, switch it off to avoid
    accidental misparsing of options.
    This was suggested after similar change in scripts/.
  - commit e978477
  - xdp: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482
    CVE-2024-42082).
  - commit 73e7677
  - arm64: jump_label: Ensure patched jump_labels are visible to all CPUs (git-fixes)
  - commit 2480247
  - KVM: arm64: Fix clobbered ELR in sync abort/SError (git-fixes)
  - commit 90dba9e
  - bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (git-fixes)
  - commit e10a18b
  - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process (git-fixes)
  - commit bae6c4b
  - nvme-pci: do not directly handle subsys reset fallout
    (bsc#1220066).
  - commit 2082e5f
  - platform/x86/intel/ifs: Initialize union ifs_status to zero
    (git-fixes).
  - commit b291cc1

++++ kernel-default:

  - Move upstreamed sound patches into sorted section
  - commit df9598d
  - ASoC: amd: yc: Add quirk entry for OMEN by HP Gaming Laptop
    16-n0xxx (bsc#1227182).
  - commit 645364b
  - tcp: avoid too many retransmit packets (CVE-2024-41007
    bsc#1227863).
  - commit 8f47fe6
  - mlxsw: core_linecards: Fix double memory deallocation in case
    of invalid INI file (CVE-2024-42138 bsc#1228500).
  - ice: Don't process extts if PTP is disabled (CVE-2024-42107
    bsc#1228494).
  - ice: Fix improper extts handling (CVE-2024-42139 bsc#1228503).
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx()
    from __netif_rx() (CVE-2024-42110 bsc#1228501).
  - net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
    (CVE-2024-42113 bsc#1228568).
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
    (CVE-2024-42148 bsc#1228487).
  - net/mlx5: E-switch, Create ingress ACL when needed
    (CVE-2024-42142 bsc#1228491).
  - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4
    systems (CVE-2024-42073 bsc#1228457).
  - gve: Account for stopped queues when reading NIC stats
    (CVE-2024-42162 bsc#1228706).
  - commit e94d07a
  - blacklist.conf: add some IRQ HANDLING ones
  - commit 404c094
  - packaging: Add case-sensitive perl option parsing
    A recent change in Getopt::Long [1]:
    Changes in version 2.55
  - ----------------------
    * Fix long standing bug that duplicate options were not detected
    when the options differ in case while ignore_case is in effect.
    This will now yield a warning and become a fatal error in a future
    release.
    perl defaults to ignore_case by default, switch it off to avoid
    accidental misparsing of options.
    This was suggested after similar change in scripts/.
  - commit e978477
  - xdp: Remove WARN() from __xdp_reg_mem_model() (bsc#1228482
    CVE-2024-42082).
  - commit 73e7677
  - arm64: jump_label: Ensure patched jump_labels are visible to all CPUs (git-fixes)
  - commit 2480247
  - KVM: arm64: Fix clobbered ELR in sync abort/SError (git-fixes)
  - commit 90dba9e
  - bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG (git-fixes)
  - commit e10a18b
  - arm64: armv8_deprecated: Fix warning in isndep cpuhp starting process (git-fixes)
  - commit bae6c4b
  - nvme-pci: do not directly handle subsys reset fallout
    (bsc#1220066).
  - commit 2082e5f
  - platform/x86/intel/ifs: Initialize union ifs_status to zero
    (git-fixes).
  - commit b291cc1

++++ libdb-4_8:

  - Security fix: [bsc#1174414, CVE-2019-2708]
    * libdb: Data store execution leads to partial DoS
    * Backport the upsteam commits:
  - Fixed several possible crashes when running db_verify
    on a corrupted database. [#27864]
  - Fixed several possible hangs when running db_verify
    on a corrupted database. [#27864]
  - Added a warning message when attempting to verify a queue
    database which has many extent files. Verification will take
    a long time if there are many extent files. [#27864]
    * Add libdb-4_8-CVE-2019-2708.patch

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311-core:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ pam:

  - Prevent cursor escape from the login prompt [bsc#1194818]
    * Added: pam-bsc1194818-cursor-escape.patch

++++ pam:

  - Prevent cursor escape from the login prompt [bsc#1194818]
    * Added: pam-bsc1194818-cursor-escape.patch

++++ pam:

  - Prevent cursor escape from the login prompt [bsc#1194818]
    * Added: pam-bsc1194818-cursor-escape.patch

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

++++ python311:

  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - %{profileopt} variable is set according to the variable
    %{do_profiling} (bsc#1227999)

------------------------------------------------------------------
------------------  2024-8-6  -  Aug 6 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Use shutil.which for Path.which
  - Drop Path.remove & Path.rename
    Both methods were only used in one place each and it makes much more sense to
    use the pathlib builtin methods instead
  - Replace Path.create implementation with pathlib builtin
  - Bump version: 10.1.0 → 10.1.1

++++ python-kiwi:

  - Use shutil.which for Path.which
  - Drop Path.remove & Path.rename
    Both methods were only used in one place each and it makes much more sense to
    use the pathlib builtin methods instead
  - Replace Path.create implementation with pathlib builtin
  - Bump version: 10.1.0 → 10.1.1

++++ python-kiwi:

  - Use shutil.which for Path.which
  - Drop Path.remove & Path.rename
    Both methods were only used in one place each and it makes much more sense to
    use the pathlib builtin methods instead
  - Replace Path.create implementation with pathlib builtin
  - Bump version: 10.1.0 → 10.1.1

++++ kernel-default:

  - scsi: qedi: Fix crash while reading debugfs attribute
    (bsc#1227929 CVE-2024-40978).
  - block/ioctl: prefer different overflow check (bsc#1227867
    CVE-2024-41000).
  - commit 4cc5e60
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
    (CVE-2024-40995 bsc#1227830).
  - commit 0580a17
  - PCI: hv: Return zero, not garbage, when reading
    PCI_INTERRUPT_PIN (git-fixes).
  - RDMA/mana_ib: Use virtual address in dma regions for MRs
    (git-fixes).
  - commit 9336dc6
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
    (bsc#1228756 CVE-2024-42161).
  - commit 64d3ad2
  - ASoC: topology: Fix route memory corruption (CVE-2024-41069
    bsc#1228644).
  - ASoC: topology: Clean up route loading (CVE-2024-41069
    bsc#1228644).
  - commit 30d44d4
  - md-cluster: keeping kabi compatibility for upstream commit
    35a0a409fa26 (bsc#1223395).
  - md-cluster: fix no recovery job when adding/re-adding a disk
    (bsc#1223395).
  - md-cluster: fix hanging issue while a new disk adding
    (bsc#1223395).
  - commit dac906f
  - tools/perf: Fix timing issue with parallel threads in perf
    bench wake-up-parallel (bsc#1227747).
  - tools/perf: Fix perf bench epoll to enable the run when some
    CPU's are offline (bsc#1227747).
  - tools/perf: Fix perf bench futex to enable the run when some
    CPU's are offline (bsc#1227747).
  - commit 7bc1e4f

++++ kernel-default:

  - scsi: qedi: Fix crash while reading debugfs attribute
    (bsc#1227929 CVE-2024-40978).
  - block/ioctl: prefer different overflow check (bsc#1227867
    CVE-2024-41000).
  - commit 4cc5e60
  - tipc: force a dst refcount before doing decryption (CVE-2024-40983 bsc#1227819).
  - commit cee1bad
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
    (CVE-2024-40995 bsc#1227830).
  - commit 0580a17
  - PCI: hv: Return zero, not garbage, when reading
    PCI_INTERRUPT_PIN (git-fixes).
  - RDMA/mana_ib: Use virtual address in dma regions for MRs
    (git-fixes).
  - commit 9336dc6
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
    (bsc#1228756 CVE-2024-42161).
  - commit 64d3ad2
  - ASoC: topology: Fix route memory corruption (CVE-2024-41069
    bsc#1228644).
  - ASoC: topology: Clean up route loading (CVE-2024-41069
    bsc#1228644).
  - commit 30d44d4
  - md-cluster: keeping kabi compatibility for upstream commit
    35a0a409fa26 (bsc#1223395).
  - md-cluster: fix no recovery job when adding/re-adding a disk
    (bsc#1223395).
  - md-cluster: fix hanging issue while a new disk adding
    (bsc#1223395).
  - commit dac906f
  - tools/perf: Fix timing issue with parallel threads in perf
    bench wake-up-parallel (bsc#1227747).
  - tools/perf: Fix perf bench epoll to enable the run when some
    CPU's are offline (bsc#1227747).
  - tools/perf: Fix perf bench futex to enable the run when some
    CPU's are offline (bsc#1227747).
  - commit 7bc1e4f

------------------------------------------------------------------
------------------  2024-8-5  -  Aug 5 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240805.7513b28:
    * Remove obsolete resolv+ manual page
    * Remove obsolete defaultdomain.5 manual page
    * Move /etc/skel to /usr/etc/skel (hermetic-usr)
    * Remove obsolete refresh_initrd
    * Add deprecation notice for service [jsc#PED-266]

++++ afterburn:

  - enable upstream tests

++++ afterburn:

  - enable upstream tests

++++ avahi:

  - Add avahi-CVE-2023-38471.patch: Extract host name using
    avahi_unescape_label (bsc#1216594, CVE-2023-38471).
  - Add avahi-CVE-2023-38469.patch: Reject overly long TXT resource
    records (bsc#1216598, CVE-2023-38469).
  - Add avahi-filter-bogus-services.patch: no longer supply bogus
    services to callbacks (bsc#1226586).

++++ python-kiwi:

  - Mandatory package scripts for Debian bootstrap
    Make sure to run some mandatory package pre/post scripts
    such that settings like /etc/passwd, a root user, etc..
    exists. This action can also be done in post_bootstrap.sh
    but I think it's better to do this in the core code
  - Bump version: 10.0.28 → 10.1.0
  - kiwi no longer uses debootstrap
    For building Debian based images we used debootstrap to
    bootstrap an empty root until apt-get could be used to
    complete the job. This has now changed such hat apt-get
    is also used for bootstrapping a new system. The concept
    and also potential alternatives to the way kiwi bootstraps
    Debian based systems can be found here:
    * https://osinside.github.io/kiwi/working_with_images/build_without_debianbootstrap.html
    Due to the drop of debootstrap it might happen that
    package lists of existing image descriptions needs to be
    extended with packages that were formerly pulled in by
    debootstrap but did not get properly pulled in with the
    new apt based bootstrap. As reference please check out the
    integration tests from here:
    * https://github.com/OSInside/kiwi/tree/main/build-tests/x86/ubuntu
    * https://github.com/OSInside/kiwi/tree/main/build-tests/x86/debian
    Thanks
  - Bump version: 10.0.27 → 10.0.28

++++ python-kiwi:

  - Mandatory package scripts for Debian bootstrap
    Make sure to run some mandatory package pre/post scripts
    such that settings like /etc/passwd, a root user, etc..
    exists. This action can also be done in post_bootstrap.sh
    but I think it's better to do this in the core code
  - Bump version: 10.0.28 → 10.1.0
  - kiwi no longer uses debootstrap
    For building Debian based images we used debootstrap to
    bootstrap an empty root until apt-get could be used to
    complete the job. This has now changed such hat apt-get
    is also used for bootstrapping a new system. The concept
    and also potential alternatives to the way kiwi bootstraps
    Debian based systems can be found here:
    * https://osinside.github.io/kiwi/working_with_images/build_without_debianbootstrap.html
    Due to the drop of debootstrap it might happen that
    package lists of existing image descriptions needs to be
    extended with packages that were formerly pulled in by
    debootstrap but did not get properly pulled in with the
    new apt based bootstrap. As reference please check out the
    integration tests from here:
    * https://github.com/OSInside/kiwi/tree/main/build-tests/x86/ubuntu
    * https://github.com/OSInside/kiwi/tree/main/build-tests/x86/debian
    Thanks
  - Bump version: 10.0.27 → 10.0.28

++++ python-kiwi:

  - Mandatory package scripts for Debian bootstrap
    Make sure to run some mandatory package pre/post scripts
    such that settings like /etc/passwd, a root user, etc..
    exists. This action can also be done in post_bootstrap.sh
    but I think it's better to do this in the core code
  - Bump version: 10.0.28 → 10.1.0
  - kiwi no longer uses debootstrap
    For building Debian based images we used debootstrap to
    bootstrap an empty root until apt-get could be used to
    complete the job. This has now changed such hat apt-get
    is also used for bootstrapping a new system. The concept
    and also potential alternatives to the way kiwi bootstraps
    Debian based systems can be found here:
    * https://osinside.github.io/kiwi/working_with_images/build_without_debianbootstrap.html
    Due to the drop of debootstrap it might happen that
    package lists of existing image descriptions needs to be
    extended with packages that were formerly pulled in by
    debootstrap but did not get properly pulled in with the
    new apt based bootstrap. As reference please check out the
    integration tests from here:
    * https://github.com/OSInside/kiwi/tree/main/build-tests/x86/ubuntu
    * https://github.com/OSInside/kiwi/tree/main/build-tests/x86/debian
    Thanks
  - Bump version: 10.0.27 → 10.0.28

++++ kernel-default:

  - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
    (bsc#1194869).
  - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3
    (bsc#1194869).
  - commit f36d7ca
  - KVM: PPC: Book3S HV: Handle pending exceptions on guest entry
    with MSR_EE (bsc#1215199).
  - commit 6051d0b
  - blacklist.conf: KVM PPC APIv2 enablement not included.
  - commit b36c39a
  - liquidio: Adjust a NULL pointer handling path in
    lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729).
  - commit 6f4e943
  - kabi/severity: add nvme common code
    The nvme common code is also allowed to change the data structures, there
    are only internal users.
  - commit 3abdbd5
  - apparmor: unpack transition table if dfa is not present
    (bsc#1226031).
  - commit 10a598f
  - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857).
  - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper
    endian macro usages (bsc#1228857).
  - scsi: lpfc: Fix incorrect request len mbox field when setting
    trunking via sysfs (bsc#1228857).
  - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
    (bsc#1228857).
  - scsi: lpfc: Fix handling of fully recovered fabric node in
    dev_loss callbk (bsc#1228857).
  - scsi: lpfc: Relax PRLI issue conditions after GID_FT response
    (bsc#1228857).
  - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if
    in PRLI_ISSUE state (bsc#1228857).
  - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI
    port is inactive (bsc#1228857).
  - commit c4b9763
  - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).
  - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).
  - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).
  - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).
  - scsi: qla2xxx: Fix optrom version displayed in FDMI
    (bsc#1228850).
  - scsi: qla2xxx: During vport delete send async logout explicitly
    (bsc#1228850).
  - scsi: qla2xxx: Complete command early within lock (bsc#1228850).
  - scsi: qla2xxx: Fix flash read failure (bsc#1228850).
  - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for
    ELS cmds (bsc#1228850).
  - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).
  - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).
  - scsi: qla2xxx: Unable to act on RSCN for port online
    (bsc#1228850).
  - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple'
    (bsc#1228850).
  - scsi: qla2xxx: Fix debugfs output for fw_resource_count
    (bsc#1228850).
  - scsi: qla2xxx: Indent help text (bsc#1228850).
  - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).
  - scsi: qla2xxx: Avoid possible run-time warning with long
    model_num (bsc#1228850).
  - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228849).
  - commit 072d194
  - nvme-pci: add missing condition check for existence of mapped
    data (git-fixes).
  - nvme-pci: Fix the instructions for disabling power management
    (git-fixes).
  - nvmet-auth: fix nvmet_auth hash error handling (git-fixes).
  - nvmet: make 'tsas' attribute idempotent for RDMA (git-fixes).
  - nvme: fixup comment for nvme RDMA Provider Type (git-fixes).
  - nvmet: do not return 'reserved' for empty TSAS values
    (git-fixes).
  - nvme: fix NVME_NS_DEAC may incorrectly identifying the disk
    as EXT_LBA (git-fixes).
  - nvmet: always initialize cqe.result (git-fixes).
  - nvme: avoid double free special payload (git-fixes).
  - nvmet: fix a possible leak when destroy a ctrl during qp
    establishment (git-fixes).
  - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
    (git-fixes).
  - nvme-multipath: find NUMA path only for online numa-node
    (git-fixes).
  - commit 7935501
  - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN
    Mainline commit f2f6a8e88717 ("init/Kconfig: remove
    CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced
    GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both
    when checking config changes.
  - commit b60be3e

++++ kernel-default:

  - powerpc: fix a file leak in kvm_vcpu_ioctl_enable_cap()
    (bsc#1194869).
  - KVM: PPC: Book3S HV: Fix the set_one_reg for MMCR3
    (bsc#1194869).
  - commit f36d7ca
  - KVM: PPC: Book3S HV: Handle pending exceptions on guest entry
    with MSR_EE (bsc#1215199).
  - commit 6051d0b
  - blacklist.conf: KVM PPC APIv2 enablement not included.
  - commit b36c39a
  - liquidio: Adjust a NULL pointer handling path in
    lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729).
  - commit 6f4e943
  - kabi/severity: add nvme common code
    The nvme common code is also allowed to change the data structures, there
    are only internal users.
  - commit 3abdbd5
  - apparmor: unpack transition table if dfa is not present
    (bsc#1226031).
  - commit 10a598f
  - scsi: lpfc: Update lpfc version to 14.4.0.3 (bsc#1228857).
  - scsi: lpfc: Revise lpfc_prep_embed_io routine with proper
    endian macro usages (bsc#1228857).
  - scsi: lpfc: Fix incorrect request len mbox field when setting
    trunking via sysfs (bsc#1228857).
  - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
    (bsc#1228857).
  - scsi: lpfc: Fix handling of fully recovered fabric node in
    dev_loss callbk (bsc#1228857).
  - scsi: lpfc: Relax PRLI issue conditions after GID_FT response
    (bsc#1228857).
  - scsi: lpfc: Allow DEVICE_RECOVERY mode after RSCN receipt if
    in PRLI_ISSUE state (bsc#1228857).
  - scsi: lpfc: Cancel ELS WQE instead of issuing abort when SLI
    port is inactive (bsc#1228857).
  - commit c4b9763
  - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).
  - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).
  - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).
  - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).
  - scsi: qla2xxx: Fix optrom version displayed in FDMI
    (bsc#1228850).
  - scsi: qla2xxx: During vport delete send async logout explicitly
    (bsc#1228850).
  - scsi: qla2xxx: Complete command early within lock (bsc#1228850).
  - scsi: qla2xxx: Fix flash read failure (bsc#1228850).
  - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for
    ELS cmds (bsc#1228850).
  - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).
  - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).
  - scsi: qla2xxx: Unable to act on RSCN for port online
    (bsc#1228850).
  - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple'
    (bsc#1228850).
  - scsi: qla2xxx: Fix debugfs output for fw_resource_count
    (bsc#1228850).
  - scsi: qla2xxx: Indent help text (bsc#1228850).
  - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).
  - scsi: qla2xxx: Avoid possible run-time warning with long
    model_num (bsc#1228850).
  - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228849).
  - commit 072d194
  - nvme-pci: add missing condition check for existence of mapped
    data (git-fixes).
  - nvme-pci: Fix the instructions for disabling power management
    (git-fixes).
  - nvmet-auth: fix nvmet_auth hash error handling (git-fixes).
  - nvmet: make 'tsas' attribute idempotent for RDMA (git-fixes).
  - nvme: fixup comment for nvme RDMA Provider Type (git-fixes).
  - nvmet: do not return 'reserved' for empty TSAS values
    (git-fixes).
  - nvme: fix NVME_NS_DEAC may incorrectly identifying the disk
    as EXT_LBA (git-fixes).
  - nvmet: always initialize cqe.result (git-fixes).
  - nvme: avoid double free special payload (git-fixes).
  - nvmet: fix a possible leak when destroy a ctrl during qp
    establishment (git-fixes).
  - nvme: adjust multiples of NVME_CTRL_PAGE_SIZE in offset
    (git-fixes).
  - nvme-multipath: find NUMA path only for online numa-node
    (git-fixes).
  - commit 7935501
  - check-for-config-changes: ignore also GCC_ASM_GOTO_OUTPUT_BROKEN
    Mainline commit f2f6a8e88717 ("init/Kconfig: remove
    CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND") replaced
    GCC_ASM_GOTO_OUTPUT_WORKAROUND with GCC_ASM_GOTO_OUTPUT_BROKEN. Ignore both
    when checking config changes.
  - commit b60be3e

++++ libzypp:

  - single_rpmtrans: fix installation of .src.rpms (bsc#1228647)
  - version 17.35.9 (35)

++++ libzypp:

  - single_rpmtrans: fix installation of .src.rpms (bsc#1228647)
  - version 17.35.9 (35)

++++ libzypp:

  - single_rpmtrans: fix installation of .src.rpms (bsc#1228647)
  - version 17.35.9 (35)

++++ libzypp:

  - single_rpmtrans: fix installation of .src.rpms (bsc#1228647)
  - version 17.35.9 (35)

++++ libzypp:

  - single_rpmtrans: fix installation of .src.rpms (bsc#1228647)
  - version 17.35.9 (35)

++++ python-PyJWT:

  - Update to version 2.9.0
    * Drop support for Python 3.7 (EOL) by @hugovk in #910
    * Allow JWT issuer claim validation to accept a list of
    strings too by @mattpollak in #913
    * Fix unnecessary string concatenation by @sirosen in #904
    * Fix docs for ``jwt.decode_complete`` to include ``strict_aud``
    option by @woodruffw in #923
    * Fix docs step by @jpadilla in #950
    * Fix: Remove an unused variable from example code block
    by @kenkoooo in #958
    * Add support for Python 3.12 by @hugovk in #910
    * Improve performance of ``is_ssh_key`` + add unit test by @bdraco in #940
    * Allow ``jwt.decode()`` to accept a PyJWK object by @luhn in #886
    * Make ``algorithm_name`` attribute available on PyJWK by @luhn in #886
    * Raise ``InvalidKeyError`` on invalid PEM keys to be compatible
    with cryptography 42.x.x by @CollinEMac in #952
    * Raise an exception when required cryptography dependency
    is missing by @tobloef in #963

++++ python-PyJWT:

  - Update to version 2.9.0
    * Drop support for Python 3.7 (EOL) by @hugovk in #910
    * Allow JWT issuer claim validation to accept a list of
    strings too by @mattpollak in #913
    * Fix unnecessary string concatenation by @sirosen in #904
    * Fix docs for ``jwt.decode_complete`` to include ``strict_aud``
    option by @woodruffw in #923
    * Fix docs step by @jpadilla in #950
    * Fix: Remove an unused variable from example code block
    by @kenkoooo in #958
    * Add support for Python 3.12 by @hugovk in #910
    * Improve performance of ``is_ssh_key`` + add unit test by @bdraco in #940
    * Allow ``jwt.decode()`` to accept a PyJWK object by @luhn in #886
    * Make ``algorithm_name`` attribute available on PyJWK by @luhn in #886
    * Raise ``InvalidKeyError`` on invalid PEM keys to be compatible
    with cryptography 42.x.x by @CollinEMac in #952
    * Raise an exception when required cryptography dependency
    is missing by @tobloef in #963

------------------------------------------------------------------
------------------  2024-8-4  -  Aug 4 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - RDMA: Fix netdev tracker in ib_device_set_netdev (git-fixes)
  - commit 3130571
  - bnxt_re: Fix imm_data endianness (git-fixes)
  - commit 49ce7dd
  - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes)
  - commit 09de886
  - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes)
  - commit 9e511e1
  - RDMA/hns: Fix undifined behavior caused by invalid max_sge (git-fixes)
  - commit 75c8a8f
  - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 (git-fixes)
  - commit f76d2ac
  - RDMA/hns: Fix missing pagesize and alignment check in FRMR (git-fixes)
  - commit 3200c5d
  - RDMA/hns: Fix unmatch exception handling when init eq table fails (git-fixes)
  - commit 1c3f5bc
  - RDMA/hns: Fix soft lockup under heavy CEQE load (git-fixes)
  - commit bae3b01
  - RDMA/hns: Check atomic wr length (git-fixes)
  - commit 53b999f
  - RDMA/device: Return error earlier if port in not valid (git-fixes)
  - commit 1a6c9cf
  - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs (git-fixes)
  - commit ecbc61e
  - RDMA/mlx4: Fix truncated output warning in alias_GUID.c (git-fixes)
  - commit 9a0a984
  - RDMA/mlx4: Fix truncated output warning in mad.c (git-fixes)
  - commit e923a91
  - RDMA/cache: Release GID table even if leak is detected (git-fixes)
  - commit e73316e
  - RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE (git-fixes)
  - commit ee50dd0
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (git-fixes)
  - commit 6b71029
  - IB/core: Implement a limit on UMAD receive List (bsc#1228743 CVE-2024-42145)
  - commit 673df57
  - xfs: convert comma to semicolon (git-fixes).
  - commit 8f18daf
  - hfs: fix to initialize fields of hfs_inode_info after
    hfs_alloc_inode() (git-fixes).
  - commit 1aa4511
  - kABI workaround for sound core UMP conversion (stable-fixes).
  - commit b9e008a
  - ALSA: seq: ump: Explicitly reset RPN with Null RPN
    (stable-fixes).
  - ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data
    reception (stable-fixes).
  - ALSA: seq: ump: Use the common RPN/bank conversion context
    (stable-fixes).
  - ALSA: ump: Explicitly reset RPN with Null RPN (stable-fixes).
  - ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data
    reception (stable-fixes).
  - commit 508da4c
  - kabi/severities: ignore kABI for FireWire sound local symbols (bsc#1208783)
  - commit 041506f
  - Drop doubly put References tags in sound patches
  - commit 92b6eba
  - Revert "ALSA: firewire-lib: operate for period elapse event
    in process context" (bsc#1208783).
  - commit 2045d7f
  - Revert "ALSA: firewire-lib: obsolete workqueue for period
    update" (bsc#1208783).
  - commit 09a87ea
  - spi: microchip-core: switch to use modern name (stable-fixes).
  - Refresh
    patches.suse/spi-microchip-core-defer-asserting-chip-select-until.patch.
  - commit 31d15b3
  - spi: microchip-core: fix init function not setting the master
    and motorola modes (git-fixes).
  - drm/amdgpu: reset vm state machine after gpu reset(vram lost)
    (stable-fixes).
  - drm/amd/display: Check for NULL pointer (stable-fixes).
  - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell
    (stable-fixes).
  - efi/libstub: Zero initialize heap allocated struct screen_info
    (git-fixes).
  - PCI: loongson: Enable MSI in LS7A Root Complex (stable-fixes).
  - dev/parport: fix the array out-of-bounds risk (stable-fixes).
  - clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer
    the error (git-fixes).
  - clk: qcom: Park shared RCGs upon registration (git-fixes).
  - clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's
    (git-fixes).
  - clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during
    disable (git-fixes).
  - clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and
    ALWAYS_ON flags (git-fixes).
  - clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and
    flags (git-fixes).
  - clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during
    disable (git-fixes).
  - clk: qcom: camcc-sc7280: Add parent dependency to all camera
    GDSCs (git-fixes).
  - clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE
    clock (git-fixes).
  - clk: en7523: fix rate divider for slic and spi clocks
    (git-fixes).
  - drm/etnaviv: don't block scheduler when GPU is still active
    (stable-fixes).
  - media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920
    (git-fixes).
  - media: uvcvideo: Quirk for invalid dev_sof in Logitech C922
    (stable-fixes).
  - ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no
    error (stable-fixes).
  - ata: libata-scsi: Do not overwrite valid sense data when
    CK_COND=1 (stable-fixes).
  - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
    (stable-fixes).
  - Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device
    tables (stable-fixes).
  - wifi: rtw88: usb: Fix disconnection after beacon loss
    (stable-fixes).
  - media: uvcvideo: Disable autosuspend for Insta360 Link
    (stable-fixes).
  - sbitmap: use READ_ONCE to access map->word (stable-fixes).
  - Bluetooth: Add device 13d3:3572 IMC Networks Bluetooth Radio
    (stable-fixes).
  - commit 5fabaee

++++ kernel-default:

  - RDMA: Fix netdev tracker in ib_device_set_netdev (git-fixes)
  - commit 3130571
  - bnxt_re: Fix imm_data endianness (git-fixes)
  - commit 49ce7dd
  - RDMA/hns: Fix mbx timing out before CMD execution is completed (git-fixes)
  - commit 09de886
  - RDMA/hns: Fix insufficient extend DB for VFs. (git-fixes)
  - commit 9e511e1
  - RDMA/hns: Fix undifined behavior caused by invalid max_sge (git-fixes)
  - commit 75c8a8f
  - RDMA/hns: Fix shift-out-bounds when max_inline_data is 0 (git-fixes)
  - commit f76d2ac
  - RDMA/hns: Fix missing pagesize and alignment check in FRMR (git-fixes)
  - commit 3200c5d
  - RDMA/hns: Fix unmatch exception handling when init eq table fails (git-fixes)
  - commit 1c3f5bc
  - RDMA/hns: Fix soft lockup under heavy CEQE load (git-fixes)
  - commit bae3b01
  - RDMA/hns: Check atomic wr length (git-fixes)
  - commit 53b999f
  - RDMA/device: Return error earlier if port in not valid (git-fixes)
  - commit 1a6c9cf
  - RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs (git-fixes)
  - commit ecbc61e
  - RDMA/mlx4: Fix truncated output warning in alias_GUID.c (git-fixes)
  - commit 9a0a984
  - RDMA/mlx4: Fix truncated output warning in mad.c (git-fixes)
  - commit e923a91
  - RDMA/cache: Release GID table even if leak is detected (git-fixes)
  - commit e73316e
  - RDMA/mlx5: Set mkeys for dmabuf at PAGE_SIZE (git-fixes)
  - commit ee50dd0
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (git-fixes)
  - commit 6b71029
  - IB/core: Implement a limit on UMAD receive List (bsc#1228743 CVE-2024-42145)
  - commit 673df57
  - xfs: convert comma to semicolon (git-fixes).
  - commit 8f18daf
  - hfs: fix to initialize fields of hfs_inode_info after
    hfs_alloc_inode() (git-fixes).
  - commit 1aa4511
  - kABI workaround for sound core UMP conversion (stable-fixes).
  - commit b9e008a
  - ALSA: seq: ump: Explicitly reset RPN with Null RPN
    (stable-fixes).
  - ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data
    reception (stable-fixes).
  - ALSA: seq: ump: Use the common RPN/bank conversion context
    (stable-fixes).
  - ALSA: ump: Explicitly reset RPN with Null RPN (stable-fixes).
  - ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data
    reception (stable-fixes).
  - commit 508da4c
  - kabi/severities: ignore kABI for FireWire sound local symbols (bsc#1208783)
  - commit 041506f
  - Drop doubly put References tags in sound patches
  - commit 92b6eba
  - Revert "ALSA: firewire-lib: operate for period elapse event
    in process context" (bsc#1208783).
  - commit 2045d7f
  - Revert "ALSA: firewire-lib: obsolete workqueue for period
    update" (bsc#1208783).
  - commit 09a87ea
  - spi: microchip-core: switch to use modern name (stable-fixes).
  - Refresh
    patches.suse/spi-microchip-core-defer-asserting-chip-select-until.patch.
  - commit 31d15b3
  - spi: microchip-core: fix init function not setting the master
    and motorola modes (git-fixes).
  - drm/amdgpu: reset vm state machine after gpu reset(vram lost)
    (stable-fixes).
  - drm/amd/display: Check for NULL pointer (stable-fixes).
  - drm/amdgpu/sdma5.2: Update wptr registers as well as doorbell
    (stable-fixes).
  - efi/libstub: Zero initialize heap allocated struct screen_info
    (git-fixes).
  - PCI: loongson: Enable MSI in LS7A Root Complex (stable-fixes).
  - dev/parport: fix the array out-of-bounds risk (stable-fixes).
  - clk: qcom: kpss-xcc: Return of_clk_add_hw_provider to transfer
    the error (git-fixes).
  - clk: qcom: Park shared RCGs upon registration (git-fixes).
  - clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's
    (git-fixes).
  - clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during
    disable (git-fixes).
  - clk: qcom: gpucc-sa8775p: Remove the CLK_IS_CRITICAL and
    ALWAYS_ON flags (git-fixes).
  - clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and
    flags (git-fixes).
  - clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during
    disable (git-fixes).
  - clk: qcom: camcc-sc7280: Add parent dependency to all camera
    GDSCs (git-fixes).
  - clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE
    clock (git-fixes).
  - clk: en7523: fix rate divider for slic and spi clocks
    (git-fixes).
  - drm/etnaviv: don't block scheduler when GPU is still active
    (stable-fixes).
  - media: uvcvideo: Add quirk for invalid dev_sof in Logitech C920
    (git-fixes).
  - media: uvcvideo: Quirk for invalid dev_sof in Logitech C922
    (stable-fixes).
  - ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no
    error (stable-fixes).
  - ata: libata-scsi: Do not overwrite valid sense data when
    CK_COND=1 (stable-fixes).
  - Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591
    (stable-fixes).
  - Bluetooth: btusb: Add RTL8852BE device 0489:e125 to device
    tables (stable-fixes).
  - wifi: rtw88: usb: Fix disconnection after beacon loss
    (stable-fixes).
  - media: uvcvideo: Disable autosuspend for Insta360 Link
    (stable-fixes).
  - sbitmap: use READ_ONCE to access map->word (stable-fixes).
  - Bluetooth: Add device 13d3:3572 IMC Networks Bluetooth Radio
    (stable-fixes).
  - commit 5fabaee

------------------------------------------------------------------
------------------  2024-8-3  -  Aug 3 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update documentation
    kiwi no longer uses debootstrap

++++ python-kiwi:

  - Update documentation
    kiwi no longer uses debootstrap

++++ python-kiwi:

  - Update documentation
    kiwi no longer uses debootstrap

++++ kernel-default:

  - ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
    (stable-fixes).
  - commit ae4c81e
  - ALSA: hda: Conditionally use snooping for AMD HDMI (git-fixes).
  - ALSA: usb-audio: Correct surround channels in UAC1 channel map
    (git-fixes).
  - ALSA: seq: ump: Optimize conversions from SysEx to UMP
    (git-fixes).
  - ALSA: hda: conexant: Fix headset auto detect fail in the
    polling mode (git-fixes).
  - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes).
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes).
  - drm/virtio: Fix type of dma-fence context variable (git-fixes).
  - drm/nouveau: prime: fix refcount underflow (git-fixes).
  - drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll()
    (git-fixes).
  - drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro (git-fixes).
  - i915/perf: Remove code to update PWR_CLK_STATE for gen12
    (git-fixes).
  - commit 581e0b5
  - ptp: fix integer overflow in max_vclocks_store (bsc#1227829
    CVE-2024-40994).
  - commit f2dc01f

++++ kernel-default:

  - ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G
    (stable-fixes).
  - commit ae4c81e
  - ALSA: hda: Conditionally use snooping for AMD HDMI (git-fixes).
  - ALSA: usb-audio: Correct surround channels in UAC1 channel map
    (git-fixes).
  - ALSA: seq: ump: Optimize conversions from SysEx to UMP
    (git-fixes).
  - ALSA: hda: conexant: Fix headset auto detect fail in the
    polling mode (git-fixes).
  - drm/vmwgfx: Fix overlay when using Screen Targets (git-fixes).
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling (git-fixes).
  - drm/virtio: Fix type of dma-fence context variable (git-fixes).
  - drm/nouveau: prime: fix refcount underflow (git-fixes).
  - drm/i915: Fix possible int overflow in skl_ddi_calculate_wrpll()
    (git-fixes).
  - drm/i915/hdcp: Fix HDCP2_STREAM_STATUS macro (git-fixes).
  - i915/perf: Remove code to update PWR_CLK_STATE for gen12
    (git-fixes).
  - commit 581e0b5
  - ptp: fix integer overflow in max_vclocks_store (bsc#1227829
    CVE-2024-40994).
  - commit f2dc01f

++++ python311-core:

  - bsc#1221854 (CVE-2024-0450) Add
    CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
    detecting the vulnerability of the "quoted-overlap" zipbomb
    (from gh#python/cpython!110016).
  - Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with
    patched libexpat below 2.6.0 that doesn't update the version number,
    just in SLE.
  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.
  - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch
    fixing bsc#1226447 (CVE-2024-0397) by removing memory race
    condition in ssl.SSLContext certificate store methods.
  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).
  - Remove included patches:
  - libexpat260.patch
  - support-expat-CVE-2022-25236-patched.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch

++++ python311-core:

  - bsc#1221854 (CVE-2024-0450) Add
    CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
    detecting the vulnerability of the "quoted-overlap" zipbomb
    (from gh#python/cpython!110016).
  - Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with
    patched libexpat below 2.6.0 that doesn't update the version number,
    just in SLE.
  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.
  - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch
    fixing bsc#1226447 (CVE-2024-0397) by removing memory race
    condition in ssl.SSLContext certificate store methods.
  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).
  - Remove included patches:
  - libexpat260.patch
  - support-expat-CVE-2022-25236-patched.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch

++++ python311:

  - bsc#1221854 (CVE-2024-0450) Add
    CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
    detecting the vulnerability of the "quoted-overlap" zipbomb
    (from gh#python/cpython!110016).
  - Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with
    patched libexpat below 2.6.0 that doesn't update the version number,
    just in SLE.
  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.
  - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch
    fixing bsc#1226447 (CVE-2024-0397) by removing memory race
    condition in ssl.SSLContext certificate store methods.
  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).
  - Remove included patches:
  - libexpat260.patch
  - support-expat-CVE-2022-25236-patched.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch

++++ python311:

  - bsc#1221854 (CVE-2024-0450) Add
    CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
    detecting the vulnerability of the "quoted-overlap" zipbomb
    (from gh#python/cpython!110016).
  - Add CVE-2023-52425-libexpat-2.6.0-backport.patch to fix tests with
    patched libexpat below 2.6.0 that doesn't update the version number,
    just in SLE.
  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.
  - Add CVE-2024-0397-memrace_ssl.SSLContext_cert_store.patch
    fixing bsc#1226447 (CVE-2024-0397) by removing memory race
    condition in ssl.SSLContext certificate store methods.
  - Add CVE-2024-6923-email-hdr-inject.patch to prevent email
    header injection due to unquoted newlines (bsc#1228780,
    CVE-2024-6923).
  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).
  - Remove included patches:
  - libexpat260.patch
  - support-expat-CVE-2022-25236-patched.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch

------------------------------------------------------------------
------------------  2024-8-2  -  Aug 2 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix test_process_result_bundle_as_rpm
  - Fix Debian/Ubuntu integration tests
    Remove package hacks for debootstrap, explicitly add
    required packages and or configurations.
  - Drop types-pkg_resources
    Got removed from PyPI

++++ python-kiwi:

  - Fix test_process_result_bundle_as_rpm
  - Fix Debian/Ubuntu integration tests
    Remove package hacks for debootstrap, explicitly add
    required packages and or configurations.
  - Drop types-pkg_resources
    Got removed from PyPI

++++ python-kiwi:

  - Fix test_process_result_bundle_as_rpm
  - Fix Debian/Ubuntu integration tests
    Remove package hacks for debootstrap, explicitly add
    required packages and or configurations.
  - Drop types-pkg_resources
    Got removed from PyPI

++++ kernel-default:

  - Update
    patches.suse/79b5b4b18bc8-mlxsw-spectrum_acl_tcam-Fix-possible-use-after-free-.patch
    (CVE-2024-35854 bsc#1224636 CVE-2024-35855 bsc#1224694).
  - Update
    patches.suse/ACPICA-Revert-ACPICA-avoid-Info-mapping-multiple-BAR.patch
    (git-fixes CVE-2024-40984 bsc#1227820).
  - Update
    patches.suse/ALSA-hda-cs35l41-Possible-null-pointer-dereference-i.patch
    (git-fixes CVE-2024-40964 bsc#1227818).
  - Update
    patches.suse/ALSA-hda-cs35l56-Fix-lifetime-of-cs_dsp-instance.patch
    (git-fixes CVE-2024-39491 bsc#1227627).
  - Update
    patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
    (git-fixes CVE-2024-26889 bsc#1228195).
  - Update
    patches.suse/HID-core-remove-unnecessary-WARN_ON-in-implement.patch
    (git-fixes CVE-2024-39509 bsc#1227733).
  - Update
    patches.suse/HID-logitech-dj-Fix-memory-leak-in-logi_dj_recv_swit.patch
    (git-fixes CVE-2024-40934 bsc#1227796).
  - Update
    patches.suse/KVM-SVM-WARN-on-vNMI-NMI-window-iff-NMIs-are-outrigh.patch
    (git-fixes CVE-2024-39483 bsc#1227494).
  - Update
    patches.suse/KVM-arm64-Fix-circular-locking-dependency.patch
    (bsc#1222463 (CVE-2024-26691) CVE-2024-26691).
  - Update
    patches.suse/RDMA-mlx5-Add-check-for-srq-max_sge-attribute.patch
    (git-fixes CVE-2024-40990 bsc#1227824).
  - Update
    patches.suse/RDMA-rxe-Fix-responder-length-checking-for-UD-reques.patch
    (git-fixes CVE-2024-40992 bsc#1227826).
  - Update
    patches.suse/SUNRPC-Fix-loop-termination-condition-in-gss_free_in.patch
    (git-fixes CVE-2024-36288 bsc#1226834).
  - Update
    patches.suse/USB-class-cdc-wdm-Fix-CPU-lockup-caused-by-excessive.patch
    (git-fixes CVE-2024-40904 bsc#1227772).
  - Update
    patches.suse/arm64-asm-bug-Add-.align-2-to-the-end-of-__BUG_ENTRY.patch
    (git-fixes CVE-2024-39488 bsc#1227618).
  - Update
    patches.suse/ata-libata-core-Fix-double-free-on-error.patch
    (git-fixes CVE-2024-41087 bsc#1228740).
  - Update
    patches.suse/ax25-Fix-refcount-imbalance-on-inbound-connections.patch
    (git-fixes CVE-2024-40910 bsc#1227832).
  - Update
    patches.suse/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch
    (stable-fixes CVE-2024-40981 bsc#1227864).
  - Update
    patches.suse/btrfs-zoned-allocate-dummy-checksums-for-zoned-NODAT.patch
    (bsc#1223731 CVE-2024-26944 CVE-2024-40962 bsc#1227815).
  - Update
    patches.suse/cachefiles-remove-requests-from-xarray-during-flushin.patch
    (bsc#1226588 CVE-2024-40900 bsc#1227760).
  - Update
    patches.suse/cpufreq-amd-pstate-fix-memory-leak-on-CPU-EPP-exit.patch
    (stable-fixes CVE-2024-40997 bsc#1227853).
  - Update
    patches.suse/crypto-hisilicon-sec-Fix-memory-leak-for-sec-resourc.patch
    (stable-fixes CVE-2024-41002 bsc#1227870).
  - Update
    patches.suse/crypto-qat-Fix-ADF_DEV_RESET_SYNC-memory-leak.patch
    (git-fixes CVE-2024-39493 bsc#1227620).
  - Update
    patches.suse/cxl-region-Fix-memregion-leaks-in-devm_cxl_add_regio.patch
    (git-fixes CVE-2024-40936 bsc#1227833).
  - Update
    patches.suse/drivers-core-synchronize-really_probe-and-dev_uevent.patch
    (git-fixes CVE-2024-39501 bsc#1227754).
  - Update
    patches.suse/drm-amdgpu-fix-UBSAN-warning-in-kv_dpm.c.patch
    (stable-fixes CVE-2024-40987 bsc#1228235).
  - Update
    patches.suse/drm-amdkfd-don-t-allow-mapping-the-MMIO-HDP-page-wit.patch
    (CVE-2024-41011 bsc#1228115 git-fixes bsc#1228114).
  - Update
    patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
    (git-fixes CVE-2024-38548 bsc#1228202).
  - Update patches.suse/drm-drm_file-Fix-pid-refcounting-race.patch
    (git-fixes CVE-2024-39486 bsc#1227492).
  - Update
    patches.suse/drm-exynos-hdmi-report-safe-640x480-mode-as-a-fallba.patch
    (git-fixes CVE-2024-40916 bsc#1227846).
  - Update
    patches.suse/drm-exynos-vidi-fix-memory-leak-in-.get_modes.patch
    (stable-fixes CVE-2024-40932 bsc#1227828).
  - Update
    patches.suse/drm-i915-dpt-Make-DPT-object-unshrinkable.patch
    (git-fixes CVE-2024-40924 bsc#1227787).
  - Update
    patches.suse/drm-komeda-check-for-error-valued-pointer.patch
    (git-fixes CVE-2024-39505 bsc#1227728).
  - Update
    patches.suse/drm-lima-mask-irqs-in-timeout-path-before-hard-reset.patch
    (stable-fixes CVE-2024-40976 bsc#1227893).
  - Update
    patches.suse/drm-nouveau-don-t-attempt-to-schedule-hpd_work-on-he.patch
    (git-fixes CVE-2024-40926 bsc#1227791).
  - Update
    patches.suse/drm-radeon-fix-UBSAN-warning-in-kv_dpm.c.patch
    (stable-fixes CVE-2024-40988 bsc#1227957).
  - Update
    patches.suse/drm-shmem-helper-Fix-BUG_ON-on-mmap-PROT_WRITE-MAP_P.patch
    (git-fixes CVE-2024-39497 bsc#1227722).
  - Update
    patches.suse/io_uring-io-wq-Use-set_bit-and-test_bit-at-worker-fl.patch
    (git-fixes CVE-2024-39508 bsc#1227732).
  - Update
    patches.suse/io_uring-rsrc-don-t-lock-while-TASK_RUNNING.patch
    (git-fixes CVE-2024-40922 bsc#1227785).
  - Update
    patches.suse/io_uring-sqpoll-work-around-a-potential-audit-memory.patch
    (git-fixes CVE-2024-41001 bsc#1227869).
  - Update
    patches.suse/iommu-Return-right-value-in-iommu_sva_bind_device.patch
    (git-fixes CVE-2024-40945 bsc#1227802).
  - Update
    patches.suse/jfs-xattr-fix-buffer-overflow-for-invalid-xattr.patch
    (bsc#1227383 CVE-2024-40902 bsc#1227764).
  - Update
    patches.suse/mmc-davinci-Don-t-strip-remove-function-when-driver-.patch
    (git-fixes CVE-2024-39484 bsc#1227493).
  - Update
    patches.suse/nfs-Handle-error-of-rpc_proc_register-in-nfs_net_ini.patch
    (git-fixes CVE-2024-36939 bsc#1225838).
  - Update
    patches.suse/ocfs2-fix-races-between-hole-punching-and-AIO-DIO.patch
    (git-fixes CVE-2024-40943 bsc#1227849).
  - Update
    patches.suse/serial-imx-Introduce-timeout-when-waiting-on-transmi.patch
    (stable-fixes CVE-2024-40967 bsc#1227891).
  - Update
    patches.suse/sock_map-avoid-race-between-sock_map_close-and-sk_ps.patch
    (bsc#1225475 CVE-2023-52735 CVE-2024-39500 bsc#1227724).
  - Update
    patches.suse/ssb-Fix-potential-NULL-pointer-dereference-in-ssb_de.patch
    (stable-fixes CVE-2024-40982 bsc#1227865).
  - Update
    patches.suse/tracing-Build-event-generation-tests-only-as-modules.patch
    (git-fixes CVE-2024-41004 bsc#1227851).
  - Update
    patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
    (git-fixes CVE-2024-26920 bsc#1228237).
  - Update
    patches.suse/usb-typec-tcpm-fix-use-after-free-case-in-tcpm_regis.patch
    (git-fixes CVE-2024-40903 bsc#1227766).
  - Update
    patches.suse/vmci-prevent-speculation-leaks-by-sanitizing-event-i.patch
    (git-fixes CVE-2024-39499 bsc#1227725).
  - Update
    patches.suse/wifi-ath11k-rely-on-mac80211-debugfs-handling-for-vi.patch
    (bsc#1227149 CVE-2024-26637 bsc#1221652).
  - Update
    patches.suse/wifi-cfg80211-Lock-wiphy-in-cfg80211_get_station.patch
    (git-fixes CVE-2024-40911 bsc#1227792).
  - Update
    patches.suse/wifi-cfg80211-detect-stuck-ECSA-element-in-probe-res.patch
    (bsc#1227149 CVE-2024-26683 bsc#1222434).
  - Update
    patches.suse/wifi-cfg80211-validate-HE-operation-element-parsing.patch
    (bsc#1227149 CVE-2024-40930 bsc#1228236).
  - Update patches.suse/wifi-iwlwifi-Use-request_module_nowait.patch
    (bsc#1227149 CVE-2024-36970 bsc#1226127).
  - Update
    patches.suse/wifi-iwlwifi-mvm-check-n_ssids-before-accessing-the-.patch
    (git-fixes CVE-2024-40929 bsc#1227774).
  - Update
    patches.suse/wifi-iwlwifi-mvm-don-t-read-past-the-mfuart-notifcat.patch
    (git-fixes CVE-2024-40941 bsc#1227771).
  - Update
    patches.suse/wifi-iwlwifi-mvm-pick-the-version-of-SESSION_PROTECT.patch
    (bsc#1227149 CVE-2024-35913 bsc#1224485).
  - Update
    patches.suse/wifi-mac80211-Fix-deadlock-in-ieee80211_sta_ps_deliv.patch
    (git-fixes CVE-2024-40912 bsc#1227790).
  - Update
    patches.suse/wifi-mac80211-improve-CSA-ECSA-connection-refusal.patch
    (bsc#1227149 CVE-2024-26682 bsc#1222433).
  - Update
    patches.suse/wifi-mac80211-mesh-Fix-leak-of-mesh_preq_queue-objec.patch
    (git-fixes CVE-2024-40942 bsc#1227770).
  - Update
    patches.suse/wifi-mt76-connac-check-for-null-before-dereferencing.patch
    (bsc#1227149 CVE-2024-38609 bsc#1226751).
  - Update
    patches.suse/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch
    (stable-fixes CVE-2024-40977 bsc#1227950).
  - Update
    patches.suse/wifi-mt76-mt7925e-fix-use-after-free-in-free_irq.patch
    (bsc#1227149 CVE-2024-27049 bsc#1223763).
  - Update
    patches.suse/wifi-mt76-mt7996-fix-potential-memory-leakage-when-r.patch
    (bsc#1227149 CVE-2024-38563 bsc#1226743).
  - Update
    patches.suse/x86-kexec-Fix-bug-with-call-depth-tracking.patch
    (git-fixes CVE-2024-40944 bsc#1227883).
  - Update
    patches.suse/xhci-Handle-TD-clearing-for-multiple-streams-case.patch
    (git-fixes CVE-2024-40927 bsc#1227816).
  - commit 2cd72fd
  - Update
    patches.suse/SUNRPC-Fix-UAF-in-svc_tcp_listen_data_ready.patch
    (bsc#1012628 CVE-2023-52885 bsc#1227750).
  - Update
    patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch
    (bsc#1213123 CVE-2023-37453 CVE-2023-52886 bsc#1227981).
  - Update
    patches.suse/btrfs-zoned-fix-lock-ordering-in-btrfs_zone_activate.patch
    (bsc#1223731 CVE-2024-26944 CVE-2023-52668 bsc#1224690).
  - Update
    patches.suse/wifi-ath12k-fix-the-error-handler-of-rfkill-config.patch
    (bsc#1227149 CVE-2023-52688 bsc#1224631).
  - commit 0637df8
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible (CVE-2024-42124 bsc#1228705)
  - commit a8638c5
  - x86: stop playing stack games in profile_pc() (bsc#1228633
    CVE-2024-42096).
  - commit 5c85064
  - net: dsa: mv88e6xxx: Correct check for empty list (CVE-2024-42224 bsc#1228723)
  - commit 48e8710
  - skmsg: Skip zero length skb in sk_msg_recvmsg (CVE-2024-41048 bsc#1228565)
  - commit 1a6942b
  - netns: Make get_net_ns() handle zero refcount net
    (CVE-2024-40958 bsc#1227812).
  - commit f6c7d72
  - nvme_core: scan namespaces asynchronously (bsc#1224105).
  - commit e6f41be
  - net: wwan: iosm: Fix tainted pointer delete is case of region
    creation fail (CVE-2024-40939 bsc#1227799).
  - commit 0b93a9f
  - nsh: Restore skb->{protocol,data,mac_header} for outer header
    in nsh_gso_segment() (CVE-2024-36933 bsc#1225832).
  - commit 6740d82
  - blacklist.conf: Add 943ad0b62e3c kernel: rerun task_work while freezing in get_signal()
    and related io_uring fix.
  - commit ead5c32
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
    (CVE-2024-36929 bsc#1225814).
  - commit e49ed10
  - blacklist.conf: Add 7a4479680d7f cgroup_misc: add kernel-doc comments for enum misc_res_type
  - commit fe05fa4
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).
  - commit 8707a09
  - Drop MD patches that caused dependency cycles
    Also the patch was placed in a wrong directory.
    Deleted:
    patches.kabi/0002-md-cluster-fix-no-recovery-job-when-adding-re-adding.patch
    patches.suse/0001-md-cluster-fix-hanging-issue-while-a-new-disk-adding.patch
  - commit f696a5b
  - net: phy: micrel: Fix the KSZ9131 MDI-X status issue
    (git-fixes).
  - Bluetooth: hci_sync: Fix suspending with wrong filter policy
    (git-fixes).
  - Bluetooth: btintel: Fail setup on error (git-fixes).
  - wifi: ath12k: fix soft lockup on suspend (git-fixes).
  - wifi: cfg80211: fix reporting failed MLO links status with
    cfg80211_connect_done (git-fixes).
  - wifi: mac80211: use monitor sdata with driver only if desired
    (git-fixes).
  - net: phy: realtek: add support for RTL8366S Gigabit PHY
    (git-fixes).
  - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
    (git-fixes).
  - commit f33a0c2
  - ppp: reject claimed-as-LCP but actually malformed packets
    (CVE-2024-41044 bsc#1228530).
  - ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066
    bsc#1228640).
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
    (CVE-2024-42093 bsc#1228680).
  - commit 960e23f
  - drm/amd/display: Add NULL pointer check for kzalloc (bsc#1228591 CVE-2024-42122)
  - commit 22c79c5

++++ kernel-default:

  - Update
    patches.suse/79b5b4b18bc8-mlxsw-spectrum_acl_tcam-Fix-possible-use-after-free-.patch
    (CVE-2024-35854 bsc#1224636 CVE-2024-35855 bsc#1224694).
  - Update
    patches.suse/ACPICA-Revert-ACPICA-avoid-Info-mapping-multiple-BAR.patch
    (git-fixes CVE-2024-40984 bsc#1227820).
  - Update
    patches.suse/ALSA-hda-cs35l41-Possible-null-pointer-dereference-i.patch
    (git-fixes CVE-2024-40964 bsc#1227818).
  - Update
    patches.suse/ALSA-hda-cs35l56-Fix-lifetime-of-cs_dsp-instance.patch
    (git-fixes CVE-2024-39491 bsc#1227627).
  - Update
    patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
    (git-fixes CVE-2024-26889 bsc#1228195).
  - Update
    patches.suse/HID-core-remove-unnecessary-WARN_ON-in-implement.patch
    (git-fixes CVE-2024-39509 bsc#1227733).
  - Update
    patches.suse/HID-logitech-dj-Fix-memory-leak-in-logi_dj_recv_swit.patch
    (git-fixes CVE-2024-40934 bsc#1227796).
  - Update
    patches.suse/KVM-SVM-WARN-on-vNMI-NMI-window-iff-NMIs-are-outrigh.patch
    (git-fixes CVE-2024-39483 bsc#1227494).
  - Update
    patches.suse/KVM-arm64-Fix-circular-locking-dependency.patch
    (bsc#1222463 (CVE-2024-26691) CVE-2024-26691).
  - Update
    patches.suse/RDMA-mlx5-Add-check-for-srq-max_sge-attribute.patch
    (git-fixes CVE-2024-40990 bsc#1227824).
  - Update
    patches.suse/RDMA-rxe-Fix-responder-length-checking-for-UD-reques.patch
    (git-fixes CVE-2024-40992 bsc#1227826).
  - Update
    patches.suse/SUNRPC-Fix-loop-termination-condition-in-gss_free_in.patch
    (git-fixes CVE-2024-36288 bsc#1226834).
  - Update
    patches.suse/USB-class-cdc-wdm-Fix-CPU-lockup-caused-by-excessive.patch
    (git-fixes CVE-2024-40904 bsc#1227772).
  - Update
    patches.suse/arm64-asm-bug-Add-.align-2-to-the-end-of-__BUG_ENTRY.patch
    (git-fixes CVE-2024-39488 bsc#1227618).
  - Update
    patches.suse/ata-libata-core-Fix-double-free-on-error.patch
    (git-fixes CVE-2024-41087 bsc#1228740).
  - Update
    patches.suse/ax25-Fix-refcount-imbalance-on-inbound-connections.patch
    (git-fixes CVE-2024-40910 bsc#1227832).
  - Update
    patches.suse/batman-adv-bypass-empty-buckets-in-batadv_purge_orig.patch
    (stable-fixes CVE-2024-40981 bsc#1227864).
  - Update
    patches.suse/btrfs-zoned-allocate-dummy-checksums-for-zoned-NODAT.patch
    (bsc#1223731 CVE-2024-26944 CVE-2024-40962 bsc#1227815).
  - Update
    patches.suse/cachefiles-remove-requests-from-xarray-during-flushin.patch
    (bsc#1226588 CVE-2024-40900 bsc#1227760).
  - Update
    patches.suse/cpufreq-amd-pstate-fix-memory-leak-on-CPU-EPP-exit.patch
    (stable-fixes CVE-2024-40997 bsc#1227853).
  - Update
    patches.suse/crypto-hisilicon-sec-Fix-memory-leak-for-sec-resourc.patch
    (stable-fixes CVE-2024-41002 bsc#1227870).
  - Update
    patches.suse/crypto-qat-Fix-ADF_DEV_RESET_SYNC-memory-leak.patch
    (git-fixes CVE-2024-39493 bsc#1227620).
  - Update
    patches.suse/cxl-region-Fix-memregion-leaks-in-devm_cxl_add_regio.patch
    (git-fixes CVE-2024-40936 bsc#1227833).
  - Update
    patches.suse/drivers-core-synchronize-really_probe-and-dev_uevent.patch
    (git-fixes CVE-2024-39501 bsc#1227754).
  - Update
    patches.suse/drm-amdgpu-fix-UBSAN-warning-in-kv_dpm.c.patch
    (stable-fixes CVE-2024-40987 bsc#1228235).
  - Update
    patches.suse/drm-amdkfd-don-t-allow-mapping-the-MMIO-HDP-page-wit.patch
    (CVE-2024-41011 bsc#1228115 git-fixes bsc#1228114).
  - Update
    patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
    (git-fixes CVE-2024-38548 bsc#1228202).
  - Update patches.suse/drm-drm_file-Fix-pid-refcounting-race.patch
    (git-fixes CVE-2024-39486 bsc#1227492).
  - Update
    patches.suse/drm-exynos-hdmi-report-safe-640x480-mode-as-a-fallba.patch
    (git-fixes CVE-2024-40916 bsc#1227846).
  - Update
    patches.suse/drm-exynos-vidi-fix-memory-leak-in-.get_modes.patch
    (stable-fixes CVE-2024-40932 bsc#1227828).
  - Update
    patches.suse/drm-i915-dpt-Make-DPT-object-unshrinkable.patch
    (git-fixes CVE-2024-40924 bsc#1227787).
  - Update
    patches.suse/drm-komeda-check-for-error-valued-pointer.patch
    (git-fixes CVE-2024-39505 bsc#1227728).
  - Update
    patches.suse/drm-lima-mask-irqs-in-timeout-path-before-hard-reset.patch
    (stable-fixes CVE-2024-40976 bsc#1227893).
  - Update
    patches.suse/drm-nouveau-don-t-attempt-to-schedule-hpd_work-on-he.patch
    (git-fixes CVE-2024-40926 bsc#1227791).
  - Update
    patches.suse/drm-radeon-fix-UBSAN-warning-in-kv_dpm.c.patch
    (stable-fixes CVE-2024-40988 bsc#1227957).
  - Update
    patches.suse/drm-shmem-helper-Fix-BUG_ON-on-mmap-PROT_WRITE-MAP_P.patch
    (git-fixes CVE-2024-39497 bsc#1227722).
  - Update
    patches.suse/io_uring-io-wq-Use-set_bit-and-test_bit-at-worker-fl.patch
    (git-fixes CVE-2024-39508 bsc#1227732).
  - Update
    patches.suse/io_uring-rsrc-don-t-lock-while-TASK_RUNNING.patch
    (git-fixes CVE-2024-40922 bsc#1227785).
  - Update
    patches.suse/io_uring-sqpoll-work-around-a-potential-audit-memory.patch
    (git-fixes CVE-2024-41001 bsc#1227869).
  - Update
    patches.suse/iommu-Return-right-value-in-iommu_sva_bind_device.patch
    (git-fixes CVE-2024-40945 bsc#1227802).
  - Update
    patches.suse/jfs-xattr-fix-buffer-overflow-for-invalid-xattr.patch
    (bsc#1227383 CVE-2024-40902 bsc#1227764).
  - Update
    patches.suse/mmc-davinci-Don-t-strip-remove-function-when-driver-.patch
    (git-fixes CVE-2024-39484 bsc#1227493).
  - Update
    patches.suse/nfs-Handle-error-of-rpc_proc_register-in-nfs_net_ini.patch
    (git-fixes CVE-2024-36939 bsc#1225838).
  - Update
    patches.suse/ocfs2-fix-races-between-hole-punching-and-AIO-DIO.patch
    (git-fixes CVE-2024-40943 bsc#1227849).
  - Update
    patches.suse/serial-imx-Introduce-timeout-when-waiting-on-transmi.patch
    (stable-fixes CVE-2024-40967 bsc#1227891).
  - Update
    patches.suse/sock_map-avoid-race-between-sock_map_close-and-sk_ps.patch
    (bsc#1225475 CVE-2023-52735 CVE-2024-39500 bsc#1227724).
  - Update
    patches.suse/ssb-Fix-potential-NULL-pointer-dereference-in-ssb_de.patch
    (stable-fixes CVE-2024-40982 bsc#1227865).
  - Update
    patches.suse/tracing-Build-event-generation-tests-only-as-modules.patch
    (git-fixes CVE-2024-41004 bsc#1227851).
  - Update
    patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
    (git-fixes CVE-2024-26920 bsc#1228237).
  - Update
    patches.suse/usb-typec-tcpm-fix-use-after-free-case-in-tcpm_regis.patch
    (git-fixes CVE-2024-40903 bsc#1227766).
  - Update
    patches.suse/vmci-prevent-speculation-leaks-by-sanitizing-event-i.patch
    (git-fixes CVE-2024-39499 bsc#1227725).
  - Update
    patches.suse/wifi-ath11k-rely-on-mac80211-debugfs-handling-for-vi.patch
    (bsc#1227149 CVE-2024-26637 bsc#1221652).
  - Update
    patches.suse/wifi-cfg80211-Lock-wiphy-in-cfg80211_get_station.patch
    (git-fixes CVE-2024-40911 bsc#1227792).
  - Update
    patches.suse/wifi-cfg80211-detect-stuck-ECSA-element-in-probe-res.patch
    (bsc#1227149 CVE-2024-26683 bsc#1222434).
  - Update
    patches.suse/wifi-cfg80211-validate-HE-operation-element-parsing.patch
    (bsc#1227149 CVE-2024-40930 bsc#1228236).
  - Update patches.suse/wifi-iwlwifi-Use-request_module_nowait.patch
    (bsc#1227149 CVE-2024-36970 bsc#1226127).
  - Update
    patches.suse/wifi-iwlwifi-mvm-check-n_ssids-before-accessing-the-.patch
    (git-fixes CVE-2024-40929 bsc#1227774).
  - Update
    patches.suse/wifi-iwlwifi-mvm-don-t-read-past-the-mfuart-notifcat.patch
    (git-fixes CVE-2024-40941 bsc#1227771).
  - Update
    patches.suse/wifi-iwlwifi-mvm-pick-the-version-of-SESSION_PROTECT.patch
    (bsc#1227149 CVE-2024-35913 bsc#1224485).
  - Update
    patches.suse/wifi-mac80211-Fix-deadlock-in-ieee80211_sta_ps_deliv.patch
    (git-fixes CVE-2024-40912 bsc#1227790).
  - Update
    patches.suse/wifi-mac80211-improve-CSA-ECSA-connection-refusal.patch
    (bsc#1227149 CVE-2024-26682 bsc#1222433).
  - Update
    patches.suse/wifi-mac80211-mesh-Fix-leak-of-mesh_preq_queue-objec.patch
    (git-fixes CVE-2024-40942 bsc#1227770).
  - Update
    patches.suse/wifi-mt76-connac-check-for-null-before-dereferencing.patch
    (bsc#1227149 CVE-2024-38609 bsc#1226751).
  - Update
    patches.suse/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch
    (stable-fixes CVE-2024-40977 bsc#1227950).
  - Update
    patches.suse/wifi-mt76-mt7925e-fix-use-after-free-in-free_irq.patch
    (bsc#1227149 CVE-2024-27049 bsc#1223763).
  - Update
    patches.suse/wifi-mt76-mt7996-fix-potential-memory-leakage-when-r.patch
    (bsc#1227149 CVE-2024-38563 bsc#1226743).
  - Update
    patches.suse/x86-kexec-Fix-bug-with-call-depth-tracking.patch
    (git-fixes CVE-2024-40944 bsc#1227883).
  - Update
    patches.suse/xhci-Handle-TD-clearing-for-multiple-streams-case.patch
    (git-fixes CVE-2024-40927 bsc#1227816).
  - commit 2cd72fd
  - Update
    patches.suse/SUNRPC-Fix-UAF-in-svc_tcp_listen_data_ready.patch
    (bsc#1012628 CVE-2023-52885 bsc#1227750).
  - Update
    patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch
    (bsc#1213123 CVE-2023-37453 CVE-2023-52886 bsc#1227981).
  - Update
    patches.suse/btrfs-zoned-fix-lock-ordering-in-btrfs_zone_activate.patch
    (bsc#1223731 CVE-2024-26944 CVE-2023-52668 bsc#1224690).
  - Update
    patches.suse/wifi-ath12k-fix-the-error-handler-of-rfkill-config.patch
    (bsc#1227149 CVE-2023-52688 bsc#1224631).
  - commit 0637df8
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible (CVE-2024-42124 bsc#1228705)
  - commit a8638c5
  - x86: stop playing stack games in profile_pc() (bsc#1228633
    CVE-2024-42096).
  - commit 5c85064
  - net: dsa: mv88e6xxx: Correct check for empty list (CVE-2024-42224 bsc#1228723)
  - commit 48e8710
  - skmsg: Skip zero length skb in sk_msg_recvmsg (CVE-2024-41048 bsc#1228565)
  - commit 1a6942b
  - netns: Make get_net_ns() handle zero refcount net
    (CVE-2024-40958 bsc#1227812).
  - commit f6c7d72
  - nvme_core: scan namespaces asynchronously (bsc#1224105).
  - commit e6f41be
  - net: wwan: iosm: Fix tainted pointer delete is case of region
    creation fail (CVE-2024-40939 bsc#1227799).
  - commit 0b93a9f
  - nsh: Restore skb->{protocol,data,mac_header} for outer header
    in nsh_gso_segment() (CVE-2024-36933 bsc#1225832).
  - commit 6740d82
  - blacklist.conf: Add 943ad0b62e3c kernel: rerun task_work while freezing in get_signal()
    and related io_uring fix.
  - commit ead5c32
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs
    (CVE-2024-36929 bsc#1225814).
  - commit e49ed10
  - blacklist.conf: Add 7a4479680d7f cgroup_misc: add kernel-doc comments for enum misc_res_type
  - commit fe05fa4
  - cgroup/cpuset: Prevent UAF in proc_cpuset_show() (bsc#1228801).
  - commit 8707a09
  - Drop MD patches that caused dependency cycles
    Also the patch was placed in a wrong directory.
    Deleted:
    patches.kabi/0002-md-cluster-fix-no-recovery-job-when-adding-re-adding.patch
    patches.suse/0001-md-cluster-fix-hanging-issue-while-a-new-disk-adding.patch
  - commit f696a5b
  - net: phy: micrel: Fix the KSZ9131 MDI-X status issue
    (git-fixes).
  - Bluetooth: hci_sync: Fix suspending with wrong filter policy
    (git-fixes).
  - Bluetooth: btintel: Fail setup on error (git-fixes).
  - wifi: ath12k: fix soft lockup on suspend (git-fixes).
  - wifi: cfg80211: fix reporting failed MLO links status with
    cfg80211_connect_done (git-fixes).
  - wifi: mac80211: use monitor sdata with driver only if desired
    (git-fixes).
  - net: phy: realtek: add support for RTL8366S Gigabit PHY
    (git-fixes).
  - net: usb: sr9700: fix uninitialized variable use in sr_mdio_read
    (git-fixes).
  - commit f33a0c2
  - ppp: reject claimed-as-LCP but actually malformed packets
    (CVE-2024-41044 bsc#1228530).
  - ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066
    bsc#1228640).
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
    (CVE-2024-42093 bsc#1228680).
  - commit 960e23f
  - drm/amd/display: Add NULL pointer check for kzalloc (bsc#1228591 CVE-2024-42122)
  - commit 22c79c5

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to enforce
    approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to enforce
    approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).

++++ mozilla-nss:

  - Updated nss-fips-approved-crypto-non-ec.patch to enforce
    approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).

++++ libzypp:

  - Make sure not to statically linked installed tools (bsc#1228787)
  - version 17.35.8 (35)

++++ libzypp:

  - Make sure not to statically linked installed tools (bsc#1228787)
  - version 17.35.8 (35)

++++ libzypp:

  - Make sure not to statically linked installed tools (bsc#1228787)
  - version 17.35.8 (35)

++++ libzypp:

  - Make sure not to statically linked installed tools (bsc#1228787)
  - version 17.35.8 (35)

++++ libzypp:

  - Make sure not to statically linked installed tools (bsc#1228787)
  - version 17.35.8 (35)

------------------------------------------------------------------
------------------  2024-8-1  -  Aug 1 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240801.75f05dd:
    * sysctl: Don't set kernel.pid_max on 32b archs (bsc#1227117)

++++ kernel-default:

  - workqueue: Improve scalability of workqueue watchdog touch
    (bsc#1193454).
  - commit 3c83768
  - workqueue: wq_watchdog_touch is always called with valid CPU
    (bsc#1193454).
  - commit 5cd5767
  - btrfs: qgroup: fix quota root leak after quota disable failure
    (bsc#1228655 CVE-2024-41078).
  - commit d598dd5
  - KVM: arm64: Disassociate vcpus from redistributor region on
    teardown (CVE-2024-40989 bsc#1227823).
  - commit 8e9651c
  - powerpc/eeh: avoid possible crash when edev->pdev changes
    (CVE-2024-41064 bsc#1228599).
  - commit 2510511
  - net: ks8851: Fix deadlock with the SPI chip variant (CVE-2024-41036 bsc#1228496)
  - commit 3cf617f
  - net/sched: Fix UAF when resolving a clash (CVE-2024-41040 bsc#1228518)
  - commit dea6a81
  - btrfs: make sure that WRITTEN is set on all metadata blocks (CVE-2024-35949 bsc#1224700)
    Changes: adjust returned error codes to -EUCLEAN and drop definition of
    the enum error.
  - commit 7880179

++++ kernel-default:

  - workqueue: Improve scalability of workqueue watchdog touch
    (bsc#1193454).
  - commit 3c83768
  - workqueue: wq_watchdog_touch is always called with valid CPU
    (bsc#1193454).
  - commit 5cd5767
  - btrfs: qgroup: fix quota root leak after quota disable failure
    (bsc#1228655 CVE-2024-41078).
  - commit d598dd5
  - KVM: arm64: Disassociate vcpus from redistributor region on
    teardown (CVE-2024-40989 bsc#1227823).
  - commit 8e9651c
  - powerpc/eeh: avoid possible crash when edev->pdev changes
    (CVE-2024-41064 bsc#1228599).
  - commit 2510511
  - net: ks8851: Fix deadlock with the SPI chip variant (CVE-2024-41036 bsc#1228496)
  - commit 3cf617f
  - net/sched: Fix UAF when resolving a clash (CVE-2024-41040 bsc#1228518)
  - commit dea6a81
  - btrfs: make sure that WRITTEN is set on all metadata blocks (CVE-2024-35949 bsc#1224700)
    Changes: adjust returned error codes to -EUCLEAN and drop definition of
    the enum error.
  - commit 7880179

++++ libzypp:

  - MediaPluginType must be resolved to a valid MediaHandler
    (bsc#1228208)
  - version 17.35.7 (35)

++++ libzypp:

  - MediaPluginType must be resolved to a valid MediaHandler
    (bsc#1228208)
  - version 17.35.7 (35)

++++ libzypp:

  - MediaPluginType must be resolved to a valid MediaHandler
    (bsc#1228208)
  - version 17.35.7 (35)

++++ libzypp:

  - MediaPluginType must be resolved to a valid MediaHandler
    (bsc#1228208)
  - version 17.35.7 (35)

++++ libzypp:

  - MediaPluginType must be resolved to a valid MediaHandler
    (bsc#1228208)
  - version 17.35.7 (35)

++++ salt:

  - Fix rich rule comparison in firewalld module (bsc#1222684)
  - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
  - Make auth.pam more robust with Salt Bundle and fix tests
  - Fix performance of user.list_groups with many remote groups
  - Fix "status.diskusage" function and exclude some tests for Salt Bundle
  - Skip certain tests if necessary for some OSes and set flaky ones
  - Add a timer to delete old env post update for venv-minion
  - Several fixes for tests to avoid errors and failures in some OSes
  - Speed up salt.matcher.confirm_top by using __context__
  - Do not call the async wrapper calls with the separate thread
  - Prevent OOM with high amount of batch async calls (bsc#1216063)
  - Add missing contextvars dependency in salt.version
  - Skip tests for unsupported algorithm on old OpenSSL version
  - Remove redundant `_file_find` call to the master
  - Prevent possible exception in tornado.concurrent.Future._set_done
  - Make reactor engine less blocking the EventPublisher
  - Make salt-master self recoverable on killing EventPublisher
  - Improve broken events catching and reporting
  - Make logging calls lighter
  - Remove unused import causing delays on starting salt-master
  - Mark python3-CherryPy as recommended package for the testsuite
  - Make "man" a recommended package instead of required
  - Convert oscap output to UTF-8
  - Make Salt compatible with Python 3.11
  - Ignore non-ascii chars in oscap output (bsc#1219001)
  - Fix detected issues in Salt tests when running on VMs
  - Make importing seco.range thread safe (bsc#1211649)
  - Fix problematic tests and allow smooth tests executions on containers
  - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
  - Provide user(salt)/group(salt) capabilities for RPM 4.19
  - Extend dependencies for python3-salt-testsuite and python3-salt packages
  - Improve Salt and testsuite packages multibuild
  - Enable multibuilld and create test flavor
  - Added:
    * add-missing-contextvars-dependency-in-salt.version.patch
    * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch
    * switch-oscap-encoding-to-utf-8-639.patch
    * fix-user.list_groups-omits-remote-groups.patch
    * remove-unused-import-causing-delays-on-starting-salt.patch
    * provide-systemd-timer-unit.patch
    * make-reactor-engine-less-blocking-the-eventpublisher.patch
    * improve-broken-events-catching-and-reporting.patch
    * make-logging-calls-lighter.patch
    * make-importing-seco.range-thread-safe-bsc-1211649.patch
    * prevent-possible-exception-in-tornado.concurrent.fut.patch
    * fix-salt-warnings-and-testuite-for-python-3.11-635.patch
    * make-salt-master-self-recoverable-on-killing-eventpu.patch
    * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch
    * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch
    * fix-problematic-tests-and-allow-smooth-tests-executi.patch
    * several-fixes-for-tests-to-avoid-errors-and-failures.patch
    * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
    * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch
    * speed-up-salt.matcher.confirm_top-by-using-__context.patch
    * do-not-call-the-async-wrapper-calls-with-the-separat.patch
    * firewalld-normalize-new-rich-rules-before-comparing-.patch
    * remove-redundant-_file_find-call-to-the-master.patch
    * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
    * some-more-small-tests-fixes-enhancements-661.patch
    * decode-oscap-byte-stream-to-string-bsc-1219001.patch
    * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch

++++ salt:

  - Fix rich rule comparison in firewalld module (bsc#1222684)
  - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
  - Make auth.pam more robust with Salt Bundle and fix tests
  - Fix performance of user.list_groups with many remote groups
  - Fix "status.diskusage" function and exclude some tests for Salt Bundle
  - Skip certain tests if necessary for some OSes and set flaky ones
  - Add a timer to delete old env post update for venv-minion
  - Several fixes for tests to avoid errors and failures in some OSes
  - Speed up salt.matcher.confirm_top by using __context__
  - Do not call the async wrapper calls with the separate thread
  - Prevent OOM with high amount of batch async calls (bsc#1216063)
  - Add missing contextvars dependency in salt.version
  - Skip tests for unsupported algorithm on old OpenSSL version
  - Remove redundant `_file_find` call to the master
  - Prevent possible exception in tornado.concurrent.Future._set_done
  - Make reactor engine less blocking the EventPublisher
  - Make salt-master self recoverable on killing EventPublisher
  - Improve broken events catching and reporting
  - Make logging calls lighter
  - Remove unused import causing delays on starting salt-master
  - Mark python3-CherryPy as recommended package for the testsuite
  - Make "man" a recommended package instead of required
  - Convert oscap output to UTF-8
  - Make Salt compatible with Python 3.11
  - Ignore non-ascii chars in oscap output (bsc#1219001)
  - Fix detected issues in Salt tests when running on VMs
  - Make importing seco.range thread safe (bsc#1211649)
  - Fix problematic tests and allow smooth tests executions on containers
  - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
  - Provide user(salt)/group(salt) capabilities for RPM 4.19
  - Extend dependencies for python3-salt-testsuite and python3-salt packages
  - Improve Salt and testsuite packages multibuild
  - Enable multibuilld and create test flavor
  - Added:
    * add-missing-contextvars-dependency-in-salt.version.patch
    * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch
    * switch-oscap-encoding-to-utf-8-639.patch
    * fix-user.list_groups-omits-remote-groups.patch
    * remove-unused-import-causing-delays-on-starting-salt.patch
    * provide-systemd-timer-unit.patch
    * make-reactor-engine-less-blocking-the-eventpublisher.patch
    * improve-broken-events-catching-and-reporting.patch
    * make-logging-calls-lighter.patch
    * make-importing-seco.range-thread-safe-bsc-1211649.patch
    * prevent-possible-exception-in-tornado.concurrent.fut.patch
    * fix-salt-warnings-and-testuite-for-python-3.11-635.patch
    * make-salt-master-self-recoverable-on-killing-eventpu.patch
    * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch
    * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch
    * fix-problematic-tests-and-allow-smooth-tests-executi.patch
    * several-fixes-for-tests-to-avoid-errors-and-failures.patch
    * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
    * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch
    * speed-up-salt.matcher.confirm_top-by-using-__context.patch
    * do-not-call-the-async-wrapper-calls-with-the-separat.patch
    * firewalld-normalize-new-rich-rules-before-comparing-.patch
    * remove-redundant-_file_find-call-to-the-master.patch
    * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
    * some-more-small-tests-fixes-enhancements-661.patch
    * decode-oscap-byte-stream-to-string-bsc-1219001.patch
    * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch

++++ salt:

  - Fix rich rule comparison in firewalld module (bsc#1222684)
  - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
  - Make auth.pam more robust with Salt Bundle and fix tests
  - Fix performance of user.list_groups with many remote groups
  - Fix "status.diskusage" function and exclude some tests for Salt Bundle
  - Skip certain tests if necessary for some OSes and set flaky ones
  - Add a timer to delete old env post update for venv-minion
  - Several fixes for tests to avoid errors and failures in some OSes
  - Speed up salt.matcher.confirm_top by using __context__
  - Do not call the async wrapper calls with the separate thread
  - Prevent OOM with high amount of batch async calls (bsc#1216063)
  - Add missing contextvars dependency in salt.version
  - Skip tests for unsupported algorithm on old OpenSSL version
  - Remove redundant `_file_find` call to the master
  - Prevent possible exception in tornado.concurrent.Future._set_done
  - Make reactor engine less blocking the EventPublisher
  - Make salt-master self recoverable on killing EventPublisher
  - Improve broken events catching and reporting
  - Make logging calls lighter
  - Remove unused import causing delays on starting salt-master
  - Mark python3-CherryPy as recommended package for the testsuite
  - Make "man" a recommended package instead of required
  - Convert oscap output to UTF-8
  - Make Salt compatible with Python 3.11
  - Ignore non-ascii chars in oscap output (bsc#1219001)
  - Fix detected issues in Salt tests when running on VMs
  - Make importing seco.range thread safe (bsc#1211649)
  - Fix problematic tests and allow smooth tests executions on containers
  - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
  - Provide user(salt)/group(salt) capabilities for RPM 4.19
  - Extend dependencies for python3-salt-testsuite and python3-salt packages
  - Improve Salt and testsuite packages multibuild
  - Enable multibuilld and create test flavor
  - Added:
    * add-missing-contextvars-dependency-in-salt.version.patch
    * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch
    * switch-oscap-encoding-to-utf-8-639.patch
    * fix-user.list_groups-omits-remote-groups.patch
    * remove-unused-import-causing-delays-on-starting-salt.patch
    * provide-systemd-timer-unit.patch
    * make-reactor-engine-less-blocking-the-eventpublisher.patch
    * improve-broken-events-catching-and-reporting.patch
    * make-logging-calls-lighter.patch
    * make-importing-seco.range-thread-safe-bsc-1211649.patch
    * prevent-possible-exception-in-tornado.concurrent.fut.patch
    * fix-salt-warnings-and-testuite-for-python-3.11-635.patch
    * make-salt-master-self-recoverable-on-killing-eventpu.patch
    * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch
    * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch
    * fix-problematic-tests-and-allow-smooth-tests-executi.patch
    * several-fixes-for-tests-to-avoid-errors-and-failures.patch
    * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
    * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch
    * speed-up-salt.matcher.confirm_top-by-using-__context.patch
    * do-not-call-the-async-wrapper-calls-with-the-separat.patch
    * firewalld-normalize-new-rich-rules-before-comparing-.patch
    * remove-redundant-_file_find-call-to-the-master.patch
    * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
    * some-more-small-tests-fixes-enhancements-661.patch
    * decode-oscap-byte-stream-to-string-bsc-1219001.patch
    * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch

++++ salt:

  - Fix rich rule comparison in firewalld module (bsc#1222684)
  - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
  - Make auth.pam more robust with Salt Bundle and fix tests
  - Fix performance of user.list_groups with many remote groups
  - Fix "status.diskusage" function and exclude some tests for Salt Bundle
  - Skip certain tests if necessary for some OSes and set flaky ones
  - Add a timer to delete old env post update for venv-minion
  - Several fixes for tests to avoid errors and failures in some OSes
  - Speed up salt.matcher.confirm_top by using __context__
  - Do not call the async wrapper calls with the separate thread
  - Prevent OOM with high amount of batch async calls (bsc#1216063)
  - Add missing contextvars dependency in salt.version
  - Skip tests for unsupported algorithm on old OpenSSL version
  - Remove redundant `_file_find` call to the master
  - Prevent possible exception in tornado.concurrent.Future._set_done
  - Make reactor engine less blocking the EventPublisher
  - Make salt-master self recoverable on killing EventPublisher
  - Improve broken events catching and reporting
  - Make logging calls lighter
  - Remove unused import causing delays on starting salt-master
  - Mark python3-CherryPy as recommended package for the testsuite
  - Make "man" a recommended package instead of required
  - Convert oscap output to UTF-8
  - Make Salt compatible with Python 3.11
  - Ignore non-ascii chars in oscap output (bsc#1219001)
  - Fix detected issues in Salt tests when running on VMs
  - Make importing seco.range thread safe (bsc#1211649)
  - Fix problematic tests and allow smooth tests executions on containers
  - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
  - Provide user(salt)/group(salt) capabilities for RPM 4.19
  - Extend dependencies for python3-salt-testsuite and python3-salt packages
  - Improve Salt and testsuite packages multibuild
  - Enable multibuilld and create test flavor
  - Added:
    * add-missing-contextvars-dependency-in-salt.version.patch
    * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch
    * switch-oscap-encoding-to-utf-8-639.patch
    * fix-user.list_groups-omits-remote-groups.patch
    * remove-unused-import-causing-delays-on-starting-salt.patch
    * provide-systemd-timer-unit.patch
    * make-reactor-engine-less-blocking-the-eventpublisher.patch
    * improve-broken-events-catching-and-reporting.patch
    * make-logging-calls-lighter.patch
    * make-importing-seco.range-thread-safe-bsc-1211649.patch
    * prevent-possible-exception-in-tornado.concurrent.fut.patch
    * fix-salt-warnings-and-testuite-for-python-3.11-635.patch
    * make-salt-master-self-recoverable-on-killing-eventpu.patch
    * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch
    * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch
    * fix-problematic-tests-and-allow-smooth-tests-executi.patch
    * several-fixes-for-tests-to-avoid-errors-and-failures.patch
    * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
    * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch
    * speed-up-salt.matcher.confirm_top-by-using-__context.patch
    * do-not-call-the-async-wrapper-calls-with-the-separat.patch
    * firewalld-normalize-new-rich-rules-before-comparing-.patch
    * remove-redundant-_file_find-call-to-the-master.patch
    * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
    * some-more-small-tests-fixes-enhancements-661.patch
    * decode-oscap-byte-stream-to-string-bsc-1219001.patch
    * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch

++++ salt:

  - Fix rich rule comparison in firewalld module (bsc#1222684)
  - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
  - Make auth.pam more robust with Salt Bundle and fix tests
  - Fix performance of user.list_groups with many remote groups
  - Fix "status.diskusage" function and exclude some tests for Salt Bundle
  - Skip certain tests if necessary for some OSes and set flaky ones
  - Add a timer to delete old env post update for venv-minion
  - Several fixes for tests to avoid errors and failures in some OSes
  - Speed up salt.matcher.confirm_top by using __context__
  - Do not call the async wrapper calls with the separate thread
  - Prevent OOM with high amount of batch async calls (bsc#1216063)
  - Add missing contextvars dependency in salt.version
  - Skip tests for unsupported algorithm on old OpenSSL version
  - Remove redundant `_file_find` call to the master
  - Prevent possible exception in tornado.concurrent.Future._set_done
  - Make reactor engine less blocking the EventPublisher
  - Make salt-master self recoverable on killing EventPublisher
  - Improve broken events catching and reporting
  - Make logging calls lighter
  - Remove unused import causing delays on starting salt-master
  - Mark python3-CherryPy as recommended package for the testsuite
  - Make "man" a recommended package instead of required
  - Convert oscap output to UTF-8
  - Make Salt compatible with Python 3.11
  - Ignore non-ascii chars in oscap output (bsc#1219001)
  - Fix detected issues in Salt tests when running on VMs
  - Make importing seco.range thread safe (bsc#1211649)
  - Fix problematic tests and allow smooth tests executions on containers
  - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
  - Provide user(salt)/group(salt) capabilities for RPM 4.19
  - Extend dependencies for python3-salt-testsuite and python3-salt packages
  - Improve Salt and testsuite packages multibuild
  - Enable multibuilld and create test flavor
  - Added:
    * add-missing-contextvars-dependency-in-salt.version.patch
    * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch
    * switch-oscap-encoding-to-utf-8-639.patch
    * fix-user.list_groups-omits-remote-groups.patch
    * remove-unused-import-causing-delays-on-starting-salt.patch
    * provide-systemd-timer-unit.patch
    * make-reactor-engine-less-blocking-the-eventpublisher.patch
    * improve-broken-events-catching-and-reporting.patch
    * make-logging-calls-lighter.patch
    * make-importing-seco.range-thread-safe-bsc-1211649.patch
    * prevent-possible-exception-in-tornado.concurrent.fut.patch
    * fix-salt-warnings-and-testuite-for-python-3.11-635.patch
    * make-salt-master-self-recoverable-on-killing-eventpu.patch
    * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch
    * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch
    * fix-problematic-tests-and-allow-smooth-tests-executi.patch
    * several-fixes-for-tests-to-avoid-errors-and-failures.patch
    * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
    * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch
    * speed-up-salt.matcher.confirm_top-by-using-__context.patch
    * do-not-call-the-async-wrapper-calls-with-the-separat.patch
    * firewalld-normalize-new-rich-rules-before-comparing-.patch
    * remove-redundant-_file_find-call-to-the-master.patch
    * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
    * some-more-small-tests-fixes-enhancements-661.patch
    * decode-oscap-byte-stream-to-string-bsc-1219001.patch
    * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch

++++ salt:

  - Fix rich rule comparison in firewalld module (bsc#1222684)
  - test_vultrpy: adjust test expectation to prevent failure after Debian 10 EOL
  - Make auth.pam more robust with Salt Bundle and fix tests
  - Fix performance of user.list_groups with many remote groups
  - Fix "status.diskusage" function and exclude some tests for Salt Bundle
  - Skip certain tests if necessary for some OSes and set flaky ones
  - Add a timer to delete old env post update for venv-minion
  - Several fixes for tests to avoid errors and failures in some OSes
  - Speed up salt.matcher.confirm_top by using __context__
  - Do not call the async wrapper calls with the separate thread
  - Prevent OOM with high amount of batch async calls (bsc#1216063)
  - Add missing contextvars dependency in salt.version
  - Skip tests for unsupported algorithm on old OpenSSL version
  - Remove redundant `_file_find` call to the master
  - Prevent possible exception in tornado.concurrent.Future._set_done
  - Make reactor engine less blocking the EventPublisher
  - Make salt-master self recoverable on killing EventPublisher
  - Improve broken events catching and reporting
  - Make logging calls lighter
  - Remove unused import causing delays on starting salt-master
  - Mark python3-CherryPy as recommended package for the testsuite
  - Make "man" a recommended package instead of required
  - Convert oscap output to UTF-8
  - Make Salt compatible with Python 3.11
  - Ignore non-ascii chars in oscap output (bsc#1219001)
  - Fix detected issues in Salt tests when running on VMs
  - Make importing seco.range thread safe (bsc#1211649)
  - Fix problematic tests and allow smooth tests executions on containers
  - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888)
  - Provide user(salt)/group(salt) capabilities for RPM 4.19
  - Extend dependencies for python3-salt-testsuite and python3-salt packages
  - Improve Salt and testsuite packages multibuild
  - Enable multibuilld and create test flavor
  - Added:
    * add-missing-contextvars-dependency-in-salt.version.patch
    * fix-status.diskusage-and-exclude-some-tests-to-run-w.patch
    * switch-oscap-encoding-to-utf-8-639.patch
    * fix-user.list_groups-omits-remote-groups.patch
    * remove-unused-import-causing-delays-on-starting-salt.patch
    * provide-systemd-timer-unit.patch
    * make-reactor-engine-less-blocking-the-eventpublisher.patch
    * improve-broken-events-catching-and-reporting.patch
    * make-logging-calls-lighter.patch
    * make-importing-seco.range-thread-safe-bsc-1211649.patch
    * prevent-possible-exception-in-tornado.concurrent.fut.patch
    * fix-salt-warnings-and-testuite-for-python-3.11-635.patch
    * make-salt-master-self-recoverable-on-killing-eventpu.patch
    * fix-tests-failures-and-errors-when-detected-on-vm-ex.patch
    * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch
    * fix-problematic-tests-and-allow-smooth-tests-executi.patch
    * several-fixes-for-tests-to-avoid-errors-and-failures.patch
    * prevent-oom-with-high-amount-of-batch-async-calls-bs.patch
    * skip-certain-tests-if-necessary-and-mark-some-flaky-.patch
    * speed-up-salt.matcher.confirm_top-by-using-__context.patch
    * do-not-call-the-async-wrapper-calls-with-the-separat.patch
    * firewalld-normalize-new-rich-rules-before-comparing-.patch
    * remove-redundant-_file_find-call-to-the-master.patch
    * skip-tests-for-unsupported-algorithm-on-old-openssl-.patch
    * some-more-small-tests-fixes-enhancements-661.patch
    * decode-oscap-byte-stream-to-string-bsc-1219001.patch
    * test_vultrpy-adjust-test-expectation-to-prevent-fail.patch

++++ supportutils:

  - Changes to version 3.2.8
    + Avoid getting duplicate kernel verifications in boot.text (pr#190)
    + lvm: suppress file descriptor leak warnings from lvm commands (pr#191)
    + docker_info: Add timestamps to container logs (pr#196)
    + Key value pairs and container log timestamps (bsc#1222021 PED-8211, pr#198)
    + Update supportconfig get pam.d sorted (pr#199)
    + yast_files: Exclude .zcat (pr#201)
    + Sanitize grub bootloader (bsc#1227127, pr#203)
    + Sanitize regcodes (pr#204)
    + Improve product detection (pr#205)
    + Add read_values for s390x (bsc#1228265, pr#206)
    + hardware_info: Remove old alsa ver check (pr#209)
    + drbd_info: Fix incorrect escape of quotes (pr#210)

++++ supportutils:

  - Changes to version 3.2.8
    + Avoid getting duplicate kernel verifications in boot.text (pr#190)
    + lvm: suppress file descriptor leak warnings from lvm commands (pr#191)
    + docker_info: Add timestamps to container logs (pr#196)
    + Key value pairs and container log timestamps (bsc#1222021 PED-8211, pr#198)
    + Update supportconfig get pam.d sorted (pr#199)
    + yast_files: Exclude .zcat (pr#201)
    + Sanitize grub bootloader (bsc#1227127, pr#203)
    + Sanitize regcodes (pr#204)
    + Improve product detection (pr#205)
    + Add read_values for s390x (bsc#1228265, pr#206)
    + hardware_info: Remove old alsa ver check (pr#209)
    + drbd_info: Fix incorrect escape of quotes (pr#210)

++++ supportutils:

  - Changes to version 3.2.8
    + Avoid getting duplicate kernel verifications in boot.text (pr#190)
    + lvm: suppress file descriptor leak warnings from lvm commands (pr#191)
    + docker_info: Add timestamps to container logs (pr#196)
    + Key value pairs and container log timestamps (bsc#1222021 PED-8211, pr#198)
    + Update supportconfig get pam.d sorted (pr#199)
    + yast_files: Exclude .zcat (pr#201)
    + Sanitize grub bootloader (bsc#1227127, pr#203)
    + Sanitize regcodes (pr#204)
    + Improve product detection (pr#205)
    + Add read_values for s390x (bsc#1228265, pr#206)
    + hardware_info: Remove old alsa ver check (pr#209)
    + drbd_info: Fix incorrect escape of quotes (pr#210)

------------------------------------------------------------------
------------------  2024-7-31  -  Jul 31 2024  -------------------
------------------------------------------------------------------

++++ chrony:

  - Update clknetsim to snapshot 633a0be: fix missing stat/fstat with
    latest glibc.

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch
  - Update to 8.9.1:
    * Security fixes:
  - curl: ASN.1 date parser overread [bsc#1228535, CVE-2024-7264]
    * Bugfixes:
  - cmake: detect 'libssh' via 'pkg-config'
  - cmake: detect 'nettle' when building with GnuTLS
  - connect: fix connection shutdown for event based processing
  - curl: more defensive socket code for --ip-tos
  - CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
  - CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
  - ftpserver.pl: make POP3 LIST serve content from the test file
  - lib: survive some NULL input args
  - os400: build cli manual.
  - os400: workaround an IBM ASCII run-time library bug
  - transfer: speed limiting fix for 32bit systems
  - vtls: avoid forward declaration in MultiSSL builds
  - x509asn1: unittests and fixes for gtime2str

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch
  - Update to 8.9.1:
    * Security fixes:
  - curl: ASN.1 date parser overread [bsc#1228535, CVE-2024-7264]
    * Bugfixes:
  - cmake: detect 'libssh' via 'pkg-config'
  - cmake: detect 'nettle' when building with GnuTLS
  - connect: fix connection shutdown for event based processing
  - curl: more defensive socket code for --ip-tos
  - CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
  - CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
  - ftpserver.pl: make POP3 LIST serve content from the test file
  - lib: survive some NULL input args
  - os400: build cli manual.
  - os400: workaround an IBM ASCII run-time library bug
  - transfer: speed limiting fix for 32bit systems
  - vtls: avoid forward declaration in MultiSSL builds
  - x509asn1: unittests and fixes for gtime2str

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch
  - Update to 8.9.1:
    * Security fixes:
  - curl: ASN.1 date parser overread [bsc#1228535, CVE-2024-7264]
    * Bugfixes:
  - cmake: detect 'libssh' via 'pkg-config'
  - cmake: detect 'nettle' when building with GnuTLS
  - connect: fix connection shutdown for event based processing
  - curl: more defensive socket code for --ip-tos
  - CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
  - CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
  - ftpserver.pl: make POP3 LIST serve content from the test file
  - lib: survive some NULL input args
  - os400: build cli manual.
  - os400: workaround an IBM ASCII run-time library bug
  - transfer: speed limiting fix for 32bit systems
  - vtls: avoid forward declaration in MultiSSL builds
  - x509asn1: unittests and fixes for gtime2str

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch
  - Update to 8.9.1:
    * Security fixes:
  - curl: ASN.1 date parser overread [bsc#1228535, CVE-2024-7264]
    * Bugfixes:
  - cmake: detect 'libssh' via 'pkg-config'
  - cmake: detect 'nettle' when building with GnuTLS
  - connect: fix connection shutdown for event based processing
  - curl: more defensive socket code for --ip-tos
  - CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
  - CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
  - ftpserver.pl: make POP3 LIST serve content from the test file
  - lib: survive some NULL input args
  - os400: build cli manual.
  - os400: workaround an IBM ASCII run-time library bug
  - transfer: speed limiting fix for 32bit systems
  - vtls: avoid forward declaration in MultiSSL builds
  - x509asn1: unittests and fixes for gtime2str

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch
  - Update to 8.9.1:
    * Security fixes:
  - curl: ASN.1 date parser overread [bsc#1228535, CVE-2024-7264]
    * Bugfixes:
  - cmake: detect 'libssh' via 'pkg-config'
  - cmake: detect 'nettle' when building with GnuTLS
  - connect: fix connection shutdown for event based processing
  - curl: more defensive socket code for --ip-tos
  - CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
  - CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
  - ftpserver.pl: make POP3 LIST serve content from the test file
  - lib: survive some NULL input args
  - os400: build cli manual.
  - os400: workaround an IBM ASCII run-time library bug
  - transfer: speed limiting fix for 32bit systems
  - vtls: avoid forward declaration in MultiSSL builds
  - x509asn1: unittests and fixes for gtime2str

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch
  - Update to 8.9.1:
    * Security fixes:
  - curl: ASN.1 date parser overread [bsc#1228535, CVE-2024-7264]
    * Bugfixes:
  - cmake: detect 'libssh' via 'pkg-config'
  - cmake: detect 'nettle' when building with GnuTLS
  - connect: fix connection shutdown for event based processing
  - curl: more defensive socket code for --ip-tos
  - CURLOPT_SSL_CTX_FUNCTION.md: mention CA caching
  - CURLSHOPT_SHARE.md: mention sessions/cookies as not thread-safe
  - ftpserver.pl: make POP3 LIST serve content from the test file
  - lib: survive some NULL input args
  - os400: build cli manual.
  - os400: workaround an IBM ASCII run-time library bug
  - transfer: speed limiting fix for 32bit systems
  - vtls: avoid forward declaration in MultiSSL builds
  - x509asn1: unittests and fixes for gtime2str

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch

++++ curl:

  - Security fix: [bsc#1228535, CVE-2024-7264]
    * curl: ASN.1 date parser overread
    * Add curl-CVE-2024-7264.patch

++++ docker:

    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes a fix for CVE-2024-41110. bsc#1228324
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Update to Docker 26.1.5-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2615>
    bsc#1230294
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070
    * CVE-2023-45142. bsc#1228553
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch
    * cli-0001-docs-include-required-tools-in-source-tree.patch
    [NOTE: This update was only ever released in SLES and Leap.]
  - Update to Docker 25.0.6-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/25.0/#2506>
  - This update includes fixes for:
    * CVE-2024-41110. bsc#1228324
    * CVE-2023-47108. bsc#1217070 bsc#1229806
    * CVE-2023-45142. bsc#1228553 bsc#1229806
  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
    * 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
    * 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ python-kiwi:

  - Fix test_process_result_bundle_as_rpm
    os.path.basename was called on a MagicMock object which
    sometimes confused pytest
  - CI: Add testing against Python 3.13
    Python 3.13 is shipping in Fedora Linux for Fedora Linux 41, so we
    should ensure kiwi is tested against it. The testing setup is
    based on the latest development version of 3.13 as it is not
    yet released.
  - Fix kiwi-repart restrictions
    The kiwi repart dracut module reads a profile file and if it
    does not exists it dies in the initrd. However, that profile
    file is not mandatory for the main resize functionality. Thus
    this commit turns this into a warning message. In addition
    the module-setup for 90kiwi-repart makes sure to include
    the required and optional profile files.
    This Fixes bsc#1228118

++++ python-kiwi:

  - Fix test_process_result_bundle_as_rpm
    os.path.basename was called on a MagicMock object which
    sometimes confused pytest
  - CI: Add testing against Python 3.13
    Python 3.13 is shipping in Fedora Linux for Fedora Linux 41, so we
    should ensure kiwi is tested against it. The testing setup is
    based on the latest development version of 3.13 as it is not
    yet released.
  - Fix kiwi-repart restrictions
    The kiwi repart dracut module reads a profile file and if it
    does not exists it dies in the initrd. However, that profile
    file is not mandatory for the main resize functionality. Thus
    this commit turns this into a warning message. In addition
    the module-setup for 90kiwi-repart makes sure to include
    the required and optional profile files.
    This Fixes bsc#1228118

++++ python-kiwi:

  - Fix test_process_result_bundle_as_rpm
    os.path.basename was called on a MagicMock object which
    sometimes confused pytest
  - CI: Add testing against Python 3.13
    Python 3.13 is shipping in Fedora Linux for Fedora Linux 41, so we
    should ensure kiwi is tested against it. The testing setup is
    based on the latest development version of 3.13 as it is not
    yet released.
  - Fix kiwi-repart restrictions
    The kiwi repart dracut module reads a profile file and if it
    does not exists it dies in the initrd. However, that profile
    file is not mandatory for the main resize functionality. Thus
    this commit turns this into a warning message. In addition
    the module-setup for 90kiwi-repart makes sure to include
    the required and optional profile files.
    This Fixes bsc#1228118

++++ kernel-default:

  - ila: block BH in ila_output() (CVE-2024-41081 bsc#1228617)
  - commit b832793
  - NFSv4: Fix memory leak in nfs4_set_security_label (CVE-2024-41076 bsc#1228649)
  - commit c2db2a8
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush
    (bsc#1228672 CVE-2024-42079).
  - commit 61cd0c5
  - Update patch reference for ASoC fix (CVE-2024-41069 bsc#1228644)
  - commit bc5c8af
  - Update patches.suse/nilfs2-fix-inode-number-range-checks.patch
    (stable-fixes bsc#1228665 CVE-2024-42105).
  - commit c8d5b4d
  - Update patches.suse/hfsplus-fix-uninit-value-in-copy_name.patch
    (git-fixes bsc#1228561 CVE-2024-41059).
  - commit f1238d0
  - cachefiles: fix slab-use-after-free in
    cachefiles_withdraw_cookie() (bsc#1228462 CVE-2024-41057).
  - cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
    (bsc#1228459 CVE-2024-41058).
  - netfs, fscache: export fscache_put_volume() and add
    fscache_try_get_volume() (bsc#1228459 bsc#1228462).
  - commit a80ddf3
  - platform/chrome: cros_ec_proto: Lock device when updating MKBP
    version (git-fixes).
  - commit ab277a6
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
    (bsc#1228409 CVE-2024-41015).
  - ocfs2: strict bound check before memcmp in
    ocfs2_xattr_find_entry() (bsc#1228410).
  - ocfs2: add bounds checking to ocfs2_xattr_find_entry()
    (bsc#1228410 CVE-2024-41016).
  - commit ec6fa65
  - platform/chrome: cros_ec_proto: Lock device when updating MKBP
    version (git-fixes).
  - commit d441a76
  - Update patch reference of dmaengine fix (CVE-2024-40956 bsc#1227810)
  - commit d7e764c
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625
    CVE-2024-27437).
  - commit de8901b
  - mm: vmalloc: check if a hash-index is in cpu_possible_mask (CVE-2024-41032 bsc#1228460)
  - commit 9b04845
  - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (CVE-2024-40957 bsc#1227811)
  - commit a8ab7dd
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (CVE-2024-41041 bsc#1228520)
  - commit 74b98cc
  - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808)
  - commit 5ea4aa9
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070 bsc#1228470)
  - commit 3ac6386

++++ kernel-default:

  - ila: block BH in ila_output() (CVE-2024-41081 bsc#1228617)
  - commit b832793
  - NFSv4: Fix memory leak in nfs4_set_security_label (CVE-2024-41076 bsc#1228649)
  - commit c2db2a8
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush
    (bsc#1228672 CVE-2024-42079).
  - commit 61cd0c5
  - Update patch reference for ASoC fix (CVE-2024-41069 bsc#1228644)
  - commit bc5c8af
  - Update patches.suse/nilfs2-fix-inode-number-range-checks.patch
    (stable-fixes bsc#1228665 CVE-2024-42105).
  - commit c8d5b4d
  - Update patches.suse/hfsplus-fix-uninit-value-in-copy_name.patch
    (git-fixes bsc#1228561 CVE-2024-41059).
  - commit f1238d0
  - cachefiles: fix slab-use-after-free in
    cachefiles_withdraw_cookie() (bsc#1228462 CVE-2024-41057).
  - cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
    (bsc#1228459 CVE-2024-41058).
  - netfs, fscache: export fscache_put_volume() and add
    fscache_try_get_volume() (bsc#1228459 bsc#1228462).
  - commit a80ddf3
  - platform/chrome: cros_ec_proto: Lock device when updating MKBP
    version (git-fixes).
  - commit ab277a6
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
    (bsc#1228409 CVE-2024-41015).
  - ocfs2: strict bound check before memcmp in
    ocfs2_xattr_find_entry() (bsc#1228410).
  - ocfs2: add bounds checking to ocfs2_xattr_find_entry()
    (bsc#1228410 CVE-2024-41016).
  - commit ec6fa65
  - platform/chrome: cros_ec_proto: Lock device when updating MKBP
    version (git-fixes).
  - commit d441a76
  - Update patch reference of dmaengine fix (CVE-2024-40956 bsc#1227810)
  - commit d7e764c
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625
    CVE-2024-27437).
  - commit de8901b
  - mm: vmalloc: check if a hash-index is in cpu_possible_mask (CVE-2024-41032 bsc#1228460)
  - commit 9b04845
  - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (CVE-2024-40957 bsc#1227811)
  - commit a8ab7dd
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (CVE-2024-41041 bsc#1228520)
  - commit 74b98cc
  - net: do not leave a dangling sk pointer, when socket creation fails (CVE-2024-40954 bsc#1227808)
  - commit 5ea4aa9
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070 bsc#1228470)
  - commit 3ac6386

++++ kernel-firmware:

  - Update to version 20240728 (git commit bcd040c21dc9):
    * amdgpu: update DMCUB to v0.0.227.0 for DCN35 and DCN351
    * Revert "iwlwifi: update ty/So/Ma firmwares for core89-58 release"
    (CVE-2023-47210, bsc#1225601, CVE-2023-38417, bsc#1225600)
    * linux-firmware: update firmware for MT7922 WiFi device
    * linux-firmware: update firmware for MT7921 WiFi device
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
    * iwlwifi: add gl FW for core89-58 release
    * iwlwifi: update ty/So/Ma firmwares for core89-58 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core89-58 release
    * mediatek: Update mt8195 SOF firmware and sof-tplg
    * ASoC: tas2781: fix the license issue for tas781 firmware
    * rtl_bt: Update RTL8852B BT USB FW to 0x048F_4008
    * .gitignore: Ignore intermediate files
    * i915: Update Xe2LPD DMC to v2.21
    * qcom: move signed x1e80100 signed firmware to the SoC subdir
    * qcom: add video firmware file for vpu-3.0
    * intel: avs: Add topology file for I2S Analog Devices 4567
    * intel: avs: Add topology file for I2S Nuvoton 8825
    * intel: avs: Add topology file for I2S Maxim 98927
    * intel: avs: Add topology file for I2S Maxim 98373
    * intel: avs: Add topology file for I2S Maxim 98357a
    * intel: avs: Add topology file for I2S Dialog 7219
    * intel: avs: Add topology file for I2S Realtek 5663
    * intel: avs: Add topology file for I2S Realtek 5640
    * intel: avs: Add topology file for I2S Realtek 5514
    * intel: avs: Add topology file for I2S Realtek 298
    * intel: avs: Add topology file for I2S Realtek 286
    * intel: avs: Add topology file for I2S Realtek 274
    * intel: avs: Add topology file for Digital Microphone Array
    * intel: avs: Add topology file for HDMI codecs
    * intel: avs: Add topology file for HDAudio codecs
    * Add a copy of Apache-2.0
    * intel: avs: Update AudioDSP base firmware for APL-based platforms
  - Update aliases from 6.10.y and 6.11-rc1
  - Add the Provides/Obsoletes for avs-topology-firmware, as now the
    firmware files are provided in this package

++++ kernel-firmware:

  - Update to version 20240728 (git commit bcd040c21dc9):
    * amdgpu: update DMCUB to v0.0.227.0 for DCN35 and DCN351
    * Revert "iwlwifi: update ty/So/Ma firmwares for core89-58 release"
    (CVE-2023-47210, bsc#1225601, CVE-2023-38417, bsc#1225600)
    * linux-firmware: update firmware for MT7922 WiFi device
    * linux-firmware: update firmware for MT7921 WiFi device
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
    * iwlwifi: add gl FW for core89-58 release
    * iwlwifi: update ty/So/Ma firmwares for core89-58 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core89-58 release
    * mediatek: Update mt8195 SOF firmware and sof-tplg
    * ASoC: tas2781: fix the license issue for tas781 firmware
    * rtl_bt: Update RTL8852B BT USB FW to 0x048F_4008
    * .gitignore: Ignore intermediate files
    * i915: Update Xe2LPD DMC to v2.21
    * qcom: move signed x1e80100 signed firmware to the SoC subdir
    * qcom: add video firmware file for vpu-3.0
    * intel: avs: Add topology file for I2S Analog Devices 4567
    * intel: avs: Add topology file for I2S Nuvoton 8825
    * intel: avs: Add topology file for I2S Maxim 98927
    * intel: avs: Add topology file for I2S Maxim 98373
    * intel: avs: Add topology file for I2S Maxim 98357a
    * intel: avs: Add topology file for I2S Dialog 7219
    * intel: avs: Add topology file for I2S Realtek 5663
    * intel: avs: Add topology file for I2S Realtek 5640
    * intel: avs: Add topology file for I2S Realtek 5514
    * intel: avs: Add topology file for I2S Realtek 298
    * intel: avs: Add topology file for I2S Realtek 286
    * intel: avs: Add topology file for I2S Realtek 274
    * intel: avs: Add topology file for Digital Microphone Array
    * intel: avs: Add topology file for HDMI codecs
    * intel: avs: Add topology file for HDAudio codecs
    * Add a copy of Apache-2.0
    * intel: avs: Update AudioDSP base firmware for APL-based platforms
  - Update aliases from 6.10.y and 6.11-rc1
  - Add the Provides/Obsoletes for avs-topology-firmware, as now the
    firmware files are provided in this package

++++ kernel-firmware:

  - Update to version 20240728 (git commit bcd040c21dc9):
    * amdgpu: update DMCUB to v0.0.227.0 for DCN35 and DCN351
    * Revert "iwlwifi: update ty/So/Ma firmwares for core89-58 release"
    (CVE-2023-47210, bsc#1225601, CVE-2023-38417, bsc#1225600)
    * linux-firmware: update firmware for MT7922 WiFi device
    * linux-firmware: update firmware for MT7921 WiFi device
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
    * linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
    * iwlwifi: add gl FW for core89-58 release
    * iwlwifi: update ty/So/Ma firmwares for core89-58 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core89-58 release
    * mediatek: Update mt8195 SOF firmware and sof-tplg
    * ASoC: tas2781: fix the license issue for tas781 firmware
    * rtl_bt: Update RTL8852B BT USB FW to 0x048F_4008
    * .gitignore: Ignore intermediate files
    * i915: Update Xe2LPD DMC to v2.21
    * qcom: move signed x1e80100 signed firmware to the SoC subdir
    * qcom: add video firmware file for vpu-3.0
    * intel: avs: Add topology file for I2S Analog Devices 4567
    * intel: avs: Add topology file for I2S Nuvoton 8825
    * intel: avs: Add topology file for I2S Maxim 98927
    * intel: avs: Add topology file for I2S Maxim 98373
    * intel: avs: Add topology file for I2S Maxim 98357a
    * intel: avs: Add topology file for I2S Dialog 7219
    * intel: avs: Add topology file for I2S Realtek 5663
    * intel: avs: Add topology file for I2S Realtek 5640
    * intel: avs: Add topology file for I2S Realtek 5514
    * intel: avs: Add topology file for I2S Realtek 298
    * intel: avs: Add topology file for I2S Realtek 286
    * intel: avs: Add topology file for I2S Realtek 274
    * intel: avs: Add topology file for Digital Microphone Array
    * intel: avs: Add topology file for HDMI codecs
    * intel: avs: Add topology file for HDAudio codecs
    * Add a copy of Apache-2.0
    * intel: avs: Update AudioDSP base firmware for APL-based platforms
  - Update aliases from 6.10.y and 6.11-rc1
  - Add the Provides/Obsoletes for avs-topology-firmware, as now the
    firmware files are provided in this package

------------------------------------------------------------------
------------------  2024-7-30  -  Jul 30 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Do not exclude the .profile env file by default
    kiwi's initrd modules read a .profile file which gets included
    into the initrd produced at build time. To allow rebuild of a
    host-only initrd from the booted system this information should
    be present such that it is possible to re-use kiwi initrd code.
  - Get rid of debootstrap
    Replace debootstrap with an apt-get based pre-download of
    packages followed by a dpkg-deb extraction.
    This Fixes #2599
  - Bump version: 10.0.26 → 10.0.27
  - Fix dracut-interactive with systemd 256
    With systemd 256, /usr (and thus also /bin/) is read-only in the initrd.
    Move dracut-interactive and its .service into /run instead.

++++ python-kiwi:

  - Do not exclude the .profile env file by default
    kiwi's initrd modules read a .profile file which gets included
    into the initrd produced at build time. To allow rebuild of a
    host-only initrd from the booted system this information should
    be present such that it is possible to re-use kiwi initrd code.
  - Get rid of debootstrap
    Replace debootstrap with an apt-get based pre-download of
    packages followed by a dpkg-deb extraction.
    This Fixes #2599
  - Bump version: 10.0.26 → 10.0.27
  - Fix dracut-interactive with systemd 256
    With systemd 256, /usr (and thus also /bin/) is read-only in the initrd.
    Move dracut-interactive and its .service into /run instead.

++++ python-kiwi:

  - Do not exclude the .profile env file by default
    kiwi's initrd modules read a .profile file which gets included
    into the initrd produced at build time. To allow rebuild of a
    host-only initrd from the booted system this information should
    be present such that it is possible to re-use kiwi initrd code.
  - Get rid of debootstrap
    Replace debootstrap with an apt-get based pre-download of
    packages followed by a dpkg-deb extraction.
    This Fixes #2599
  - Bump version: 10.0.26 → 10.0.27
  - Fix dracut-interactive with systemd 256
    With systemd 256, /usr (and thus also /bin/) is read-only in the initrd.
    Move dracut-interactive and its .service into /run instead.

++++ git:

  - update to 2.46.0
    UI, Workflows & Features
    * The "--rfc" option of "git format-patch" learned to take an
    optional string value to be used in place of "RFC" to tweak the
    "[PATCH]" on the subject header.
    * The credential helper protocol, together with the HTTP layer, have
    been enhanced to support authentication schemes different from
    username & password pair, like Bearer and NTLM.
    * Command line completion script (in contrib/) learned to complete
    "git symbolic-ref" a bit better (you need to enable plumbing
    commands to be completed with GIT_COMPLETION_SHOW_ALL_COMMANDS).
    * When the user responds to a prompt given by "git add -p" with an
    unsupported command, list of available commands were given, which
    was too much if the user knew what they wanted to type but merely
    made a typo.  Now the user gets a much shorter error message.
    * The color parsing code learned to handle 12-bit RGB colors, spelled
    as "#RGB" (in addition to "#RRGGBB" that is already supported).
    * The operation mode options (like "--get") the "git config" command
    uses have been deprecated and replaced with subcommands (like "git
    config get").
    * "git tag" learned the "--trailer" option to futz with the trailers
    in the same way as "git commit" does.
    * A new global "--no-advice" option can be used to disable all advice
    messages, which is meant to be used only in scripts.
    * Updates to symbolic refs can now be made as a part of ref
    transaction.
    * The trailer API has been reshuffled a bit.
    * Terminology to call various ref-like things are getting
    straightened out.
    * The command line completion script (in contrib/) has been adjusted
    to the recent update to "git config" that adopted subcommand based
    UI.
    * The knobs to tweak how reftable files are written have been made
    available as configuration variables.
    * When "git push" notices that the commit at the tip of the ref on
    the other side it is about to overwrite does not exist locally, it
    used to first try fetching it if the local repository is a partial
    clone. The command has been taught not to do so and immediately
    fail instead.
    * The promisor.quiet configuration knob can be set to true to make
    lazy fetching from promisor remotes silent.
    * The inter/range-diff output has been moved to the end of the patch
    when format-patch adds it to a single patch, instead of writing it
    before the patch text, to be consistent with what is done for a
    cover letter for a multi-patch series.
    * A new command has been added to migrate a repository that uses the
    files backend for its ref storage to use the reftable backend, with
    limitations.
    * "git diff --exit-code --ext-diff" learned to take the exit status
    of the external diff driver into account when deciding the exit
    status of the overall "git diff" invocation when configured to do
    so.
    * "git update-ref --stdin" learned to handle transactional updates of
    symbolic-refs.
    * "git format-patch --interdiff" for multi-patch series learned to
    turn on cover letters automatically (unless told never to enable
    cover letter with "--no-cover-letter" and such).
    * The "--heads" option of "ls-remote" and "show-ref" has been been
    deprecated; "--branches" replaces "--heads".
    * For over a year, setting add.interactive.useBuiltin configuration
    variable did nothing but giving a "this does not do anything"
    warning.  The warning has been removed.
    * The http transport can now be told to send request with
    authentication material without first getting a 401 response.
    * A handful of entries are added to the GitFAQ document.
    * "git var GIT_SHELL_PATH" should report the path to the shell used
    to spawn external commands, but it didn't do so on Windows, which
    has been corrected.
    Performance, Internal Implementation, Development Support etc.
    * Advertise "git contacts", a tool for newcomers to find people to
    ask review for their patches, a bit more in our developer
    documentation.
    * In addition to building the objects needed, try to link the objects
    that are used in fuzzer tests, to make sure at least they build
    without bitrot, in Linux CI runs.
    * Code to write out reftable has seen some optimization and
    simplification.
    * Tests to ensure interoperability between reftable written by jgit
    and our code have been added and enabled in CI.
    * The singleton index_state instance "the_index" has been eliminated
    by always instantiating "the_repository" and replacing references
    to "the_index"  with references to its .index member.
    * Git-GUI has a new maintainer, Johannes Sixt.
    * The "test-tool" has been taught to run testsuite tests in parallel,
    bypassing the need to use the "prove" tool.
    * The "whitespace check" task that was enabled for GitHub Actions CI
    has been ported to GitLab CI.
    * The refs API lost functions that implicitly assumes to work on the
    primary ref_store by forcing the callers to pass a ref_store as an
    argument.
    * Code clean-up to reduce inter-function communication inside
    builtin/config.c done via the use of global variables.
    * The pack bitmap code saw some clean-up to prepare for a follow-up topic.
    * Preliminary code clean-up for "git send-email".
    * The default "creation-factor" used by "git format-patch" has been
    raised to make it more aggressively find matching commits.
    * Before discovering the repository details, We used to assume SHA-1
    as the "default" hash function, which has been corrected. Hopefully
    this will smoke out codepaths that rely on such an unwarranted
    assumptions.
    * The project decision making policy has been documented.
    * The strcmp-offset tests have been rewritten using the unit test
    framework.
    * "git add -p" learned to complain when an answer with more than one
    letter is given to a prompt that expects a single letter answer.
    * The alias-expanded command lines are logged to the trace output.
    * A new test was added to ensure git commands that are designed to
    run outside repositories do work.
    * A few tests in reftable library have been rewritten using the
    unit test framework.
    * A pair of test helpers that essentially are unit tests on hash
    algorithms have been rewritten using the unit-tests framework.
    * A test helper that essentially is unit tests on the "decorate"
    logic has been rewritten using the unit-tests framework.
    * Many memory leaks in the sparse-checkout code paths have been
    plugged.
    * "make check-docs" noticed problems and reported to its output but
    failed to signal its findings with its exit status, which has been
    corrected.
    * Building with "-Werror -Wwrite-strings" is now supported.
    * To help developers, the build procedure now allows builders to use
    CFLAGS_APPEND to specify additional CFLAGS.
    * "oidtree" tests were rewritten to use the unit test framework.
    * The structure of the document that records longer-term project
    decisions to deprecate/remove/update various behaviour has been
    outlined.
    * The pseudo-merge reachability bitmap to help more efficient storage
    of the reachability bitmap in a repository with too many refs has
    been added.
    * When "git merge" sees that the index cannot be refreshed (e.g. due
    to another process doing the same in the background), it died but
    after writing MERGE_HEAD etc. files, which was useless for the
    purpose to recover from the failure.
    * The output from "git cat-file --batch-check" and "--batch-command
    (info)" should not be unbuffered, for which some tests have been
    added.
    * A CPP macro USE_THE_REPOSITORY_VARIABLE is introduced to help
    transition the codebase to rely less on the availability of the
    singleton the_repository instance.
    * "git version --build-options" reports the version information of
    OpenSSL and other libraries (if used) in the build.
    * Memory ownership rules for the in-core representation of
    remote.*.url configuration values have been straightened out, which
    resulted in a few leak fixes and code clarification.
    * When bundleURI interface fetches multiple bundles, Git failed to
    take full advantage of all bundles and ended up slurping duplicated
    objects, which has been corrected.
    * The code to deal with modified paths that are out-of-cone in a
    sparsely checked out working tree has been optimized.
    * An existing test of oidmap API has been rewritten with the
    unit-test framework.
    * The "ort" merge backend saw one bugfix for a crash that happens
    when inner merge gets killed, and assorted code clean-ups.
    * A new warning message is issued when a command has to expand a
    sparse index to handle working tree cruft that are outside of the
    sparse checkout.
    * The test framework learned to take the test body not as a single
    string but as a here-document.
    * "git push '' HEAD:there" used to hit a BUG(); it has been corrected
    to die with "fatal: bad repository ''".
    * What happens when http.cookieFile gets the special value "" has
    been clarified in the documentation.
    Fixes
    * "git rebase --signoff" used to forget that it needs to add a
    sign-off to the resulting commit when told to continue after a
    conflict stops its operation.
    * The procedure to build multi-pack-index got confused by the
    replace-refs mechanism, which has been corrected by disabling the
    latter.
    * The "-k" and "--rfc" options of "format-patch" will now error out
    when used together, as one tells us not to add anything to the
    title of the commit, and the other one tells us to add "RFC" in
    addition to "PATCH".
    * "git stash -S" did not handle binary files correctly, which has
    been corrected.
    * A scheduled "git maintenance" job is expected to work on all
    repositories it knows about, but it stopped at the first one that
    errored out.  Now it keeps going.
    * zsh can pretend to be a normal shell pretty well except for some
    glitches that we tickle in some of our scripts. Work them around
    so that "vimdiff" and our test suite works well enough with it.
    * Command line completion support for zsh (in contrib/) has been
    updated to stop exposing internal state to end-user shell
    interaction.
    * Tests that try to corrupt in-repository files in chunked format did
    not work well on macOS due to its broken "mv", which has been
    worked around.
    * The maximum size of attribute files is enforced more consistently.
    * Unbreak CI jobs so that we do not attempt to use Python 2 that has
    been removed from the platform.
    * Git 2.43 started using the tree of HEAD as the source of attributes
    in a bare repository, which has severe performance implications.
    For now, revert the change, without ripping out a more explicit
    support for the attr.tree configuration variable.
    * The "--exit-code" option of "git diff" command learned to work with
    the "--ext-diff" option.
    * Windows CI running in GitHub Actions started complaining about the
    order of arguments given to calloc(); the imported regex code uses
    the wrong order almost consistently, which has been corrected.
    * Expose "name conflict" error when a ref creation fails due to D/F
    conflict in the ref namespace, to improve an error message given by
    "git fetch".
    (merge 9339fca23e it/refs-name-conflict later to maint).
    * The SubmittingPatches document now refers folks to manpages
    translation project.
    * The documentation for "git diff --name-only" has been clarified
    that it is about showing the names in the post-image tree.
    * The credential helper that talks with osx keychain learned to avoid
    storing back the authentication material it just got received from
    the keychain.
    (merge e1ab45b2da kn/osxkeychain-skip-idempotent-store later to maint).
    * The chainlint script (invoked during "make test") did nothing when
    it failed to detect the number of available CPUs.  It now falls
    back to 1 CPU to avoid the problem.
    * Revert overly aggressive "layered defence" that went into 2.45.1
    and friends, which broke "git-lfs", "git-annex", and other use
    cases, so that we can rebuild necessary counterparts in the open.
    * "git init" in an already created directory, when the user
    configuration has includeif.onbranch, started to fail recently,
    which has been corrected.
    * Memory leaks in "git mv" has been plugged.
    * The safe.directory configuration knob has been updated to
    optionally allow leading path matches.
    * An overly large ".gitignore" files are now rejected silently.
    * Upon expiration event, the credential subsystem forgot to clear
    in-core authentication material other than password (whose support
    was added recently), which has been corrected.
    * Fix for an embarrassing typo that prevented Python2 tests from running
    anywhere.
    * Varargs functions that are unannotated as printf-like or execl-like
    have been annotated as such.
    * "git am" has a safety feature to prevent it from starting a new
    session when there already is a session going.  It reliably
    triggers when a mbox is given on the command line, but it has to
    rely on the tty-ness of the standard input.  Add an explicit way to
    opt out of this safety with a command line option.
    (merge 62c71ace44 jk/am-retry later to maint).
    * A leak in "git imap-send" that somehow escapes LSan has been
    plugged.
    * Setting core.abbrev too early before the repository set-up
    (typically in "git clone") caused segfault, which as been
    corrected.
    * When the user adds to "git rebase -i" instruction to "pick" a merge
    commit, the error experience is not pleasant.  Such an error is now
    caught earlier in the process that parses the todo list.
    * We forgot to normalize the result of getcwd() to NFC on macOS where
    all other paths are normalized, which has been corrected.  This still
    does not address the case where core.precomposeUnicode configuration
    is not defined globally.
    * Earlier we stopped using the tree of HEAD as the default source of
    attributes in a bare repository, but failed to document it.  This
    has been corrected.
    * "git update-server-info" and "git commit-graph --write" have been
    updated to use the tempfile API to avoid leaving cruft after
    failing.
    * An unused extern declaration for mingw has been removed to prevent
    it from causing build failure.
    * A helper function shared between two tests had a copy-paste bug,
    which has been corrected.
    * "git fetch-pack -k -k" without passing "--lock-pack" (which we
    never do ourselves) did not work at all, which has been corrected.
    * CI job to build minimum fuzzers learned to pass NO_CURL=NoThanks to
    the build procedure, as its build environment does not offer, or
    the rest of the build needs, anything cURL.
    (merge 4e66b5a990 jc/fuzz-sans-curl later to maint).
    * "git diff --no-ext-diff" when diff.external is configured ignored
    the "--color-moved" option.
    (merge 0f4b0d4cf0 rs/diff-color-moved-w-no-ext-diff-fix later to maint).
    * "git archive --add-virtual-file=<path>:<contents>" never paid
    attention to the --prefix=<prefix> option but the documentation
    said it would. The documentation has been corrected.
    (merge 72c282098d jc/archive-prefix-with-add-virtual-file later to maint).
    * When GIT_PAGER failed to spawn, depending on the code path taken,
    we failed immediately (correct) or just spew the payload to the
    standard output (incorrect).  The code now always fail immediately
    when GIT_PAGER fails.
    (merge 78f0a5d187 rj/pager-die-upon-exec-failure later to maint).
    * date parser updates to be more careful about underflowing epoch
    based timestamp.
    (merge 9d69789770 db/date-underflow-fix later to maint).
    * The Bloom filter used for path limited history traversal was broken
    on systems whose "char" is unsigned; update the implementation and
    bump the format version to 2.
    (merge 9c8a9ec787 tb/path-filter-fix later to maint).
    * Typofix.
    (merge 231cf7370e as/pathspec-h-typofix later to maint).
    * Code clean-up.
    (merge 4b837f821e rs/simplify-submodule-helper-super-prefix-invocation later to maint).
    * "git describe --dirty --broken" forgot to refresh the index before
    seeing if there is any chang, ("git describe --dirty" correctly did
    so), which has been corrected.
    (merge b8ae42e292 as/describe-broken-refresh-index-fix later to maint).
    * Test suite has been taught not to unnecessarily rely on DNS failing
    a bogus external name.
    (merge 407cdbd271 jk/tests-without-dns later to maint).
    * GitWeb update to use committer date consistently in rss/atom feeds.
    (merge cf6ead095b am/gitweb-feed-use-committer-date later to maint).
    * Custom control structures we invented more recently have been
    taught to the clang-format file.
    (merge 1457dff9be rs/clang-format-updates later to maint).
    * Developer build procedure fix.
    (merge df32729866 tb/dev-build-pedantic-fix later to maint).
    * "git push" that pushes only deletion gave an unnecessary and
    harmless error message when push negotiation is configured, which
    has been corrected.
    (merge 4d8ee0317f jc/disable-push-nego-for-deletion later to maint).
    * Address-looking strings found on the trailer are now placed on the
    Cc: list after running through sanitize_address by "git send-email".
    (merge c852531f45 cb/send-email-sanitize-trailer-addresses later to maint).
    * Tests that use GIT_TEST_SANITIZE_LEAK_LOG feature got their exit
    status inverted, which has been corrected.
    (merge 8c1d6691bc rj/test-sanitize-leak-log-fix later to maint).
    * The http.cookieFile and http.saveCookies configuration variables
    have a few values that need to be avoided, which are now ignored
    with warning messages.
    (merge 4f5822076f jc/http-cookiefile later to maint).
    * Repacking a repository with multi-pack index started making stupid
    pack selections in Git 2.45, which has been corrected.
    (merge 8fb6d11fad ds/midx-write-repack-fix later to maint).
    * Fix documentation mark-up regression in 2.45.
    (merge 6474da0aa4 ja/doc-markup-updates-fix later to maint).
    * Work around asciidoctor's css that renders `monospace` material
    in the SYNOPSIS section of manual pages as block elements.
    (merge d44ce6ddd5 js/doc-markup-updates-fix later to maint).
    * Other code cleanup, docfix, build fix, etc.
    (merge 493fdae046 ew/object-convert-leakfix later to maint).
    (merge 00f3661a0a ss/doc-eol-attr-fix later to maint).
    (merge 428c40da61 ri/doc-show-branch-fix later to maint).
    (merge 58696bfcaa jc/where-is-bash-for-ci later to maint).
    (merge 616e94ca24 tb/doc-max-tree-depth-fix later to maint).

++++ kernel-default:

  - HID: wacom: Modify pen IDs (git-fixes).
  - commit 9c450d7
  - Move upstreamed ASoC patch into sorted section
  - commit adae4df

++++ kernel-default:

  - KVM: PPC: Book3S HV: Prevent UAF in
    kvm_spapr_tce_attach_iommu_group() (bsc#1228581 CVE-2024-41070).
  - commit 89912c7
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
    (CVE-2024-40959 bsc#1227884).
  - commit 3a174d1
  - Update config files.
    Disable vdpa drivers for Alibaba ENI and SolidNET (jsc#PED-8954, bsc#1227834)
  - commit 9287d7f
  - selftests/bpf: Extend tcx tests to cover late tcx_entry release
    (bsc#1228021 CVE-2024-41010).
  - bpf: Fix too early release of tcx_entry (bsc#1228021
    CVE-2024-41010).
  - commit 57180df
  - selftests/bpf: Add more ring buffer test coverage (bsc#1228020
    CVE-2024-41009).
  - bpf: Fix overrunning reservations in ringbuf (bsc#1228020
    CVE-2024-41009).
  - commit cd82cf6
  - md-cluster: fix no recovery job when adding/re-adding a disk
    (bsc#1223395).
  - md-cluster: fix hanging issue while a new disk adding
    (bsc#1223395).
  - commit d3c6e61
  - rpm/guards: fix precedence issue with control flow operator
    With perl 5.40 it report the following error on rpm/guards script:
    Possible precedence issue with control flow operator (exit) at scripts/guards line 208.
    Fix the issue by adding parenthesis around ternary operator.
  - commit dfba20e
  - blacklist.conf: Add 9c573cd31343 randomize_kstack: Improve entropy diffusion
  - commit 095be15
  - blacklist.conf: kABI
  - commit 1dd3f93
  - blacklist.conf: spelling fix in comment
  - commit de0ca0a
  - blacklist.conf: cleanup, no code change
  - commit 19384b6
  - blacklist.conf: pure cleanup
  - commit 21ff021
  - blacklist.conf: pure cleanup
  - commit fef6015
  - HID: wacom: Modify pen IDs (git-fixes).
  - commit 9c450d7
  - Move upstreamed ASoC patch into sorted section
  - commit adae4df

++++ kernel-default:

  - KVM: PPC: Book3S HV: Prevent UAF in
    kvm_spapr_tce_attach_iommu_group() (bsc#1228581 CVE-2024-41070).
  - commit 89912c7
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
    (CVE-2024-40959 bsc#1227884).
  - commit 3a174d1
  - Update config files.
    Disable vdpa drivers for Alibaba ENI and SolidNET (jsc#PED-8954, bsc#1227834)
  - commit 9287d7f
  - selftests/bpf: Extend tcx tests to cover late tcx_entry release
    (bsc#1228021 CVE-2024-41010).
  - bpf: Fix too early release of tcx_entry (bsc#1228021
    CVE-2024-41010).
  - commit 57180df
  - selftests/bpf: Add more ring buffer test coverage (bsc#1228020
    CVE-2024-41009).
  - bpf: Fix overrunning reservations in ringbuf (bsc#1228020
    CVE-2024-41009).
  - commit cd82cf6
  - md-cluster: fix no recovery job when adding/re-adding a disk
    (bsc#1223395).
  - md-cluster: fix hanging issue while a new disk adding
    (bsc#1223395).
  - commit d3c6e61
  - rpm/guards: fix precedence issue with control flow operator
    With perl 5.40 it report the following error on rpm/guards script:
    Possible precedence issue with control flow operator (exit) at scripts/guards line 208.
    Fix the issue by adding parenthesis around ternary operator.
  - commit dfba20e
  - blacklist.conf: Add 9c573cd31343 randomize_kstack: Improve entropy diffusion
  - commit 095be15
  - blacklist.conf: kABI
  - commit 1dd3f93
  - blacklist.conf: spelling fix in comment
  - commit de0ca0a
  - blacklist.conf: cleanup, no code change
  - commit 19384b6
  - blacklist.conf: pure cleanup
  - commit 21ff021
  - blacklist.conf: pure cleanup
  - commit fef6015
  - HID: wacom: Modify pen IDs (git-fixes).
  - commit 9c450d7
  - Move upstreamed ASoC patch into sorted section
  - commit adae4df

++++ libzypp:

  - Export CredentialManager for legacy YAST versions (bsc#1228420)
  - version 17.35.6 (35)
  - Export asSolvable for YAST (bsc#1228420)
  - Fix 4 typos in zypp.conf.
  - version 17.35.5 (35)

++++ libzypp:

  - Export CredentialManager for legacy YAST versions (bsc#1228420)
  - version 17.35.6 (35)
  - Export asSolvable for YAST (bsc#1228420)
  - Fix 4 typos in zypp.conf.
  - version 17.35.5 (35)

++++ libzypp:

  - Export CredentialManager for legacy YAST versions (bsc#1228420)
  - version 17.35.6 (35)
  - Export asSolvable for YAST (bsc#1228420)
  - Fix 4 typos in zypp.conf.
  - version 17.35.5 (35)

++++ libzypp:

  - Export CredentialManager for legacy YAST versions (bsc#1228420)
  - version 17.35.6 (35)
  - Export asSolvable for YAST (bsc#1228420)
  - Fix 4 typos in zypp.conf.
  - version 17.35.5 (35)

++++ libzypp:

  - Export CredentialManager for legacy YAST versions (bsc#1228420)
  - version 17.35.6 (35)
  - Export asSolvable for YAST (bsc#1228420)
  - Fix 4 typos in zypp.conf.
  - version 17.35.5 (35)

++++ patch:

  - CVE-2019-20633.patch: Fix double-free/OOB read in pch.c (bsc#1167721)

++++ regionServiceClientConfigAzure:

  - Update to version 2.2.0 (jsc#PCT-360)
    + Add IPv6 certs to enable IPv6 access of the update infrastructure
    + Add noipv6.patch to patch out IPv6 on SLE 12, no IPv6 support in SLE 12
    in the Public Cloud

++++ regionServiceClientConfigAzure:

  - Update to version 2.2.0 (jsc#PCT-360)
    + Add IPv6 certs to enable IPv6 access of the update infrastructure
    + Add noipv6.patch to patch out IPv6 on SLE 12, no IPv6 support in SLE 12
    in the Public Cloud

------------------------------------------------------------------
------------------  2024-7-29  -  Jul 29 2024  -------------------
------------------------------------------------------------------

++++ dmidecode:

  - Update to upstream version 3.6 (jsc#PED-8647):
    * Support for SMBIOS 3.6.0. This includes new memory device types, new
    processor upgrades, and Loongarch support.
    * Support for SMBIOS 3.7.0. This includes new port types, new processor
    upgrades, new slot characteristics and new fields for memory modules.
    * Add bash completion.
    * Decode HPE OEM records 197, 239 and 245.
    * Implement options --list-strings and --list-types.
    * Update HPE OEM records 203, 212, 216, 221, 233, 236, 238 and 242.
    * Update Redfish support.
    * Bug fixes:
    Fix enabled slot characteristics not being printed
    * Minor improvements:
    Print slot width on its own line
    Use standard strings for slot width
    * Obsoletes arm-use-alignment-workaround.patch,
    dmioem-hpe-oem-record-237-firmware-change.patch and
    use-read_file-to-read-from-dump.patch.
    Update for HPE servers from upstream:
  - dmioem-update-hpe-oem-type-238.patch: Decode PCI bus segment in
    HPE type 238 records.
  - Drop legacy Provides: and Obsoletes: tags. The split from the
    pmtools package happened 15 years ago so they are no longer
    relevant.

++++ ignition:

  - Fix order of previous change - *first* remount rw, *then* create
    directory.

++++ ignition:

  - Fix order of previous change - *first* remount rw, *then* create
    directory.

++++ ignition:

  - Fix order of previous change - *first* remount rw, *then* create
    directory.

++++ kernel-default:

  - xfs: add bounds checking to xlog_recover_process_data
    (bsc#1228408 CVE-2024-41014).
  - commit bb0300d
  - xfs: don't walk off the end of a directory data block
    (bsc#1228405 CVE-2024-41013).
  - commit 8a0b7eb
  - jfs: don't walk off the end of ealist (bsc#1228403
    CVE-2024-41017).
  - commit 4159bc5
  - ext4: fold quota accounting into
    ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
  - commit 94f6f2b
  - ext4: fix mb_cache_entry's e_refcnt leak in
    ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
  - commit d72f4d7
  - block: fix request.queuelist usage in flush (bsc#1227789
    CVE-2024-40925).
  - commit 4903430
  - supported.conf: mark vdpa modules supported (jsc#PED-8954)
  - commit 483ffd4
  - ext4: do not create EA inode under buffer lock (bsc#1227910
    CVE-2024-40972).
  - commit 37fb4de
  - ext4: fix uninitialized ratelimit_state->lock access in
    __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
  - commit cefc508
  - Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
  - commit 96de263
  - ceph: fix incorrect kmalloc size of pagevec mempool
    (bsc#1228417).
  - commit 84977b0
  - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
  - commit f7cf8d6
  - btrfs: zoned: fix use-after-free due to race with dev replace
    (bsc#1227719 CVE-2024-39496).
  - commit c878f86
  - tun: add missing verification for short frame (CVE-2024-41091
    bsc#1228327).
  - tap: add missing verification for short frame (CVE-2024-41090
    bsc#1228328).
  - net: ena: Add validation for completion descriptors consistency
    (CVE-2024-40999 bsc#1227913).
  - commit 7fa5ae2
  - Refresh
    patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
    Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
  - commit 9280ac5

++++ kernel-default:

  - xfs: add bounds checking to xlog_recover_process_data
    (bsc#1228408 CVE-2024-41014).
  - commit bb0300d
  - xfs: don't walk off the end of a directory data block
    (bsc#1228405 CVE-2024-41013).
  - commit 8a0b7eb
  - jfs: don't walk off the end of ealist (bsc#1228403
    CVE-2024-41017).
  - commit 4159bc5
  - ext4: fold quota accounting into
    ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
  - commit 94f6f2b
  - ext4: fix mb_cache_entry's e_refcnt leak in
    ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
  - commit d72f4d7
  - block: fix request.queuelist usage in flush (bsc#1227789
    CVE-2024-40925).
  - commit 4903430
  - supported.conf: mark vdpa modules supported (jsc#PED-8954)
  - commit 483ffd4
  - ext4: do not create EA inode under buffer lock (bsc#1227910
    CVE-2024-40972).
  - commit 37fb4de
  - ext4: fix uninitialized ratelimit_state->lock access in
    __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
  - commit cefc508
  - Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
  - commit 96de263
  - ceph: fix incorrect kmalloc size of pagevec mempool
    (bsc#1228417).
  - commit 84977b0
  - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
  - commit f7cf8d6
  - btrfs: zoned: fix use-after-free due to race with dev replace
    (bsc#1227719 CVE-2024-39496).
  - commit c878f86
  - tun: add missing verification for short frame (CVE-2024-41091
    bsc#1228327).
  - tap: add missing verification for short frame (CVE-2024-41090
    bsc#1228328).
  - net: ena: Add validation for completion descriptors consistency
    (CVE-2024-40999 bsc#1227913).
  - commit 7fa5ae2
  - netlink: add nla be16/32 types to minlen array (CVE-2024-26849
    bsc#1223053).
  - commit 2747893
  - Refresh
    patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
    Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
  - commit 9280ac5

++++ kernel-default:

  - xfs: add bounds checking to xlog_recover_process_data
    (bsc#1228408 CVE-2024-41014).
  - commit bb0300d
  - xfs: don't walk off the end of a directory data block
    (bsc#1228405 CVE-2024-41013).
  - commit 8a0b7eb
  - jfs: don't walk off the end of ealist (bsc#1228403
    CVE-2024-41017).
  - commit 4159bc5
  - ext4: fold quota accounting into
    ext4_xattr_inode_lookup_create() (bsc#1227910 CVE-2024-40972).
  - commit 94f6f2b
  - ext4: fix mb_cache_entry's e_refcnt leak in
    ext4_xattr_block_cache_find() (bsc#1226993 CVE-2024-39276).
  - commit d72f4d7
  - block: fix request.queuelist usage in flush (bsc#1227789
    CVE-2024-40925).
  - commit 4903430
  - supported.conf: mark vdpa modules supported (jsc#PED-8954)
  - commit 483ffd4
  - ext4: do not create EA inode under buffer lock (bsc#1227910
    CVE-2024-40972).
  - commit 37fb4de
  - ext4: fix uninitialized ratelimit_state->lock access in
    __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
  - commit cefc508
  - Update patch reference of AMDGPU fix (CVE-2024-41011 bsc#1228115)
  - commit 96de263
  - ceph: fix incorrect kmalloc size of pagevec mempool
    (bsc#1228417).
  - commit 84977b0
  - ima: Fix use-after-free on a dentry's dname.name (bsc#1227716 CVE-2024-39494).
  - commit f7cf8d6
  - btrfs: zoned: fix use-after-free due to race with dev replace
    (bsc#1227719 CVE-2024-39496).
  - commit c878f86
  - tun: add missing verification for short frame (CVE-2024-41091
    bsc#1228327).
  - tap: add missing verification for short frame (CVE-2024-41090
    bsc#1228328).
  - net: ena: Add validation for completion descriptors consistency
    (CVE-2024-40999 bsc#1227913).
  - commit 7fa5ae2
  - netlink: add nla be16/32 types to minlen array (CVE-2024-26849
    bsc#1223053).
  - commit 2747893
  - Refresh
    patches.kabi/tty-add-the-option-to-have-a-tty-reject-a-new-ldisc.patch.
    Fix build for CONFIG_VT=n (ppc64le/kvmsmall).
  - commit 9280ac5

++++ mozilla-nss:

  - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh
    depends on it and will create a broken, empty config, if sed is
    missing (bsc#1227918)

++++ mozilla-nss:

  - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh
    depends on it and will create a broken, empty config, if sed is
    missing (bsc#1227918)

++++ mozilla-nss:

  - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh
    depends on it and will create a broken, empty config, if sed is
    missing (bsc#1227918)

++++ mozilla-nss:

  - Require `sed` for mozilla-nss-sysinit, as setup-nsssysinit.sh
    depends on it and will create a broken, empty config, if sed is
    missing (bsc#1227918)

------------------------------------------------------------------
------------------  2024-7-28  -  Jul 28 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - spi: spidev: add correct compatible for Rohm BH2228FV
    (git-fixes).
  - spi: microchip-core: ensure TX and RX FIFOs are empty at start
    of a transfer (git-fixes).
  - spi: microchip-core: only disable SPI controller when register
    value change requires it (git-fixes).
  - spi: microchip-core: defer asserting chip select until just
    before write to TX FIFO (git-fixes).
  - spi: microchip-core: fix the issues in the isr (git-fixes).
  - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
    use (git-fixes).
  - decompress_bunzip2: fix rare decompression failure (git-fixes).
  - commit 536a80d

++++ kernel-default:

  - spi: spidev: add correct compatible for Rohm BH2228FV
    (git-fixes).
  - spi: microchip-core: ensure TX and RX FIFOs are empty at start
    of a transfer (git-fixes).
  - spi: microchip-core: only disable SPI controller when register
    value change requires it (git-fixes).
  - spi: microchip-core: defer asserting chip select until just
    before write to TX FIFO (git-fixes).
  - spi: microchip-core: fix the issues in the isr (git-fixes).
  - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
    use (git-fixes).
  - decompress_bunzip2: fix rare decompression failure (git-fixes).
  - commit 536a80d

++++ kernel-default:

  - spi: spidev: add correct compatible for Rohm BH2228FV
    (git-fixes).
  - spi: microchip-core: ensure TX and RX FIFOs are empty at start
    of a transfer (git-fixes).
  - spi: microchip-core: only disable SPI controller when register
    value change requires it (git-fixes).
  - spi: microchip-core: defer asserting chip select until just
    before write to TX FIFO (git-fixes).
  - spi: microchip-core: fix the issues in the isr (git-fixes).
  - clk: davinci: da8xx-cfgchip: Initialize clk_init_data before
    use (git-fixes).
  - decompress_bunzip2: fix rare decompression failure (git-fixes).
  - commit 536a80d

++++ regionServiceClientConfigGCE:

  - Version 4.2.0 (jsc#PCT-361)
    + Add IPv6 certs to supprt access of the update infrastructure via
    IPv6 on GCE instances.

++++ regionServiceClientConfigGCE:

  - Version 4.2.0 (jsc#PCT-361)
    + Add IPv6 certs to supprt access of the update infrastructure via
    IPv6 on GCE instances.
    + Add noipv6.patch

++++ regionServiceClientConfigGCE:

  - Version 4.2.0 (jsc#PCT-361)
    + Add IPv6 certs to supprt access of the update infrastructure via
    IPv6 on GCE instances.
    + Add noipv6.patch

------------------------------------------------------------------
------------------  2024-7-27  -  Jul 27 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
    (stable-fixes).
  - ALSA: usb-audio: Move HD Webcam quirk to the right place
    (git-fixes).
  - ALSA: usb-audio: Fix microphone sound on HD webcam
    (stable-fixes).
  - commit 07826dc
  - auxdisplay: ht16k33: Drop reference after LED registration
    (git-fixes).
  - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
    on unprepare (git-fixes).
  - ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
  - ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
    reachable (git-fixes).
  - ASoC: sof: amd: fix for firmware reload failure in Vangogh
    platform (git-fixes).
  - ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
  - ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
    (git-fixes).
  - ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
  - ALSA: ump: Don't update FB name for static blocks (git-fixes).
  - drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
  - drm/i915/gt: Do not consider preemption during execlists_dequeue
    for gen8 (git-fixes).
  - drm/i915/dp: Don't switch the LTTPR mode on an active link
    (git-fixes).
  - commit d7e2deb

++++ kernel-default:

  - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
    (stable-fixes).
  - ALSA: usb-audio: Move HD Webcam quirk to the right place
    (git-fixes).
  - ALSA: usb-audio: Fix microphone sound on HD webcam
    (stable-fixes).
  - commit 07826dc
  - auxdisplay: ht16k33: Drop reference after LED registration
    (git-fixes).
  - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
    on unprepare (git-fixes).
  - ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
  - ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
    reachable (git-fixes).
  - ASoC: sof: amd: fix for firmware reload failure in Vangogh
    platform (git-fixes).
  - ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
  - ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
    (git-fixes).
  - ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
  - ALSA: ump: Don't update FB name for static blocks (git-fixes).
  - drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
  - drm/i915/gt: Do not consider preemption during execlists_dequeue
    for gen8 (git-fixes).
  - drm/i915/dp: Don't switch the LTTPR mode on an active link
    (git-fixes).
  - commit d7e2deb

++++ kernel-default:

  - ALSA: usb-audio: Add a quirk for Sonix HD USB Camera
    (stable-fixes).
  - ALSA: usb-audio: Move HD Webcam quirk to the right place
    (git-fixes).
  - ALSA: usb-audio: Fix microphone sound on HD webcam
    (stable-fixes).
  - commit 07826dc
  - auxdisplay: ht16k33: Drop reference after LED registration
    (git-fixes).
  - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA
    on unprepare (git-fixes).
  - ASoC: TAS2781: Fix tasdev_load_calibrated_data() (git-fixes).
  - ASoC: Intel: use soc_intel_is_byt_cr() only when IOSF_MBI is
    reachable (git-fixes).
  - ASoC: sof: amd: fix for firmware reload failure in Vangogh
    platform (git-fixes).
  - ASoC: SOF: imx8m: Fix DSP control regmap retrieval (git-fixes).
  - ALSA: hda/realtek: cs35l41: Fixup remaining asus strix models
    (git-fixes).
  - ALSA: ump: Force 1 Group for MIDI1 FBs (git-fixes).
  - ALSA: ump: Don't update FB name for static blocks (git-fixes).
  - drm/amd/amdgpu: Fix uninitialized variable warnings (git-fixes).
  - drm/i915/gt: Do not consider preemption during execlists_dequeue
    for gen8 (git-fixes).
  - drm/i915/dp: Don't switch the LTTPR mode on an active link
    (git-fixes).
  - commit d7e2deb

------------------------------------------------------------------
------------------  2024-7-26  -  Jul 26 2024  -------------------
------------------------------------------------------------------

++++ gtk3:

  - Add CVE-2024-6655.patch: CVE-2024-6655 Stop looking for modules
    in cwd (bsc#1228120).

++++ kernel-default:

  - ALSA: hda/conexant: Mute speakers at suspend / shutdown
    (bsc#1228269).
  - ALSA: hda/generic: Add a helper to mute speakers at
    suspend/shutdown (bsc#1228269).
  - commit e046d5e
  - Refresh the previous ASoC patch, landed in subsystem tree (bsc#1228269)
  - commit 180425d
  - kABI: tty: add the option to have a tty reject a new ldisc
    (kabi CVE-2024-40966 bsc#1227886).
  - tty: add the option to have a tty reject a new ldisc
    (CVE-2024-40966 bsc#1227886).
  - commit 00113b6
  - fs/file: fix the check in find_next_fd() (git-fixes).
  - commit 3ec6b68
  - erofs: ensure m_llen is reset to 0 if metadata is invalid
    (git-fixes).
  - commit 03e55bf
  - jfs: Fix array-index-out-of-bounds in diFree (git-fixes).
  - commit a89a289
  - hfsplus: fix uninit-value in copy_name (git-fixes).
  - commit 4f0ad7b
  - mISDN: Fix a use after free in hfcmulti_tx() (git-fixes).
  - devres: Fix memory leakage caused by driver API
    devm_free_percpu() (git-fixes).
  - devres: Fix devm_krealloc() wasting memory (git-fixes).
  - kobject_uevent: Fix OOB access within zap_modalias_env()
    (git-fixes).
  - watchdog: rzn1: Convert comma to semicolon (git-fixes).
  - watchdog: rzg2l_wdt: Check return status of pm_runtime_put()
    (git-fixes).
  - watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get()
    (git-fixes).
  - dma: fix call order in dmam_free_coherent (git-fixes).
  - mISDN: fix MISDN_TIME_STAMP handling (git-fixes).
  - commit 69aa862

++++ kernel-default:

  - ALSA: hda/conexant: Mute speakers at suspend / shutdown
    (bsc#1228269).
  - ALSA: hda/generic: Add a helper to mute speakers at
    suspend/shutdown (bsc#1228269).
  - commit e046d5e
  - Refresh the previous ASoC patch, landed in subsystem tree (bsc#1228269)
  - commit 180425d
  - kABI: tty: add the option to have a tty reject a new ldisc
    (kabi CVE-2024-40966 bsc#1227886).
  - tty: add the option to have a tty reject a new ldisc
    (CVE-2024-40966 bsc#1227886).
  - commit 00113b6
  - fs/file: fix the check in find_next_fd() (git-fixes).
  - commit 3ec6b68
  - erofs: ensure m_llen is reset to 0 if metadata is invalid
    (git-fixes).
  - commit 03e55bf
  - jfs: Fix array-index-out-of-bounds in diFree (git-fixes).
  - commit a89a289
  - hfsplus: fix uninit-value in copy_name (git-fixes).
  - commit 4f0ad7b
  - mISDN: Fix a use after free in hfcmulti_tx() (git-fixes).
  - devres: Fix memory leakage caused by driver API
    devm_free_percpu() (git-fixes).
  - devres: Fix devm_krealloc() wasting memory (git-fixes).
  - kobject_uevent: Fix OOB access within zap_modalias_env()
    (git-fixes).
  - watchdog: rzn1: Convert comma to semicolon (git-fixes).
  - watchdog: rzg2l_wdt: Check return status of pm_runtime_put()
    (git-fixes).
  - watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get()
    (git-fixes).
  - dma: fix call order in dmam_free_coherent (git-fixes).
  - mISDN: fix MISDN_TIME_STAMP handling (git-fixes).
  - commit 69aa862
  - bpf: Fix a potential use-after-free in bpf_link_free()
    (bsc#1227798 CVE-2024-40909).
  - Refresh patches.kabi/bpf-bpf_link-and-bpf_link_ops-kABI-workaround.patch
  - commit 377837f

++++ kernel-default:

  - ALSA: hda/conexant: Mute speakers at suspend / shutdown
    (bsc#1228269).
  - ALSA: hda/generic: Add a helper to mute speakers at
    suspend/shutdown (bsc#1228269).
  - commit e046d5e
  - Refresh the previous ASoC patch, landed in subsystem tree (bsc#1228269)
  - commit 180425d
  - kABI: tty: add the option to have a tty reject a new ldisc
    (kabi CVE-2024-40966 bsc#1227886).
  - tty: add the option to have a tty reject a new ldisc
    (CVE-2024-40966 bsc#1227886).
  - commit 00113b6
  - fs/file: fix the check in find_next_fd() (git-fixes).
  - commit 3ec6b68
  - erofs: ensure m_llen is reset to 0 if metadata is invalid
    (git-fixes).
  - commit 03e55bf
  - jfs: Fix array-index-out-of-bounds in diFree (git-fixes).
  - commit a89a289
  - hfsplus: fix uninit-value in copy_name (git-fixes).
  - commit 4f0ad7b
  - mISDN: Fix a use after free in hfcmulti_tx() (git-fixes).
  - devres: Fix memory leakage caused by driver API
    devm_free_percpu() (git-fixes).
  - devres: Fix devm_krealloc() wasting memory (git-fixes).
  - kobject_uevent: Fix OOB access within zap_modalias_env()
    (git-fixes).
  - watchdog: rzn1: Convert comma to semicolon (git-fixes).
  - watchdog: rzg2l_wdt: Check return status of pm_runtime_put()
    (git-fixes).
  - watchdog: rzg2l_wdt: Use pm_runtime_resume_and_get()
    (git-fixes).
  - dma: fix call order in dmam_free_coherent (git-fixes).
  - mISDN: fix MISDN_TIME_STAMP handling (git-fixes).
  - commit 69aa862
  - bpf: Fix a potential use-after-free in bpf_link_free()
    (bsc#1227798 CVE-2024-40909).
  - Refresh patches.kabi/bpf-bpf_link-and-bpf_link_ops-kABI-workaround.patch
  - commit 377837f

++++ regionServiceClientConfigEC2:

  - Update to version 4.3.0 (bsc#1228363)
    + The IPv6 cert was switched up for the region server running in us-west-2
    and as such the SSL handshake was failing. Drop the incorrect cert
    and add the correct cert.
  - Switch the patch syntax away form the deprecated shorthand macro

++++ regionServiceClientConfigEC2:

  - Update to version 4.3.0 (bsc#1228363)
    + The IPv6 cert was switched up for the region server running in us-west-2
    and as such the SSL handshake was failing. Drop the incorrect cert
    and add the correct cert.
  - Switch the patch syntax away form the deprecated shorthand macro

------------------------------------------------------------------
------------------  2024-7-25  -  Jul 25 2024  -------------------
------------------------------------------------------------------

++++ ignition:

  - Apply (temporary) upstream patch from fedora-coreos-config for
    compatibility with systemd 256.

++++ ignition:

  - Apply (temporary) upstream patch from fedora-coreos-config for
    compatibility with systemd 256.

++++ ignition:

  - Apply (temporary) upstream patch from fedora-coreos-config for
    compatibility with systemd 256.

++++ kernel-default:

  - drm/amd/display: Fix array-index-out-of-bounds in
    dml2/FCLKChangeSupport (stable-fixes).
  - drm/amd/display: Update efficiency bandwidth for dcn351
    (stable-fixes).
  - drm/ttm: Always take the bo delayed cleanup path for imported
    bos (git-fixes).
  - drm/amd/display: change dram_clock_latency to 34us for dcn35
    (stable-fixes).
  - drm/amdgpu: fix locking scope when flushing tlb (stable-fixes).
  - wifi: mac80211: Avoid address calculations via out of bounds
    array indexing (stable-fixes).
  - drm/amdkfd: Let VRAM allocations go to GTT domain on small APUs
    (stable-fixes).
  - drm/amd/display: ASSERT when failing to find index by
    plane/stream id (stable-fixes).
  - drm/amd/display: Fix overlapping copy within
    dml_core_mode_programming (stable-fixes).
  - drm/amd/display: Skip pipe if the pipe idx not set properly
    (stable-fixes).
  - drm/amd/display: Workaround register access in idle race with
    cursor (stable-fixes).
  - commit 830869c
  - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA
    is paused (git-fixes).
  - commit aadeb44
  - spi: mux: set ctlr->bits_per_word_mask (stable-fixes).
  - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
    (git-fixes).
  - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
    (stable-fixes).
  - wifi: mac80211: disable softirqs for queued frame handling
    (git-fixes).
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
    (stable-fixes).
  - wifi: cfg80211: wext: set ssids=NULL for passive scans
    (git-fixes).
  - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
    (stable-fixes).
  - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
    (stable-fixes).
  - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe
    option (stable-fixes).
  - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
    (stable-fixes).
  - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
    (stable-fixes).
  - wifi: iwlwifi: mvm: remove stale STA link data during restart
    (stable-fixes).
  - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
    (stable-fixes).
  - wifi: cfg80211: fix 6 GHz scan request building (stable-fixes).
  - wifi: mac80211: handle tasklet frames before stopping
    (stable-fixes).
  - wifi: mac80211: apply mcast rate only if interface is up
    (stable-fixes).
  - wifi: mac80211: mesh: init nonpeer_pm to active by default in
    mesh sdata (stable-fixes).
  - tools/power/cpupower: Fix Pstate frequency reporting on AMD
    Family 1Ah CPUs (stable-fixes).
  - tools/power turbostat: Remember global max_die_id
    (stable-fixes).
  - commit 37df9b4
  - phy: cadence-torrent: Check return value on register read
    (git-fixes).
  - kbuild: avoid build error when single DTB is turned into
    composite DTB (git-fixes).
  - remoteproc: stm32_rproc: Fix mailbox interrupts queuing
    (git-fixes).
  - remoteproc: k3-r5: Fix IPC-only mode detection (git-fixes).
  - remoteproc: imx_rproc: Fix refcount mistake in
    imx_rproc_addr_init (git-fixes).
  - remoteproc: imx_rproc: Skip over memory region when node value
    is NULL (git-fixes).
  - mailbox: mtk-cmdq: Move devm_mbox_controller_register() after
    devm_pm_runtime_enable() (git-fixes).
  - power: supply: ingenic: Fix some error handling paths in
    ingenic_battery_get_property() (git-fixes).
  - power: supply: ab8500: Fix error handling when calling
    iio_read_channel_processed() (git-fixes).
  - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
    (stable-fixes).
  - net: mac802154: Fix racy device stats updates by DEV_STATS_INC()
    and DEV_STATS_ADD() (stable-fixes).
  - platform/x86: lg-laptop: Use ACPI device handle when evaluating
    WMAB/WMBB (stable-fixes).
  - platform/x86: lg-laptop: Change ACPI device id (stable-fixes).
  - platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
    (stable-fixes).
  - platform/x86: wireless-hotkey: Add support for LG Airplane
    Button (stable-fixes).
  - net: usb: qmi_wwan: add Telit FN912 compositions (stable-fixes).
  - Input: ads7846 - use spi_device_id table (stable-fixes).
  - mei: demote client disconnect warning on suspend to debug
    (stable-fixes).
  - kconfig: remove wrong expr_trans_bool() (stable-fixes).
  - kconfig: gconf: give a proper initial state to the Save button
    (stable-fixes).
  - commit f6cec75
  - dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
    (git-fixes).
  - docs: crypto: async-tx-api: fix broken code example (git-fixes).
  - drm/radeon: check bo_va->bo is non-NULL before using it
    (stable-fixes).
  - drm/amd/display: Fix refresh rate range for some panel
    (stable-fixes).
  - drm/amd/display: Account for cursor prefetch BW in DML1 mode
    support (stable-fixes).
  - drm/amd/display: Add refresh rate range check (stable-fixes).
  - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
    (stable-fixes).
  - can: kvaser_usb: fix return value for hif_usb_send_regout
    (stable-fixes).
  - Input: xpad - add support for ASUS ROG RAIKIRI PRO
    (stable-fixes).
  - Input: i8042 - add Ayaneo Kun to i8042 quirk table
    (stable-fixes).
  - Input: elantech - fix touchpad state on resume for Lenovo N24
    (stable-fixes).
  - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
    (stable-fixes).
  - drm/amdgpu: Indicate CU havest info to CP (stable-fixes).
  - drm/exynos: dp: drop driver owner initialization (stable-fixes).
  - drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
    (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
    (stable-fixes).
  - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
    (stable-fixes).
  - input: Add support for "Do Not Disturb" (stable-fixes).
  - input: Add event code for accessibility key (stable-fixes).
  - Input: silead - Always support 10 fingers (stable-fixes).
  - commit a5bc4da
  - Bluetooth: btnxpuart: Enable Power Save feature on startup
    (stable-fixes).
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
    (stable-fixes).
  - ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
    (stable-fixes).
  - ASoC: rt722-sdca-sdw: add debounce time for type detection
    (stable-fixes).
  - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on
    error rollback (stable-fixes).
  - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
    (stable-fixes).
  - ALSA: dmaengine: Synchronize dma channel after drop()
    (stable-fixes).
  - ASoC: ti: omap-hdmi: Fix too long driver name (stable-fixes).
  - ASoC: topology: Do not assign fields that are already set
    (stable-fixes).
  - ASoC: topology: Fix references to freed memory (stable-fixes).
  - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
    (stable-fixes).
  - ASoC: rt722-sdca-sdw: add silence detection register as volatile
    (stable-fixes).
  - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
    (stable-fixes).
  - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
    (stable-fixes).
  - ALSA: PCM: Allow resume only for suspended streams
    (stable-fixes).
  - ACPI: EC: Avoid returning AE_OK on errors in address space
    handler (stable-fixes).
  - ACPI: EC: Abort address space access upon error (stable-fixes).
  - commit aa63c91
  - config/arm64: Enable CoreSight PMU drivers (bsc#1228289 jsc#PED-7859)
  - commit f80ff65
  - platform/x86: x86-android-tablets: Unregister devices in
    reverse order (CVE-2024-40975 bsc#1227926).
  - commit 16439fd
  - Avoid hw_desc array overrun in dw-axi-dmac (CVE-2024-40970
    bsc#1227899).
  - commit 8f7016c
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2
    (bsc#1228269).
  - commit 78e0f74

++++ kernel-default:

  - drm/amd/display: Fix array-index-out-of-bounds in
    dml2/FCLKChangeSupport (stable-fixes).
  - drm/amd/display: Update efficiency bandwidth for dcn351
    (stable-fixes).
  - drm/ttm: Always take the bo delayed cleanup path for imported
    bos (git-fixes).
  - drm/amd/display: change dram_clock_latency to 34us for dcn35
    (stable-fixes).
  - drm/amdgpu: fix locking scope when flushing tlb (stable-fixes).
  - wifi: mac80211: Avoid address calculations via out of bounds
    array indexing (stable-fixes).
  - drm/amdkfd: Let VRAM allocations go to GTT domain on small APUs
    (stable-fixes).
  - drm/amd/display: ASSERT when failing to find index by
    plane/stream id (stable-fixes).
  - drm/amd/display: Fix overlapping copy within
    dml_core_mode_programming (stable-fixes).
  - drm/amd/display: Skip pipe if the pipe idx not set properly
    (stable-fixes).
  - drm/amd/display: Workaround register access in idle race with
    cursor (stable-fixes).
  - commit 830869c
  - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA
    is paused (git-fixes).
  - commit aadeb44
  - spi: mux: set ctlr->bits_per_word_mask (stable-fixes).
  - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
    (git-fixes).
  - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
    (stable-fixes).
  - wifi: mac80211: disable softirqs for queued frame handling
    (git-fixes).
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
    (stable-fixes).
  - wifi: cfg80211: wext: set ssids=NULL for passive scans
    (git-fixes).
  - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
    (stable-fixes).
  - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
    (stable-fixes).
  - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe
    option (stable-fixes).
  - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
    (stable-fixes).
  - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
    (stable-fixes).
  - wifi: iwlwifi: mvm: remove stale STA link data during restart
    (stable-fixes).
  - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
    (stable-fixes).
  - wifi: cfg80211: fix 6 GHz scan request building (stable-fixes).
  - wifi: mac80211: handle tasklet frames before stopping
    (stable-fixes).
  - wifi: mac80211: apply mcast rate only if interface is up
    (stable-fixes).
  - wifi: mac80211: mesh: init nonpeer_pm to active by default in
    mesh sdata (stable-fixes).
  - tools/power/cpupower: Fix Pstate frequency reporting on AMD
    Family 1Ah CPUs (stable-fixes).
  - tools/power turbostat: Remember global max_die_id
    (stable-fixes).
  - commit 37df9b4
  - phy: cadence-torrent: Check return value on register read
    (git-fixes).
  - kbuild: avoid build error when single DTB is turned into
    composite DTB (git-fixes).
  - remoteproc: stm32_rproc: Fix mailbox interrupts queuing
    (git-fixes).
  - remoteproc: k3-r5: Fix IPC-only mode detection (git-fixes).
  - remoteproc: imx_rproc: Fix refcount mistake in
    imx_rproc_addr_init (git-fixes).
  - remoteproc: imx_rproc: Skip over memory region when node value
    is NULL (git-fixes).
  - mailbox: mtk-cmdq: Move devm_mbox_controller_register() after
    devm_pm_runtime_enable() (git-fixes).
  - power: supply: ingenic: Fix some error handling paths in
    ingenic_battery_get_property() (git-fixes).
  - power: supply: ab8500: Fix error handling when calling
    iio_read_channel_processed() (git-fixes).
  - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
    (stable-fixes).
  - net: mac802154: Fix racy device stats updates by DEV_STATS_INC()
    and DEV_STATS_ADD() (stable-fixes).
  - platform/x86: lg-laptop: Use ACPI device handle when evaluating
    WMAB/WMBB (stable-fixes).
  - platform/x86: lg-laptop: Change ACPI device id (stable-fixes).
  - platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
    (stable-fixes).
  - platform/x86: wireless-hotkey: Add support for LG Airplane
    Button (stable-fixes).
  - net: usb: qmi_wwan: add Telit FN912 compositions (stable-fixes).
  - Input: ads7846 - use spi_device_id table (stable-fixes).
  - mei: demote client disconnect warning on suspend to debug
    (stable-fixes).
  - kconfig: remove wrong expr_trans_bool() (stable-fixes).
  - kconfig: gconf: give a proper initial state to the Save button
    (stable-fixes).
  - commit f6cec75
  - dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
    (git-fixes).
  - docs: crypto: async-tx-api: fix broken code example (git-fixes).
  - drm/radeon: check bo_va->bo is non-NULL before using it
    (stable-fixes).
  - drm/amd/display: Fix refresh rate range for some panel
    (stable-fixes).
  - drm/amd/display: Account for cursor prefetch BW in DML1 mode
    support (stable-fixes).
  - drm/amd/display: Add refresh rate range check (stable-fixes).
  - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
    (stable-fixes).
  - can: kvaser_usb: fix return value for hif_usb_send_regout
    (stable-fixes).
  - Input: xpad - add support for ASUS ROG RAIKIRI PRO
    (stable-fixes).
  - Input: i8042 - add Ayaneo Kun to i8042 quirk table
    (stable-fixes).
  - Input: elantech - fix touchpad state on resume for Lenovo N24
    (stable-fixes).
  - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
    (stable-fixes).
  - drm/amdgpu: Indicate CU havest info to CP (stable-fixes).
  - drm/exynos: dp: drop driver owner initialization (stable-fixes).
  - drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
    (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
    (stable-fixes).
  - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
    (stable-fixes).
  - input: Add support for "Do Not Disturb" (stable-fixes).
  - input: Add event code for accessibility key (stable-fixes).
  - Input: silead - Always support 10 fingers (stable-fixes).
  - commit a5bc4da
  - Bluetooth: btnxpuart: Enable Power Save feature on startup
    (stable-fixes).
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
    (stable-fixes).
  - ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
    (stable-fixes).
  - ASoC: rt722-sdca-sdw: add debounce time for type detection
    (stable-fixes).
  - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on
    error rollback (stable-fixes).
  - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
    (stable-fixes).
  - ALSA: dmaengine: Synchronize dma channel after drop()
    (stable-fixes).
  - ASoC: ti: omap-hdmi: Fix too long driver name (stable-fixes).
  - ASoC: topology: Do not assign fields that are already set
    (stable-fixes).
  - ASoC: topology: Fix references to freed memory (stable-fixes).
  - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
    (stable-fixes).
  - ASoC: rt722-sdca-sdw: add silence detection register as volatile
    (stable-fixes).
  - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
    (stable-fixes).
  - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
    (stable-fixes).
  - ALSA: PCM: Allow resume only for suspended streams
    (stable-fixes).
  - ACPI: EC: Avoid returning AE_OK on errors in address space
    handler (stable-fixes).
  - ACPI: EC: Abort address space access upon error (stable-fixes).
  - commit aa63c91
  - config/arm64: Enable CoreSight PMU drivers (bsc#1228289 jsc#PED-7859)
  - commit f80ff65
  - platform/x86: x86-android-tablets: Unregister devices in
    reverse order (CVE-2024-40975 bsc#1227926).
  - commit 16439fd
  - Avoid hw_desc array overrun in dw-axi-dmac (CVE-2024-40970
    bsc#1227899).
  - commit 8f7016c
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2
    (bsc#1228269).
  - commit 78e0f74

++++ kernel-default:

  - drm/amd/display: Fix array-index-out-of-bounds in
    dml2/FCLKChangeSupport (stable-fixes).
  - drm/amd/display: Update efficiency bandwidth for dcn351
    (stable-fixes).
  - drm/ttm: Always take the bo delayed cleanup path for imported
    bos (git-fixes).
  - drm/amd/display: change dram_clock_latency to 34us for dcn35
    (stable-fixes).
  - drm/amdgpu: fix locking scope when flushing tlb (stable-fixes).
  - wifi: mac80211: Avoid address calculations via out of bounds
    array indexing (stable-fixes).
  - drm/amdkfd: Let VRAM allocations go to GTT domain on small APUs
    (stable-fixes).
  - drm/amd/display: ASSERT when failing to find index by
    plane/stream id (stable-fixes).
  - drm/amd/display: Fix overlapping copy within
    dml_core_mode_programming (stable-fixes).
  - drm/amd/display: Skip pipe if the pipe idx not set properly
    (stable-fixes).
  - drm/amd/display: Workaround register access in idle race with
    cursor (stable-fixes).
  - commit 830869c
  - ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA
    is paused (git-fixes).
  - commit aadeb44
  - spi: mux: set ctlr->bits_per_word_mask (stable-fixes).
  - wifi: iwlwifi: mvm: don't wake up rx_sync_waitq upon RFKILL
    (git-fixes).
  - wifi: iwlwifi: properly set WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK
    (stable-fixes).
  - wifi: mac80211: disable softirqs for queued frame handling
    (git-fixes).
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
    (stable-fixes).
  - wifi: cfg80211: wext: set ssids=NULL for passive scans
    (git-fixes).
  - wifi: mac80211: fix UBSAN noise in ieee80211_prep_hw_scan()
    (stable-fixes).
  - wifi: iwlwifi: mvm: Fix scan abort handling with HW rfkill
    (stable-fixes).
  - wifi: iwlwifi: mvm: properly set 6 GHz channel direct probe
    option (stable-fixes).
  - wifi: iwlwifi: mvm: handle BA session teardown in RF-kill
    (stable-fixes).
  - wifi: iwlwifi: mvm: Handle BIGTK cipher in kek_kck cmd
    (stable-fixes).
  - wifi: iwlwifi: mvm: remove stale STA link data during restart
    (stable-fixes).
  - wifi: iwlwifi: mvm: d3: fix WoWLAN command version lookup
    (stable-fixes).
  - wifi: cfg80211: fix 6 GHz scan request building (stable-fixes).
  - wifi: mac80211: handle tasklet frames before stopping
    (stable-fixes).
  - wifi: mac80211: apply mcast rate only if interface is up
    (stable-fixes).
  - wifi: mac80211: mesh: init nonpeer_pm to active by default in
    mesh sdata (stable-fixes).
  - tools/power/cpupower: Fix Pstate frequency reporting on AMD
    Family 1Ah CPUs (stable-fixes).
  - tools/power turbostat: Remember global max_die_id
    (stable-fixes).
  - commit 37df9b4
  - phy: cadence-torrent: Check return value on register read
    (git-fixes).
  - kbuild: avoid build error when single DTB is turned into
    composite DTB (git-fixes).
  - remoteproc: stm32_rproc: Fix mailbox interrupts queuing
    (git-fixes).
  - remoteproc: k3-r5: Fix IPC-only mode detection (git-fixes).
  - remoteproc: imx_rproc: Fix refcount mistake in
    imx_rproc_addr_init (git-fixes).
  - remoteproc: imx_rproc: Skip over memory region when node value
    is NULL (git-fixes).
  - mailbox: mtk-cmdq: Move devm_mbox_controller_register() after
    devm_pm_runtime_enable() (git-fixes).
  - power: supply: ingenic: Fix some error handling paths in
    ingenic_battery_get_property() (git-fixes).
  - power: supply: ab8500: Fix error handling when calling
    iio_read_channel_processed() (git-fixes).
  - spi: imx: Don't expect DMA for i.MX{25,35,50,51,53} cspi devices
    (stable-fixes).
  - net: mac802154: Fix racy device stats updates by DEV_STATS_INC()
    and DEV_STATS_ADD() (stable-fixes).
  - platform/x86: lg-laptop: Use ACPI device handle when evaluating
    WMAB/WMBB (stable-fixes).
  - platform/x86: lg-laptop: Change ACPI device id (stable-fixes).
  - platform/x86: lg-laptop: Remove LGEX0815 hotkey handling
    (stable-fixes).
  - platform/x86: wireless-hotkey: Add support for LG Airplane
    Button (stable-fixes).
  - net: usb: qmi_wwan: add Telit FN912 compositions (stable-fixes).
  - Input: ads7846 - use spi_device_id table (stable-fixes).
  - mei: demote client disconnect warning on suspend to debug
    (stable-fixes).
  - kconfig: remove wrong expr_trans_bool() (stable-fixes).
  - kconfig: gconf: give a proper initial state to the Save button
    (stable-fixes).
  - commit f6cec75
  - dmaengine: ti: k3-udma: Fix BCHAN count with UHC and HC channels
    (git-fixes).
  - docs: crypto: async-tx-api: fix broken code example (git-fixes).
  - drm/radeon: check bo_va->bo is non-NULL before using it
    (stable-fixes).
  - drm/amd/display: Fix refresh rate range for some panel
    (stable-fixes).
  - drm/amd/display: Account for cursor prefetch BW in DML1 mode
    support (stable-fixes).
  - drm/amd/display: Add refresh rate range check (stable-fixes).
  - gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
    (stable-fixes).
  - can: kvaser_usb: fix return value for hif_usb_send_regout
    (stable-fixes).
  - Input: xpad - add support for ASUS ROG RAIKIRI PRO
    (stable-fixes).
  - Input: i8042 - add Ayaneo Kun to i8042 quirk table
    (stable-fixes).
  - Input: elantech - fix touchpad state on resume for Lenovo N24
    (stable-fixes).
  - drm/vmwgfx: Fix missing HYPERVISOR_GUEST dependency
    (stable-fixes).
  - drm/amdgpu: Indicate CU havest info to CP (stable-fixes).
  - drm/exynos: dp: drop driver owner initialization (stable-fixes).
  - drm/mediatek: Call drm_atomic_helper_shutdown() at shutdown time
    (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Aya Neo KUN
    (stable-fixes).
  - HID: Ignore battery for ELAN touchscreens 2F2C and 4116
    (stable-fixes).
  - input: Add support for "Do Not Disturb" (stable-fixes).
  - input: Add event code for accessibility key (stable-fixes).
  - Input: silead - Always support 10 fingers (stable-fixes).
  - commit a5bc4da
  - Bluetooth: btnxpuart: Enable Power Save feature on startup
    (stable-fixes).
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
    (stable-fixes).
  - ASoC: amd: yc: Fix non-functional mic on ASUS M5602RA
    (stable-fixes).
  - ASoC: rt722-sdca-sdw: add debounce time for type detection
    (stable-fixes).
  - ASoC: SOF: sof-audio: Skip unprepare for in-use widgets on
    error rollback (stable-fixes).
  - ASoC: ti: davinci-mcasp: Set min period size using FIFO config
    (stable-fixes).
  - ALSA: dmaengine: Synchronize dma channel after drop()
    (stable-fixes).
  - ASoC: ti: omap-hdmi: Fix too long driver name (stable-fixes).
  - ASoC: topology: Do not assign fields that are already set
    (stable-fixes).
  - ASoC: topology: Fix references to freed memory (stable-fixes).
  - bytcr_rt5640 : inverse jack detect for Archos 101 cesium
    (stable-fixes).
  - ASoC: rt722-sdca-sdw: add silence detection register as volatile
    (stable-fixes).
  - ALSA: dmaengine_pcm: terminate dmaengine before synchronize
    (stable-fixes).
  - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15-gw0xxx
    (stable-fixes).
  - ALSA: PCM: Allow resume only for suspended streams
    (stable-fixes).
  - ACPI: EC: Avoid returning AE_OK on errors in address space
    handler (stable-fixes).
  - ACPI: EC: Abort address space access upon error (stable-fixes).
  - commit aa63c91
  - config/arm64: Enable CoreSight PMU drivers (bsc#1228289 jsc#PED-7859)
  - commit f80ff65
  - platform/x86: x86-android-tablets: Unregister devices in
    reverse order (CVE-2024-40975 bsc#1227926).
  - commit 16439fd
  - Avoid hw_desc array overrun in dw-axi-dmac (CVE-2024-40970
    bsc#1227899).
  - commit 8f7016c
  - ASoC: amd: yc: Support mic on Lenovo Thinkpad E16 Gen 2
    (bsc#1228269).
  - commit 78e0f74

++++ mozilla-nss:

  - update to NSS 3.101.2
    * bmo#1905691 - ChaChaXor to return after the function

++++ mozilla-nss:

  - update to NSS 3.101.2
    * bmo#1905691 - ChaChaXor to return after the function

++++ mozilla-nss:

  - update to NSS 3.101.2
    * bmo#1905691 - ChaChaXor to return after the function

++++ mozilla-nss:

  - update to NSS 3.101.2
    * bmo#1905691 - ChaChaXor to return after the function

------------------------------------------------------------------
------------------  2024-7-24  -  Jul 24 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Update to 8.9.0:
    * Security fixes:
  - [bsc#1227888, CVE-2024-6197] curl: freeing stack buffer
    in utf8asn1str
  - [bsc#1228260, CVE-2024-6874] idn: tweak buffer use when
    converting with macidn
    * Changes:
  - curl: add --ip-tos (IP Type of Service / Traffic Class)
  - curl: add --mptcp
  - curl: add --vlan-priority
  - curl: add -w '%{num_retries}
  - gnutls: support CA caching
  - mbedtls: support CURLOPT_CERTINFO
  - noproxy: patterns need to be comma separated
  - socket: support binding to interface *AND* IP
  - tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
  - urlapi: add CURLU_NO_GUESS_SCHEME
  - wolfssl: support CA caching
    * Bugfixes:
  - connection: shutdown TLS (for FTP) better
  - curl-config: revert to backticks to support old target envs
  - curl: allow etag and content-disposition for 3xx reply
  - curl: bsearch the --write-out variable name
  - curl: check for --disable case *sensitively*
  - doh: fix leak and zero-length HTTPS RR crash
  - file: separate fake headers and body with a stand-alone CRLF
  - ftp: remove redundant null pointer check in loop condition
  - gnutls: improve TLS shutdown
  - gnutls: pass in SNI name, not hostname when checking cert
  - hostip: skip error check for infallible function call
  - http/3: add shutdown support
  - http/3: resume upload on ack if we have more data to send
  - lib: add a few DEBUGASSERT(data) to aid code analyzers
  - lib: add failure reason on bind errors
  - lib: graceful connection shutdown
  - lib: xfer_setup and non-blocking shutdown
  - multi: add multi->proto_hash, a key-value store for protocol data
  - multi: do a final progress update on connect failure
  - multi: fix multi_wait() timeout handling
  - multi: fix pollset during RESOLVING phase
  - ngtcp2+quictls: fix cert-status use
  - noproxy: test bad ipv6 net size first
  - openssl/gnutls: rectify the TLS version checks for QUIC
  - openssl: fix hostname handling when using ECH
  - openssl: stop duplicate ssl key logging for legacy OpenSSL
  - quic: enable UDP GRO
  - quic: openssl quic, cmake and doc version update to 3.3.0
  - quic: require at least OpenSSL 3.3 for QUIC
  - quic: update to quiche 0.22.0
  - smtp: for starttls, do full upgrade
  - tool_operate: avoid explicitly setting verifypeer to 1
  - tool_writeout: get certinfo only when needing it
  - transfer: avoid polling socket every transfer loop
  - transfer: conn close on paused upload
  - transfer: do not use EXPIRE_NOW while blocked
  - transfer: remove curl_upload_refill_watermark, no longer used
  - transfer: set CSELECT_IN if there is data pending
  - url: allow DoH transfers to override max connection limit
  - x509asn1: add some common ECDSA OIDs
  - x509asn1: ASN1tostr() should fail when 'constructed' is set
  - x509asn1: fallback to dotted OID representation
  - x509asn1: prevent NULL dereference
  - x509asn1: remove superfluous free()
  - x509asn1: remove two static variables
    * Rebase libcurl-ocloexec.patch
    * Remove curl-make-install-curl-config.patch upstream

++++ curl:

  - Update to 8.9.0:
    * Security fixes:
  - [bsc#1227888, CVE-2024-6197] curl: freeing stack buffer
    in utf8asn1str
  - [bsc#1228260, CVE-2024-6874] idn: tweak buffer use when
    converting with macidn
    * Changes:
  - curl: add --ip-tos (IP Type of Service / Traffic Class)
  - curl: add --mptcp
  - curl: add --vlan-priority
  - curl: add -w '%{num_retries}
  - gnutls: support CA caching
  - mbedtls: support CURLOPT_CERTINFO
  - noproxy: patterns need to be comma separated
  - socket: support binding to interface *AND* IP
  - tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
  - urlapi: add CURLU_NO_GUESS_SCHEME
  - wolfssl: support CA caching
    * Bugfixes:
  - connection: shutdown TLS (for FTP) better
  - curl-config: revert to backticks to support old target envs
  - curl: allow etag and content-disposition for 3xx reply
  - curl: bsearch the --write-out variable name
  - curl: check for --disable case *sensitively*
  - doh: fix leak and zero-length HTTPS RR crash
  - file: separate fake headers and body with a stand-alone CRLF
  - ftp: remove redundant null pointer check in loop condition
  - gnutls: improve TLS shutdown
  - gnutls: pass in SNI name, not hostname when checking cert
  - hostip: skip error check for infallible function call
  - http/3: add shutdown support
  - http/3: resume upload on ack if we have more data to send
  - lib: add a few DEBUGASSERT(data) to aid code analyzers
  - lib: add failure reason on bind errors
  - lib: graceful connection shutdown
  - lib: xfer_setup and non-blocking shutdown
  - multi: add multi->proto_hash, a key-value store for protocol data
  - multi: do a final progress update on connect failure
  - multi: fix multi_wait() timeout handling
  - multi: fix pollset during RESOLVING phase
  - ngtcp2+quictls: fix cert-status use
  - noproxy: test bad ipv6 net size first
  - openssl/gnutls: rectify the TLS version checks for QUIC
  - openssl: fix hostname handling when using ECH
  - openssl: stop duplicate ssl key logging for legacy OpenSSL
  - quic: enable UDP GRO
  - quic: openssl quic, cmake and doc version update to 3.3.0
  - quic: require at least OpenSSL 3.3 for QUIC
  - quic: update to quiche 0.22.0
  - smtp: for starttls, do full upgrade
  - tool_operate: avoid explicitly setting verifypeer to 1
  - tool_writeout: get certinfo only when needing it
  - transfer: avoid polling socket every transfer loop
  - transfer: conn close on paused upload
  - transfer: do not use EXPIRE_NOW while blocked
  - transfer: remove curl_upload_refill_watermark, no longer used
  - transfer: set CSELECT_IN if there is data pending
  - url: allow DoH transfers to override max connection limit
  - x509asn1: add some common ECDSA OIDs
  - x509asn1: ASN1tostr() should fail when 'constructed' is set
  - x509asn1: fallback to dotted OID representation
  - x509asn1: prevent NULL dereference
  - x509asn1: remove superfluous free()
  - x509asn1: remove two static variables
    * Rebase libcurl-ocloexec.patch
    * Remove curl-make-install-curl-config.patch upstream

++++ curl:

  - Update to 8.9.0:
    * Security fixes:
  - [bsc#1227888, CVE-2024-6197] curl: freeing stack buffer
    in utf8asn1str
  - [bsc#1228260, CVE-2024-6874] idn: tweak buffer use when
    converting with macidn
    * Changes:
  - curl: add --ip-tos (IP Type of Service / Traffic Class)
  - curl: add --mptcp
  - curl: add --vlan-priority
  - curl: add -w '%{num_retries}
  - gnutls: support CA caching
  - mbedtls: support CURLOPT_CERTINFO
  - noproxy: patterns need to be comma separated
  - socket: support binding to interface *AND* IP
  - tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
  - urlapi: add CURLU_NO_GUESS_SCHEME
  - wolfssl: support CA caching
    * Bugfixes:
  - connection: shutdown TLS (for FTP) better
  - curl-config: revert to backticks to support old target envs
  - curl: allow etag and content-disposition for 3xx reply
  - curl: bsearch the --write-out variable name
  - curl: check for --disable case *sensitively*
  - doh: fix leak and zero-length HTTPS RR crash
  - file: separate fake headers and body with a stand-alone CRLF
  - ftp: remove redundant null pointer check in loop condition
  - gnutls: improve TLS shutdown
  - gnutls: pass in SNI name, not hostname when checking cert
  - hostip: skip error check for infallible function call
  - http/3: add shutdown support
  - http/3: resume upload on ack if we have more data to send
  - lib: add a few DEBUGASSERT(data) to aid code analyzers
  - lib: add failure reason on bind errors
  - lib: graceful connection shutdown
  - lib: xfer_setup and non-blocking shutdown
  - multi: add multi->proto_hash, a key-value store for protocol data
  - multi: do a final progress update on connect failure
  - multi: fix multi_wait() timeout handling
  - multi: fix pollset during RESOLVING phase
  - ngtcp2+quictls: fix cert-status use
  - noproxy: test bad ipv6 net size first
  - openssl/gnutls: rectify the TLS version checks for QUIC
  - openssl: fix hostname handling when using ECH
  - openssl: stop duplicate ssl key logging for legacy OpenSSL
  - quic: enable UDP GRO
  - quic: openssl quic, cmake and doc version update to 3.3.0
  - quic: require at least OpenSSL 3.3 for QUIC
  - quic: update to quiche 0.22.0
  - smtp: for starttls, do full upgrade
  - tool_operate: avoid explicitly setting verifypeer to 1
  - tool_writeout: get certinfo only when needing it
  - transfer: avoid polling socket every transfer loop
  - transfer: conn close on paused upload
  - transfer: do not use EXPIRE_NOW while blocked
  - transfer: remove curl_upload_refill_watermark, no longer used
  - transfer: set CSELECT_IN if there is data pending
  - url: allow DoH transfers to override max connection limit
  - x509asn1: add some common ECDSA OIDs
  - x509asn1: ASN1tostr() should fail when 'constructed' is set
  - x509asn1: fallback to dotted OID representation
  - x509asn1: prevent NULL dereference
  - x509asn1: remove superfluous free()
  - x509asn1: remove two static variables
    * Rebase libcurl-ocloexec.patch
    * Remove curl-make-install-curl-config.patch upstream

++++ curl:

  - Update to 8.9.0:
    * Security fixes:
  - [bsc#1227888, CVE-2024-6197] curl: freeing stack buffer
    in utf8asn1str
  - [bsc#1228260, CVE-2024-6874] idn: tweak buffer use when
    converting with macidn
    * Changes:
  - curl: add --ip-tos (IP Type of Service / Traffic Class)
  - curl: add --mptcp
  - curl: add --vlan-priority
  - curl: add -w '%{num_retries}
  - gnutls: support CA caching
  - mbedtls: support CURLOPT_CERTINFO
  - noproxy: patterns need to be comma separated
  - socket: support binding to interface *AND* IP
  - tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
  - urlapi: add CURLU_NO_GUESS_SCHEME
  - wolfssl: support CA caching
    * Bugfixes:
  - connection: shutdown TLS (for FTP) better
  - curl-config: revert to backticks to support old target envs
  - curl: allow etag and content-disposition for 3xx reply
  - curl: bsearch the --write-out variable name
  - curl: check for --disable case *sensitively*
  - doh: fix leak and zero-length HTTPS RR crash
  - file: separate fake headers and body with a stand-alone CRLF
  - ftp: remove redundant null pointer check in loop condition
  - gnutls: improve TLS shutdown
  - gnutls: pass in SNI name, not hostname when checking cert
  - hostip: skip error check for infallible function call
  - http/3: add shutdown support
  - http/3: resume upload on ack if we have more data to send
  - lib: add a few DEBUGASSERT(data) to aid code analyzers
  - lib: add failure reason on bind errors
  - lib: graceful connection shutdown
  - lib: xfer_setup and non-blocking shutdown
  - multi: add multi->proto_hash, a key-value store for protocol data
  - multi: do a final progress update on connect failure
  - multi: fix multi_wait() timeout handling
  - multi: fix pollset during RESOLVING phase
  - ngtcp2+quictls: fix cert-status use
  - noproxy: test bad ipv6 net size first
  - openssl/gnutls: rectify the TLS version checks for QUIC
  - openssl: fix hostname handling when using ECH
  - openssl: stop duplicate ssl key logging for legacy OpenSSL
  - quic: enable UDP GRO
  - quic: openssl quic, cmake and doc version update to 3.3.0
  - quic: require at least OpenSSL 3.3 for QUIC
  - quic: update to quiche 0.22.0
  - smtp: for starttls, do full upgrade
  - tool_operate: avoid explicitly setting verifypeer to 1
  - tool_writeout: get certinfo only when needing it
  - transfer: avoid polling socket every transfer loop
  - transfer: conn close on paused upload
  - transfer: do not use EXPIRE_NOW while blocked
  - transfer: remove curl_upload_refill_watermark, no longer used
  - transfer: set CSELECT_IN if there is data pending
  - url: allow DoH transfers to override max connection limit
  - x509asn1: add some common ECDSA OIDs
  - x509asn1: ASN1tostr() should fail when 'constructed' is set
  - x509asn1: fallback to dotted OID representation
  - x509asn1: prevent NULL dereference
  - x509asn1: remove superfluous free()
  - x509asn1: remove two static variables
    * Rebase libcurl-ocloexec.patch
    * Remove curl-make-install-curl-config.patch upstream

++++ curl:

  - Update to 8.9.0:
    * Security fixes:
  - [bsc#1227888, CVE-2024-6197] curl: freeing stack buffer
    in utf8asn1str
  - [bsc#1228260, CVE-2024-6874] idn: tweak buffer use when
    converting with macidn
    * Changes:
  - curl: add --ip-tos (IP Type of Service / Traffic Class)
  - curl: add --mptcp
  - curl: add --vlan-priority
  - curl: add -w '%{num_retries}
  - gnutls: support CA caching
  - mbedtls: support CURLOPT_CERTINFO
  - noproxy: patterns need to be comma separated
  - socket: support binding to interface *AND* IP
  - tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
  - urlapi: add CURLU_NO_GUESS_SCHEME
  - wolfssl: support CA caching
    * Bugfixes:
  - connection: shutdown TLS (for FTP) better
  - curl-config: revert to backticks to support old target envs
  - curl: allow etag and content-disposition for 3xx reply
  - curl: bsearch the --write-out variable name
  - curl: check for --disable case *sensitively*
  - doh: fix leak and zero-length HTTPS RR crash
  - file: separate fake headers and body with a stand-alone CRLF
  - ftp: remove redundant null pointer check in loop condition
  - gnutls: improve TLS shutdown
  - gnutls: pass in SNI name, not hostname when checking cert
  - hostip: skip error check for infallible function call
  - http/3: add shutdown support
  - http/3: resume upload on ack if we have more data to send
  - lib: add a few DEBUGASSERT(data) to aid code analyzers
  - lib: add failure reason on bind errors
  - lib: graceful connection shutdown
  - lib: xfer_setup and non-blocking shutdown
  - multi: add multi->proto_hash, a key-value store for protocol data
  - multi: do a final progress update on connect failure
  - multi: fix multi_wait() timeout handling
  - multi: fix pollset during RESOLVING phase
  - ngtcp2+quictls: fix cert-status use
  - noproxy: test bad ipv6 net size first
  - openssl/gnutls: rectify the TLS version checks for QUIC
  - openssl: fix hostname handling when using ECH
  - openssl: stop duplicate ssl key logging for legacy OpenSSL
  - quic: enable UDP GRO
  - quic: openssl quic, cmake and doc version update to 3.3.0
  - quic: require at least OpenSSL 3.3 for QUIC
  - quic: update to quiche 0.22.0
  - smtp: for starttls, do full upgrade
  - tool_operate: avoid explicitly setting verifypeer to 1
  - tool_writeout: get certinfo only when needing it
  - transfer: avoid polling socket every transfer loop
  - transfer: conn close on paused upload
  - transfer: do not use EXPIRE_NOW while blocked
  - transfer: remove curl_upload_refill_watermark, no longer used
  - transfer: set CSELECT_IN if there is data pending
  - url: allow DoH transfers to override max connection limit
  - x509asn1: add some common ECDSA OIDs
  - x509asn1: ASN1tostr() should fail when 'constructed' is set
  - x509asn1: fallback to dotted OID representation
  - x509asn1: prevent NULL dereference
  - x509asn1: remove superfluous free()
  - x509asn1: remove two static variables
    * Rebase libcurl-ocloexec.patch
    * Remove curl-make-install-curl-config.patch upstream

++++ curl:

  - Update to 8.9.0:
    * Security fixes:
  - [bsc#1227888, CVE-2024-6197] curl: freeing stack buffer
    in utf8asn1str
  - [bsc#1228260, CVE-2024-6874] idn: tweak buffer use when
    converting with macidn
    * Changes:
  - curl: add --ip-tos (IP Type of Service / Traffic Class)
  - curl: add --mptcp
  - curl: add --vlan-priority
  - curl: add -w '%{num_retries}
  - gnutls: support CA caching
  - mbedtls: support CURLOPT_CERTINFO
  - noproxy: patterns need to be comma separated
  - socket: support binding to interface *AND* IP
  - tcpkeepalive: add CURLOPT_TCP_KEEPCNT and --keepalive-cnt
  - urlapi: add CURLU_NO_GUESS_SCHEME
  - wolfssl: support CA caching
    * Bugfixes:
  - connection: shutdown TLS (for FTP) better
  - curl-config: revert to backticks to support old target envs
  - curl: allow etag and content-disposition for 3xx reply
  - curl: bsearch the --write-out variable name
  - curl: check for --disable case *sensitively*
  - doh: fix leak and zero-length HTTPS RR crash
  - file: separate fake headers and body with a stand-alone CRLF
  - ftp: remove redundant null pointer check in loop condition
  - gnutls: improve TLS shutdown
  - gnutls: pass in SNI name, not hostname when checking cert
  - hostip: skip error check for infallible function call
  - http/3: add shutdown support
  - http/3: resume upload on ack if we have more data to send
  - lib: add a few DEBUGASSERT(data) to aid code analyzers
  - lib: add failure reason on bind errors
  - lib: graceful connection shutdown
  - lib: xfer_setup and non-blocking shutdown
  - multi: add multi->proto_hash, a key-value store for protocol data
  - multi: do a final progress update on connect failure
  - multi: fix multi_wait() timeout handling
  - multi: fix pollset during RESOLVING phase
  - ngtcp2+quictls: fix cert-status use
  - noproxy: test bad ipv6 net size first
  - openssl/gnutls: rectify the TLS version checks for QUIC
  - openssl: fix hostname handling when using ECH
  - openssl: stop duplicate ssl key logging for legacy OpenSSL
  - quic: enable UDP GRO
  - quic: openssl quic, cmake and doc version update to 3.3.0
  - quic: require at least OpenSSL 3.3 for QUIC
  - quic: update to quiche 0.22.0
  - smtp: for starttls, do full upgrade
  - tool_operate: avoid explicitly setting verifypeer to 1
  - tool_writeout: get certinfo only when needing it
  - transfer: avoid polling socket every transfer loop
  - transfer: conn close on paused upload
  - transfer: do not use EXPIRE_NOW while blocked
  - transfer: remove curl_upload_refill_watermark, no longer used
  - transfer: set CSELECT_IN if there is data pending
  - url: allow DoH transfers to override max connection limit
  - x509asn1: add some common ECDSA OIDs
  - x509asn1: ASN1tostr() should fail when 'constructed' is set
  - x509asn1: fallback to dotted OID representation
  - x509asn1: prevent NULL dereference
  - x509asn1: remove superfluous free()
  - x509asn1: remove two static variables
    * Rebase libcurl-ocloexec.patch
    * Remove curl-make-install-curl-config.patch upstream

++++ docker-compose:

  - Update to version 2.29.1:
    * Enhance JSON progress events with more fields.
    * bump compose-go v2.1.5
    * bump github.com/docker/cli v27.1.0
    * bump github.com/docker/docker v27.1.0
    * bump github.com/containerd/containerd v1.7.20
    * gha: add docker 27.1.0
    * fix(containers): fix sorting logic by adding secondary sorting
    for one-off containers

++++ docker-compose:

  - Update to version 2.29.1:
    * Enhance JSON progress events with more fields.
    * bump compose-go v2.1.5
    * bump github.com/docker/cli v27.1.0
    * bump github.com/docker/docker v27.1.0
    * bump github.com/containerd/containerd v1.7.20
    * gha: add docker 27.1.0
    * fix(containers): fix sorting logic by adding secondary sorting
    for one-off containers

++++ docker-compose:

  - Update to version 2.29.1:
    * Enhance JSON progress events with more fields.
    * bump compose-go v2.1.5
    * bump github.com/docker/cli v27.1.0
    * bump github.com/docker/docker v27.1.0
    * bump github.com/containerd/containerd v1.7.20
    * gha: add docker 27.1.0
    * fix(containers): fix sorting logic by adding secondary sorting
    for one-off containers

++++ kernel-default:

  - ima: Avoid blocking in RCU read-side critical section (bsc#1227803, CVE-2024-40947).
  - commit 6fea688

++++ kernel-default:

  - ima: Avoid blocking in RCU read-side critical section (bsc#1227803, CVE-2024-40947).
  - commit 6fea688
  - net/rds: fix WARNING in rds_conn_connect_if_down (CVE-2024-27024
    bsc#1223777).
  - commit 466c800
  - Update config files. Disable CONFIG_KFENCE on ppc64le (bsc#1226920)
  - commit 05180ef

++++ kernel-default:

  - ima: Avoid blocking in RCU read-side critical section (bsc#1227803, CVE-2024-40947).
  - commit 6fea688
  - net/rds: fix WARNING in rds_conn_connect_if_down (CVE-2024-27024
    bsc#1223777).
  - commit 466c800
  - Update config files. Disable CONFIG_KFENCE on ppc64le (bsc#1226920)
  - commit 05180ef

------------------------------------------------------------------
------------------  2024-7-23  -  Jul 23 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - bpf: Set run context for rawtp test_run callback (bsc#1227783
    CVE-2024-40908).
  - commit c965ae8
  - nfs: Fix up kabi after adding write_congestion_wait
    (bsc#1218442).
  - commit fa72236
  - ipv6: prevent possible NULL dereference in rt6_probe()
    (CVE-2024-40960 bsc#1227813).
  - commit acda250
  - PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode()
    (git-fixes).
  - commit e717f73
  - x86/csum: clean up `csum_partial' further (git-fixes).
  - commit eb0657c
  - x86/resctrl: Remove redundant variable in mbm_config_write_domain() (git-fixes).
  - commit 7ae6079
  - blacklist.conf: This patch gets reverted
  - commit c490f33
  - x86/resctrl: Read supported bandwidth sources from CPUID (git-fixes).
  - commit 907534d
  - blacklist.conf: Remove dead-end revert
    We never merged the buggy upstream fix.
  - commit 9b319fd
  - x86/shstk: Make return uprobe work with shadow stack (git-fixes).
  - commit a22c34a
  - x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS (git-fixes).
  - commit 0887d68
  - x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and  VPDPWSSDS (git-fixes).
  - commit 4b4922f
  - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup (git-fixes).
  - commit 4c24788
  - x86/cpu: Provide default cache line size if not enumerated (git-fixes).
  - commit c2b6a76
  - x86/bhi: Avoid warning in #DB handler due to BHI mitigation :(git-fixes).
  - commit d32b5a4
  - x86/apic: Force native_apic_mem_read() to use the MOV instruction (git-fixes).
  - commit a7c18d6
  - x86/amd_nb: Check for invalid SMN reads (git-fixes).
  - commit 5e0a2ff
  - cachefiles: flush all requests after setting CACHEFILES_DEAD
    (bsc#1227797 CVE-2024-40935).
  - commit 6acb040
  - PCI: tegra194: Set EP alignment restriction for inbound ATU
    (git-fixes).
  - PCI: keystone: Fix NULL pointer dereference in case of DT
    error in ks_pcie_setup_rc_app_regs() (git-fixes).
  - PCI: keystone: Don't enable BAR 0 for AM654x (git-fixes).
  - commit 3d6a567
  - ipv6: prevent possible NULL deref in fib6_nh_init()
    (CVE-2024-40961 bsc#1227814).
  - commit 3de66de
  - PCI: Extend ACS configurability (bsc#1228090).
  - commit 571e431
  - netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757 CVE-2024-39504).
  - commit becdc7a

++++ kernel-default:

  - bpf: Set run context for rawtp test_run callback (bsc#1227783
    CVE-2024-40908).
  - commit c965ae8
  - nfs: Fix up kabi after adding write_congestion_wait
    (bsc#1218442).
  - commit fa72236
  - ipv6: prevent possible NULL dereference in rt6_probe()
    (CVE-2024-40960 bsc#1227813).
  - commit acda250
  - PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode()
    (git-fixes).
  - commit e717f73
  - x86/csum: clean up `csum_partial' further (git-fixes).
  - commit eb0657c
  - x86/resctrl: Remove redundant variable in mbm_config_write_domain() (git-fixes).
  - commit 7ae6079
  - blacklist.conf: This patch gets reverted
  - commit c490f33
  - x86/resctrl: Read supported bandwidth sources from CPUID (git-fixes).
  - commit 907534d
  - blacklist.conf: Remove dead-end revert
    We never merged the buggy upstream fix.
  - commit 9b319fd
  - x86/shstk: Make return uprobe work with shadow stack (git-fixes).
  - commit a22c34a
  - x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS (git-fixes).
  - commit 0887d68
  - x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and  VPDPWSSDS (git-fixes).
  - commit 4b4922f
  - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup (git-fixes).
  - commit 4c24788
  - x86/cpu: Provide default cache line size if not enumerated (git-fixes).
  - commit c2b6a76
  - x86/bhi: Avoid warning in #DB handler due to BHI mitigation :(git-fixes).
  - commit d32b5a4
  - x86/apic: Force native_apic_mem_read() to use the MOV instruction (git-fixes).
  - commit a7c18d6
  - x86/amd_nb: Check for invalid SMN reads (git-fixes).
  - commit 5e0a2ff
  - cachefiles: flush all requests after setting CACHEFILES_DEAD
    (bsc#1227797 CVE-2024-40935).
  - commit 6acb040
  - PCI: tegra194: Set EP alignment restriction for inbound ATU
    (git-fixes).
  - PCI: keystone: Fix NULL pointer dereference in case of DT
    error in ks_pcie_setup_rc_app_regs() (git-fixes).
  - PCI: keystone: Don't enable BAR 0 for AM654x (git-fixes).
  - commit 3d6a567
  - ipv6: prevent possible NULL deref in fib6_nh_init()
    (CVE-2024-40961 bsc#1227814).
  - commit 3de66de
  - PCI: Extend ACS configurability (bsc#1228090).
  - commit 571e431
  - netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757 CVE-2024-39504).
  - commit becdc7a

++++ kernel-default:

  - bpf: Set run context for rawtp test_run callback (bsc#1227783
    CVE-2024-40908).
  - commit c965ae8
  - nfs: Fix up kabi after adding write_congestion_wait
    (bsc#1218442).
  - commit fa72236
  - ipv6: prevent possible NULL dereference in rt6_probe()
    (CVE-2024-40960 bsc#1227813).
  - commit acda250
  - PCI: keystone: Relocate ks_pcie_set/clear_dbi_mode()
    (git-fixes).
  - commit e717f73
  - x86/csum: clean up `csum_partial' further (git-fixes).
  - commit eb0657c
  - x86/resctrl: Remove redundant variable in mbm_config_write_domain() (git-fixes).
  - commit 7ae6079
  - blacklist.conf: This patch gets reverted
  - commit c490f33
  - x86/resctrl: Read supported bandwidth sources from CPUID (git-fixes).
  - commit 907534d
  - blacklist.conf: Remove dead-end revert
    We never merged the buggy upstream fix.
  - commit 9b319fd
  - x86/shstk: Make return uprobe work with shadow stack (git-fixes).
  - commit a22c34a
  - x86/kconfig: Add as-instr64 macro to properly evaluate AS_WRUSS (git-fixes).
  - commit 0887d68
  - x86/insn: Add VEX versions of VPDPBUSD, VPDPBUSDS, VPDPWSSD and  VPDPWSSDS (git-fixes).
  - commit 4b4922f
  - x86/fpu: Fix AMD X86_BUG_FXSAVE_LEAK fixup (git-fixes).
  - commit 4c24788
  - x86/cpu: Provide default cache line size if not enumerated (git-fixes).
  - commit c2b6a76
  - x86/bhi: Avoid warning in #DB handler due to BHI mitigation :(git-fixes).
  - commit d32b5a4
  - x86/apic: Force native_apic_mem_read() to use the MOV instruction (git-fixes).
  - commit a7c18d6
  - x86/amd_nb: Check for invalid SMN reads (git-fixes).
  - commit 5e0a2ff
  - cachefiles: flush all requests after setting CACHEFILES_DEAD
    (bsc#1227797 CVE-2024-40935).
  - commit 6acb040
  - PCI: tegra194: Set EP alignment restriction for inbound ATU
    (git-fixes).
  - PCI: keystone: Fix NULL pointer dereference in case of DT
    error in ks_pcie_setup_rc_app_regs() (git-fixes).
  - PCI: keystone: Don't enable BAR 0 for AM654x (git-fixes).
  - commit 3d6a567
  - ipv6: prevent possible NULL deref in fib6_nh_init()
    (CVE-2024-40961 bsc#1227814).
  - commit 3de66de
  - PCI: Extend ACS configurability (bsc#1228090).
  - commit 571e431
  - netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757 CVE-2024-39504).
  - commit becdc7a

++++ util-linux:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

++++ util-linux:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

++++ util-linux:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

++++ util-linux:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

++++ libzypp:

  - Fix typo in the geoip update pipeline (bsc#1228206)
  - Export RepoVariablesStringReplacer for yast2 (bsc#1228138)
  - version 17.35.4 (35)

++++ libzypp:

  - Fix typo in the geoip update pipeline (bsc#1228206)
  - Export RepoVariablesStringReplacer for yast2 (bsc#1228138)
  - version 17.35.4 (35)

++++ libzypp:

  - Fix typo in the geoip update pipeline (bsc#1228206)
  - Export RepoVariablesStringReplacer for yast2 (bsc#1228138)
  - version 17.35.4 (35)

++++ libzypp:

  - Fix typo in the geoip update pipeline (bsc#1228206)
  - Export RepoVariablesStringReplacer for yast2 (bsc#1228138)
  - version 17.35.4 (35)

++++ libzypp:

  - Fix typo in the geoip update pipeline (bsc#1228206)
  - Export RepoVariablesStringReplacer for yast2 (bsc#1228138)
  - version 17.35.4 (35)

++++ nvidia-open-driver-G06-signed:

  - better summary and description for KMP

++++ util-linux-systemd:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

++++ util-linux-systemd:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

++++ util-linux-systemd:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

++++ util-linux-systemd:

  - agetty: Prevent login cursor escape (bsc#1194818,
    util-linux-agetty-prevent-cursor-escape.patch).

------------------------------------------------------------------
------------------  2024-7-22  -  Jul 22 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - nfs: Block on write congestion (bsc#1218442).
  - commit b7f1cad
  - nfs: Properly initialize server->writeback (bsc#1218442).
  - commit c293976
  - nfs: Drop pointless check from nfs_commit_release_pages()
    (bsc#1218442).
  - commit 20931fe
  - kabi/severities: cleanup and update for WiFi driver entries (bsc#1227149)
  - commit 777b4e0
  - wifi: libertas: Follow renaming of SPI "master" to "controller"
    (bsc#1227149).
  - wifi: cw1200: restore endian swapping (bsc#1227149).
  - wifi: wlcore: sdio: Rate limit wl12xx_sdio_raw_{read,write}()
    failures warns (bsc#1227149).
  - wifi: zd1211rw: silence sparse warnings (bsc#1227149).
  - wifi: rt2x00: silence sparse warnings (bsc#1227149).
  - wifi: brcmsmac: silence sparse warnings (bsc#1227149).
  - wifi: b43: silence sparse warnings (bsc#1227149).
  - wifi: brcmfmac: do not pass hidden SSID attribute as value
    directly (bsc#1227149).
  - wifi: brcmfmac: fweh: Fix boot crash on Raspberry Pi 4
    (bsc#1227149).
  - wifi: wilc1000: remove AKM suite be32 conversion for external
    auth request (bsc#1227149).
  - wifi: wilc1000: add missing read critical sections around vif
    list traversal (bsc#1227149).
  - wifi: wilc1000: fix declarations ordering (bsc#1227149).
  - wifi: wilc1000: use SRCU instead of RCU for vif list traversal
    (bsc#1227149).
  - wifi: wilc1000: split deeply nested RCU list traversal in
    dedicated helper (bsc#1227149).
  - wifi: wilc1000: validate chip id during bus probe (bsc#1227149).
  - wifi: brcmfmac: do not cast hidden SSID attribute value to
    boolean (bsc#1227149).
  - wifi: mwifiex: Refactor 1-element array into flexible array
    in struct mwifiex_ie_types_chan_list_param_set (bsc#1227149).
  - wifi: wilc1000: correct CRC7 calculation (bsc#1227149).
  - wifi: wilc1000: set preamble size to auto as default in
    wilc_init_fw_config() (bsc#1227149).
  - wifi: mwifiex: use kstrtoX_from_user() in debugfs handlers
    (bsc#1227149).
  - wifi: wilc1000: remove setting msg.spi (bsc#1227149).
  - wifi: cw1200: Convert to GPIO descriptors (bsc#1227149).
  - wifi: plfxlc: Drop unused include (bsc#1227149).
  - wifi: mwifiex: Drop unused headers (bsc#1227149).
  - wifi: ti: wlcore: sdio: Drop unused include (bsc#1227149).
  - wifi: cw1200: fix __le16 sparse warnings (bsc#1227149).
  - wifi: rsi: fix restricted __le32 degrades to integer sparse
    warnings (bsc#1227149).
  - wifi: zd1211rw: remove __nocast from zd_addr_t (bsc#1227149).
  - wifi: brcmfmac: add linefeed at end of file (bsc#1227149).
  - wifi: brcmfmac: allow per-vendor event handling (bsc#1227149).
  - wifi: brcmfmac: move feature overrides before feature_disable
    (bsc#1227149).
  - wifi: brcmfmac: export firmware interface functions
    (bsc#1227149).
  - wifi: rt2x00: simplify rt2x00crypto_rx_insert_iv()
    (bsc#1227149).
  - wifi: mwifiex: Use helpers to check multicast addresses
    (bsc#1227149).
  - wifi: brcmsmac: phy: Remove unreachable code (bsc#1227149).
  - wifi: wilc1000: fix incorrect power down sequence (bsc#1227149).
  - wifi: wilc1000: fix driver_handler when committing initial
    configuration (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wilc1000 (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wl18xx (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for p54spi (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for Broadcom WLAN
    (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wl1251 and wl12xx
    (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wlcore (bsc#1227149).
  - wifi: p54: fix GCC format truncation warning with
    wiphy->fw_version (bsc#1227149).
  - wifi: mwifiex: use cfg80211_ssid_eq() instead of
    mwifiex_ssid_cmp() (bsc#1227149).
  - wifi: rt2x00: remove useless code in
    rt2x00queue_create_tx_descriptor() (bsc#1227149).
  - commit 08ddd32
  - wifi: rt2x00: make watchdog param per device (bsc#1227149).
  - wifi: rt2x00: Simplify bool conversion (bsc#1227149).
  - wifi: mwifiex: mwifiex_process_sleep_confirm_resp(): remove
    unused priv variable (bsc#1227149).
  - wifi: rt2x00: disable RTS threshold for rt2800 by default
    (bsc#1227149).
  - wifi: rt2x00: introduce DMA busy check watchdog for rt2800
    (bsc#1227149).
  - wifi: wilc1000: simplify wilc_scan() (bsc#1227149).
  - wifi: wilc1000: cleanup struct wilc_conn_info (bsc#1227149).
  - wifi: wilc1000: always release SDIO host in wilc_sdio_cmd53()
    (bsc#1227149).
  - wifi: wilc1000: simplify remain on channel support
    (bsc#1227149).
  - wifi: brcmsmac: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - wifi: brcm80211: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: rt2x00: rework MT7620 PA/LNA RF calibration (bsc#1227149).
  - wifi: rt2x00: rework MT7620 channel config function
    (bsc#1227149).
  - commit 055fd52
  - wifi: rt2x00: improve MT7620 register initialization
    (bsc#1227149).
  - wifi: wlcore: main: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wlcore: boot: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wl18xx: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wl1251: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: rt2x00: fix rt2800 watchdog function (bsc#1227149).
  - wifi: brcmfmac: fix format-truncation warnings (bsc#1227149).
  - wifi: hostap: remove unused ioctl function (bsc#1227149).
  - wifi: atmel: remove unused ioctl function (bsc#1227149).
  - wifi: p54: Annotate struct p54_cal_database with __counted_by
    (bsc#1227149).
  - wifi: brcmfmac: fweh: Add __counted_by for struct
    brcmf_fweh_queue_item and use struct_size() (bsc#1227149).
  - wifi: hostap: Add __counted_by for struct prism2_download_data
    and use struct_size() (bsc#1227149).
  - wifi: wfx: implement wfx_remain_on_channel() (bsc#1227149).
  - wifi: wfx: allow to send frames during ROC (bsc#1227149).
  - wifi: wfx: scan_lock is global to the device (bsc#1227149).
  - wifi: wfx: simplify exclusion between scan and Rx filters
    (bsc#1227149).
  - wifi: wfx: introduce hif_scan_uniq() (bsc#1227149).
  - wifi: wfx: move wfx_skb_*() out of the header file
    (bsc#1227149).
  - wifi: wfx: relocate wfx_rate_mask_to_hw() (bsc#1227149).
  - wifi: wfx: fix power_save setting when AP is stopped
    (bsc#1227149).
  - commit 859f128
  - wifi: mwifiex: Replace one-element array with flexible-array
    member in struct mwifiex_ie_types_rxba_sync (bsc#1227149).
  - Refresh
    patches.suse/wifi-mwifiex-Sanity-check-tlv_len-and-tlv_bitmap_len.patch.
  - commit 0e5befb
  - wifi: rt2x00: fix MT7620 low RSSI issue (bsc#1227149).
  - wifi: rt2x00: remove redundant check if u8 array element is
    less than zero (bsc#1227149).
  - wifi: mwifiex: followup PCIE and related cleanups (bsc#1227149).
  - wifi: mwifiex: simplify PCIE write operations (bsc#1227149).
  - wifi: wilc1000: add back-off algorithm to balance tx queue
    packets (bsc#1227149).
  - wifi: mwifiex: use MODULE_FIRMWARE to add firmware files
    metadata (bsc#1227149).
  - wifi: mwifiex: cleanup struct mwifiex_sdio_mpa_rx (bsc#1227149).
  - wifi: brcmfmac: firmware: Annotate struct brcmf_fw_request
    with __counted_by (bsc#1227149).
  - wifi: brcmfmac: Annotate struct brcmf_gscan_config with
    __counted_by (bsc#1227149).
  - wifi: cw1200: Avoid processing an invalid TIM IE (bsc#1227149).
  - wifi: wlcore: sdio: Use module_sdio_driver macro to simplify
    the code (bsc#1227149).
  - wifi: wilc1000: Remove unused declarations (bsc#1227149).
  - wifi: rt2x00: limit MT7620 TX power based on eeprom calibration
    (bsc#1227149).
  - wifi: wfx: Use devm_kmemdup to replace devm_kmalloc + memcpy
    (bsc#1227149).
  - wifi: rsi: rsi_91x_usb_ops: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_usb: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_sdio_ops: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_sdio: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - commit a544c26
  - wifi: rsi: rsi_91x_main: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_mac80211: Remove unnecessary conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_hal: Remove unnecessary conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_debugfs: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_coex: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rt2x00: correct MAC_SYS_CTRL register RX mask in
    R-Calibration (bsc#1227149).
  - wifi: mwifiex: fix comment typos in SDIO module (bsc#1227149).
  - wifi: mwifiex: cleanup adapter data (bsc#1227149).
  - wifi: mwifiex: use is_zero_ether_addr() instead of
    ether_addr_equal() (bsc#1227149).
  - wifi: mwifiex: drop BUG_ON from TX paths (bsc#1227149).
  - wifi: mwifiex: handle possible mwifiex_write_reg() errors
    (bsc#1227149).
  - wifi: mwifiex: handle possible sscanf() errors (bsc#1227149).
  - wifi: mwifiex: cleanup private data structures (bsc#1227149).
  - wlcore: spi: Remove redundant of_match_ptr() (bsc#1227149).
  - wifi: brcmsmac: cleanup SCB-related data types (bsc#1227149).
  - wifi: brcmsmac: remove more unused data types (bsc#1227149).
  - wifi: libertas: prefer kstrtoX() for simple integer conversions
    (bsc#1227149).
  - wifi: libertas: handle possible spu_write_u16() errors
    (bsc#1227149).
  - wifi: libertas: cleanup SDIO reset (bsc#1227149).
  - wifi: libertas: simplify list operations in free_if_spi_card()
    (bsc#1227149).
  - wifi: libertas: use convenient lists to manage SDIO packets
    (bsc#1227149).
  - wifi: libertas: add missing calls to cancel_work_sync()
    (bsc#1227149).
  - wifi: wilc1000: add SPI commands retry mechanism (bsc#1227149).
  - wifi: wilc1000: remove use of has_thrpt_enh3 flag (bsc#1227149).
  - wifi: brcmsmac: remove unused data type (bsc#1227149).
  - wifi: mwifiex: Set WIPHY_FLAG_NETNS_OK flag (bsc#1227149).
  - wifi: mwifiex: prefer strscpy() over strlcpy() (bsc#1227149).
  - wifi: zd1211rw: fix typo "tranmits" (bsc#1227149).
  - wifi: p54: Add missing MODULE_FIRMWARE macro (bsc#1227149).
  - wifi: hostap: fix stringop-truncations GCC warning
    (bsc#1227149).
  - wifi: brcmsmac: fix gnu_printf warnings (bsc#1227149).
  - wifi: brcmfmac: fix gnu_printf warnings (bsc#1227149).
  - wifi: rt2x00: fix the typo in comments (bsc#1227149).
  - wifi: brcmfmac: Detect corner error case earlier with log
    (bsc#1227149).
  - wifi: brcmutil: use helper function pktq_empty() instead of
    open code (bsc#1227149).
  - wifi: add HAS_IOPORT dependencies (bsc#1227149).
  - wifi: wilc1000: Increase ASSOC response buffer (bsc#1227149).
  - wifi: mwifiex: Use list_count_nodes() (bsc#1227149).
  - wifi: mwifiex: Use default @max_active for workqueues
    (bsc#1227149).
  - commit edbabc2
  - xfs: Add cond_resched to block unmap range and reflink remap
    path (bsc#1228211).
  - commit 4c79a42
  - supported.conf: Add support for v4l2-dv-timings
    (jsc#PED-8645)
  - commit 6262df7
  - supported.conf: Add support for v4l2-dv-timings
    (jsc#PED-8644)
  - commit a3622c5
  - netrom: Fix a memory leak in nr_heartbeat_expiry()
    (CVE-2024-41006 bsc#1227862).
  - commit 59ef181
  - arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu (git-fixes)
  - commit 6571948
  - arm64: dts: rockchip: Fix mic-in-differential usage on (git-fixes)
  - commit 67939cb
  - arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc (git-fixes)
  - commit 5ed815a
  - arm64: dts: rockchip: Drop invalid mic-in-differential on (git-fixes)
  - commit af4620a
  - arm64: dts: rockchip: Increase VOP clk rate on RK3328 (git-fixes)
  - commit 0171830
  - arm64: dts: rockchip: Update WIFi/BT related nodes on (git-fixes)
  - commit 2186774
  - arm64: dts: rockchip: Add mdio and ethernet-phy nodes to (git-fixes)
  - commit 7bd1596
  - arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s (git-fixes)
  - commit a5c559a
  - arm64: dts: rockchip: Add sdmmc related properties on (git-fixes)
  - commit 07ed999
  - arm64: dts: rockchip: Add sound-dai-cells for RK3368 (git-fixes)
  - commit 0d2dc44
  - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E (git-fixes)
  - commit 17c17ec
  - arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch (git-fixes)
  - commit ef568ac
  - arm64: dts: rockchip: Rename LED related pinctrl nodes on (git-fixes)
  - commit 3ac3475
  - arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s (git-fixes)
  - commit f0f8ba5
  - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 (git-fixes)
  - commit a564fef
  - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc (git-fixes)
  - commit d7e72e1
  - arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input (git-fixes)
  - commit ca6c1bb
  - arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property (git-fixes)
  - commit a10e3de
  - blacklist.conf: ("arm64: dts: freescale: imx8mm-verdin: Fix GPU speed")
  - commit ea9f475
  - Move upstreamed patches into sorted section
  - commit 0bb0cc8
  - fuse: verify {g,u}id mount options correctly (bsc#1228193).
  - libceph: fix race between delayed_work() and ceph_monc_stop()
    (bsc#1228192).
  - commit 10e7bb9
  - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
    (git-fixes).
  - checkpatch: really skip LONG_LINE_* when LONG_LINE is ignored
    (git-fixes).
  - rtc: interface: Add RTC offset to alarm after fix-up
    (git-fixes).
  - rtc: abx80x: Fix return value of nvmem callback on read
    (git-fixes).
  - rtc: cmos: Fix return value of nvmem callbacks (git-fixes).
  - rtc: isl1208: Fix return value of nvmem callbacks (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix TPU suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix TCLK suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: FIX PWM suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix IRQ suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes
    (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix CANFD5 suffix (git-fixes).
  - pinctrl: freescale: mxs: Fix refcount of child (git-fixes).
  - pinctrl: ti: ti-iodelay: fix possible memory leak when
    pinctrl_enable() fails (git-fixes).
  - pinctrl: single: fix possible memory leak when pinctrl_enable()
    fails (git-fixes).
  - pinctrl: core: fix possible memory leak when pinctrl_enable()
    fails (git-fixes).
  - pinctrl: rockchip: update rk3308 iomux routes (git-fixes).
  - selftests/sigaltstack: Fix ppc64 GCC build (git-fixes).
  - PCI: dw-rockchip: Fix initial PERST# GPIO value (git-fixes).
  - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
    (git-fixes).
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in
    rcar_pcie_wakeup() (git-fixes).
  - PCI: qcom-ep: Disable resources unconditionally during PERST#
    assert (git-fixes).
  - PCI: dwc: Fix index 0 incorrectly being interpreted as a free
    ATU slot (git-fixes).
  - PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup()
    (git-fixes).
  - PCI: endpoint: Clean up error handling in vpci_scan_bus()
    (git-fixes).
  - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features'
    in pci_epf_test_core_init() (git-fixes).
  - PCI: Fix resource double counting on remove & rescan
    (git-fixes).
  - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
    (git-fixes).
  - PCI: Introduce cleanup helpers for device reference counts
    and locks (stable-fixes).
  - commit a7e6cbc

++++ kernel-default:

  - nfs: Block on write congestion (bsc#1218442).
  - commit b7f1cad
  - nfs: Properly initialize server->writeback (bsc#1218442).
  - commit c293976
  - nfs: Drop pointless check from nfs_commit_release_pages()
    (bsc#1218442).
  - commit 20931fe
  - kabi/severities: cleanup and update for WiFi driver entries (bsc#1227149)
  - commit 777b4e0
  - wifi: libertas: Follow renaming of SPI "master" to "controller"
    (bsc#1227149).
  - wifi: cw1200: restore endian swapping (bsc#1227149).
  - wifi: wlcore: sdio: Rate limit wl12xx_sdio_raw_{read,write}()
    failures warns (bsc#1227149).
  - wifi: zd1211rw: silence sparse warnings (bsc#1227149).
  - wifi: rt2x00: silence sparse warnings (bsc#1227149).
  - wifi: brcmsmac: silence sparse warnings (bsc#1227149).
  - wifi: b43: silence sparse warnings (bsc#1227149).
  - wifi: brcmfmac: do not pass hidden SSID attribute as value
    directly (bsc#1227149).
  - wifi: brcmfmac: fweh: Fix boot crash on Raspberry Pi 4
    (bsc#1227149).
  - wifi: wilc1000: remove AKM suite be32 conversion for external
    auth request (bsc#1227149).
  - wifi: wilc1000: add missing read critical sections around vif
    list traversal (bsc#1227149).
  - wifi: wilc1000: fix declarations ordering (bsc#1227149).
  - wifi: wilc1000: use SRCU instead of RCU for vif list traversal
    (bsc#1227149).
  - wifi: wilc1000: split deeply nested RCU list traversal in
    dedicated helper (bsc#1227149).
  - wifi: wilc1000: validate chip id during bus probe (bsc#1227149).
  - wifi: brcmfmac: do not cast hidden SSID attribute value to
    boolean (bsc#1227149).
  - wifi: mwifiex: Refactor 1-element array into flexible array
    in struct mwifiex_ie_types_chan_list_param_set (bsc#1227149).
  - wifi: wilc1000: correct CRC7 calculation (bsc#1227149).
  - wifi: wilc1000: set preamble size to auto as default in
    wilc_init_fw_config() (bsc#1227149).
  - wifi: mwifiex: use kstrtoX_from_user() in debugfs handlers
    (bsc#1227149).
  - wifi: wilc1000: remove setting msg.spi (bsc#1227149).
  - wifi: cw1200: Convert to GPIO descriptors (bsc#1227149).
  - wifi: plfxlc: Drop unused include (bsc#1227149).
  - wifi: mwifiex: Drop unused headers (bsc#1227149).
  - wifi: ti: wlcore: sdio: Drop unused include (bsc#1227149).
  - wifi: cw1200: fix __le16 sparse warnings (bsc#1227149).
  - wifi: rsi: fix restricted __le32 degrades to integer sparse
    warnings (bsc#1227149).
  - wifi: zd1211rw: remove __nocast from zd_addr_t (bsc#1227149).
  - wifi: brcmfmac: add linefeed at end of file (bsc#1227149).
  - wifi: brcmfmac: allow per-vendor event handling (bsc#1227149).
  - wifi: brcmfmac: move feature overrides before feature_disable
    (bsc#1227149).
  - wifi: brcmfmac: export firmware interface functions
    (bsc#1227149).
  - wifi: rt2x00: simplify rt2x00crypto_rx_insert_iv()
    (bsc#1227149).
  - wifi: mwifiex: Use helpers to check multicast addresses
    (bsc#1227149).
  - wifi: brcmsmac: phy: Remove unreachable code (bsc#1227149).
  - wifi: wilc1000: fix incorrect power down sequence (bsc#1227149).
  - wifi: wilc1000: fix driver_handler when committing initial
    configuration (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wilc1000 (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wl18xx (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for p54spi (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for Broadcom WLAN
    (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wl1251 and wl12xx
    (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wlcore (bsc#1227149).
  - wifi: p54: fix GCC format truncation warning with
    wiphy->fw_version (bsc#1227149).
  - wifi: mwifiex: use cfg80211_ssid_eq() instead of
    mwifiex_ssid_cmp() (bsc#1227149).
  - wifi: rt2x00: remove useless code in
    rt2x00queue_create_tx_descriptor() (bsc#1227149).
  - commit 08ddd32
  - wifi: rt2x00: make watchdog param per device (bsc#1227149).
  - wifi: rt2x00: Simplify bool conversion (bsc#1227149).
  - wifi: mwifiex: mwifiex_process_sleep_confirm_resp(): remove
    unused priv variable (bsc#1227149).
  - wifi: rt2x00: disable RTS threshold for rt2800 by default
    (bsc#1227149).
  - wifi: rt2x00: introduce DMA busy check watchdog for rt2800
    (bsc#1227149).
  - wifi: wilc1000: simplify wilc_scan() (bsc#1227149).
  - wifi: wilc1000: cleanup struct wilc_conn_info (bsc#1227149).
  - wifi: wilc1000: always release SDIO host in wilc_sdio_cmd53()
    (bsc#1227149).
  - wifi: wilc1000: simplify remain on channel support
    (bsc#1227149).
  - wifi: brcmsmac: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - wifi: brcm80211: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: rt2x00: rework MT7620 PA/LNA RF calibration (bsc#1227149).
  - wifi: rt2x00: rework MT7620 channel config function
    (bsc#1227149).
  - commit 055fd52
  - wifi: rt2x00: improve MT7620 register initialization
    (bsc#1227149).
  - wifi: wlcore: main: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wlcore: boot: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wl18xx: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wl1251: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: rt2x00: fix rt2800 watchdog function (bsc#1227149).
  - wifi: brcmfmac: fix format-truncation warnings (bsc#1227149).
  - wifi: hostap: remove unused ioctl function (bsc#1227149).
  - wifi: atmel: remove unused ioctl function (bsc#1227149).
  - wifi: p54: Annotate struct p54_cal_database with __counted_by
    (bsc#1227149).
  - wifi: brcmfmac: fweh: Add __counted_by for struct
    brcmf_fweh_queue_item and use struct_size() (bsc#1227149).
  - wifi: hostap: Add __counted_by for struct prism2_download_data
    and use struct_size() (bsc#1227149).
  - wifi: wfx: implement wfx_remain_on_channel() (bsc#1227149).
  - wifi: wfx: allow to send frames during ROC (bsc#1227149).
  - wifi: wfx: scan_lock is global to the device (bsc#1227149).
  - wifi: wfx: simplify exclusion between scan and Rx filters
    (bsc#1227149).
  - wifi: wfx: introduce hif_scan_uniq() (bsc#1227149).
  - wifi: wfx: move wfx_skb_*() out of the header file
    (bsc#1227149).
  - wifi: wfx: relocate wfx_rate_mask_to_hw() (bsc#1227149).
  - wifi: wfx: fix power_save setting when AP is stopped
    (bsc#1227149).
  - commit 859f128
  - wifi: mwifiex: Replace one-element array with flexible-array
    member in struct mwifiex_ie_types_rxba_sync (bsc#1227149).
  - Refresh
    patches.suse/wifi-mwifiex-Sanity-check-tlv_len-and-tlv_bitmap_len.patch.
  - commit 0e5befb
  - wifi: rt2x00: fix MT7620 low RSSI issue (bsc#1227149).
  - wifi: rt2x00: remove redundant check if u8 array element is
    less than zero (bsc#1227149).
  - wifi: mwifiex: followup PCIE and related cleanups (bsc#1227149).
  - wifi: mwifiex: simplify PCIE write operations (bsc#1227149).
  - wifi: wilc1000: add back-off algorithm to balance tx queue
    packets (bsc#1227149).
  - wifi: mwifiex: use MODULE_FIRMWARE to add firmware files
    metadata (bsc#1227149).
  - wifi: mwifiex: cleanup struct mwifiex_sdio_mpa_rx (bsc#1227149).
  - wifi: brcmfmac: firmware: Annotate struct brcmf_fw_request
    with __counted_by (bsc#1227149).
  - wifi: brcmfmac: Annotate struct brcmf_gscan_config with
    __counted_by (bsc#1227149).
  - wifi: cw1200: Avoid processing an invalid TIM IE (bsc#1227149).
  - wifi: wlcore: sdio: Use module_sdio_driver macro to simplify
    the code (bsc#1227149).
  - wifi: wilc1000: Remove unused declarations (bsc#1227149).
  - wifi: rt2x00: limit MT7620 TX power based on eeprom calibration
    (bsc#1227149).
  - wifi: wfx: Use devm_kmemdup to replace devm_kmalloc + memcpy
    (bsc#1227149).
  - wifi: rsi: rsi_91x_usb_ops: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_usb: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_sdio_ops: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_sdio: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - commit a544c26
  - wifi: rsi: rsi_91x_main: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_mac80211: Remove unnecessary conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_hal: Remove unnecessary conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_debugfs: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_coex: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rt2x00: correct MAC_SYS_CTRL register RX mask in
    R-Calibration (bsc#1227149).
  - wifi: mwifiex: fix comment typos in SDIO module (bsc#1227149).
  - wifi: mwifiex: cleanup adapter data (bsc#1227149).
  - wifi: mwifiex: use is_zero_ether_addr() instead of
    ether_addr_equal() (bsc#1227149).
  - wifi: mwifiex: drop BUG_ON from TX paths (bsc#1227149).
  - wifi: mwifiex: handle possible mwifiex_write_reg() errors
    (bsc#1227149).
  - wifi: mwifiex: handle possible sscanf() errors (bsc#1227149).
  - wifi: mwifiex: cleanup private data structures (bsc#1227149).
  - wlcore: spi: Remove redundant of_match_ptr() (bsc#1227149).
  - wifi: brcmsmac: cleanup SCB-related data types (bsc#1227149).
  - wifi: brcmsmac: remove more unused data types (bsc#1227149).
  - wifi: libertas: prefer kstrtoX() for simple integer conversions
    (bsc#1227149).
  - wifi: libertas: handle possible spu_write_u16() errors
    (bsc#1227149).
  - wifi: libertas: cleanup SDIO reset (bsc#1227149).
  - wifi: libertas: simplify list operations in free_if_spi_card()
    (bsc#1227149).
  - wifi: libertas: use convenient lists to manage SDIO packets
    (bsc#1227149).
  - wifi: libertas: add missing calls to cancel_work_sync()
    (bsc#1227149).
  - wifi: wilc1000: add SPI commands retry mechanism (bsc#1227149).
  - wifi: wilc1000: remove use of has_thrpt_enh3 flag (bsc#1227149).
  - wifi: brcmsmac: remove unused data type (bsc#1227149).
  - wifi: mwifiex: Set WIPHY_FLAG_NETNS_OK flag (bsc#1227149).
  - wifi: mwifiex: prefer strscpy() over strlcpy() (bsc#1227149).
  - wifi: zd1211rw: fix typo "tranmits" (bsc#1227149).
  - wifi: p54: Add missing MODULE_FIRMWARE macro (bsc#1227149).
  - wifi: hostap: fix stringop-truncations GCC warning
    (bsc#1227149).
  - wifi: brcmsmac: fix gnu_printf warnings (bsc#1227149).
  - wifi: brcmfmac: fix gnu_printf warnings (bsc#1227149).
  - wifi: rt2x00: fix the typo in comments (bsc#1227149).
  - wifi: brcmfmac: Detect corner error case earlier with log
    (bsc#1227149).
  - wifi: brcmutil: use helper function pktq_empty() instead of
    open code (bsc#1227149).
  - wifi: add HAS_IOPORT dependencies (bsc#1227149).
  - wifi: wilc1000: Increase ASSOC response buffer (bsc#1227149).
  - wifi: mwifiex: Use list_count_nodes() (bsc#1227149).
  - wifi: mwifiex: Use default @max_active for workqueues
    (bsc#1227149).
  - commit edbabc2
  - xfs: Add cond_resched to block unmap range and reflink remap
    path (bsc#1228211).
  - commit 4c79a42
  - supported.conf: Add support for v4l2-dv-timings
    (jsc#PED-8645)
  - commit 6262df7
  - supported.conf: Add support for v4l2-dv-timings
    (jsc#PED-8644)
  - commit a3622c5
  - netrom: Fix a memory leak in nr_heartbeat_expiry()
    (CVE-2024-41006 bsc#1227862).
  - commit 59ef181
  - arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu (git-fixes)
  - commit 6571948
  - arm64: dts: rockchip: Fix mic-in-differential usage on (git-fixes)
  - commit 67939cb
  - arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc (git-fixes)
  - commit 5ed815a
  - arm64: dts: rockchip: Drop invalid mic-in-differential on (git-fixes)
  - commit af4620a
  - arm64: dts: rockchip: Increase VOP clk rate on RK3328 (git-fixes)
  - commit 0171830
  - arm64: dts: rockchip: Update WIFi/BT related nodes on (git-fixes)
  - commit 2186774
  - arm64: dts: rockchip: Add mdio and ethernet-phy nodes to (git-fixes)
  - commit 7bd1596
  - arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s (git-fixes)
  - commit a5c559a
  - arm64: dts: rockchip: Add sdmmc related properties on (git-fixes)
  - commit 07ed999
  - arm64: dts: rockchip: Add sound-dai-cells for RK3368 (git-fixes)
  - commit 0d2dc44
  - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E (git-fixes)
  - commit 17c17ec
  - arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch (git-fixes)
  - commit ef568ac
  - arm64: dts: rockchip: Rename LED related pinctrl nodes on (git-fixes)
  - commit 3ac3475
  - arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s (git-fixes)
  - commit f0f8ba5
  - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 (git-fixes)
  - commit a564fef
  - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc (git-fixes)
  - commit d7e72e1
  - arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input (git-fixes)
  - commit ca6c1bb
  - arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property (git-fixes)
  - commit a10e3de
  - blacklist.conf: ("arm64: dts: freescale: imx8mm-verdin: Fix GPU speed")
  - commit ea9f475
  - Move upstreamed patches into sorted section
  - commit 0bb0cc8
  - fuse: verify {g,u}id mount options correctly (bsc#1228193).
  - libceph: fix race between delayed_work() and ceph_monc_stop()
    (bsc#1228192).
  - commit 10e7bb9
  - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
    (git-fixes).
  - checkpatch: really skip LONG_LINE_* when LONG_LINE is ignored
    (git-fixes).
  - rtc: interface: Add RTC offset to alarm after fix-up
    (git-fixes).
  - rtc: abx80x: Fix return value of nvmem callback on read
    (git-fixes).
  - rtc: cmos: Fix return value of nvmem callbacks (git-fixes).
  - rtc: isl1208: Fix return value of nvmem callbacks (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix TPU suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix TCLK suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: FIX PWM suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix IRQ suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes
    (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix CANFD5 suffix (git-fixes).
  - pinctrl: freescale: mxs: Fix refcount of child (git-fixes).
  - pinctrl: ti: ti-iodelay: fix possible memory leak when
    pinctrl_enable() fails (git-fixes).
  - pinctrl: single: fix possible memory leak when pinctrl_enable()
    fails (git-fixes).
  - pinctrl: core: fix possible memory leak when pinctrl_enable()
    fails (git-fixes).
  - pinctrl: rockchip: update rk3308 iomux routes (git-fixes).
  - selftests/sigaltstack: Fix ppc64 GCC build (git-fixes).
  - PCI: dw-rockchip: Fix initial PERST# GPIO value (git-fixes).
  - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
    (git-fixes).
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in
    rcar_pcie_wakeup() (git-fixes).
  - PCI: qcom-ep: Disable resources unconditionally during PERST#
    assert (git-fixes).
  - PCI: dwc: Fix index 0 incorrectly being interpreted as a free
    ATU slot (git-fixes).
  - PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup()
    (git-fixes).
  - PCI: endpoint: Clean up error handling in vpci_scan_bus()
    (git-fixes).
  - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features'
    in pci_epf_test_core_init() (git-fixes).
  - PCI: Fix resource double counting on remove & rescan
    (git-fixes).
  - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
    (git-fixes).
  - PCI: Introduce cleanup helpers for device reference counts
    and locks (stable-fixes).
  - commit a7e6cbc

++++ kernel-default:

  - nfs: Block on write congestion (bsc#1218442).
  - commit b7f1cad
  - nfs: Properly initialize server->writeback (bsc#1218442).
  - commit c293976
  - nfs: Drop pointless check from nfs_commit_release_pages()
    (bsc#1218442).
  - commit 20931fe
  - kabi/severities: cleanup and update for WiFi driver entries (bsc#1227149)
  - commit 777b4e0
  - wifi: libertas: Follow renaming of SPI "master" to "controller"
    (bsc#1227149).
  - wifi: cw1200: restore endian swapping (bsc#1227149).
  - wifi: wlcore: sdio: Rate limit wl12xx_sdio_raw_{read,write}()
    failures warns (bsc#1227149).
  - wifi: zd1211rw: silence sparse warnings (bsc#1227149).
  - wifi: rt2x00: silence sparse warnings (bsc#1227149).
  - wifi: brcmsmac: silence sparse warnings (bsc#1227149).
  - wifi: b43: silence sparse warnings (bsc#1227149).
  - wifi: brcmfmac: do not pass hidden SSID attribute as value
    directly (bsc#1227149).
  - wifi: brcmfmac: fweh: Fix boot crash on Raspberry Pi 4
    (bsc#1227149).
  - wifi: wilc1000: remove AKM suite be32 conversion for external
    auth request (bsc#1227149).
  - wifi: wilc1000: add missing read critical sections around vif
    list traversal (bsc#1227149).
  - wifi: wilc1000: fix declarations ordering (bsc#1227149).
  - wifi: wilc1000: use SRCU instead of RCU for vif list traversal
    (bsc#1227149).
  - wifi: wilc1000: split deeply nested RCU list traversal in
    dedicated helper (bsc#1227149).
  - wifi: wilc1000: validate chip id during bus probe (bsc#1227149).
  - wifi: brcmfmac: do not cast hidden SSID attribute value to
    boolean (bsc#1227149).
  - wifi: mwifiex: Refactor 1-element array into flexible array
    in struct mwifiex_ie_types_chan_list_param_set (bsc#1227149).
  - wifi: wilc1000: correct CRC7 calculation (bsc#1227149).
  - wifi: wilc1000: set preamble size to auto as default in
    wilc_init_fw_config() (bsc#1227149).
  - wifi: mwifiex: use kstrtoX_from_user() in debugfs handlers
    (bsc#1227149).
  - wifi: wilc1000: remove setting msg.spi (bsc#1227149).
  - wifi: cw1200: Convert to GPIO descriptors (bsc#1227149).
  - wifi: plfxlc: Drop unused include (bsc#1227149).
  - wifi: mwifiex: Drop unused headers (bsc#1227149).
  - wifi: ti: wlcore: sdio: Drop unused include (bsc#1227149).
  - wifi: cw1200: fix __le16 sparse warnings (bsc#1227149).
  - wifi: rsi: fix restricted __le32 degrades to integer sparse
    warnings (bsc#1227149).
  - wifi: zd1211rw: remove __nocast from zd_addr_t (bsc#1227149).
  - wifi: brcmfmac: add linefeed at end of file (bsc#1227149).
  - wifi: brcmfmac: allow per-vendor event handling (bsc#1227149).
  - wifi: brcmfmac: move feature overrides before feature_disable
    (bsc#1227149).
  - wifi: brcmfmac: export firmware interface functions
    (bsc#1227149).
  - wifi: rt2x00: simplify rt2x00crypto_rx_insert_iv()
    (bsc#1227149).
  - wifi: mwifiex: Use helpers to check multicast addresses
    (bsc#1227149).
  - wifi: brcmsmac: phy: Remove unreachable code (bsc#1227149).
  - wifi: wilc1000: fix incorrect power down sequence (bsc#1227149).
  - wifi: wilc1000: fix driver_handler when committing initial
    configuration (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wilc1000 (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wl18xx (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for p54spi (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for Broadcom WLAN
    (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wl1251 and wl12xx
    (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wlcore (bsc#1227149).
  - wifi: p54: fix GCC format truncation warning with
    wiphy->fw_version (bsc#1227149).
  - wifi: mwifiex: use cfg80211_ssid_eq() instead of
    mwifiex_ssid_cmp() (bsc#1227149).
  - wifi: rt2x00: remove useless code in
    rt2x00queue_create_tx_descriptor() (bsc#1227149).
  - commit 08ddd32
  - wifi: rt2x00: make watchdog param per device (bsc#1227149).
  - wifi: rt2x00: Simplify bool conversion (bsc#1227149).
  - wifi: mwifiex: mwifiex_process_sleep_confirm_resp(): remove
    unused priv variable (bsc#1227149).
  - wifi: rt2x00: disable RTS threshold for rt2800 by default
    (bsc#1227149).
  - wifi: rt2x00: introduce DMA busy check watchdog for rt2800
    (bsc#1227149).
  - wifi: wilc1000: simplify wilc_scan() (bsc#1227149).
  - wifi: wilc1000: cleanup struct wilc_conn_info (bsc#1227149).
  - wifi: wilc1000: always release SDIO host in wilc_sdio_cmd53()
    (bsc#1227149).
  - wifi: wilc1000: simplify remain on channel support
    (bsc#1227149).
  - wifi: brcmsmac: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - wifi: brcm80211: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: rt2x00: rework MT7620 PA/LNA RF calibration (bsc#1227149).
  - wifi: rt2x00: rework MT7620 channel config function
    (bsc#1227149).
  - commit 055fd52
  - wifi: rt2x00: improve MT7620 register initialization
    (bsc#1227149).
  - wifi: wlcore: main: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wlcore: boot: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wl18xx: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: wl1251: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: rt2x00: fix rt2800 watchdog function (bsc#1227149).
  - wifi: brcmfmac: fix format-truncation warnings (bsc#1227149).
  - wifi: hostap: remove unused ioctl function (bsc#1227149).
  - wifi: atmel: remove unused ioctl function (bsc#1227149).
  - wifi: p54: Annotate struct p54_cal_database with __counted_by
    (bsc#1227149).
  - wifi: brcmfmac: fweh: Add __counted_by for struct
    brcmf_fweh_queue_item and use struct_size() (bsc#1227149).
  - wifi: hostap: Add __counted_by for struct prism2_download_data
    and use struct_size() (bsc#1227149).
  - wifi: wfx: implement wfx_remain_on_channel() (bsc#1227149).
  - wifi: wfx: allow to send frames during ROC (bsc#1227149).
  - wifi: wfx: scan_lock is global to the device (bsc#1227149).
  - wifi: wfx: simplify exclusion between scan and Rx filters
    (bsc#1227149).
  - wifi: wfx: introduce hif_scan_uniq() (bsc#1227149).
  - wifi: wfx: move wfx_skb_*() out of the header file
    (bsc#1227149).
  - wifi: wfx: relocate wfx_rate_mask_to_hw() (bsc#1227149).
  - wifi: wfx: fix power_save setting when AP is stopped
    (bsc#1227149).
  - commit 859f128
  - wifi: mwifiex: Replace one-element array with flexible-array
    member in struct mwifiex_ie_types_rxba_sync (bsc#1227149).
  - Refresh
    patches.suse/wifi-mwifiex-Sanity-check-tlv_len-and-tlv_bitmap_len.patch.
  - commit 0e5befb
  - wifi: rt2x00: fix MT7620 low RSSI issue (bsc#1227149).
  - wifi: rt2x00: remove redundant check if u8 array element is
    less than zero (bsc#1227149).
  - wifi: mwifiex: followup PCIE and related cleanups (bsc#1227149).
  - wifi: mwifiex: simplify PCIE write operations (bsc#1227149).
  - wifi: wilc1000: add back-off algorithm to balance tx queue
    packets (bsc#1227149).
  - wifi: mwifiex: use MODULE_FIRMWARE to add firmware files
    metadata (bsc#1227149).
  - wifi: mwifiex: cleanup struct mwifiex_sdio_mpa_rx (bsc#1227149).
  - wifi: brcmfmac: firmware: Annotate struct brcmf_fw_request
    with __counted_by (bsc#1227149).
  - wifi: brcmfmac: Annotate struct brcmf_gscan_config with
    __counted_by (bsc#1227149).
  - wifi: cw1200: Avoid processing an invalid TIM IE (bsc#1227149).
  - wifi: wlcore: sdio: Use module_sdio_driver macro to simplify
    the code (bsc#1227149).
  - wifi: wilc1000: Remove unused declarations (bsc#1227149).
  - wifi: rt2x00: limit MT7620 TX power based on eeprom calibration
    (bsc#1227149).
  - wifi: wfx: Use devm_kmemdup to replace devm_kmalloc + memcpy
    (bsc#1227149).
  - wifi: rsi: rsi_91x_usb_ops: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_usb: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_sdio_ops: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_sdio: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - commit a544c26
  - wifi: rsi: rsi_91x_main: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_mac80211: Remove unnecessary conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_hal: Remove unnecessary conversions
    (bsc#1227149).
  - wifi: rsi: rsi_91x_debugfs: Remove unnecessary (void*)
    conversions (bsc#1227149).
  - wifi: rsi: rsi_91x_coex: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: rt2x00: correct MAC_SYS_CTRL register RX mask in
    R-Calibration (bsc#1227149).
  - wifi: mwifiex: fix comment typos in SDIO module (bsc#1227149).
  - wifi: mwifiex: cleanup adapter data (bsc#1227149).
  - wifi: mwifiex: use is_zero_ether_addr() instead of
    ether_addr_equal() (bsc#1227149).
  - wifi: mwifiex: drop BUG_ON from TX paths (bsc#1227149).
  - wifi: mwifiex: handle possible mwifiex_write_reg() errors
    (bsc#1227149).
  - wifi: mwifiex: handle possible sscanf() errors (bsc#1227149).
  - wifi: mwifiex: cleanup private data structures (bsc#1227149).
  - wlcore: spi: Remove redundant of_match_ptr() (bsc#1227149).
  - wifi: brcmsmac: cleanup SCB-related data types (bsc#1227149).
  - wifi: brcmsmac: remove more unused data types (bsc#1227149).
  - wifi: libertas: prefer kstrtoX() for simple integer conversions
    (bsc#1227149).
  - wifi: libertas: handle possible spu_write_u16() errors
    (bsc#1227149).
  - wifi: libertas: cleanup SDIO reset (bsc#1227149).
  - wifi: libertas: simplify list operations in free_if_spi_card()
    (bsc#1227149).
  - wifi: libertas: use convenient lists to manage SDIO packets
    (bsc#1227149).
  - wifi: libertas: add missing calls to cancel_work_sync()
    (bsc#1227149).
  - wifi: wilc1000: add SPI commands retry mechanism (bsc#1227149).
  - wifi: wilc1000: remove use of has_thrpt_enh3 flag (bsc#1227149).
  - wifi: brcmsmac: remove unused data type (bsc#1227149).
  - wifi: mwifiex: Set WIPHY_FLAG_NETNS_OK flag (bsc#1227149).
  - wifi: mwifiex: prefer strscpy() over strlcpy() (bsc#1227149).
  - wifi: zd1211rw: fix typo "tranmits" (bsc#1227149).
  - wifi: p54: Add missing MODULE_FIRMWARE macro (bsc#1227149).
  - wifi: hostap: fix stringop-truncations GCC warning
    (bsc#1227149).
  - wifi: brcmsmac: fix gnu_printf warnings (bsc#1227149).
  - wifi: brcmfmac: fix gnu_printf warnings (bsc#1227149).
  - wifi: rt2x00: fix the typo in comments (bsc#1227149).
  - wifi: brcmfmac: Detect corner error case earlier with log
    (bsc#1227149).
  - wifi: brcmutil: use helper function pktq_empty() instead of
    open code (bsc#1227149).
  - wifi: add HAS_IOPORT dependencies (bsc#1227149).
  - wifi: wilc1000: Increase ASSOC response buffer (bsc#1227149).
  - wifi: mwifiex: Use list_count_nodes() (bsc#1227149).
  - wifi: mwifiex: Use default @max_active for workqueues
    (bsc#1227149).
  - commit edbabc2
  - xfs: Add cond_resched to block unmap range and reflink remap
    path (bsc#1228211).
  - commit 4c79a42
  - supported.conf: Add support for v4l2-dv-timings
    (jsc#PED-8645)
  - commit 6262df7
  - supported.conf: Add support for v4l2-dv-timings
    (jsc#PED-8644)
  - commit a3622c5
  - netrom: Fix a memory leak in nr_heartbeat_expiry()
    (CVE-2024-41006 bsc#1227862).
  - commit 59ef181
  - arm64: dts: rockchip: Add missing power-domains for rk356x vop_mmu (git-fixes)
  - commit 6571948
  - arm64: dts: rockchip: Fix mic-in-differential usage on (git-fixes)
  - commit 67939cb
  - arm64: dts: rockchip: Fix mic-in-differential usage on rk3566-roc-pc (git-fixes)
  - commit 5ed815a
  - arm64: dts: rockchip: Drop invalid mic-in-differential on (git-fixes)
  - commit af4620a
  - arm64: dts: rockchip: Increase VOP clk rate on RK3328 (git-fixes)
  - commit 0171830
  - arm64: dts: rockchip: Update WIFi/BT related nodes on (git-fixes)
  - commit 2186774
  - arm64: dts: rockchip: Add mdio and ethernet-phy nodes to (git-fixes)
  - commit 7bd1596
  - arm64: dts: rockchip: Add pinctrl for UART0 to rk3308-rock-pi-s (git-fixes)
  - commit a5c559a
  - arm64: dts: rockchip: Add sdmmc related properties on (git-fixes)
  - commit 07ed999
  - arm64: dts: rockchip: Add sound-dai-cells for RK3368 (git-fixes)
  - commit 0d2dc44
  - arm64: dts: rockchip: fix PMIC interrupt pin on ROCK Pi E (git-fixes)
  - commit 17c17ec
  - arm64: dts: rockchip: Fix the value of `dlg,jack-det-rate` mismatch (git-fixes)
  - commit ef568ac
  - arm64: dts: rockchip: Rename LED related pinctrl nodes on (git-fixes)
  - commit 3ac3475
  - arm64: dts: rockchip: Fix SD NAND and eMMC init on rk3308-rock-pi-s (git-fixes)
  - commit f0f8ba5
  - arm64: dts: rockchip: Fix the DCDC_REG2 minimum voltage on Quartz64 (git-fixes)
  - commit a564fef
  - arm64: dts: imx8qm-mek: fix gpio number for reg_usdhc2_vmmc (git-fixes)
  - commit d7e72e1
  - arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input (git-fixes)
  - commit ca6c1bb
  - arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property (git-fixes)
  - commit a10e3de
  - blacklist.conf: ("arm64: dts: freescale: imx8mm-verdin: Fix GPU speed")
  - commit ea9f475
  - Move upstreamed patches into sorted section
  - commit 0bb0cc8
  - fuse: verify {g,u}id mount options correctly (bsc#1228193).
  - libceph: fix race between delayed_work() and ceph_monc_stop()
    (bsc#1228192).
  - commit 10e7bb9
  - nilfs2: avoid undefined behavior in nilfs_cnt32_ge macro
    (git-fixes).
  - checkpatch: really skip LONG_LINE_* when LONG_LINE is ignored
    (git-fixes).
  - rtc: interface: Add RTC offset to alarm after fix-up
    (git-fixes).
  - rtc: abx80x: Fix return value of nvmem callback on read
    (git-fixes).
  - rtc: cmos: Fix return value of nvmem callbacks (git-fixes).
  - rtc: isl1208: Fix return value of nvmem callbacks (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix TPU suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix TCLK suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: FIX PWM suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix IRQ suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF3 suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix (H)SCIF1 suffixes (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix FXR_TXEN[AB] suffixes
    (git-fixes).
  - pinctrl: renesas: r8a779g0: Fix CANFD5 suffix (git-fixes).
  - pinctrl: freescale: mxs: Fix refcount of child (git-fixes).
  - pinctrl: ti: ti-iodelay: fix possible memory leak when
    pinctrl_enable() fails (git-fixes).
  - pinctrl: single: fix possible memory leak when pinctrl_enable()
    fails (git-fixes).
  - pinctrl: core: fix possible memory leak when pinctrl_enable()
    fails (git-fixes).
  - pinctrl: rockchip: update rk3308 iomux routes (git-fixes).
  - selftests/sigaltstack: Fix ppc64 GCC build (git-fixes).
  - PCI: dw-rockchip: Fix initial PERST# GPIO value (git-fixes).
  - PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
    (git-fixes).
  - PCI: rcar: Demote WARN() to dev_warn_ratelimited() in
    rcar_pcie_wakeup() (git-fixes).
  - PCI: qcom-ep: Disable resources unconditionally during PERST#
    assert (git-fixes).
  - PCI: dwc: Fix index 0 incorrectly being interpreted as a free
    ATU slot (git-fixes).
  - PCI: endpoint: Fix error handling in epf_ntb_epc_cleanup()
    (git-fixes).
  - PCI: endpoint: Clean up error handling in vpci_scan_bus()
    (git-fixes).
  - PCI: endpoint: pci-epf-test: Make use of cached 'epc_features'
    in pci_epf_test_core_init() (git-fixes).
  - PCI: Fix resource double counting on remove & rescan
    (git-fixes).
  - PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
    (git-fixes).
  - PCI: Introduce cleanup helpers for device reference counts
    and locks (stable-fixes).
  - commit a7e6cbc

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ openssl-3:

  - Build with no-afalgeng [bsc#1226463]
  - Security fix: [bsc#1227138, CVE-2024-5535]
    * SSL_select_next_proto buffer overread
    * Add openssl-CVE-2024-5535.patch

++++ orc:

  - Add patch from upstream to fix a stack-based buffer overflow
    in the Orc compiler when formatting error messages (bsc#1228184,
    CVE-2024-40897):
    * 0001-Use-vasprintf-if-available-for-error-messages-and.patch

++++ orc:

  - Add patch from upstream to fix a stack-based buffer overflow
    in the Orc compiler when formatting error messages (bsc#1228184,
    CVE-2024-40897):
    * 0001-Use-vasprintf-if-available-for-error-messages-and.patch

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311-core:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ systemd:

  - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091)
    Otherwise pesign-obs-integration ends up re-packaging systemd with all macros
    inside comments unescaped leading to unpredictable behavior. Now why rpm
    expands rpm macros inside comments is the question...

++++ systemd:

  - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091)
    Otherwise pesign-obs-integration ends up re-packaging systemd with all macros
    inside comments unescaped leading to unpredictable behavior. Now why rpm
    expands rpm macros inside comments is the question...

++++ systemd:

  - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091)
    Otherwise pesign-obs-integration ends up re-packaging systemd with all macros
    inside comments unescaped leading to unpredictable behavior. Now why rpm
    expands rpm macros inside comments is the question...

++++ systemd:

  - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091)
    Otherwise pesign-obs-integration ends up re-packaging systemd with all macros
    inside comments unescaped leading to unpredictable behavior. Now why rpm
    expands rpm macros inside comments is the question...

++++ systemd:

  - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091)
    Otherwise pesign-obs-integration ends up re-packaging systemd with all macros
    inside comments unescaped leading to unpredictable behavior. Now why rpm
    expands rpm macros inside comments is the question...

++++ systemd:

  - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091)
    Otherwise pesign-obs-integration ends up re-packaging systemd with all macros
    inside comments unescaped leading to unpredictable behavior. Now why rpm
    expands rpm macros inside comments is the question...

++++ systemd:

  - Don't mention any rpm macros inside comments, even if escaped (bsc#1228091)
    Otherwise pesign-obs-integration ends up re-packaging systemd with all macros
    inside comments unescaped leading to unpredictable behavior. Now why rpm
    expands rpm macros inside comments is the question...

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ python311:

  - Remove %suse_update_desktop_file macro as it is not useful any
    more.

++++ runc:

    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.13. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.13>.
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a
    performance issue when running lots of containers, caused by systemd getting
    too many mount notifications. bsc#1214960
    + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.13. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.12>.
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a
    performance issue when running lots of containers, caused by systemd getting
    too many mount notifications. bsc#1214960
    + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.13. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.13>.
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a
    performance issue when running lots of containers, caused by systemd getting
    too many mount notifications. bsc#1214960
    + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.13. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.13>.
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a
    performance issue when running lots of containers, caused by systemd getting
    too many mount notifications. bsc#1214960
    + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

++++ runc:

    [ This was only ever released for SLES and Leap. ]
  - Update to runc v1.1.13. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.1.13>.
  - Rebase patches:
    * 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
    * 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
    * 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - Backport <https://github.com/opencontainers/runc/pull/3931> to fix a
    performance issue when running lots of containers, caused by systemd getting
    too many mount notifications. bsc#1214960
    + 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

------------------------------------------------------------------
------------------  2024-7-21  -  Jul 21 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.0.25 → 10.0.26

++++ python-kiwi:

  - Bump version: 10.0.25 → 10.0.26

++++ python-kiwi:

  - Bump version: 10.0.25 → 10.0.26

------------------------------------------------------------------
------------------  2024-7-20  -  Jul 20 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy
    Book Pro 360 (stable-fixes).
  - ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
    (stable-fixes).
  - ASoC: SOF: ipc4-topology: Use correct queue_id for requesting
    input pin format (stable-fixes).
  - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
    (stable-fixes).
  - commit be4d8bf
  - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
    (stable-fixes).
  - Refresh
    patches.suse/eeprom-at24-fix-memory-corruption-race-condition.patch.
  - commit 82fbd42
  - Input: elan_i2c - do not leave interrupt disabled on suspend
    failure (git-fixes).
  - Input: qt1050 - handle CHIP_ID reading error (git-fixes).
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID
    (git-fixes).
  - iio: frequency: adrf6780: rm clk provider include (git-fixes).
  - iio: Fix the sorting functionality in
    iio_gts_build_avail_time_table (git-fixes).
  - eeprom: digsy_mtc: Fix 93xx46 driver probe failure (git-fixes).
  - Revert "usb: musb: da8xx: Set phy in OTG mode by default"
    (stable-fixes).
  - ALSA: seq: ump: Skip useless ports for static blocks
    (git-fixes).
  - ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
    (git-fixes).
  - ASoC: amd: Adjust error handling in case of absent codec device
    (git-fixes).
  - ASoC: max98088: Check for clk_prepare_enable() error
    (git-fixes).
  - ASoC: qcom: Adjust issues in case of DT error in
    asoc_qcom_lpass_cpu_platform_probe() (git-fixes).
  - ASoC: cs35l56: Accept values greater than 0 as IRQ numbers
    (git-fixes).
  - ASoc: tas2781: Enable RCA-based playback without DSP firmware
    download (git-fixes).
  - crypto: qat - extend scope of lock in
    adf_cfg_add_key_value_param() (git-fixes).
  - hwrng: core - Fix wrong quality calculation at hw rng
    registration (git-fixes).
  - crypto: ccp - Fix null pointer dereference in
    __sev_snp_shutdown_locked (git-fixes).
  - crypto: ecdsa - Fix the public key format description
    (git-fixes).
  - hwrng: amd - Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - commit 7fcc337

++++ kernel-default:

  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy
    Book Pro 360 (stable-fixes).
  - ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
    (stable-fixes).
  - ASoC: SOF: ipc4-topology: Use correct queue_id for requesting
    input pin format (stable-fixes).
  - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
    (stable-fixes).
  - commit be4d8bf
  - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
    (stable-fixes).
  - Refresh
    patches.suse/eeprom-at24-fix-memory-corruption-race-condition.patch.
  - commit 82fbd42
  - Input: elan_i2c - do not leave interrupt disabled on suspend
    failure (git-fixes).
  - Input: qt1050 - handle CHIP_ID reading error (git-fixes).
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID
    (git-fixes).
  - iio: frequency: adrf6780: rm clk provider include (git-fixes).
  - iio: Fix the sorting functionality in
    iio_gts_build_avail_time_table (git-fixes).
  - eeprom: digsy_mtc: Fix 93xx46 driver probe failure (git-fixes).
  - Revert "usb: musb: da8xx: Set phy in OTG mode by default"
    (stable-fixes).
  - ALSA: seq: ump: Skip useless ports for static blocks
    (git-fixes).
  - ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
    (git-fixes).
  - ASoC: amd: Adjust error handling in case of absent codec device
    (git-fixes).
  - ASoC: max98088: Check for clk_prepare_enable() error
    (git-fixes).
  - ASoC: qcom: Adjust issues in case of DT error in
    asoc_qcom_lpass_cpu_platform_probe() (git-fixes).
  - ASoC: cs35l56: Accept values greater than 0 as IRQ numbers
    (git-fixes).
  - ASoc: tas2781: Enable RCA-based playback without DSP firmware
    download (git-fixes).
  - crypto: qat - extend scope of lock in
    adf_cfg_add_key_value_param() (git-fixes).
  - hwrng: core - Fix wrong quality calculation at hw rng
    registration (git-fixes).
  - crypto: ccp - Fix null pointer dereference in
    __sev_snp_shutdown_locked (git-fixes).
  - crypto: ecdsa - Fix the public key format description
    (git-fixes).
  - hwrng: amd - Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - commit 7fcc337

++++ kernel-default:

  - ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy
    Book Pro 360 (stable-fixes).
  - ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
    (stable-fixes).
  - ASoC: SOF: ipc4-topology: Use correct queue_id for requesting
    input pin format (stable-fixes).
  - ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
    (stable-fixes).
  - commit be4d8bf
  - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case
    (stable-fixes).
  - Refresh
    patches.suse/eeprom-at24-fix-memory-corruption-race-condition.patch.
  - commit 82fbd42
  - Input: elan_i2c - do not leave interrupt disabled on suspend
    failure (git-fixes).
  - Input: qt1050 - handle CHIP_ID reading error (git-fixes).
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc RPM master ID
    (git-fixes).
  - iio: frequency: adrf6780: rm clk provider include (git-fixes).
  - iio: Fix the sorting functionality in
    iio_gts_build_avail_time_table (git-fixes).
  - eeprom: digsy_mtc: Fix 93xx46 driver probe failure (git-fixes).
  - Revert "usb: musb: da8xx: Set phy in OTG mode by default"
    (stable-fixes).
  - ALSA: seq: ump: Skip useless ports for static blocks
    (git-fixes).
  - ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value
    (git-fixes).
  - ASoC: amd: Adjust error handling in case of absent codec device
    (git-fixes).
  - ASoC: max98088: Check for clk_prepare_enable() error
    (git-fixes).
  - ASoC: qcom: Adjust issues in case of DT error in
    asoc_qcom_lpass_cpu_platform_probe() (git-fixes).
  - ASoC: cs35l56: Accept values greater than 0 as IRQ numbers
    (git-fixes).
  - ASoc: tas2781: Enable RCA-based playback without DSP firmware
    download (git-fixes).
  - crypto: qat - extend scope of lock in
    adf_cfg_add_key_value_param() (git-fixes).
  - hwrng: core - Fix wrong quality calculation at hw rng
    registration (git-fixes).
  - crypto: ccp - Fix null pointer dereference in
    __sev_snp_shutdown_locked (git-fixes).
  - crypto: ecdsa - Fix the public key format description
    (git-fixes).
  - hwrng: amd - Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - commit 7fcc337

------------------------------------------------------------------
------------------  2024-7-19  -  Jul 19 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Revise scripts_testing.rst
  - Revise schema_extensions.rst

++++ python-kiwi:

  - Revise scripts_testing.rst
  - Revise schema_extensions.rst

++++ python-kiwi:

  - Revise scripts_testing.rst
  - Revise schema_extensions.rst

++++ kernel-default:

  - Add Alt-commit for amdgpu patch (git-fixes)
  - commit 7fbd801
  - gve: Clear napi->skb before dev_kfree_skb_any() (CVE-2024-40937
    bsc#1227836).
  - net: hns3: fix kernel crash problem in concurrent scenario
    (CVE-2024-39507 bsc#1227730).
  - net/mlx5: Fix tainted pointer delete is case of flow rules
    creation fail (CVE-2024-40940 bsc#1227800).
  - commit 8d4dcfb
  - net: ethtool: fix the error condition in
    ethtool_get_phy_stats_ethtool() (CVE-2024-40928 bsc#1227788).
  - commit be667d4
  - btrfs: zoned: fix lock ordering in btrfs_zone_activate()
    (bsc#1223731 CVE-2024-26944).
  - commit c6e27f8
  - vmxnet3: disable rx data ring on dma allocation failure
    (CVE-2024-40923 bsc#1227786).
  - commit 3828e87
  - mptcp: ensure snd_una is properly initialized on connect
    (CVE-2024-40931 bsc#1227780).
  - commit 60fd0e2
  - bnxt_en: Adjust logging of firmware messages in case of released
    token in __hwrm_send() (CVE-2024-40919 bsc#1227779).
  - commit c060c32
  - btrfs: zoned: allocate dummy checksums for zoned NODATASUM
    writes (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: fix use-after-free in do_zone_finish()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: fix chunk map leak when loading block group zone
    info (bsc#1223731 CVE-2024-26944).
  - btrfs: fix unbalanced unlock of mapping_tree_lock (bsc#1223731
    CVE-2024-26944).
  - btrfs: remove stripe size local variable from
    insert_dev_extents() (bsc#1223731 CVE-2024-26944).
  - btrfs: use a dedicated data structure for chunk maps
    (bsc#1223731 CVE-2024-26944).
  - commit 201e016
  - btrfs: zoned: wait for data BG to be finished on direct IO
    allocation (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: drop no longer valid write pointer check
    (bsc#1223731 CVE-2024-26944).
  - commit a5e78f9
  - btrfs: do not require EXTENT_NOWAIT for btrfs_redirty_list_add()
    (bsc#1223731 CVE-2024-26944).
  - commit f638537
  - drm/mediatek: Add DRM_MODE_ROTATE_0 to rotation property
    (git-fixes).
  - commit f21db33
  - btrfs: drop gfp from parameter extent state helpers (bsc#1223731
    CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - Refresh
    patches.suse/btrfs-open-code-trivial-btrfs_add_excluded_extent.patch.
  - commit 2097a9c
  - drm/fbdev-dma: Fix framebuffer mode for big endian devices
    (git-fixes).
  - drm/msm/mdp5: Remove MDP_CAP_SRC_SPLIT from msm8x53_config
    (git-fixes).
  - drm/msm/dpu: drop validity checks for clear_pending_flush()
    ctl op (git-fixes).
  - drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC (git-fixes).
  - USB: serial: option: add Rolling RW350-GL variants
    (stable-fixes).
  - USB: serial: option: add support for Foxconn T99W651
    (stable-fixes).
  - USB: serial: option: add Netprisma LCUK54 series modules
    (stable-fixes).
  - usb: gadget: configfs: Prevent OOB read/write in
    usb_string_copy() (stable-fixes).
  - usb: dwc3: pci: add support for the Intel Panther Lake
    (stable-fixes).
  - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
    (stable-fixes).
  - xhci: always resume roothubs if xHC was reset during resume
    (stable-fixes).
  - USB: serial: option: add Telit generic core-dump composition
    (stable-fixes).
  - USB: serial: option: add Fibocom FM350-GL (stable-fixes).
  - USB: serial: option: add Telit FN912 rmnet compositions
    (stable-fixes).
  - commit f9ac994
  - drm/msm/dpu: fix encoder irq wait skip (git-fixes).
  - drm/dp_mst: Fix all mstb marked as not probed after
    suspend/resume (git-fixes).
  - drm/panfrost: Mark simple_ondemand governor as softdep
    (git-fixes).
  - drm/lima: Mark simple_ondemand governor as softdep (git-fixes).
  - drm/mediatek: Remove less-than-zero comparison of an unsigned
    value (git-fixes).
  - drm/mediatek: Fix bit depth overwritten for mtk_ovl_set
    bit_depth() (git-fixes).
  - drm/mediatek: Support DRM plane alpha in Mixer (git-fixes).
  - drm/mediatek: Support DRM plane alpha in OVL (git-fixes).
  - drm/mediatek: Support RGBA8888 and RGBX8888 in OVL on MT8195
    (git-fixes).
  - drm/mediatek: Set DRM mode configs accordingly (git-fixes).
  - drm/mediatek: Add OVL compatible name for MT8195 (git-fixes).
  - drm/mediatek: Turn off the layers with zero width or height
    (git-fixes).
  - drm/mediatek: Fix destination alpha error in OVL (git-fixes).
  - drm/mediatek: Fix XRGB setting error in Mixer (git-fixes).
  - drm/mediatek: Fix XRGB setting error in OVL (git-fixes).
  - drm/mediatek: Use 8-bit alpha in ETHDR (git-fixes).
  - drm/mediatek: Add missing plane settings when async update
    (git-fixes).
  - drm/etnaviv: fix DMA direction handling for cached RW buffers
    (git-fixes).
  - Revert "drm/bridge: tc358767: Set default CLRSIPO count"
    (stable-fixes).
  - drm/qxl: Add check for drm_cvt_mode (git-fixes).
  - drm: zynqmp_kms: Fix AUX bus not getting unregistered
    (git-fixes).
  - drm: zynqmp_dpsub: Fix an error handling path in
    zynqmp_dpsub_probe() (git-fixes).
  - drm/bridge: samsung-dsim: Set P divider based on min/max of
    fin pll (git-fixes).
  - drm/bridge: it6505: fix hibernate to resume no display issue
    (git-fixes).
  - drm/panel: ilitek-ili9882t: Check for errors on the NOP in
    prepare() (git-fixes).
  - drm/panel: ilitek-ili9882t: If prepare fails, disable GPIO
    before regulators (git-fixes).
  - drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in
    prepare() (git-fixes).
  - drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO
    before regulators (git-fixes).
  - drm/panel: himax-hx8394: Handle errors from
    mipi_dsi_dcs_set_display_on() better (git-fixes).
  - drm/mgag200: Bind I2C lifetime to DRM device (git-fixes).
  - drm/mgag200: Set DDC timeout in milliseconds (git-fixes).
  - drm/mipi-dsi: Fix theoretical int overflow in
    mipi_dsi_generic_write_seq() (git-fixes).
  - drm/mipi-dsi: Fix theoretical int overflow in
    mipi_dsi_dcs_write_seq() (git-fixes).
  - commit 6fb58b4
  - drm/udl: Remove DRM_CONNECTOR_POLL_HPD (git-fixes).
  - drm/arm/komeda: Fix komeda probe failing if there are no links
    in the secondary pipeline (git-fixes).
  - drm/rockchip: vop2: Fix the port mux of VP2 (git-fixes).
  - drm/amd/display: Move 'struct scaler_data' off stack
    (git-fixes).
  - drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1 (git-fixes).
  - drm/amdgpu: Check if NBIO funcs are NULL in
    amdgpu_device_baco_exit (git-fixes).
  - drm/amdgpu: Fix memory range calculation (git-fixes).
  - drm/amd/pm: Fix aldebaran pcie speed reporting (git-fixes).
  - drm/amd/pm: remove logically dead code for renoir (git-fixes).
  - drm/amdkfd: Fix CU Masking for GFX 9.4.3 (git-fixes).
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
    (git-fixes).
  - commit ba21687
  - Add Alt-commit to AMDGPU patches from 6.11-rc1
  - commit f4ae72a
  - PCI/ASPM: Update save_state when configuration changes (bsc#1226915)
  - commit 5192284
  - block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
    (bsc#1226213).
  - commit 6855b2f
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487 bsc#1227573)
  - commit 1c7a482
  - tls: get psock ref after taking rxlock to avoid leak (CVE-2024-35908 bsc#1224490)
  - commit b0d23d0
  - netfilter: nf_tables: flush pending destroy work before exit_net release (CVE-2024-35899 bsc#1224499)
  - commit 8a86808

++++ kernel-default:

  - Add Alt-commit for amdgpu patch (git-fixes)
  - commit 7fbd801
  - gve: Clear napi->skb before dev_kfree_skb_any() (CVE-2024-40937
    bsc#1227836).
  - net: hns3: fix kernel crash problem in concurrent scenario
    (CVE-2024-39507 bsc#1227730).
  - net/mlx5: Fix tainted pointer delete is case of flow rules
    creation fail (CVE-2024-40940 bsc#1227800).
  - commit 8d4dcfb
  - net: ethtool: fix the error condition in
    ethtool_get_phy_stats_ethtool() (CVE-2024-40928 bsc#1227788).
  - commit be667d4
  - btrfs: zoned: fix lock ordering in btrfs_zone_activate()
    (bsc#1223731 CVE-2024-26944).
  - commit c6e27f8
  - vmxnet3: disable rx data ring on dma allocation failure
    (CVE-2024-40923 bsc#1227786).
  - commit 3828e87
  - mptcp: ensure snd_una is properly initialized on connect
    (CVE-2024-40931 bsc#1227780).
  - commit 60fd0e2
  - bnxt_en: Adjust logging of firmware messages in case of released
    token in __hwrm_send() (CVE-2024-40919 bsc#1227779).
  - commit c060c32
  - btrfs: zoned: allocate dummy checksums for zoned NODATASUM
    writes (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: fix use-after-free in do_zone_finish()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: fix chunk map leak when loading block group zone
    info (bsc#1223731 CVE-2024-26944).
  - btrfs: fix unbalanced unlock of mapping_tree_lock (bsc#1223731
    CVE-2024-26944).
  - btrfs: remove stripe size local variable from
    insert_dev_extents() (bsc#1223731 CVE-2024-26944).
  - btrfs: use a dedicated data structure for chunk maps
    (bsc#1223731 CVE-2024-26944).
  - commit 201e016
  - btrfs: zoned: wait for data BG to be finished on direct IO
    allocation (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: drop no longer valid write pointer check
    (bsc#1223731 CVE-2024-26944).
  - commit a5e78f9
  - btrfs: do not require EXTENT_NOWAIT for btrfs_redirty_list_add()
    (bsc#1223731 CVE-2024-26944).
  - commit f638537
  - drm/mediatek: Add DRM_MODE_ROTATE_0 to rotation property
    (git-fixes).
  - commit f21db33
  - btrfs: drop gfp from parameter extent state helpers (bsc#1223731
    CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - Refresh
    patches.suse/btrfs-open-code-trivial-btrfs_add_excluded_extent.patch.
  - commit 2097a9c
  - drm/fbdev-dma: Fix framebuffer mode for big endian devices
    (git-fixes).
  - drm/msm/mdp5: Remove MDP_CAP_SRC_SPLIT from msm8x53_config
    (git-fixes).
  - drm/msm/dpu: drop validity checks for clear_pending_flush()
    ctl op (git-fixes).
  - drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC (git-fixes).
  - USB: serial: option: add Rolling RW350-GL variants
    (stable-fixes).
  - USB: serial: option: add support for Foxconn T99W651
    (stable-fixes).
  - USB: serial: option: add Netprisma LCUK54 series modules
    (stable-fixes).
  - usb: gadget: configfs: Prevent OOB read/write in
    usb_string_copy() (stable-fixes).
  - usb: dwc3: pci: add support for the Intel Panther Lake
    (stable-fixes).
  - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
    (stable-fixes).
  - xhci: always resume roothubs if xHC was reset during resume
    (stable-fixes).
  - USB: serial: option: add Telit generic core-dump composition
    (stable-fixes).
  - USB: serial: option: add Fibocom FM350-GL (stable-fixes).
  - USB: serial: option: add Telit FN912 rmnet compositions
    (stable-fixes).
  - commit f9ac994
  - drm/msm/dpu: fix encoder irq wait skip (git-fixes).
  - drm/dp_mst: Fix all mstb marked as not probed after
    suspend/resume (git-fixes).
  - drm/panfrost: Mark simple_ondemand governor as softdep
    (git-fixes).
  - drm/lima: Mark simple_ondemand governor as softdep (git-fixes).
  - drm/mediatek: Remove less-than-zero comparison of an unsigned
    value (git-fixes).
  - drm/mediatek: Fix bit depth overwritten for mtk_ovl_set
    bit_depth() (git-fixes).
  - drm/mediatek: Support DRM plane alpha in Mixer (git-fixes).
  - drm/mediatek: Support DRM plane alpha in OVL (git-fixes).
  - drm/mediatek: Support RGBA8888 and RGBX8888 in OVL on MT8195
    (git-fixes).
  - drm/mediatek: Set DRM mode configs accordingly (git-fixes).
  - drm/mediatek: Add OVL compatible name for MT8195 (git-fixes).
  - drm/mediatek: Turn off the layers with zero width or height
    (git-fixes).
  - drm/mediatek: Fix destination alpha error in OVL (git-fixes).
  - drm/mediatek: Fix XRGB setting error in Mixer (git-fixes).
  - drm/mediatek: Fix XRGB setting error in OVL (git-fixes).
  - drm/mediatek: Use 8-bit alpha in ETHDR (git-fixes).
  - drm/mediatek: Add missing plane settings when async update
    (git-fixes).
  - drm/etnaviv: fix DMA direction handling for cached RW buffers
    (git-fixes).
  - Revert "drm/bridge: tc358767: Set default CLRSIPO count"
    (stable-fixes).
  - drm/qxl: Add check for drm_cvt_mode (git-fixes).
  - drm: zynqmp_kms: Fix AUX bus not getting unregistered
    (git-fixes).
  - drm: zynqmp_dpsub: Fix an error handling path in
    zynqmp_dpsub_probe() (git-fixes).
  - drm/bridge: samsung-dsim: Set P divider based on min/max of
    fin pll (git-fixes).
  - drm/bridge: it6505: fix hibernate to resume no display issue
    (git-fixes).
  - drm/panel: ilitek-ili9882t: Check for errors on the NOP in
    prepare() (git-fixes).
  - drm/panel: ilitek-ili9882t: If prepare fails, disable GPIO
    before regulators (git-fixes).
  - drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in
    prepare() (git-fixes).
  - drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO
    before regulators (git-fixes).
  - drm/panel: himax-hx8394: Handle errors from
    mipi_dsi_dcs_set_display_on() better (git-fixes).
  - drm/mgag200: Bind I2C lifetime to DRM device (git-fixes).
  - drm/mgag200: Set DDC timeout in milliseconds (git-fixes).
  - drm/mipi-dsi: Fix theoretical int overflow in
    mipi_dsi_generic_write_seq() (git-fixes).
  - drm/mipi-dsi: Fix theoretical int overflow in
    mipi_dsi_dcs_write_seq() (git-fixes).
  - commit 6fb58b4
  - drm/udl: Remove DRM_CONNECTOR_POLL_HPD (git-fixes).
  - drm/arm/komeda: Fix komeda probe failing if there are no links
    in the secondary pipeline (git-fixes).
  - drm/rockchip: vop2: Fix the port mux of VP2 (git-fixes).
  - drm/amd/display: Move 'struct scaler_data' off stack
    (git-fixes).
  - drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1 (git-fixes).
  - drm/amdgpu: Check if NBIO funcs are NULL in
    amdgpu_device_baco_exit (git-fixes).
  - drm/amdgpu: Fix memory range calculation (git-fixes).
  - drm/amd/pm: Fix aldebaran pcie speed reporting (git-fixes).
  - drm/amd/pm: remove logically dead code for renoir (git-fixes).
  - drm/amdkfd: Fix CU Masking for GFX 9.4.3 (git-fixes).
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
    (git-fixes).
  - commit ba21687
  - Add Alt-commit to AMDGPU patches from 6.11-rc1
  - commit f4ae72a
  - PCI/ASPM: Update save_state when configuration changes (bsc#1226915)
  - commit 5192284
  - block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
    (bsc#1226213).
  - commit 6855b2f
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487 bsc#1227573)
  - commit 1c7a482
  - tls: get psock ref after taking rxlock to avoid leak (CVE-2024-35908 bsc#1224490)
  - commit b0d23d0
  - netfilter: nf_tables: flush pending destroy work before exit_net release (CVE-2024-35899 bsc#1224499)
  - commit 8a86808

++++ kernel-default:

  - Add Alt-commit for amdgpu patch (git-fixes)
  - commit 7fbd801
  - gve: Clear napi->skb before dev_kfree_skb_any() (CVE-2024-40937
    bsc#1227836).
  - net: hns3: fix kernel crash problem in concurrent scenario
    (CVE-2024-39507 bsc#1227730).
  - net/mlx5: Fix tainted pointer delete is case of flow rules
    creation fail (CVE-2024-40940 bsc#1227800).
  - commit 8d4dcfb
  - net: ethtool: fix the error condition in
    ethtool_get_phy_stats_ethtool() (CVE-2024-40928 bsc#1227788).
  - commit be667d4
  - btrfs: zoned: fix lock ordering in btrfs_zone_activate()
    (bsc#1223731 CVE-2024-26944).
  - commit c6e27f8
  - vmxnet3: disable rx data ring on dma allocation failure
    (CVE-2024-40923 bsc#1227786).
  - commit 3828e87
  - mptcp: ensure snd_una is properly initialized on connect
    (CVE-2024-40931 bsc#1227780).
  - commit 60fd0e2
  - bnxt_en: Adjust logging of firmware messages in case of released
    token in __hwrm_send() (CVE-2024-40919 bsc#1227779).
  - commit c060c32
  - btrfs: zoned: allocate dummy checksums for zoned NODATASUM
    writes (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: fix use-after-free in do_zone_finish()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: fix chunk map leak when loading block group zone
    info (bsc#1223731 CVE-2024-26944).
  - btrfs: fix unbalanced unlock of mapping_tree_lock (bsc#1223731
    CVE-2024-26944).
  - btrfs: remove stripe size local variable from
    insert_dev_extents() (bsc#1223731 CVE-2024-26944).
  - btrfs: use a dedicated data structure for chunk maps
    (bsc#1223731 CVE-2024-26944).
  - commit 201e016
  - btrfs: zoned: wait for data BG to be finished on direct IO
    allocation (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: drop no longer valid write pointer check
    (bsc#1223731 CVE-2024-26944).
  - commit a5e78f9
  - btrfs: do not require EXTENT_NOWAIT for btrfs_redirty_list_add()
    (bsc#1223731 CVE-2024-26944).
  - commit f638537
  - drm/mediatek: Add DRM_MODE_ROTATE_0 to rotation property
    (git-fixes).
  - commit f21db33
  - btrfs: drop gfp from parameter extent state helpers (bsc#1223731
    CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - Refresh
    patches.suse/btrfs-open-code-trivial-btrfs_add_excluded_extent.patch.
  - commit 2097a9c
  - drm/fbdev-dma: Fix framebuffer mode for big endian devices
    (git-fixes).
  - drm/msm/mdp5: Remove MDP_CAP_SRC_SPLIT from msm8x53_config
    (git-fixes).
  - drm/msm/dpu: drop validity checks for clear_pending_flush()
    ctl op (git-fixes).
  - drm/msm/dsi: set VIDEO_COMPRESSION_MODE_CTRL_WC (git-fixes).
  - USB: serial: option: add Rolling RW350-GL variants
    (stable-fixes).
  - USB: serial: option: add support for Foxconn T99W651
    (stable-fixes).
  - USB: serial: option: add Netprisma LCUK54 series modules
    (stable-fixes).
  - usb: gadget: configfs: Prevent OOB read/write in
    usb_string_copy() (stable-fixes).
  - usb: dwc3: pci: add support for the Intel Panther Lake
    (stable-fixes).
  - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
    (stable-fixes).
  - xhci: always resume roothubs if xHC was reset during resume
    (stable-fixes).
  - USB: serial: option: add Telit generic core-dump composition
    (stable-fixes).
  - USB: serial: option: add Fibocom FM350-GL (stable-fixes).
  - USB: serial: option: add Telit FN912 rmnet compositions
    (stable-fixes).
  - commit f9ac994
  - drm/msm/dpu: fix encoder irq wait skip (git-fixes).
  - drm/dp_mst: Fix all mstb marked as not probed after
    suspend/resume (git-fixes).
  - drm/panfrost: Mark simple_ondemand governor as softdep
    (git-fixes).
  - drm/lima: Mark simple_ondemand governor as softdep (git-fixes).
  - drm/mediatek: Remove less-than-zero comparison of an unsigned
    value (git-fixes).
  - drm/mediatek: Fix bit depth overwritten for mtk_ovl_set
    bit_depth() (git-fixes).
  - drm/mediatek: Support DRM plane alpha in Mixer (git-fixes).
  - drm/mediatek: Support DRM plane alpha in OVL (git-fixes).
  - drm/mediatek: Support RGBA8888 and RGBX8888 in OVL on MT8195
    (git-fixes).
  - drm/mediatek: Set DRM mode configs accordingly (git-fixes).
  - drm/mediatek: Add OVL compatible name for MT8195 (git-fixes).
  - drm/mediatek: Turn off the layers with zero width or height
    (git-fixes).
  - drm/mediatek: Fix destination alpha error in OVL (git-fixes).
  - drm/mediatek: Fix XRGB setting error in Mixer (git-fixes).
  - drm/mediatek: Fix XRGB setting error in OVL (git-fixes).
  - drm/mediatek: Use 8-bit alpha in ETHDR (git-fixes).
  - drm/mediatek: Add missing plane settings when async update
    (git-fixes).
  - drm/etnaviv: fix DMA direction handling for cached RW buffers
    (git-fixes).
  - Revert "drm/bridge: tc358767: Set default CLRSIPO count"
    (stable-fixes).
  - drm/qxl: Add check for drm_cvt_mode (git-fixes).
  - drm: zynqmp_kms: Fix AUX bus not getting unregistered
    (git-fixes).
  - drm: zynqmp_dpsub: Fix an error handling path in
    zynqmp_dpsub_probe() (git-fixes).
  - drm/bridge: samsung-dsim: Set P divider based on min/max of
    fin pll (git-fixes).
  - drm/bridge: it6505: fix hibernate to resume no display issue
    (git-fixes).
  - drm/panel: ilitek-ili9882t: Check for errors on the NOP in
    prepare() (git-fixes).
  - drm/panel: ilitek-ili9882t: If prepare fails, disable GPIO
    before regulators (git-fixes).
  - drm/panel: boe-tv101wum-nl6: Check for errors on the NOP in
    prepare() (git-fixes).
  - drm/panel: boe-tv101wum-nl6: If prepare fails, disable GPIO
    before regulators (git-fixes).
  - drm/panel: himax-hx8394: Handle errors from
    mipi_dsi_dcs_set_display_on() better (git-fixes).
  - drm/mgag200: Bind I2C lifetime to DRM device (git-fixes).
  - drm/mgag200: Set DDC timeout in milliseconds (git-fixes).
  - drm/mipi-dsi: Fix theoretical int overflow in
    mipi_dsi_generic_write_seq() (git-fixes).
  - drm/mipi-dsi: Fix theoretical int overflow in
    mipi_dsi_dcs_write_seq() (git-fixes).
  - commit 6fb58b4
  - drm/udl: Remove DRM_CONNECTOR_POLL_HPD (git-fixes).
  - drm/arm/komeda: Fix komeda probe failing if there are no links
    in the secondary pipeline (git-fixes).
  - drm/rockchip: vop2: Fix the port mux of VP2 (git-fixes).
  - drm/amd/display: Move 'struct scaler_data' off stack
    (git-fixes).
  - drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1 (git-fixes).
  - drm/amdgpu: Check if NBIO funcs are NULL in
    amdgpu_device_baco_exit (git-fixes).
  - drm/amdgpu: Fix memory range calculation (git-fixes).
  - drm/amd/pm: Fix aldebaran pcie speed reporting (git-fixes).
  - drm/amd/pm: remove logically dead code for renoir (git-fixes).
  - drm/amdkfd: Fix CU Masking for GFX 9.4.3 (git-fixes).
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
    (git-fixes).
  - commit ba21687
  - Add Alt-commit to AMDGPU patches from 6.11-rc1
  - commit f4ae72a
  - PCI/ASPM: Update save_state when configuration changes (bsc#1226915)
  - commit 5192284
  - block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
    (bsc#1226213).
  - commit 6855b2f
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487 bsc#1227573)
  - commit 1c7a482
  - tls: get psock ref after taking rxlock to avoid leak (CVE-2024-35908 bsc#1224490)
  - commit b0d23d0
  - netfilter: nf_tables: flush pending destroy work before exit_net release (CVE-2024-35899 bsc#1224499)
  - commit 8a86808

------------------------------------------------------------------
------------------  2024-7-18  -  Jul 18 2024  -------------------
------------------------------------------------------------------

++++ git:

  - Add CVE-2024-24577.patch
    * CVE-2024-24577: arbitrary code execution due to heap corruption
    in git_index_add (boo#1219660)

++++ glibc:

  - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228041, BZ
    [#31934])

++++ glibc:

  - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228041, BZ
    [#31934])

++++ glibc:

  - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228041, BZ
    [#31934])

++++ glibc:

  - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228041, BZ
    [#31934])

++++ glibc:

  - s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228041, BZ
    [#31934])

++++ kernel-default:

  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (CVE-2024-35934 bsc#1224641)
  - commit 812f420
  - net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893 bsc#1224512)
  - commit 5be3514
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated
    memory (bsc#1227762 CVE-2024-40901).
  - commit 5eb5075
  - btrfs: pass NOWAIT for set/clear extent bits as another bit
    (bsc#1223731 CVE-2024-26944).
  - commit 33253df
  - btrfs: drop NOFAIL from set_extent_bit allocation masks
    (bsc#1223731 CVE-2024-26944).
  - commit 46559ec
  - btrfs: open code set_extent_bits (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - Refresh
    patches.suse/btrfs-open-code-trivial-btrfs_add_excluded_extent.patch.
  - commit 460a0d4
  - xfs: fix log recovery buffer allocation for the legacy h_size
    fixup (bsc#1227432 CVE-2024-39472).
  - commit 04ef30f
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
    (CVE-2024-40953, bsc#1227806).
  - commit 60989df
  - Update config files (bsc#1227282).
    Update the CONFIG_LSM option to include the selinux LSM in the default set
    of LSMs. The selinux LSM will not get enabled because it is preceded by
    apparmor, which is the first exclusive LSM. Updating CONFIG_LSM resolves
    failures that result in the system not booting up when "security=selinux
    selinux=1" is passed to the kernel and SELinux policies are installed.
  - commit 0a95a78
  - xfs: use roundup_pow_of_two instead of ffs during xlog_find_tail
    (git-fixes).
  - commit 44812b1
  - wifi: mt76: connac: use muar idx 0xe for non-mt799x as well
    (bsc#1227149).
  - wifi: mt76: mt7996: fix potential memory leakage when reading
    chip temperature (bsc#1227149).
  - wifi: mt76: mt7996: fix uninitialized variable in
    mt7996_irq_tasklet() (bsc#1227149).
  - wifi: mt76: mt7925: ensure 4-byte alignment for suspend &
    wow command (bsc#1227149).
  - wifi: mt76: mt7996: fix size of txpower MCU command
    (bsc#1227149).
  - wifi: mt76: connac: check for null before dereferencing
    (bsc#1227149).
  - commit 4e5584e
  - wifi: mt76: Remove redundant assignment to variable tidno
    (bsc#1227149).
  - wifi: mt76: fix the issue of missing txpwr settings from ch153
    to ch177 (bsc#1227149).
  - wifi: mt76: mt7921: fix suspend issue on MediaTek COB platform
    (bsc#1227149).
  - wifi: mt76: mt7921: fix a potential association failure upon
    resuming (bsc#1227149).
  - wifi: mt76: mt7921: fix the unfinished command of regd_notifier
    before suspend (bsc#1227149).
  - wifi: mt76: mt792x: update the country list of EU for ACPI SAR
    (bsc#1227149).
  - wifi: mt76: mt7925e: fix use-after-free in free_irq()
    (bsc#1227149).
  - wifi: mt76: mt792x: add the illegal value check for mtcl table
    of acpi (bsc#1227149).
  - wifi: mt76: mt7925: fix the wrong data type for scan command
    (bsc#1227149).
  - wifi: mt76: set page_pool napi pointer for mmio devices
    (bsc#1227149).
  - wifi: mt76: mt792x: fix ethtool warning (bsc#1227149).
  - commit 3499113
  - wifi: mt76: connac: set correct muar_idx for mt799x chipsets
    (bsc#1227149).
  - wifi: mt76: mt7996: remove TXS queue setting (bsc#1227149).
  - wifi: mt76: mt7996: mark GCMP IGTK unsupported (bsc#1227149).
  - wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
    (bsc#1227149).
  - wifi: mt76: mt7996: check txs format before getting skb by pid
    (bsc#1227149).
  - wifi: mt76: mt7925: support temperature sensor (bsc#1227149).
  - wifi: mt76: mt7925: update PCIe DMA settings (bsc#1227149).
  - wifi: mt76: mt7925: add support to set ifs time by mcu command
    (bsc#1227149).
  - wifi: mt76: mt7925: add flow to avoid chip bt function fail
    (bsc#1227149).
  - wifi: mt76: mt7925: fix the wrong header translation config
    (bsc#1227149).
  - commit 7f22357
  - wifi: mt76: mt7925: fix WoW failed in encrypted mode
    (bsc#1227149).
  - wifi: mt76: mt7925: fix fw download fail (bsc#1227149).
  - wifi: mt76: mt7925: fix wmm queue mapping (bsc#1227149).
  - wifi: mt76: mt7925: fix mcu query command fail (bsc#1227149).
  - wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz
    band (bsc#1227149).
  - wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
    (bsc#1227149).
  - wifi: mt76: mt76x2u: add netgear wdna3100v3 to device table
    (bsc#1227149).
  - wifi: mt76: mt792xu: enable dmashdl support (bsc#1227149).
  - wifi: mt76: usb: store usb endpoint in mt76_queue (bsc#1227149).
  - wifi: mt76: usb: create a dedicated queue for psd traffic
    (bsc#1227149).
  - commit 01e1acb
  - wifi: mt76: mt7996: fix fw loading timeout (bsc#1227149).
  - wifi: mt76: mt7915: update mt798x_wmac_adie_patch_7976
    (bsc#1227149).
  - wifi: mt76: mt7915: add locking for accessing mapped registers
    (bsc#1227149).
  - wifi: mt76: mt7915: fix error recovery with WED enabled
    (bsc#1227149).
  - wifi: mt76: check txs format before getting skb by pid
    (bsc#1227149).
  - wifi: mt76: disable HW AMSDU when using fixed rate
    (bsc#1227149).
  - wifi: mt76: mt7996: fix fortify warning (bsc#1227149).
  - commit 0013ef2
  - wifi: fill in MODULE_DESCRIPTION()s for mt76 drivers
    (bsc#1227149).
  - wifi: mt76: mt7996: Use DECLARE_FLEX_ARRAY() and fix
  - Warray-bounds warnings (bsc#1227149).
  - wifi: mt76: mt7921: fix wrong 6Ghz power type (bsc#1227149).
  - wifi: mt76: mt7921: fix CLC command timeout when suspend/resume
    (bsc#1227149).
  - wifi: mt76: mt7921: reduce the size of MCU firmware download
    Rx queue (bsc#1227149).
  - wifi: mt76: mt7996: set DMA mask to 36 bits for boards with
    more than 4GB of RAM (bsc#1227149).
  - wifi: mt76: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: mt76: mt7925: remove iftype from mt7925_init_eht_caps
    signature (bsc#1227149).
  - wifi: mt76: connac: add new definition of tx descriptor
    (bsc#1227149).
  - wifi: mt76: mt7996: adjust interface num and wtbl size for
    mt7992 (bsc#1227149).
  - commit cbff43f
  - wifi: mt76: mt7996: support mt7992 eeprom loading (bsc#1227149).
  - wifi: mt76: mt7996: rework register offsets for mt7992
    (bsc#1227149).
  - wifi: mt76: mt7996: add DMA support for mt7992 (bsc#1227149).
  - wifi: mt76: connac: add firmware support for mt7992
    (bsc#1227149).
  - wifi: mt76: mt7996: introduce mt7996_band_valid() (bsc#1227149).
  - wifi: mt76: mt7996: fix mt7996_mcu_all_sta_info_event struct
    packing (bsc#1227149).
  - wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on 5 GHz band
    (bsc#1227149).
  - wifi: mt76: mt7915: fix EEPROM offset of TSSI flag on MT7981
    (bsc#1227149).
  - wifi: mt76: connac: add beacon protection support for mt7996
    (bsc#1227149).
  - wifi: mt76: mt7996: rework ampdu params setting (bsc#1227149).
  - commit 3e59fd6
  - wifi: mt76: mt7996: add txpower setting support (bsc#1227149).
  - commit fd1825a
  - wifi: mt76: mt7996: fix alignment of sta info event
    (bsc#1227149).
  - wifi: mt76: mt7996: switch to mcu command for TX GI report
    (bsc#1227149).
  - wifi: mt76: use chainmask for power delta calculation
    (bsc#1227149).
  - wifi: mt76: change txpower init to per-phy (bsc#1227149).
  - wifi: mt76: mt7996: align the format of fixed rate command
    (bsc#1227149).
  - wifi: mt76: mt7996: handle IEEE80211_RC_SMPS_CHANGED
    (bsc#1227149).
  - wifi: mt76: connac: set fixed_bw bit in TX descriptor for
    fixed rate frames (bsc#1227149).
  - wifi: mt76: mt7996: adjust WFDMA settings to improve performance
    (bsc#1227149).
  - wifi: mt76: connac: add beacon duplicate TX mode support for
    mt7996 (bsc#1227149).
  - commit e90dd6a
  - wifi: mt76: move wed reset common code in mt76 module
    (bsc#1227149).
  - commit b63457a
  - wifi: mt76: mt7996: add thermal sensor device support
    (bsc#1227149).
  - wifi: mt76: connac: add thermal protection support for mt7996
    (bsc#1227149).
  - wifi: mt76: mt7996: add TX statistics for EHT mode in debugfs
    (bsc#1227149).
  - wifi: mt76: mt7996: add support for variants with auxiliary
    RX path (bsc#1227149).
  - wifi: mt76: mt7996: use u16 for val field in mt7996_mcu_set_rro
    signature (bsc#1227149).
  - wifi: mt76: dma: introduce __mt76_dma_queue_reset utility
    routine (bsc#1227149).
  - commit dd57284
  - wifi: mt76: increase MT_QFLAG_WED_TYPE size (bsc#1227149).
  - wifi: mt76: introduce wed pointer in mt76_queue (bsc#1227149).
  - wifi: mt76: introduce mt76_queue_is_wed_tx_free utility routine
    (bsc#1227149).
  - wifi: mt76: move mt76_net_setup_tc in common code (bsc#1227149).
  - wifi: mt76: move mt76_mmio_wed_offload_{enable,disable} in
    common code (bsc#1227149).
  - wifi: mt76: mmio: move mt76_mmio_wed_{init,release}_rx_buf in
    common code (bsc#1227149).
  - wifi: mt76: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: mt76: permit to load precal from NVMEM cell for mt7915
    (bsc#1227149).
  - wifi: mt76: permit to use alternative cell name to eeprom
    NVMEM load (bsc#1227149).
  - commit 15e9dc7
  - wifi: mt76: mt7921: support 5.9/6GHz channel config in acpi
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit 915b272
  - wifi: mt76: make mt76_get_of_eeprom static again (bsc#1227149).
  - wifi: mt76: limit support of precal loading for mt7915 to MTD
    only (bsc#1227149).
  - wifi: mt76: fix typo in mt76_get_of_eeprom_from_nvmem function
    (bsc#1227149).
  - wifi: mt76: mt7996: fix uninitialized variable in parsing txfree
    (bsc#1227149).
  - wifi: mt76: add ability to explicitly forbid LED registration
    with DT (bsc#1227149).
  - wifi: mt76: mt7925: fix typo in mt7925_init_he_caps
    (bsc#1227149).
  - wifi: mt76: mt7921: fix 6GHz disabled by the missing default
    CLC config (bsc#1227149).
  - net: fill in MODULE_DESCRIPTION()s in kuba@'s modules
    (bsc#1227149).
  - wifi: mt76: mt7921: fix kernel panic by accessing invalid 6GHz
    channel info (bsc#1227149).
  - commit b106ffb
  - wifi: mt76: Annotate struct mt76_rx_tid with __counted_by
    (bsc#1227149).
  - commit aecab86
  - wifi: mt76: mt7921: update the channel usage when the regd
    domain changed (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit b09df3f
  - wifi: mt76: mt7921: get regulatory information from the clc
    event (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit 04b07d9
  - wifi: mt76: mt7921: add 6GHz power type support for clc
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - commit b7bb561
  - wifi: mt76: mt7921: enable set txpower for UNII-4 (bsc#1227149).
  - wifi: mt76: mt7921: move connac nic capability handling to
    mt7921 (bsc#1227149).
  - wifi: mt76: reduce spin_lock_bh held up in mt76_dma_rx_cleanup
    (bsc#1227149).
  - wifi: mt76: mt7996: remove periodic MPDU TXS request
    (bsc#1227149).
  - wifi: mt76: mt7996: enable PPDU-TxS to host (bsc#1227149).
  - wifi: mt76: mt7996: Add mcu commands for getting sta tx
    statistic (bsc#1227149).
  - commit e37a1c7
  - Update config files for mt76 stuff (bsc#1227149)
  - commit debbb92
  - wifi: mt76: connac: add MBSSID support for mt7996 (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-update-beacon-size-limitation.patch.
  - commit 54772eb
  - wifi: mt76: mt7996: get tx_retries and tx_failed from txfree
    (bsc#1227149).
  - wifi: mt76: mt792x: move some common usb code in mt792x module
    (bsc#1227149).
  - wifi: mt76: mt792x: move mt7921_skb_add_usb_sdio_hdr in mt792x
    module (bsc#1227149).
  - wifi: mt76: mt7915 add tc offloading support (bsc#1227149).
  - wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips
    (bsc#1227149).
  - wifi: mt76: mt7915: update mpdu density capability
    (bsc#1227149).
  - wifi: mt76: check vif type before reporting cca and csa
    (bsc#1227149).
  - wifi: mt76: check sta rx control frame to multibss capability
    (bsc#1227149).
  - wifi: mt76: Use PTR_ERR_OR_ZERO() to simplify code
    (bsc#1227149).
  - commit 2106e27
  - wifi: mt76: mt7996: support per-band LED control (bsc#1227149).
  - wifi: mt76: mt7996: support more options for
    mt7996_set_bitrate_mask() (bsc#1227149).
  - wifi: mt76: mt7996: only set vif teardown cmds at remove
    interface (bsc#1227149).
  - wifi: mt76: connac: add more unified event IDs (bsc#1227149).
  - wifi: mt76: connac: add more unified command IDs (bsc#1227149).
  - wifi: mt76: connac: add data field in struct tlv (bsc#1227149).
  - wifi: mt76: connac: add eht support for tx power (bsc#1227149).
  - wifi: mt76: connac: add eht support for phy mode config
    (bsc#1227149).
  - wifi: mt76: connac: export functions for mt7925 (bsc#1227149).
  - wifi: mt76: mt792x: support mt7925 chip init (bsc#1227149).
  - commit 135e742
  - wifi: mt76: connac: introduce helper for mt7925 chipset
    (bsc#1227149).
  - wifi: mt76: mt7915: fix monitor mode issues (bsc#1227149).
  - wifi: mt76: add DMA mapping error check in mt76_alloc_txwi()
    (bsc#1227149).
  - wifi: mt76: fix race condition related to checking tx queue
    fill status (bsc#1227149).
  - wifi: mt76: use atomic iface iteration for pre-TBTT work
    (bsc#1227149).
  - wifi: mt76: mt7603: disable A-MSDU tx support on MT7628
    (bsc#1227149).
  - wifi: mt76: mt7603: add missing register initialization for
    MT7628 (bsc#1227149).
  - commit 6594bb5
  - net: ethernet: mtk_wed: introduce mtk_wed_buf structure
    (bsc#1227149).
  - net: ethernet: mtk_wed: rename mtk_rxbm_desc in mtk_wed_bm_desc
    (bsc#1227149).
  - wifi: mt76: Replace strlcpy() with strscpy() (bsc#1227149).
  - wifi: mt76: mt76x02: fix return value check in
    mt76x02_mac_process_rx (bsc#1227149).
  - wifi: mt76: mt7921: move mt7921u_disconnect mt792x-lib
    (bsc#1227149).
  - wifi: mt76: mt7921: move mt7921_dma_init in pci.c (bsc#1227149).
  - wifi: mt76: mt792x: move MT7921_PM_TIMEOUT and
    MT7921_HW_SCAN_TIMEOUT in common code (bsc#1227149).
  - wifi: mt76: mt76_connac3: move lmac queue enumeration in
    mt76_connac3_mac.h (bsc#1227149).
  - wifi: mt76: mt792x: move mt7921_load_firmware in mt792x-lib
    module (bsc#1227149).
  - commit 1179b28
  - wifi: mt76: mt792x: introduce mt792x-usb module (bsc#1227149).
  - commit bb743ca
  - wifi: mt76: mt7921: move acpi_sar code in mt792x-lib module
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - Refresh
    patches.suse/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch.
  - commit e00ae3f
  - wifi: mt76: mt7921: move runtime-pm pci code in mt792x-lib
    (bsc#1227149).
  - commit 35d834e
  - wifi: mt76: mt7921: move shared runtime-pm code on mt792x-lib
    (bsc#1227149).
  - commit 5efac2c
  - wifi: mt76: mt7921: move hif_ops macro in mt792x.h
    (bsc#1227149).
  - commit 945f2ed
  - wifi: mt76: mt792x: move more dma shared code in mt792x_dma
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - commit 4136c03
  - wifi: mt76: mt792x: introduce mt792x_irq_map (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch.
  - commit 94984c8
  - wifi: mt76: mt7921: move init shared code in mt792x-lib module
    (bsc#1227149).
  - wifi: mt76: mt7921: move debugfs shared code in mt792x-lib
    module (bsc#1227149).
  - wifi: mt76: mt7921: move dma shared code in mt792x-lib module
    (bsc#1227149).
  - commit 8138035
  - wifi: mt76: mt7921: move mac shared code in mt792x-lib module
    (bsc#1227149).
  - commit 118e960
  - wifi: mt76: mt792x: introduce mt792x-lib module (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit bba35bb
  - wifi: mt76: mt7921: move mt792x_hw_dev in mt792x.h
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit e5956d4
  - wifi: mt76: mt7921: move mt792x_mutex_{acquire/release} in
    mt792x.h (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit ea3046f
  - wifi: mt76: mt792x: move shared structure definition in mt792x.h
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit c60dc5e
  - wifi: mt76: mt7921: rename mt7921_dev in mt792x_dev
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - Refresh
    patches.suse/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch.
  - commit 845aa52
  - wifi: mt76: mt7921: rename mt7921_vif in mt792x_vif
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit d4d2c1b
  - wifi: mt76: mt7921: rename mt7921_hif_ops in mt792x_hif_ops
    (bsc#1227149).
  - wifi: mt76: mt7921: rename mt7921_phy in mt792x_phy
    (bsc#1227149).
  - wifi: mt76: mt7921: rename mt7921_sta in mt792x_sta
    (bsc#1227149).
  - commit 47cecdc
  - wifi: mt76: move rate info in mt76_vif (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch.
  - commit 8909aa1
  - wifi: mt76: mt7921: convert acpisar and clc pointers to void
    (bsc#1227149).
  - wifi: mt76: mt7921: move common register definition in
    mt792x_regs.h (bsc#1227149).
  - wifi: mt76: mt7603: fix tx filter/flush function (bsc#1227149).
  - wifi: mt76: mt7603: fix beacon interval after disabling a
    single vif (bsc#1227149).
  - wifi: mt76: add support for providing eeprom in nvmem cells
    (bsc#1227149).
  - wifi: mt76: split get_of_eeprom in subfunction (bsc#1227149).
  - wifi: mt76: connac: add connac3 mac library (bsc#1227149).
  - mt76: connac: move more mt7921/mt7915 mac shared code in connac
    lib (bsc#1227149).
  - wifi: mt76: move ampdu_state in mt76_wcid (bsc#1227149).
  - commit 343ad65
  - wifi: mt76: mt7921: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit 72ca75a
  - wifi: mt76: mt7921: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7996: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7615: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7603: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7915: move poll_list in mt76_wcid (bsc#1227149).
  - wifi: mt76: mt7996: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7615: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7603: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7915: move sta_poll_list and sta_poll_lock in
    mt76_dev (bsc#1227149).
  - commit 2965d6e
  - wifi: mt76: mt7996: increase tx token size (bsc#1227149).
  - wifi: mt76: mt7996: add muru support (bsc#1227149).
  - wifi: mt76: connac: add support to set ifs time by mcu command
    (bsc#1227149).
  - wifi: mt76: mt7996: enable VHT extended NSS BW feature
    (bsc#1227149).
  - wifi: mt76: connac: add support for dsp firmware download
    (bsc#1227149).
  - wifi: mt76: mt7996: move radio ctrl commands to proper functions
    (bsc#1227149).
  - wifi: mt76: mt7921: get rid of MT7921_RESET_TIMEOUT marco
    (bsc#1227149).
  - mt76: mt7996: rely on mt76_sta_stats in mt76_wcid (bsc#1227149).
  - wifi: mt76: mt7921: make mt7921_mac_sta_poll static
    (bsc#1227149).
  - wifi: mt76: mt7996: disable WFDMA Tx/Rx during SER recovery
    (bsc#1227149).
  - commit fc1c367
  - Update config files: adjust for Arm CONFIG_MT798X_WMAC (bsc#1227149)
  - commit 5938ea9
  - wifi: mt76: mt7921: rely on mib_stats shared definition
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit a519a6e
  - wifi: mt76: mt7915: disable WFDMA Tx/Rx during SER recovery
    (bsc#1227149).
  - wifi: mt76: mt7921: Support temp sensor (bsc#1227149).
  - wifi: mt76: mt7915: accumulate mu-mimo ofdma muru stats
    (bsc#1227149).
  - wifi: mt76: add tx_nss histogram to ethtool stats (bsc#1227149).
  - wifi: mt76: mt7921e: report tx retries/failed counts in tx
    free event (bsc#1227149).
  - wifi: mt76: mt7915: add support for MT7981 (bsc#1227149).
  - wifi: mt76: mt7996: rely on mib_stats shared definition
    (bsc#1227149).
  - wifi: mt76: mt7915: move mib_stats structure in mt76.h
    (bsc#1227149).
  - wifi: mt76: mt7921: remove macro duplication in regs.h
    (bsc#1227149).
  - commit c307798
  - wifi: mt76: mt7915: report tx retries/failed counts for non-WED
    path (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7915-rework-tx-packets-counting-when-WED.patch.
  - commit 25e2b06
  - wifi: mt76: mt7996: enable BSS_CHANGED_MU_GROUPS support
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-update-beacon-size-limitation.patch.
  - commit b121af9
  - wifi: mt76: mt7996: drop return in mt7996_sta_statistics
    (bsc#1227149).
  - wifi: mt76: mt7915: drop return in mt7915_sta_statistics
    (bsc#1227149).
  - wifi: mt76: report non-binding skb tx rate when WED is active
    (bsc#1227149).
  - wifi: mt76: enable UNII-4 channel 177 support (bsc#1227149).
  - wifi: mt76: mt7615: enable BSS_CHANGED_MU_GROUPS support
    (bsc#1227149).
  - wifi: mt7601u: replace strlcpy() with strscpy() (bsc#1227149).
  - wifi: mt7601u: delete dead code checking debugfs returns
    (bsc#1227149).
  - commit 3625743
  - exfat: fix potential deadlock on __exfat_get_dentry_set
    (git-fixes).
  - commit aaa908a
  - media: venus: fix use after free in vdec_close (git-fixes).
  - media: venus: flush all buffers in output plane streamoff
    (git-fixes).
  - media: v4l: subdev: Fix typo in documentation (git-fixes).
  - media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
    (git-fixes).
  - media: renesas: vsp1: Store RPF partition configuration per
    RPF instance (git-fixes).
  - media: renesas: vsp1: Fix _irqsave and _irq mix (git-fixes).
  - media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2 (git-fixes).
  - media: imx-jpeg: Drop initial source change event if capture
    has been setup (git-fixes).
  - media: imx-jpeg: Remove some redundant error logs (git-fixes).
  - media: uvcvideo: Override default flags (git-fixes).
  - media: uvcvideo: Fix integer overflow calculating timestamp
    (git-fixes).
  - saa7134: Unchecked i2c_transfer function result fixed
    (git-fixes).
  - media: v4l: async: Fix NULL pointer dereference in adding
    ancillary links (git-fixes).
  - media: i2c: Fix imx412 exposure control (git-fixes).
  - media: imon: Fix race getting ictx->lock (git-fixes).
  - media: dvb-usb: Fix unexpected infinite loop in
    dvb_usb_read_remote_control() (git-fixes).
  - media: pci: ivtv: Add check for DMA map result (git-fixes).
  - leds: flash: leds-qcom-flash: Test the correct variable in init
    (git-fixes).
  - Revert "leds: led-core: Fix refcount leak in of_led_get()"
    (git-fixes).
  - leds: mt6360: Fix memory leak in mt6360_init_isnk_properties()
    (git-fixes).
  - leds: triggers: Flush pending brightness before activating
    trigger (git-fixes).
  - leds: ss4200: Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - leds: trigger: Unregister sysfs attributes before calling
    deactivate() (git-fixes).
  - mfd: omap-usb-tll: Use struct_size to allocate tll (git-fixes).
  - mfd: pm8008: Fix regmap irq chip initialisation (git-fixes).
  - ipmi: ssif_bmc: prevent integer overflow on 32bit systems
    (git-fixes).
  - ata: libata-scsi: Fix offsets for the fixed format sense data
    (git-fixes).
  - commit a8e6a5f
  - Update
    patches.suse/mptcp-ensure-snd_nxt-is-properly-initialized-on-conn.patch
    (CVE-2024-36889 bsc#1225746).
  - commit 98abb2b
  - mptcp: fix data races on remote_id (CVE-2024-27404 bsc#1224422)
  - commit ed12cfe

++++ kernel-default:

  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (CVE-2024-35934 bsc#1224641)
  - commit 812f420
  - net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893 bsc#1224512)
  - commit 5be3514
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated
    memory (bsc#1227762 CVE-2024-40901).
  - commit 5eb5075
  - btrfs: pass NOWAIT for set/clear extent bits as another bit
    (bsc#1223731 CVE-2024-26944).
  - commit 33253df
  - btrfs: drop NOFAIL from set_extent_bit allocation masks
    (bsc#1223731 CVE-2024-26944).
  - commit 46559ec
  - btrfs: open code set_extent_bits (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - Refresh
    patches.suse/btrfs-open-code-trivial-btrfs_add_excluded_extent.patch.
  - commit 460a0d4
  - xfs: fix log recovery buffer allocation for the legacy h_size
    fixup (bsc#1227432 CVE-2024-39472).
  - commit 04ef30f
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
    (CVE-2024-40953, bsc#1227806).
  - commit 60989df
  - Update config files (bsc#1227282).
    Update the CONFIG_LSM option to include the selinux LSM in the default set
    of LSMs. The selinux LSM will not get enabled because it is preceded by
    apparmor, which is the first exclusive LSM. Updating CONFIG_LSM resolves
    failures that result in the system not booting up when "security=selinux
    selinux=1" is passed to the kernel and SELinux policies are installed.
  - commit 0a95a78
  - xfs: use roundup_pow_of_two instead of ffs during xlog_find_tail
    (git-fixes).
  - commit 44812b1
  - wifi: mt76: connac: use muar idx 0xe for non-mt799x as well
    (bsc#1227149).
  - wifi: mt76: mt7996: fix potential memory leakage when reading
    chip temperature (bsc#1227149).
  - wifi: mt76: mt7996: fix uninitialized variable in
    mt7996_irq_tasklet() (bsc#1227149).
  - wifi: mt76: mt7925: ensure 4-byte alignment for suspend &
    wow command (bsc#1227149).
  - wifi: mt76: mt7996: fix size of txpower MCU command
    (bsc#1227149).
  - wifi: mt76: connac: check for null before dereferencing
    (bsc#1227149).
  - commit 4e5584e
  - wifi: mt76: Remove redundant assignment to variable tidno
    (bsc#1227149).
  - wifi: mt76: fix the issue of missing txpwr settings from ch153
    to ch177 (bsc#1227149).
  - wifi: mt76: mt7921: fix suspend issue on MediaTek COB platform
    (bsc#1227149).
  - wifi: mt76: mt7921: fix a potential association failure upon
    resuming (bsc#1227149).
  - wifi: mt76: mt7921: fix the unfinished command of regd_notifier
    before suspend (bsc#1227149).
  - wifi: mt76: mt792x: update the country list of EU for ACPI SAR
    (bsc#1227149).
  - wifi: mt76: mt7925e: fix use-after-free in free_irq()
    (bsc#1227149).
  - wifi: mt76: mt792x: add the illegal value check for mtcl table
    of acpi (bsc#1227149).
  - wifi: mt76: mt7925: fix the wrong data type for scan command
    (bsc#1227149).
  - wifi: mt76: set page_pool napi pointer for mmio devices
    (bsc#1227149).
  - wifi: mt76: mt792x: fix ethtool warning (bsc#1227149).
  - commit 3499113
  - wifi: mt76: connac: set correct muar_idx for mt799x chipsets
    (bsc#1227149).
  - wifi: mt76: mt7996: remove TXS queue setting (bsc#1227149).
  - wifi: mt76: mt7996: mark GCMP IGTK unsupported (bsc#1227149).
  - wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
    (bsc#1227149).
  - wifi: mt76: mt7996: check txs format before getting skb by pid
    (bsc#1227149).
  - wifi: mt76: mt7925: support temperature sensor (bsc#1227149).
  - wifi: mt76: mt7925: update PCIe DMA settings (bsc#1227149).
  - wifi: mt76: mt7925: add support to set ifs time by mcu command
    (bsc#1227149).
  - wifi: mt76: mt7925: add flow to avoid chip bt function fail
    (bsc#1227149).
  - wifi: mt76: mt7925: fix the wrong header translation config
    (bsc#1227149).
  - commit 7f22357
  - wifi: mt76: mt7925: fix WoW failed in encrypted mode
    (bsc#1227149).
  - wifi: mt76: mt7925: fix fw download fail (bsc#1227149).
  - wifi: mt76: mt7925: fix wmm queue mapping (bsc#1227149).
  - wifi: mt76: mt7925: fix mcu query command fail (bsc#1227149).
  - wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz
    band (bsc#1227149).
  - wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
    (bsc#1227149).
  - wifi: mt76: mt76x2u: add netgear wdna3100v3 to device table
    (bsc#1227149).
  - wifi: mt76: mt792xu: enable dmashdl support (bsc#1227149).
  - wifi: mt76: usb: store usb endpoint in mt76_queue (bsc#1227149).
  - wifi: mt76: usb: create a dedicated queue for psd traffic
    (bsc#1227149).
  - commit 01e1acb
  - wifi: mt76: mt7996: fix fw loading timeout (bsc#1227149).
  - wifi: mt76: mt7915: update mt798x_wmac_adie_patch_7976
    (bsc#1227149).
  - wifi: mt76: mt7915: add locking for accessing mapped registers
    (bsc#1227149).
  - wifi: mt76: mt7915: fix error recovery with WED enabled
    (bsc#1227149).
  - wifi: mt76: check txs format before getting skb by pid
    (bsc#1227149).
  - wifi: mt76: disable HW AMSDU when using fixed rate
    (bsc#1227149).
  - wifi: mt76: mt7996: fix fortify warning (bsc#1227149).
  - commit 0013ef2
  - wifi: fill in MODULE_DESCRIPTION()s for mt76 drivers
    (bsc#1227149).
  - wifi: mt76: mt7996: Use DECLARE_FLEX_ARRAY() and fix
  - Warray-bounds warnings (bsc#1227149).
  - wifi: mt76: mt7921: fix wrong 6Ghz power type (bsc#1227149).
  - wifi: mt76: mt7921: fix CLC command timeout when suspend/resume
    (bsc#1227149).
  - wifi: mt76: mt7921: reduce the size of MCU firmware download
    Rx queue (bsc#1227149).
  - wifi: mt76: mt7996: set DMA mask to 36 bits for boards with
    more than 4GB of RAM (bsc#1227149).
  - wifi: mt76: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: mt76: mt7925: remove iftype from mt7925_init_eht_caps
    signature (bsc#1227149).
  - wifi: mt76: connac: add new definition of tx descriptor
    (bsc#1227149).
  - wifi: mt76: mt7996: adjust interface num and wtbl size for
    mt7992 (bsc#1227149).
  - commit cbff43f
  - wifi: mt76: mt7996: support mt7992 eeprom loading (bsc#1227149).
  - wifi: mt76: mt7996: rework register offsets for mt7992
    (bsc#1227149).
  - wifi: mt76: mt7996: add DMA support for mt7992 (bsc#1227149).
  - wifi: mt76: connac: add firmware support for mt7992
    (bsc#1227149).
  - wifi: mt76: mt7996: introduce mt7996_band_valid() (bsc#1227149).
  - wifi: mt76: mt7996: fix mt7996_mcu_all_sta_info_event struct
    packing (bsc#1227149).
  - wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on 5 GHz band
    (bsc#1227149).
  - wifi: mt76: mt7915: fix EEPROM offset of TSSI flag on MT7981
    (bsc#1227149).
  - wifi: mt76: connac: add beacon protection support for mt7996
    (bsc#1227149).
  - wifi: mt76: mt7996: rework ampdu params setting (bsc#1227149).
  - commit 3e59fd6
  - wifi: mt76: mt7996: add txpower setting support (bsc#1227149).
  - commit fd1825a
  - wifi: mt76: mt7996: fix alignment of sta info event
    (bsc#1227149).
  - wifi: mt76: mt7996: switch to mcu command for TX GI report
    (bsc#1227149).
  - wifi: mt76: use chainmask for power delta calculation
    (bsc#1227149).
  - wifi: mt76: change txpower init to per-phy (bsc#1227149).
  - wifi: mt76: mt7996: align the format of fixed rate command
    (bsc#1227149).
  - wifi: mt76: mt7996: handle IEEE80211_RC_SMPS_CHANGED
    (bsc#1227149).
  - wifi: mt76: connac: set fixed_bw bit in TX descriptor for
    fixed rate frames (bsc#1227149).
  - wifi: mt76: mt7996: adjust WFDMA settings to improve performance
    (bsc#1227149).
  - wifi: mt76: connac: add beacon duplicate TX mode support for
    mt7996 (bsc#1227149).
  - commit e90dd6a
  - wifi: mt76: move wed reset common code in mt76 module
    (bsc#1227149).
  - commit b63457a
  - wifi: mt76: mt7996: add thermal sensor device support
    (bsc#1227149).
  - wifi: mt76: connac: add thermal protection support for mt7996
    (bsc#1227149).
  - wifi: mt76: mt7996: add TX statistics for EHT mode in debugfs
    (bsc#1227149).
  - wifi: mt76: mt7996: add support for variants with auxiliary
    RX path (bsc#1227149).
  - wifi: mt76: mt7996: use u16 for val field in mt7996_mcu_set_rro
    signature (bsc#1227149).
  - wifi: mt76: dma: introduce __mt76_dma_queue_reset utility
    routine (bsc#1227149).
  - commit dd57284
  - wifi: mt76: increase MT_QFLAG_WED_TYPE size (bsc#1227149).
  - wifi: mt76: introduce wed pointer in mt76_queue (bsc#1227149).
  - wifi: mt76: introduce mt76_queue_is_wed_tx_free utility routine
    (bsc#1227149).
  - wifi: mt76: move mt76_net_setup_tc in common code (bsc#1227149).
  - wifi: mt76: move mt76_mmio_wed_offload_{enable,disable} in
    common code (bsc#1227149).
  - wifi: mt76: mmio: move mt76_mmio_wed_{init,release}_rx_buf in
    common code (bsc#1227149).
  - wifi: mt76: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: mt76: permit to load precal from NVMEM cell for mt7915
    (bsc#1227149).
  - wifi: mt76: permit to use alternative cell name to eeprom
    NVMEM load (bsc#1227149).
  - commit 15e9dc7
  - wifi: mt76: mt7921: support 5.9/6GHz channel config in acpi
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit 915b272
  - wifi: mt76: make mt76_get_of_eeprom static again (bsc#1227149).
  - wifi: mt76: limit support of precal loading for mt7915 to MTD
    only (bsc#1227149).
  - wifi: mt76: fix typo in mt76_get_of_eeprom_from_nvmem function
    (bsc#1227149).
  - wifi: mt76: mt7996: fix uninitialized variable in parsing txfree
    (bsc#1227149).
  - wifi: mt76: add ability to explicitly forbid LED registration
    with DT (bsc#1227149).
  - wifi: mt76: mt7925: fix typo in mt7925_init_he_caps
    (bsc#1227149).
  - wifi: mt76: mt7921: fix 6GHz disabled by the missing default
    CLC config (bsc#1227149).
  - net: fill in MODULE_DESCRIPTION()s in kuba@'s modules
    (bsc#1227149).
  - wifi: mt76: mt7921: fix kernel panic by accessing invalid 6GHz
    channel info (bsc#1227149).
  - commit b106ffb
  - wifi: mt76: Annotate struct mt76_rx_tid with __counted_by
    (bsc#1227149).
  - commit aecab86
  - wifi: mt76: mt7921: update the channel usage when the regd
    domain changed (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit b09df3f
  - wifi: mt76: mt7921: get regulatory information from the clc
    event (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit 04b07d9
  - wifi: mt76: mt7921: add 6GHz power type support for clc
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - commit b7bb561
  - wifi: mt76: mt7921: enable set txpower for UNII-4 (bsc#1227149).
  - wifi: mt76: mt7921: move connac nic capability handling to
    mt7921 (bsc#1227149).
  - wifi: mt76: reduce spin_lock_bh held up in mt76_dma_rx_cleanup
    (bsc#1227149).
  - wifi: mt76: mt7996: remove periodic MPDU TXS request
    (bsc#1227149).
  - wifi: mt76: mt7996: enable PPDU-TxS to host (bsc#1227149).
  - wifi: mt76: mt7996: Add mcu commands for getting sta tx
    statistic (bsc#1227149).
  - commit e37a1c7
  - Update config files for mt76 stuff (bsc#1227149)
  - commit debbb92
  - wifi: mt76: connac: add MBSSID support for mt7996 (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-update-beacon-size-limitation.patch.
  - commit 54772eb
  - wifi: mt76: mt7996: get tx_retries and tx_failed from txfree
    (bsc#1227149).
  - wifi: mt76: mt792x: move some common usb code in mt792x module
    (bsc#1227149).
  - wifi: mt76: mt792x: move mt7921_skb_add_usb_sdio_hdr in mt792x
    module (bsc#1227149).
  - wifi: mt76: mt7915 add tc offloading support (bsc#1227149).
  - wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips
    (bsc#1227149).
  - wifi: mt76: mt7915: update mpdu density capability
    (bsc#1227149).
  - wifi: mt76: check vif type before reporting cca and csa
    (bsc#1227149).
  - wifi: mt76: check sta rx control frame to multibss capability
    (bsc#1227149).
  - wifi: mt76: Use PTR_ERR_OR_ZERO() to simplify code
    (bsc#1227149).
  - commit 2106e27
  - wifi: mt76: mt7996: support per-band LED control (bsc#1227149).
  - wifi: mt76: mt7996: support more options for
    mt7996_set_bitrate_mask() (bsc#1227149).
  - wifi: mt76: mt7996: only set vif teardown cmds at remove
    interface (bsc#1227149).
  - wifi: mt76: connac: add more unified event IDs (bsc#1227149).
  - wifi: mt76: connac: add more unified command IDs (bsc#1227149).
  - wifi: mt76: connac: add data field in struct tlv (bsc#1227149).
  - wifi: mt76: connac: add eht support for tx power (bsc#1227149).
  - wifi: mt76: connac: add eht support for phy mode config
    (bsc#1227149).
  - wifi: mt76: connac: export functions for mt7925 (bsc#1227149).
  - wifi: mt76: mt792x: support mt7925 chip init (bsc#1227149).
  - commit 135e742
  - wifi: mt76: connac: introduce helper for mt7925 chipset
    (bsc#1227149).
  - wifi: mt76: mt7915: fix monitor mode issues (bsc#1227149).
  - wifi: mt76: add DMA mapping error check in mt76_alloc_txwi()
    (bsc#1227149).
  - wifi: mt76: fix race condition related to checking tx queue
    fill status (bsc#1227149).
  - wifi: mt76: use atomic iface iteration for pre-TBTT work
    (bsc#1227149).
  - wifi: mt76: mt7603: disable A-MSDU tx support on MT7628
    (bsc#1227149).
  - wifi: mt76: mt7603: add missing register initialization for
    MT7628 (bsc#1227149).
  - commit 6594bb5
  - net: ethernet: mtk_wed: introduce mtk_wed_buf structure
    (bsc#1227149).
  - net: ethernet: mtk_wed: rename mtk_rxbm_desc in mtk_wed_bm_desc
    (bsc#1227149).
  - wifi: mt76: Replace strlcpy() with strscpy() (bsc#1227149).
  - wifi: mt76: mt76x02: fix return value check in
    mt76x02_mac_process_rx (bsc#1227149).
  - wifi: mt76: mt7921: move mt7921u_disconnect mt792x-lib
    (bsc#1227149).
  - wifi: mt76: mt7921: move mt7921_dma_init in pci.c (bsc#1227149).
  - wifi: mt76: mt792x: move MT7921_PM_TIMEOUT and
    MT7921_HW_SCAN_TIMEOUT in common code (bsc#1227149).
  - wifi: mt76: mt76_connac3: move lmac queue enumeration in
    mt76_connac3_mac.h (bsc#1227149).
  - wifi: mt76: mt792x: move mt7921_load_firmware in mt792x-lib
    module (bsc#1227149).
  - commit 1179b28
  - wifi: mt76: mt792x: introduce mt792x-usb module (bsc#1227149).
  - commit bb743ca
  - wifi: mt76: mt7921: move acpi_sar code in mt792x-lib module
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - Refresh
    patches.suse/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch.
  - commit e00ae3f
  - wifi: mt76: mt7921: move runtime-pm pci code in mt792x-lib
    (bsc#1227149).
  - commit 35d834e
  - wifi: mt76: mt7921: move shared runtime-pm code on mt792x-lib
    (bsc#1227149).
  - commit 5efac2c
  - wifi: mt76: mt7921: move hif_ops macro in mt792x.h
    (bsc#1227149).
  - commit 945f2ed
  - wifi: mt76: mt792x: move more dma shared code in mt792x_dma
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - commit 4136c03
  - wifi: mt76: mt792x: introduce mt792x_irq_map (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch.
  - commit 94984c8
  - wifi: mt76: mt7921: move init shared code in mt792x-lib module
    (bsc#1227149).
  - wifi: mt76: mt7921: move debugfs shared code in mt792x-lib
    module (bsc#1227149).
  - wifi: mt76: mt7921: move dma shared code in mt792x-lib module
    (bsc#1227149).
  - commit 8138035
  - wifi: mt76: mt7921: move mac shared code in mt792x-lib module
    (bsc#1227149).
  - commit 118e960
  - wifi: mt76: mt792x: introduce mt792x-lib module (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit bba35bb
  - wifi: mt76: mt7921: move mt792x_hw_dev in mt792x.h
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit e5956d4
  - wifi: mt76: mt7921: move mt792x_mutex_{acquire/release} in
    mt792x.h (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit ea3046f
  - wifi: mt76: mt792x: move shared structure definition in mt792x.h
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit c60dc5e
  - wifi: mt76: mt7921: rename mt7921_dev in mt792x_dev
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - Refresh
    patches.suse/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch.
  - commit 845aa52
  - wifi: mt76: mt7921: rename mt7921_vif in mt792x_vif
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit d4d2c1b
  - wifi: mt76: mt7921: rename mt7921_hif_ops in mt792x_hif_ops
    (bsc#1227149).
  - wifi: mt76: mt7921: rename mt7921_phy in mt792x_phy
    (bsc#1227149).
  - wifi: mt76: mt7921: rename mt7921_sta in mt792x_sta
    (bsc#1227149).
  - commit 47cecdc
  - wifi: mt76: move rate info in mt76_vif (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch.
  - commit 8909aa1
  - wifi: mt76: mt7921: convert acpisar and clc pointers to void
    (bsc#1227149).
  - wifi: mt76: mt7921: move common register definition in
    mt792x_regs.h (bsc#1227149).
  - wifi: mt76: mt7603: fix tx filter/flush function (bsc#1227149).
  - wifi: mt76: mt7603: fix beacon interval after disabling a
    single vif (bsc#1227149).
  - wifi: mt76: add support for providing eeprom in nvmem cells
    (bsc#1227149).
  - wifi: mt76: split get_of_eeprom in subfunction (bsc#1227149).
  - wifi: mt76: connac: add connac3 mac library (bsc#1227149).
  - mt76: connac: move more mt7921/mt7915 mac shared code in connac
    lib (bsc#1227149).
  - wifi: mt76: move ampdu_state in mt76_wcid (bsc#1227149).
  - commit 343ad65
  - wifi: mt76: mt7921: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit 72ca75a
  - wifi: mt76: mt7921: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7996: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7615: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7603: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7915: move poll_list in mt76_wcid (bsc#1227149).
  - wifi: mt76: mt7996: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7615: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7603: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7915: move sta_poll_list and sta_poll_lock in
    mt76_dev (bsc#1227149).
  - commit 2965d6e
  - wifi: mt76: mt7996: increase tx token size (bsc#1227149).
  - wifi: mt76: mt7996: add muru support (bsc#1227149).
  - wifi: mt76: connac: add support to set ifs time by mcu command
    (bsc#1227149).
  - wifi: mt76: mt7996: enable VHT extended NSS BW feature
    (bsc#1227149).
  - wifi: mt76: connac: add support for dsp firmware download
    (bsc#1227149).
  - wifi: mt76: mt7996: move radio ctrl commands to proper functions
    (bsc#1227149).
  - wifi: mt76: mt7921: get rid of MT7921_RESET_TIMEOUT marco
    (bsc#1227149).
  - mt76: mt7996: rely on mt76_sta_stats in mt76_wcid (bsc#1227149).
  - wifi: mt76: mt7921: make mt7921_mac_sta_poll static
    (bsc#1227149).
  - wifi: mt76: mt7996: disable WFDMA Tx/Rx during SER recovery
    (bsc#1227149).
  - commit fc1c367
  - Update config files: adjust for Arm CONFIG_MT798X_WMAC (bsc#1227149)
  - commit 5938ea9
  - wifi: mt76: mt7921: rely on mib_stats shared definition
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit a519a6e
  - wifi: mt76: mt7915: disable WFDMA Tx/Rx during SER recovery
    (bsc#1227149).
  - wifi: mt76: mt7921: Support temp sensor (bsc#1227149).
  - wifi: mt76: mt7915: accumulate mu-mimo ofdma muru stats
    (bsc#1227149).
  - wifi: mt76: add tx_nss histogram to ethtool stats (bsc#1227149).
  - wifi: mt76: mt7921e: report tx retries/failed counts in tx
    free event (bsc#1227149).
  - wifi: mt76: mt7915: add support for MT7981 (bsc#1227149).
  - wifi: mt76: mt7996: rely on mib_stats shared definition
    (bsc#1227149).
  - wifi: mt76: mt7915: move mib_stats structure in mt76.h
    (bsc#1227149).
  - wifi: mt76: mt7921: remove macro duplication in regs.h
    (bsc#1227149).
  - commit c307798
  - wifi: mt76: mt7915: report tx retries/failed counts for non-WED
    path (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7915-rework-tx-packets-counting-when-WED.patch.
  - commit 25e2b06
  - wifi: mt76: mt7996: enable BSS_CHANGED_MU_GROUPS support
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-update-beacon-size-limitation.patch.
  - commit b121af9
  - wifi: mt76: mt7996: drop return in mt7996_sta_statistics
    (bsc#1227149).
  - wifi: mt76: mt7915: drop return in mt7915_sta_statistics
    (bsc#1227149).
  - wifi: mt76: report non-binding skb tx rate when WED is active
    (bsc#1227149).
  - wifi: mt76: enable UNII-4 channel 177 support (bsc#1227149).
  - wifi: mt76: mt7615: enable BSS_CHANGED_MU_GROUPS support
    (bsc#1227149).
  - wifi: mt7601u: replace strlcpy() with strscpy() (bsc#1227149).
  - wifi: mt7601u: delete dead code checking debugfs returns
    (bsc#1227149).
  - commit 3625743
  - exfat: fix potential deadlock on __exfat_get_dentry_set
    (git-fixes).
  - commit aaa908a
  - media: venus: fix use after free in vdec_close (git-fixes).
  - media: venus: flush all buffers in output plane streamoff
    (git-fixes).
  - media: v4l: subdev: Fix typo in documentation (git-fixes).
  - media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
    (git-fixes).
  - media: renesas: vsp1: Store RPF partition configuration per
    RPF instance (git-fixes).
  - media: renesas: vsp1: Fix _irqsave and _irq mix (git-fixes).
  - media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2 (git-fixes).
  - media: imx-jpeg: Drop initial source change event if capture
    has been setup (git-fixes).
  - media: imx-jpeg: Remove some redundant error logs (git-fixes).
  - media: uvcvideo: Override default flags (git-fixes).
  - media: uvcvideo: Fix integer overflow calculating timestamp
    (git-fixes).
  - saa7134: Unchecked i2c_transfer function result fixed
    (git-fixes).
  - media: v4l: async: Fix NULL pointer dereference in adding
    ancillary links (git-fixes).
  - media: i2c: Fix imx412 exposure control (git-fixes).
  - media: imon: Fix race getting ictx->lock (git-fixes).
  - media: dvb-usb: Fix unexpected infinite loop in
    dvb_usb_read_remote_control() (git-fixes).
  - media: pci: ivtv: Add check for DMA map result (git-fixes).
  - leds: flash: leds-qcom-flash: Test the correct variable in init
    (git-fixes).
  - Revert "leds: led-core: Fix refcount leak in of_led_get()"
    (git-fixes).
  - leds: mt6360: Fix memory leak in mt6360_init_isnk_properties()
    (git-fixes).
  - leds: triggers: Flush pending brightness before activating
    trigger (git-fixes).
  - leds: ss4200: Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - leds: trigger: Unregister sysfs attributes before calling
    deactivate() (git-fixes).
  - mfd: omap-usb-tll: Use struct_size to allocate tll (git-fixes).
  - mfd: pm8008: Fix regmap irq chip initialisation (git-fixes).
  - ipmi: ssif_bmc: prevent integer overflow on 32bit systems
    (git-fixes).
  - ata: libata-scsi: Fix offsets for the fixed format sense data
    (git-fixes).
  - commit a8e6a5f
  - Update
    patches.suse/mptcp-ensure-snd_nxt-is-properly-initialized-on-conn.patch
    (CVE-2024-36889 bsc#1225746).
  - commit 98abb2b
  - mptcp: fix data races on remote_id (CVE-2024-27404 bsc#1224422)
  - commit ed12cfe

++++ kernel-default:

  - net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (CVE-2024-35934 bsc#1224641)
  - commit 812f420
  - net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893 bsc#1224512)
  - commit 5be3514
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated
    memory (bsc#1227762 CVE-2024-40901).
  - commit 5eb5075
  - btrfs: pass NOWAIT for set/clear extent bits as another bit
    (bsc#1223731 CVE-2024-26944).
  - commit 33253df
  - btrfs: drop NOFAIL from set_extent_bit allocation masks
    (bsc#1223731 CVE-2024-26944).
  - commit 46559ec
  - btrfs: open code set_extent_bits (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - Refresh
    patches.suse/btrfs-open-code-trivial-btrfs_add_excluded_extent.patch.
  - commit 460a0d4
  - xfs: fix log recovery buffer allocation for the legacy h_size
    fixup (bsc#1227432 CVE-2024-39472).
  - commit 04ef30f
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
    (CVE-2024-40953, bsc#1227806).
  - commit 60989df
  - Update config files (bsc#1227282).
    Update the CONFIG_LSM option to include the selinux LSM in the default set
    of LSMs. The selinux LSM will not get enabled because it is preceded by
    apparmor, which is the first exclusive LSM. Updating CONFIG_LSM resolves
    failures that result in the system not booting up when "security=selinux
    selinux=1" is passed to the kernel and SELinux policies are installed.
  - commit 0a95a78
  - xfs: use roundup_pow_of_two instead of ffs during xlog_find_tail
    (git-fixes).
  - commit 44812b1
  - wifi: mt76: connac: use muar idx 0xe for non-mt799x as well
    (bsc#1227149).
  - wifi: mt76: mt7996: fix potential memory leakage when reading
    chip temperature (bsc#1227149).
  - wifi: mt76: mt7996: fix uninitialized variable in
    mt7996_irq_tasklet() (bsc#1227149).
  - wifi: mt76: mt7925: ensure 4-byte alignment for suspend &
    wow command (bsc#1227149).
  - wifi: mt76: mt7996: fix size of txpower MCU command
    (bsc#1227149).
  - wifi: mt76: connac: check for null before dereferencing
    (bsc#1227149).
  - commit 4e5584e
  - wifi: mt76: Remove redundant assignment to variable tidno
    (bsc#1227149).
  - wifi: mt76: fix the issue of missing txpwr settings from ch153
    to ch177 (bsc#1227149).
  - wifi: mt76: mt7921: fix suspend issue on MediaTek COB platform
    (bsc#1227149).
  - wifi: mt76: mt7921: fix a potential association failure upon
    resuming (bsc#1227149).
  - wifi: mt76: mt7921: fix the unfinished command of regd_notifier
    before suspend (bsc#1227149).
  - wifi: mt76: mt792x: update the country list of EU for ACPI SAR
    (bsc#1227149).
  - wifi: mt76: mt7925e: fix use-after-free in free_irq()
    (bsc#1227149).
  - wifi: mt76: mt792x: add the illegal value check for mtcl table
    of acpi (bsc#1227149).
  - wifi: mt76: mt7925: fix the wrong data type for scan command
    (bsc#1227149).
  - wifi: mt76: set page_pool napi pointer for mmio devices
    (bsc#1227149).
  - wifi: mt76: mt792x: fix ethtool warning (bsc#1227149).
  - commit 3499113
  - wifi: mt76: connac: set correct muar_idx for mt799x chipsets
    (bsc#1227149).
  - wifi: mt76: mt7996: remove TXS queue setting (bsc#1227149).
  - wifi: mt76: mt7996: mark GCMP IGTK unsupported (bsc#1227149).
  - wifi: mt76: mt7996: ensure 4-byte alignment for beacon commands
    (bsc#1227149).
  - wifi: mt76: mt7996: check txs format before getting skb by pid
    (bsc#1227149).
  - wifi: mt76: mt7925: support temperature sensor (bsc#1227149).
  - wifi: mt76: mt7925: update PCIe DMA settings (bsc#1227149).
  - wifi: mt76: mt7925: add support to set ifs time by mcu command
    (bsc#1227149).
  - wifi: mt76: mt7925: add flow to avoid chip bt function fail
    (bsc#1227149).
  - wifi: mt76: mt7925: fix the wrong header translation config
    (bsc#1227149).
  - commit 7f22357
  - wifi: mt76: mt7925: fix WoW failed in encrypted mode
    (bsc#1227149).
  - wifi: mt76: mt7925: fix fw download fail (bsc#1227149).
  - wifi: mt76: mt7925: fix wmm queue mapping (bsc#1227149).
  - wifi: mt76: mt7925: fix mcu query command fail (bsc#1227149).
  - wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz
    band (bsc#1227149).
  - wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
    (bsc#1227149).
  - wifi: mt76: mt76x2u: add netgear wdna3100v3 to device table
    (bsc#1227149).
  - wifi: mt76: mt792xu: enable dmashdl support (bsc#1227149).
  - wifi: mt76: usb: store usb endpoint in mt76_queue (bsc#1227149).
  - wifi: mt76: usb: create a dedicated queue for psd traffic
    (bsc#1227149).
  - commit 01e1acb
  - wifi: mt76: mt7996: fix fw loading timeout (bsc#1227149).
  - wifi: mt76: mt7915: update mt798x_wmac_adie_patch_7976
    (bsc#1227149).
  - wifi: mt76: mt7915: add locking for accessing mapped registers
    (bsc#1227149).
  - wifi: mt76: mt7915: fix error recovery with WED enabled
    (bsc#1227149).
  - wifi: mt76: check txs format before getting skb by pid
    (bsc#1227149).
  - wifi: mt76: disable HW AMSDU when using fixed rate
    (bsc#1227149).
  - wifi: mt76: mt7996: fix fortify warning (bsc#1227149).
  - commit 0013ef2
  - wifi: fill in MODULE_DESCRIPTION()s for mt76 drivers
    (bsc#1227149).
  - wifi: mt76: mt7996: Use DECLARE_FLEX_ARRAY() and fix
  - Warray-bounds warnings (bsc#1227149).
  - wifi: mt76: mt7921: fix wrong 6Ghz power type (bsc#1227149).
  - wifi: mt76: mt7921: fix CLC command timeout when suspend/resume
    (bsc#1227149).
  - wifi: mt76: mt7921: reduce the size of MCU firmware download
    Rx queue (bsc#1227149).
  - wifi: mt76: mt7996: set DMA mask to 36 bits for boards with
    more than 4GB of RAM (bsc#1227149).
  - wifi: mt76: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: mt76: mt7925: remove iftype from mt7925_init_eht_caps
    signature (bsc#1227149).
  - wifi: mt76: connac: add new definition of tx descriptor
    (bsc#1227149).
  - wifi: mt76: mt7996: adjust interface num and wtbl size for
    mt7992 (bsc#1227149).
  - commit cbff43f
  - wifi: mt76: mt7996: support mt7992 eeprom loading (bsc#1227149).
  - wifi: mt76: mt7996: rework register offsets for mt7992
    (bsc#1227149).
  - wifi: mt76: mt7996: add DMA support for mt7992 (bsc#1227149).
  - wifi: mt76: connac: add firmware support for mt7992
    (bsc#1227149).
  - wifi: mt76: mt7996: introduce mt7996_band_valid() (bsc#1227149).
  - wifi: mt76: mt7996: fix mt7996_mcu_all_sta_info_event struct
    packing (bsc#1227149).
  - wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on 5 GHz band
    (bsc#1227149).
  - wifi: mt76: mt7915: fix EEPROM offset of TSSI flag on MT7981
    (bsc#1227149).
  - wifi: mt76: connac: add beacon protection support for mt7996
    (bsc#1227149).
  - wifi: mt76: mt7996: rework ampdu params setting (bsc#1227149).
  - commit 3e59fd6
  - wifi: mt76: mt7996: add txpower setting support (bsc#1227149).
  - commit fd1825a
  - wifi: mt76: mt7996: fix alignment of sta info event
    (bsc#1227149).
  - wifi: mt76: mt7996: switch to mcu command for TX GI report
    (bsc#1227149).
  - wifi: mt76: use chainmask for power delta calculation
    (bsc#1227149).
  - wifi: mt76: change txpower init to per-phy (bsc#1227149).
  - wifi: mt76: mt7996: align the format of fixed rate command
    (bsc#1227149).
  - wifi: mt76: mt7996: handle IEEE80211_RC_SMPS_CHANGED
    (bsc#1227149).
  - wifi: mt76: connac: set fixed_bw bit in TX descriptor for
    fixed rate frames (bsc#1227149).
  - wifi: mt76: mt7996: adjust WFDMA settings to improve performance
    (bsc#1227149).
  - wifi: mt76: connac: add beacon duplicate TX mode support for
    mt7996 (bsc#1227149).
  - commit e90dd6a
  - wifi: mt76: move wed reset common code in mt76 module
    (bsc#1227149).
  - commit b63457a
  - wifi: mt76: mt7996: add thermal sensor device support
    (bsc#1227149).
  - wifi: mt76: connac: add thermal protection support for mt7996
    (bsc#1227149).
  - wifi: mt76: mt7996: add TX statistics for EHT mode in debugfs
    (bsc#1227149).
  - wifi: mt76: mt7996: add support for variants with auxiliary
    RX path (bsc#1227149).
  - wifi: mt76: mt7996: use u16 for val field in mt7996_mcu_set_rro
    signature (bsc#1227149).
  - wifi: mt76: dma: introduce __mt76_dma_queue_reset utility
    routine (bsc#1227149).
  - commit dd57284
  - wifi: mt76: increase MT_QFLAG_WED_TYPE size (bsc#1227149).
  - wifi: mt76: introduce wed pointer in mt76_queue (bsc#1227149).
  - wifi: mt76: introduce mt76_queue_is_wed_tx_free utility routine
    (bsc#1227149).
  - wifi: mt76: move mt76_net_setup_tc in common code (bsc#1227149).
  - wifi: mt76: move mt76_mmio_wed_offload_{enable,disable} in
    common code (bsc#1227149).
  - wifi: mt76: mmio: move mt76_mmio_wed_{init,release}_rx_buf in
    common code (bsc#1227149).
  - wifi: mt76: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: mt76: permit to load precal from NVMEM cell for mt7915
    (bsc#1227149).
  - wifi: mt76: permit to use alternative cell name to eeprom
    NVMEM load (bsc#1227149).
  - commit 15e9dc7
  - wifi: mt76: mt7921: support 5.9/6GHz channel config in acpi
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit 915b272
  - wifi: mt76: make mt76_get_of_eeprom static again (bsc#1227149).
  - wifi: mt76: limit support of precal loading for mt7915 to MTD
    only (bsc#1227149).
  - wifi: mt76: fix typo in mt76_get_of_eeprom_from_nvmem function
    (bsc#1227149).
  - wifi: mt76: mt7996: fix uninitialized variable in parsing txfree
    (bsc#1227149).
  - wifi: mt76: add ability to explicitly forbid LED registration
    with DT (bsc#1227149).
  - wifi: mt76: mt7925: fix typo in mt7925_init_he_caps
    (bsc#1227149).
  - wifi: mt76: mt7921: fix 6GHz disabled by the missing default
    CLC config (bsc#1227149).
  - net: fill in MODULE_DESCRIPTION()s in kuba@'s modules
    (bsc#1227149).
  - wifi: mt76: mt7921: fix kernel panic by accessing invalid 6GHz
    channel info (bsc#1227149).
  - commit b106ffb
  - wifi: mt76: Annotate struct mt76_rx_tid with __counted_by
    (bsc#1227149).
  - commit aecab86
  - wifi: mt76: mt7921: update the channel usage when the regd
    domain changed (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit b09df3f
  - wifi: mt76: mt7921: get regulatory information from the clc
    event (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - commit 04b07d9
  - wifi: mt76: mt7921: add 6GHz power type support for clc
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - commit b7bb561
  - wifi: mt76: mt7921: enable set txpower for UNII-4 (bsc#1227149).
  - wifi: mt76: mt7921: move connac nic capability handling to
    mt7921 (bsc#1227149).
  - wifi: mt76: reduce spin_lock_bh held up in mt76_dma_rx_cleanup
    (bsc#1227149).
  - wifi: mt76: mt7996: remove periodic MPDU TXS request
    (bsc#1227149).
  - wifi: mt76: mt7996: enable PPDU-TxS to host (bsc#1227149).
  - wifi: mt76: mt7996: Add mcu commands for getting sta tx
    statistic (bsc#1227149).
  - commit e37a1c7
  - Update config files for mt76 stuff (bsc#1227149)
  - commit debbb92
  - wifi: mt76: connac: add MBSSID support for mt7996 (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-update-beacon-size-limitation.patch.
  - commit 54772eb
  - wifi: mt76: mt7996: get tx_retries and tx_failed from txfree
    (bsc#1227149).
  - wifi: mt76: mt792x: move some common usb code in mt792x module
    (bsc#1227149).
  - wifi: mt76: mt792x: move mt7921_skb_add_usb_sdio_hdr in mt792x
    module (bsc#1227149).
  - wifi: mt76: mt7915 add tc offloading support (bsc#1227149).
  - wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips
    (bsc#1227149).
  - wifi: mt76: mt7915: update mpdu density capability
    (bsc#1227149).
  - wifi: mt76: check vif type before reporting cca and csa
    (bsc#1227149).
  - wifi: mt76: check sta rx control frame to multibss capability
    (bsc#1227149).
  - wifi: mt76: Use PTR_ERR_OR_ZERO() to simplify code
    (bsc#1227149).
  - commit 2106e27
  - wifi: mt76: mt7996: support per-band LED control (bsc#1227149).
  - wifi: mt76: mt7996: support more options for
    mt7996_set_bitrate_mask() (bsc#1227149).
  - wifi: mt76: mt7996: only set vif teardown cmds at remove
    interface (bsc#1227149).
  - wifi: mt76: connac: add more unified event IDs (bsc#1227149).
  - wifi: mt76: connac: add more unified command IDs (bsc#1227149).
  - wifi: mt76: connac: add data field in struct tlv (bsc#1227149).
  - wifi: mt76: connac: add eht support for tx power (bsc#1227149).
  - wifi: mt76: connac: add eht support for phy mode config
    (bsc#1227149).
  - wifi: mt76: connac: export functions for mt7925 (bsc#1227149).
  - wifi: mt76: mt792x: support mt7925 chip init (bsc#1227149).
  - commit 135e742
  - wifi: mt76: connac: introduce helper for mt7925 chipset
    (bsc#1227149).
  - wifi: mt76: mt7915: fix monitor mode issues (bsc#1227149).
  - wifi: mt76: add DMA mapping error check in mt76_alloc_txwi()
    (bsc#1227149).
  - wifi: mt76: fix race condition related to checking tx queue
    fill status (bsc#1227149).
  - wifi: mt76: use atomic iface iteration for pre-TBTT work
    (bsc#1227149).
  - wifi: mt76: mt7603: disable A-MSDU tx support on MT7628
    (bsc#1227149).
  - wifi: mt76: mt7603: add missing register initialization for
    MT7628 (bsc#1227149).
  - commit 6594bb5
  - net: ethernet: mtk_wed: introduce mtk_wed_buf structure
    (bsc#1227149).
  - net: ethernet: mtk_wed: rename mtk_rxbm_desc in mtk_wed_bm_desc
    (bsc#1227149).
  - wifi: mt76: Replace strlcpy() with strscpy() (bsc#1227149).
  - wifi: mt76: mt76x02: fix return value check in
    mt76x02_mac_process_rx (bsc#1227149).
  - wifi: mt76: mt7921: move mt7921u_disconnect mt792x-lib
    (bsc#1227149).
  - wifi: mt76: mt7921: move mt7921_dma_init in pci.c (bsc#1227149).
  - wifi: mt76: mt792x: move MT7921_PM_TIMEOUT and
    MT7921_HW_SCAN_TIMEOUT in common code (bsc#1227149).
  - wifi: mt76: mt76_connac3: move lmac queue enumeration in
    mt76_connac3_mac.h (bsc#1227149).
  - wifi: mt76: mt792x: move mt7921_load_firmware in mt792x-lib
    module (bsc#1227149).
  - commit 1179b28
  - wifi: mt76: mt792x: introduce mt792x-usb module (bsc#1227149).
  - commit bb743ca
  - wifi: mt76: mt7921: move acpi_sar code in mt792x-lib module
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-country-count-limitation-for-CL.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-C.patch.
  - Refresh
    patches.suse/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch.
  - commit e00ae3f
  - wifi: mt76: mt7921: move runtime-pm pci code in mt792x-lib
    (bsc#1227149).
  - commit 35d834e
  - wifi: mt76: mt7921: move shared runtime-pm code on mt792x-lib
    (bsc#1227149).
  - commit 5efac2c
  - wifi: mt76: mt7921: move hif_ops macro in mt792x.h
    (bsc#1227149).
  - commit 945f2ed
  - wifi: mt76: mt792x: move more dma shared code in mt792x_dma
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - commit 4136c03
  - wifi: mt76: mt792x: introduce mt792x_irq_map (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921s-fix-potential-hung-tasks-during-ch.patch.
  - commit 94984c8
  - wifi: mt76: mt7921: move init shared code in mt792x-lib module
    (bsc#1227149).
  - wifi: mt76: mt7921: move debugfs shared code in mt792x-lib
    module (bsc#1227149).
  - wifi: mt76: mt7921: move dma shared code in mt792x-lib module
    (bsc#1227149).
  - commit 8138035
  - wifi: mt76: mt7921: move mac shared code in mt792x-lib module
    (bsc#1227149).
  - commit 118e960
  - wifi: mt76: mt792x: introduce mt792x-lib module (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit bba35bb
  - wifi: mt76: mt7921: move mt792x_hw_dev in mt792x.h
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit e5956d4
  - wifi: mt76: mt7921: move mt792x_mutex_{acquire/release} in
    mt792x.h (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit ea3046f
  - wifi: mt76: mt792x: move shared structure definition in mt792x.h
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit c60dc5e
  - wifi: mt76: mt7921: rename mt7921_dev in mt792x_dev
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch.
  - Refresh
    patches.suse/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch.
  - commit 845aa52
  - wifi: mt76: mt7921: rename mt7921_vif in mt792x_vif
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit d4d2c1b
  - wifi: mt76: mt7921: rename mt7921_hif_ops in mt792x_hif_ops
    (bsc#1227149).
  - wifi: mt76: mt7921: rename mt7921_phy in mt792x_phy
    (bsc#1227149).
  - wifi: mt76: mt7921: rename mt7921_sta in mt792x_sta
    (bsc#1227149).
  - commit 47cecdc
  - wifi: mt76: move rate info in mt76_vif (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - Refresh
    patches.suse/wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch.
  - commit 8909aa1
  - wifi: mt76: mt7921: convert acpisar and clc pointers to void
    (bsc#1227149).
  - wifi: mt76: mt7921: move common register definition in
    mt792x_regs.h (bsc#1227149).
  - wifi: mt76: mt7603: fix tx filter/flush function (bsc#1227149).
  - wifi: mt76: mt7603: fix beacon interval after disabling a
    single vif (bsc#1227149).
  - wifi: mt76: add support for providing eeprom in nvmem cells
    (bsc#1227149).
  - wifi: mt76: split get_of_eeprom in subfunction (bsc#1227149).
  - wifi: mt76: connac: add connac3 mac library (bsc#1227149).
  - mt76: connac: move more mt7921/mt7915 mac shared code in connac
    lib (bsc#1227149).
  - wifi: mt76: move ampdu_state in mt76_wcid (bsc#1227149).
  - commit 343ad65
  - wifi: mt76: mt7921: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit 72ca75a
  - wifi: mt76: mt7921: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7996: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7615: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7603: rely on shared poll_list field
    (bsc#1227149).
  - wifi: mt76: mt7915: move poll_list in mt76_wcid (bsc#1227149).
  - wifi: mt76: mt7996: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7615: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7603: rely on shared sta_poll_list and
    sta_poll_lock (bsc#1227149).
  - wifi: mt76: mt7915: move sta_poll_list and sta_poll_lock in
    mt76_dev (bsc#1227149).
  - commit 2965d6e
  - wifi: mt76: mt7996: increase tx token size (bsc#1227149).
  - wifi: mt76: mt7996: add muru support (bsc#1227149).
  - wifi: mt76: connac: add support to set ifs time by mcu command
    (bsc#1227149).
  - wifi: mt76: mt7996: enable VHT extended NSS BW feature
    (bsc#1227149).
  - wifi: mt76: connac: add support for dsp firmware download
    (bsc#1227149).
  - wifi: mt76: mt7996: move radio ctrl commands to proper functions
    (bsc#1227149).
  - wifi: mt76: mt7921: get rid of MT7921_RESET_TIMEOUT marco
    (bsc#1227149).
  - mt76: mt7996: rely on mt76_sta_stats in mt76_wcid (bsc#1227149).
  - wifi: mt76: mt7921: make mt7921_mac_sta_poll static
    (bsc#1227149).
  - wifi: mt76: mt7996: disable WFDMA Tx/Rx during SER recovery
    (bsc#1227149).
  - commit fc1c367
  - Update config files: adjust for Arm CONFIG_MT798X_WMAC (bsc#1227149)
  - commit 5938ea9
  - wifi: mt76: mt7921: rely on mib_stats shared definition
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-move-struct-ieee80211_chanctx_conf-up-to-s.patch.
  - commit a519a6e
  - wifi: mt76: mt7915: disable WFDMA Tx/Rx during SER recovery
    (bsc#1227149).
  - wifi: mt76: mt7921: Support temp sensor (bsc#1227149).
  - wifi: mt76: mt7915: accumulate mu-mimo ofdma muru stats
    (bsc#1227149).
  - wifi: mt76: add tx_nss histogram to ethtool stats (bsc#1227149).
  - wifi: mt76: mt7921e: report tx retries/failed counts in tx
    free event (bsc#1227149).
  - wifi: mt76: mt7915: add support for MT7981 (bsc#1227149).
  - wifi: mt76: mt7996: rely on mib_stats shared definition
    (bsc#1227149).
  - wifi: mt76: mt7915: move mib_stats structure in mt76.h
    (bsc#1227149).
  - wifi: mt76: mt7921: remove macro duplication in regs.h
    (bsc#1227149).
  - commit c307798
  - wifi: mt76: mt7915: report tx retries/failed counts for non-WED
    path (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-mt7915-rework-tx-packets-counting-when-WED.patch.
  - commit 25e2b06
  - wifi: mt76: mt7996: enable BSS_CHANGED_MU_GROUPS support
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mt76-update-beacon-size-limitation.patch.
  - commit b121af9
  - wifi: mt76: mt7996: drop return in mt7996_sta_statistics
    (bsc#1227149).
  - wifi: mt76: mt7915: drop return in mt7915_sta_statistics
    (bsc#1227149).
  - wifi: mt76: report non-binding skb tx rate when WED is active
    (bsc#1227149).
  - wifi: mt76: enable UNII-4 channel 177 support (bsc#1227149).
  - wifi: mt76: mt7615: enable BSS_CHANGED_MU_GROUPS support
    (bsc#1227149).
  - wifi: mt7601u: replace strlcpy() with strscpy() (bsc#1227149).
  - wifi: mt7601u: delete dead code checking debugfs returns
    (bsc#1227149).
  - commit 3625743
  - exfat: fix potential deadlock on __exfat_get_dentry_set
    (git-fixes).
  - commit aaa908a
  - media: venus: fix use after free in vdec_close (git-fixes).
  - media: venus: flush all buffers in output plane streamoff
    (git-fixes).
  - media: v4l: subdev: Fix typo in documentation (git-fixes).
  - media: imx-pxp: Fix ERR_PTR dereference in pxp_probe()
    (git-fixes).
  - media: renesas: vsp1: Store RPF partition configuration per
    RPF instance (git-fixes).
  - media: renesas: vsp1: Fix _irqsave and _irq mix (git-fixes).
  - media: rcar-vin: Fix YUYV8_1X16 handling for CSI-2 (git-fixes).
  - media: imx-jpeg: Drop initial source change event if capture
    has been setup (git-fixes).
  - media: imx-jpeg: Remove some redundant error logs (git-fixes).
  - media: uvcvideo: Override default flags (git-fixes).
  - media: uvcvideo: Fix integer overflow calculating timestamp
    (git-fixes).
  - saa7134: Unchecked i2c_transfer function result fixed
    (git-fixes).
  - media: v4l: async: Fix NULL pointer dereference in adding
    ancillary links (git-fixes).
  - media: i2c: Fix imx412 exposure control (git-fixes).
  - media: imon: Fix race getting ictx->lock (git-fixes).
  - media: dvb-usb: Fix unexpected infinite loop in
    dvb_usb_read_remote_control() (git-fixes).
  - media: pci: ivtv: Add check for DMA map result (git-fixes).
  - leds: flash: leds-qcom-flash: Test the correct variable in init
    (git-fixes).
  - Revert "leds: led-core: Fix refcount leak in of_led_get()"
    (git-fixes).
  - leds: mt6360: Fix memory leak in mt6360_init_isnk_properties()
    (git-fixes).
  - leds: triggers: Flush pending brightness before activating
    trigger (git-fixes).
  - leds: ss4200: Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - leds: trigger: Unregister sysfs attributes before calling
    deactivate() (git-fixes).
  - mfd: omap-usb-tll: Use struct_size to allocate tll (git-fixes).
  - mfd: pm8008: Fix regmap irq chip initialisation (git-fixes).
  - ipmi: ssif_bmc: prevent integer overflow on 32bit systems
    (git-fixes).
  - ata: libata-scsi: Fix offsets for the fixed format sense data
    (git-fixes).
  - commit a8e6a5f
  - Update
    patches.suse/mptcp-ensure-snd_nxt-is-properly-initialized-on-conn.patch
    (CVE-2024-36889 bsc#1225746).
  - commit 98abb2b
  - mptcp: fix data races on remote_id (CVE-2024-27404 bsc#1224422)
  - commit ed12cfe

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311-core:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

++++ python311:

  - Adding bso1227999-reproducible-builds.patch fixing bsc#1227999
    adding reproducibility patches from gh#python/cpython!121872
    and gh#python/cpython!121883.

------------------------------------------------------------------
------------------  2024-7-17  -  Jul 17 2024  -------------------
------------------------------------------------------------------

++++ docker-compose:

  - Update to version 2.29.0:
    * fix: typos
    * update docs generation to avoid man pages generation
    * bump compose-go to v2.1.4, buildx to v0.16.0, containerd to
    v1.7.19 and buildx to v0.15.0
    * restore setEnvWithDotEnv
    * empty env variable with no value must be unset in container
    * exclude unnecessary resources after services have been selected
    * change time for stale bot
    * Remove debug mode and run twice a week
    * Add stale workflow
    * update docs
    * feat(watch): Add --prune option to docker-compose watch command
    * Remove COMPOSE_MENU env from e2e tests
    * Use rawjson for the build backend.
    * Set logging format to JSON.
    * Format errors as JSON when in JSON progress mode.
    * Pass 'plain' instead of 'json' to build backend
    * Add JSON stream progress writer
    * go.mod: docker/cli, docker/docker v27.0.3
    * gha: test against docker v27.0.3
    * go.mod: docker/cli, docker/docker v27.0.2

++++ docker-compose:

  - Update to version 2.29.0:
    * fix: typos
    * update docs generation to avoid man pages generation
    * bump compose-go to v2.1.4, buildx to v0.16.0, containerd to
    v1.7.19 and buildx to v0.15.0
    * restore setEnvWithDotEnv
    * empty env variable with no value must be unset in container
    * exclude unnecessary resources after services have been selected
    * change time for stale bot
    * Remove debug mode and run twice a week
    * Add stale workflow
    * update docs
    * feat(watch): Add --prune option to docker-compose watch command
    * Remove COMPOSE_MENU env from e2e tests
    * Use rawjson for the build backend.
    * Set logging format to JSON.
    * Format errors as JSON when in JSON progress mode.
    * Pass 'plain' instead of 'json' to build backend
    * Add JSON stream progress writer
    * go.mod: docker/cli, docker/docker v27.0.3
    * gha: test against docker v27.0.3
    * go.mod: docker/cli, docker/docker v27.0.2

++++ docker-compose:

  - Update to version 2.29.0:
    * fix: typos
    * update docs generation to avoid man pages generation
    * bump compose-go to v2.1.4, buildx to v0.16.0, containerd to
    v1.7.19 and buildx to v0.15.0
    * restore setEnvWithDotEnv
    * empty env variable with no value must be unset in container
    * exclude unnecessary resources after services have been selected
    * change time for stale bot
    * Remove debug mode and run twice a week
    * Add stale workflow
    * update docs
    * feat(watch): Add --prune option to docker-compose watch command
    * Remove COMPOSE_MENU env from e2e tests
    * Use rawjson for the build backend.
    * Set logging format to JSON.
    * Format errors as JSON when in JSON progress mode.
    * Pass 'plain' instead of 'json' to build backend
    * Add JSON stream progress writer
    * go.mod: docker/cli, docker/docker v27.0.3
    * gha: test against docker v27.0.3
    * go.mod: docker/cli, docker/docker v27.0.2

++++ python-kiwi:

  - Pass kernel cmdline to agama
    In the agama integration test make sure to pass along
    the kernel boot parameters to allow controlling the
    behavior of agama better

++++ python-kiwi:

  - Pass kernel cmdline to agama
    In the agama integration test make sure to pass along
    the kernel boot parameters to allow controlling the
    behavior of agama better

++++ python-kiwi:

  - Pass kernel cmdline to agama
    In the agama integration test make sure to pass along
    the kernel boot parameters to allow controlling the
    behavior of agama better

++++ kernel-default:

  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020 bsc#1223815)
  - commit 79c457d
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019 bsc#1223813)
  - commit 73c5c5f
  - btrfs: open code set_extent_bits_nowait (bsc#1223731
    CVE-2024-26944).
  - commit da5e600
  - btrfs: open code set_extent_dirty (bsc#1223731 CVE-2024-26944).
  - commit 3076056
  - btrfs: open code set_extent_new (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - commit 3afda0a
  - mm/page_table_check: fix crash on ZONE_DEVICE (CVE-2024-40948
    bsc#1227801).
  - commit 69b3c59
  - btrfs: open code set_extent_delalloc (bsc#1223731
    CVE-2024-26944).
  - btrfs: open code set_extent_defrag (bsc#1223731 CVE-2024-26944).
  - commit 646bcad
  - btrfs: use btrfs_next_item() at scrub.c:find_first_extent_item()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: unexport extent_map_block_end() (bsc#1223731
    CVE-2024-26944).
  - btrfs: split assert into two different asserts when removing
    block group (bsc#1223731 CVE-2024-26944).
  - btrfs: mark sanity checks when getting chunk map as unlikely
    (bsc#1223731 CVE-2024-26944).
  - commit b0dd338
  - gro: fix ownership transfer (CVE-2024-35890 bsc#1224516).
  - commit 8c57ce0
  - mptcp: ensure snd_nxt is properly initialized on connect
    (CVE-2024-36889).
  - commit 724d285
  - ipv6: fib6_rules: avoid possible NULL dereference in
    fib6_rule_action() (CVE-2024-36902 bsc#1225719).
  - commit d8c5ba2
  - phonet: fix rtm_phonet_notify() skb allocation (CVE-2024-36946
    bsc#1225851).
  - commit a878203
  - r8169: Fix possible ring buffer corruption on fragmented Tx
    packets (CVE-2024-38586 bsc#1226750).
  - commit 1324b27
  - btrfs: zoned: factor out DUP bg handling from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: factor out single bg handling from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: factor out per-zone logic from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: introduce a zone_info struct in
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - commit f06e144
  - wifi: virt_wifi: don't use strlen() in const context
    (git-fixes).
  - commit b4154c8
  - wifi: rtw89: Fix array index mistake in
    rtw89_sta_info_get_iter() (git-fixes).
  - wifi: rtl8xxxu: 8188f: Limit TX power index (git-fixes).
  - wifi: rtw89: 8852b: fix definition of KIP register number
    (git-fixes).
  - wifi: mac80211: chanctx emulation set CHANGE_CHANNEL when
    in_reconfig (git-fixes).
  - wifi: virt_wifi: avoid reporting connection success with wrong
    SSID (git-fixes).
  - wifi: ath12k: fix peer metadata parsing (git-fixes).
  - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
    (git-fixes).
  - wifi: ath11k: fix RCU documentation in
    ath11k_mac_op_ipv6_changed() (git-fixes).
  - wifi: iwlwifi: mvm: don't limit VLP/AFC to UATS-enabled
    (git-fixes).
  - wifi: iwlwifi: fix iwl_mvm_get_valid_rx_ant() (git-fixes).
  - wifi: mac80211: correcty limit wider BW TDLS STAs (git-fixes).
  - wifi: mac80211: add ieee80211_tdls_sta_link_id() (stable-fixes).
  - commit 949fcca
  - wifi: cfg80211: handle 2x996 RU allocation in
    cfg80211_calculate_bitrate_he() (git-fixes).
  - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
    (git-fixes).
  - wifi: ath12k: fix wrong definition of CE ring's base address
    (git-fixes).
  - wifi: ath11k: fix wrong definition of CE ring's base address
    (git-fixes).
  - wifi: ath12k: fix firmware crash during reo reinject
    (git-fixes).
  - wifi: ath12k: fix invalid memory access while processing
    fragmented packets (git-fixes).
  - wifi: ath12k: change DMA direction while mapping reinjected
    packets (git-fixes).
  - wifi: ath11k: restore country code during resume (git-fixes).
  - wifi: ath11k: refactor setting country code logic
    (stable-fixes).
  - wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure
    (git-fixes).
  - wifi: ath12k: Correct 6 GHz frequency value in rx status
    (git-fixes).
  - wifi: ath12k: avoid duplicated vdev stop (git-fixes).
  - wifi: ath12k: drop failed transmitted frames from metric
    calculation (git-fixes).
  - wifi: ath12k: Don't drop tx_status in failure case (git-fixes).
  - wifi: rtw89: fix HW scan not aborting properly (git-fixes).
  - commit 7f555ea
  - wifi: mac80211: reset negotiated TTLM on disconnect (git-fixes).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit e02cbd1
  - wifi: mac80211: cancel multi-link reconf work on disconnect
    (git-fixes).
  - wifi: mwifiex: Fix interface type change (git-fixes).
  - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
    (git-fixes).
  - vmlinux.lds.h: catch .bss..L* sections into BSS") (git-fixes).
  - wifi: mac80211: Recalc offload when monitor stop (git-fixes).
  - commit 0c5d63e
  - Bluetooth: hci_event: Set QoS encryption from BIGInfo report
    (git-fixes).
  - Bluetooth: btnxpuart: Add handling for boot-signature timeout
    errors (git-fixes).
  - Bluetooth: btintel: Refactor btintel_set_ppag() (git-fixes).
  - Bluetooth: hci_bcm4377: Use correct unit for timeouts
    (git-fixes).
  - lib: objagg: Fix general protection fault (git-fixes).
  - lib: test_objagg: Fix spelling (git-fixes).
  - lib: objagg: Fix spelling (git-fixes).
  - cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe()
    (git-fixes).
  - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared
    memory CPPC systems (git-fixes).
  - firmware: turris-mox-rwtm: Initialize completion before mailbox
    (git-fixes).
  - firmware: turris-mox-rwtm: Fix checking return value of
    wait_for_completion_timeout() (git-fixes).
  - firmware: turris-mox-rwtm: Do not complete if there are no
    waiters (git-fixes).
  - drivers: soc: xilinx: check return status of get_api_version()
    (git-fixes).
  - soc: xilinx: rename cpu_number1 to dummy_cpu_number (git-fixes).
  - soc: qcom: pdr: fix parsing of domains lists (git-fixes).
  - soc: qcom: pdr: protect locator_addr with the main mutex
    (git-fixes).
  - soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by
    rpmh_rsc_send_data() callers (git-fixes).
  - soc: qcom: pmic_glink: Handle the return value of
    pmic_glink_init (git-fixes).
  - commit aea26b0

++++ kernel-default:

  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020 bsc#1223815)
  - commit 79c457d
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019 bsc#1223813)
  - commit 73c5c5f
  - btrfs: open code set_extent_bits_nowait (bsc#1223731
    CVE-2024-26944).
  - commit da5e600
  - btrfs: open code set_extent_dirty (bsc#1223731 CVE-2024-26944).
  - commit 3076056
  - btrfs: open code set_extent_new (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - commit 3afda0a
  - mm/page_table_check: fix crash on ZONE_DEVICE (CVE-2024-40948
    bsc#1227801).
  - commit 69b3c59
  - btrfs: open code set_extent_delalloc (bsc#1223731
    CVE-2024-26944).
  - btrfs: open code set_extent_defrag (bsc#1223731 CVE-2024-26944).
  - commit 646bcad
  - btrfs: use btrfs_next_item() at scrub.c:find_first_extent_item()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: unexport extent_map_block_end() (bsc#1223731
    CVE-2024-26944).
  - btrfs: split assert into two different asserts when removing
    block group (bsc#1223731 CVE-2024-26944).
  - btrfs: mark sanity checks when getting chunk map as unlikely
    (bsc#1223731 CVE-2024-26944).
  - commit b0dd338
  - gro: fix ownership transfer (CVE-2024-35890 bsc#1224516).
  - commit 8c57ce0
  - mptcp: ensure snd_nxt is properly initialized on connect
    (CVE-2024-36889).
  - commit 724d285
  - ipv6: fib6_rules: avoid possible NULL dereference in
    fib6_rule_action() (CVE-2024-36902 bsc#1225719).
  - commit d8c5ba2
  - phonet: fix rtm_phonet_notify() skb allocation (CVE-2024-36946
    bsc#1225851).
  - commit a878203
  - r8169: Fix possible ring buffer corruption on fragmented Tx
    packets (CVE-2024-38586 bsc#1226750).
  - commit 1324b27
  - btrfs: zoned: factor out DUP bg handling from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: factor out single bg handling from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: factor out per-zone logic from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: introduce a zone_info struct in
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - commit f06e144
  - wifi: virt_wifi: don't use strlen() in const context
    (git-fixes).
  - commit b4154c8
  - wifi: rtw89: Fix array index mistake in
    rtw89_sta_info_get_iter() (git-fixes).
  - wifi: rtl8xxxu: 8188f: Limit TX power index (git-fixes).
  - wifi: rtw89: 8852b: fix definition of KIP register number
    (git-fixes).
  - wifi: mac80211: chanctx emulation set CHANGE_CHANNEL when
    in_reconfig (git-fixes).
  - wifi: virt_wifi: avoid reporting connection success with wrong
    SSID (git-fixes).
  - wifi: ath12k: fix peer metadata parsing (git-fixes).
  - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
    (git-fixes).
  - wifi: ath11k: fix RCU documentation in
    ath11k_mac_op_ipv6_changed() (git-fixes).
  - wifi: iwlwifi: mvm: don't limit VLP/AFC to UATS-enabled
    (git-fixes).
  - wifi: iwlwifi: fix iwl_mvm_get_valid_rx_ant() (git-fixes).
  - wifi: mac80211: correcty limit wider BW TDLS STAs (git-fixes).
  - wifi: mac80211: add ieee80211_tdls_sta_link_id() (stable-fixes).
  - commit 949fcca
  - wifi: cfg80211: handle 2x996 RU allocation in
    cfg80211_calculate_bitrate_he() (git-fixes).
  - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
    (git-fixes).
  - wifi: ath12k: fix wrong definition of CE ring's base address
    (git-fixes).
  - wifi: ath11k: fix wrong definition of CE ring's base address
    (git-fixes).
  - wifi: ath12k: fix firmware crash during reo reinject
    (git-fixes).
  - wifi: ath12k: fix invalid memory access while processing
    fragmented packets (git-fixes).
  - wifi: ath12k: change DMA direction while mapping reinjected
    packets (git-fixes).
  - wifi: ath11k: restore country code during resume (git-fixes).
  - wifi: ath11k: refactor setting country code logic
    (stable-fixes).
  - wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure
    (git-fixes).
  - wifi: ath12k: Correct 6 GHz frequency value in rx status
    (git-fixes).
  - wifi: ath12k: avoid duplicated vdev stop (git-fixes).
  - wifi: ath12k: drop failed transmitted frames from metric
    calculation (git-fixes).
  - wifi: ath12k: Don't drop tx_status in failure case (git-fixes).
  - wifi: rtw89: fix HW scan not aborting properly (git-fixes).
  - commit 7f555ea
  - wifi: mac80211: reset negotiated TTLM on disconnect (git-fixes).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit e02cbd1
  - wifi: mac80211: cancel multi-link reconf work on disconnect
    (git-fixes).
  - wifi: mwifiex: Fix interface type change (git-fixes).
  - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
    (git-fixes).
  - vmlinux.lds.h: catch .bss..L* sections into BSS") (git-fixes).
  - wifi: mac80211: Recalc offload when monitor stop (git-fixes).
  - commit 0c5d63e
  - Bluetooth: hci_event: Set QoS encryption from BIGInfo report
    (git-fixes).
  - Bluetooth: btnxpuart: Add handling for boot-signature timeout
    errors (git-fixes).
  - Bluetooth: btintel: Refactor btintel_set_ppag() (git-fixes).
  - Bluetooth: hci_bcm4377: Use correct unit for timeouts
    (git-fixes).
  - lib: objagg: Fix general protection fault (git-fixes).
  - lib: test_objagg: Fix spelling (git-fixes).
  - lib: objagg: Fix spelling (git-fixes).
  - cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe()
    (git-fixes).
  - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared
    memory CPPC systems (git-fixes).
  - firmware: turris-mox-rwtm: Initialize completion before mailbox
    (git-fixes).
  - firmware: turris-mox-rwtm: Fix checking return value of
    wait_for_completion_timeout() (git-fixes).
  - firmware: turris-mox-rwtm: Do not complete if there are no
    waiters (git-fixes).
  - drivers: soc: xilinx: check return status of get_api_version()
    (git-fixes).
  - soc: xilinx: rename cpu_number1 to dummy_cpu_number (git-fixes).
  - soc: qcom: pdr: fix parsing of domains lists (git-fixes).
  - soc: qcom: pdr: protect locator_addr with the main mutex
    (git-fixes).
  - soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by
    rpmh_rsc_send_data() callers (git-fixes).
  - soc: qcom: pmic_glink: Handle the return value of
    pmic_glink_init (git-fixes).
  - commit aea26b0

++++ kernel-default:

  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020 bsc#1223815)
  - commit 79c457d
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019 bsc#1223813)
  - commit 73c5c5f
  - btrfs: open code set_extent_bits_nowait (bsc#1223731
    CVE-2024-26944).
  - commit da5e600
  - btrfs: open code set_extent_dirty (bsc#1223731 CVE-2024-26944).
  - commit 3076056
  - btrfs: open code set_extent_new (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-make-find_first_extent_bit-return-a-boolean.patch.
  - commit 3afda0a
  - mm/page_table_check: fix crash on ZONE_DEVICE (CVE-2024-40948
    bsc#1227801).
  - commit 69b3c59
  - btrfs: open code set_extent_delalloc (bsc#1223731
    CVE-2024-26944).
  - btrfs: open code set_extent_defrag (bsc#1223731 CVE-2024-26944).
  - commit 646bcad
  - btrfs: use btrfs_next_item() at scrub.c:find_first_extent_item()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: unexport extent_map_block_end() (bsc#1223731
    CVE-2024-26944).
  - btrfs: split assert into two different asserts when removing
    block group (bsc#1223731 CVE-2024-26944).
  - btrfs: mark sanity checks when getting chunk map as unlikely
    (bsc#1223731 CVE-2024-26944).
  - commit b0dd338
  - gro: fix ownership transfer (CVE-2024-35890 bsc#1224516).
  - commit 8c57ce0
  - mptcp: ensure snd_nxt is properly initialized on connect
    (CVE-2024-36889).
  - commit 724d285
  - ipv6: fib6_rules: avoid possible NULL dereference in
    fib6_rule_action() (CVE-2024-36902 bsc#1225719).
  - commit d8c5ba2
  - phonet: fix rtm_phonet_notify() skb allocation (CVE-2024-36946
    bsc#1225851).
  - commit a878203
  - r8169: Fix possible ring buffer corruption on fragmented Tx
    packets (CVE-2024-38586 bsc#1226750).
  - commit 1324b27
  - btrfs: zoned: factor out DUP bg handling from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: factor out single bg handling from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: factor out per-zone logic from
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: introduce a zone_info struct in
    btrfs_load_block_group_zone_info (bsc#1223731 CVE-2024-26944).
  - commit f06e144
  - wifi: virt_wifi: don't use strlen() in const context
    (git-fixes).
  - commit b4154c8
  - wifi: rtw89: Fix array index mistake in
    rtw89_sta_info_get_iter() (git-fixes).
  - wifi: rtl8xxxu: 8188f: Limit TX power index (git-fixes).
  - wifi: rtw89: 8852b: fix definition of KIP register number
    (git-fixes).
  - wifi: mac80211: chanctx emulation set CHANGE_CHANNEL when
    in_reconfig (git-fixes).
  - wifi: virt_wifi: avoid reporting connection success with wrong
    SSID (git-fixes).
  - wifi: ath12k: fix peer metadata parsing (git-fixes).
  - wifi: ath11k: fix wrong handling of CCMP256 and GCMP ciphers
    (git-fixes).
  - wifi: ath11k: fix RCU documentation in
    ath11k_mac_op_ipv6_changed() (git-fixes).
  - wifi: iwlwifi: mvm: don't limit VLP/AFC to UATS-enabled
    (git-fixes).
  - wifi: iwlwifi: fix iwl_mvm_get_valid_rx_ant() (git-fixes).
  - wifi: mac80211: correcty limit wider BW TDLS STAs (git-fixes).
  - wifi: mac80211: add ieee80211_tdls_sta_link_id() (stable-fixes).
  - commit 949fcca
  - wifi: cfg80211: handle 2x996 RU allocation in
    cfg80211_calculate_bitrate_he() (git-fixes).
  - wifi: cfg80211: fix typo in cfg80211_calculate_bitrate_he()
    (git-fixes).
  - wifi: ath12k: fix wrong definition of CE ring's base address
    (git-fixes).
  - wifi: ath11k: fix wrong definition of CE ring's base address
    (git-fixes).
  - wifi: ath12k: fix firmware crash during reo reinject
    (git-fixes).
  - wifi: ath12k: fix invalid memory access while processing
    fragmented packets (git-fixes).
  - wifi: ath12k: change DMA direction while mapping reinjected
    packets (git-fixes).
  - wifi: ath11k: restore country code during resume (git-fixes).
  - wifi: ath11k: refactor setting country code logic
    (stable-fixes).
  - wifi: ath12k: Fix tx completion ring (WBM2SW) setup failure
    (git-fixes).
  - wifi: ath12k: Correct 6 GHz frequency value in rx status
    (git-fixes).
  - wifi: ath12k: avoid duplicated vdev stop (git-fixes).
  - wifi: ath12k: drop failed transmitted frames from metric
    calculation (git-fixes).
  - wifi: ath12k: Don't drop tx_status in failure case (git-fixes).
  - wifi: rtw89: fix HW scan not aborting properly (git-fixes).
  - commit 7f555ea
  - wifi: mac80211: reset negotiated TTLM on disconnect (git-fixes).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit e02cbd1
  - wifi: mac80211: cancel multi-link reconf work on disconnect
    (git-fixes).
  - wifi: mwifiex: Fix interface type change (git-fixes).
  - wifi: brcmsmac: LCN PHY code is used for BCM4313 2G-only device
    (git-fixes).
  - vmlinux.lds.h: catch .bss..L* sections into BSS") (git-fixes).
  - wifi: mac80211: Recalc offload when monitor stop (git-fixes).
  - commit 0c5d63e
  - Bluetooth: hci_event: Set QoS encryption from BIGInfo report
    (git-fixes).
  - Bluetooth: btnxpuart: Add handling for boot-signature timeout
    errors (git-fixes).
  - Bluetooth: btintel: Refactor btintel_set_ppag() (git-fixes).
  - Bluetooth: hci_bcm4377: Use correct unit for timeouts
    (git-fixes).
  - lib: objagg: Fix general protection fault (git-fixes).
  - lib: test_objagg: Fix spelling (git-fixes).
  - lib: objagg: Fix spelling (git-fixes).
  - cpufreq: ti-cpufreq: Handle deferred probe with dev_err_probe()
    (git-fixes).
  - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared
    memory CPPC systems (git-fixes).
  - firmware: turris-mox-rwtm: Initialize completion before mailbox
    (git-fixes).
  - firmware: turris-mox-rwtm: Fix checking return value of
    wait_for_completion_timeout() (git-fixes).
  - firmware: turris-mox-rwtm: Do not complete if there are no
    waiters (git-fixes).
  - drivers: soc: xilinx: check return status of get_api_version()
    (git-fixes).
  - soc: xilinx: rename cpu_number1 to dummy_cpu_number (git-fixes).
  - soc: qcom: pdr: fix parsing of domains lists (git-fixes).
  - soc: qcom: pdr: protect locator_addr with the main mutex
    (git-fixes).
  - soc: qcom: rpmh-rsc: Ensure irqs aren't disabled by
    rpmh_rsc_send_data() callers (git-fixes).
  - soc: qcom: pmic_glink: Handle the return value of
    pmic_glink_init (git-fixes).
  - commit aea26b0

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ openssl-3:

  - Build with enabled sm2 and sm4 support [bsc#1222899]

++++ systemd:

  - Import commit 8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b...8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f

++++ systemd:

  - Import commit 8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b...8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f

++++ systemd:

  - Import commit 8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b...8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f

++++ systemd:

  - Import commit 8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b...8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f

++++ systemd:

  - Import commit 8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b...8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f

++++ systemd:

  - Import commit 8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b...8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f

++++ systemd:

  - Import commit 8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f (merge of v254.15)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b...8acd7e2a9524d0a8db7976b4e1f10d6f0bd0441f

++++ selinux-policy:

  - Update to version 20230523+git16.0849f54c:
    * allow firewalld access to /dev/random and write HW acceleration logs
    (bsc#1215405, bsc#1227930)

++++ selinux-policy:

  - Update to version 20230523+git16.0849f54c:
    * allow firewalld access to /dev/random and write HW acceleration logs
    (bsc#1215405, bsc#1227930)

++++ selinux-policy:

  - Update to version 20230523+git16.0849f54c:
    * allow firewalld access to /dev/random and write HW acceleration logs
    (bsc#1215405, bsc#1227930)

++++ selinux-policy:

  - Update to version 20230523+git16.0849f54c:
    * allow firewalld access to /dev/random and write HW acceleration logs
    (bsc#1215405, bsc#1227930)

++++ selinux-policy:

  - Update to version 20230523+git16.0849f54c:
    * allow firewalld access to /dev/random and write HW acceleration logs
    (bsc#1215405, bsc#1227930)

++++ selinux-policy:

  - Update to version 20230523+git16.0849f54c:
    * allow firewalld access to /dev/random and write HW acceleration logs
    (bsc#1215405, bsc#1227930)

------------------------------------------------------------------
------------------  2024-7-16  -  Jul 16 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ curl:

  - Security fix: [bsc#1227888, CVE-2024-6197]
    * Freeing stack buffer in utf8asn1str
    * x509asn1: remove superfluous free()
    * Add curl-CVE-2024-6197.patch

++++ transactional-update:

  - It seems it's taking a longer time until the tests will be
    adopted to the new reboot behavior. Disable soft-reboot for now
    to unblock the regular transactional-update update.

++++ transactional-update:

  - It seems it's taking a longer time until the tests will be
    adopted to the new reboot behavior. Disable soft-reboot for now
    to unblock the regular transactional-update update.

++++ kernel-default:

  - blacklist.conf: add 54cbc058d86b
    commit 54cbc058d86b ("fs/aio: Make io_cancel() generate completions
    again") was later reverted upstream by commit 28468cbed92e, so blacklist
    it.
  - commit bc9be4f
  - btrfs: remove the need_raid_map parameter from btrfs_map_block()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: skip splitting and logical rewriting on pre-alloc
    write (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: do not zone finish data relocation block group
    (bsc#1223731 CVE-2024-26944).
  - btrfs: add comments for btrfs_map_block() (bsc#1223731
    CVE-2024-26944).
  - commit 0c47c71
  - Revert "gfs2: fix glock shrinker ref issues" (git-fixes).
  - commit f7bfdba
  - gfs2: Fix "ignore unlock failures after withdraw" (git-fixes).
  - commit 519ac22
  - gfs2: Don't forget to complete delayed withdraw (git-fixes).
  - commit 7f71d47
  - gfs2: Fix invalid metadata access in punch_hole (git-fixes).
  - commit 1be0540
  - gfs2: Rename gfs2_lookup_{ simple => meta } (git-fixes).
  - commit d7e53ef
  - gfs2: Use mapping->gfp_mask for metadata inodes (git-fixes).
  - commit 78503fa
  - gfs2: convert to ctime accessor functions (git-fixes).
  - commit b024418
  - gfs2: Get rid of gfs2_alloc_blocks generation parameter
    (git-fixes).
  - commit e229d26
  - dlm: fix user space lock decision to copy lvb (git-fixes).
  - commit 9a5eade
  - ocfs2: fix DIO failure due to insufficient transaction credits
    (git-fixes).
  - commit cf885b6
  - ocfs2: use coarse time for new created files (git-fixes).
  - commit 61f3cb7
  - ocfs2: fix races between hole punching and AIO+DIO (git-fixes).
  - commit bdcd35b
  - filelock: fix potential use-after-free in posix_lock_inode
    (git-fixes).
  - commit 4ceada4
  - fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()
    (git-fixes).
  - commit 047ac8f
  - tracefs: Add missing lockdown check to tracefs_create_dir()
    (git-fixes).
  - commit 65b8efc
  - f2fs: fix error path of __f2fs_build_free_nids (git-fixes).
  - commit 6c1efec
  - btrfs: zoned: re-enable metadata over-commit for zoned mode
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: don't activate non-DATA BG on allocation
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: no longer count fresh BG region as zone unusable
    (bsc#1223731 CVE-2024-26944).
  - commit cc48fd8
  - smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103,
    CVE-2024-39468).
  - commit 1548cc0
  - orangefs: fix out-of-bounds fsid access (git-fixes).
  - commit 8d69475
  - btrfs: zoned: activate metadata block group on write time
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: reserve zones for an active metadata/system
    block group (bsc#1223731 CVE-2024-26944).
  - commit 00c0b10
  - btrfs: zoned: update meta write pointer on zone finish
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: defer advancing meta write pointer (bsc#1223731
    CVE-2024-26944).
  - commit 9625328
  - net/mlx5: Always stop health timer during driver removal
    (CVE-2024-40906 bsc#1227763).
  - commit 3630f6e
  - btrfs: zoned: return int from btrfs_check_meta_write_pointer
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: introduce block group context to
    btrfs_eb_write_context (bsc#1223731 CVE-2024-26944).
  - btrfs: introduce struct to consolidate extent buffer write
    context (bsc#1223731 CVE-2024-26944).
  - commit d8f8b66
  - btrfs: zoned: use vcalloc instead of for vzalloc in
    btrfs_get_dev_zone_info (bsc#1223731 CVE-2024-26944).
  - commit 4837f02
  - btrfs: open code need_full_stripe conditions (bsc#1223731
    CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-be-a-bit-more-careful-when-setting-mirror.patch.
  - commit 0011c1e
  - nilfs2: fix incorrect inode allocation from reserved inodes
    (git-fixes).
  - commit 9ce9b3c
  - nilfs2: convert persistent object allocator to use kmap_local
    (git-fixes).
  - commit dc36fd2
  - netfilter: nf_tables: restore set elements when delete set fails
    (CVE-2024-27012 bsc#1223804).
  - commit 8ba3bb4
  - jffs2: Fix potential illegal address access in jffs2_free_inode
    (git-fixes).
  - commit 282ccaf
  - hfsplus: fix to avoid false alarm of circular locking
    (git-fixes).
  - commit 490432a
  - btrfs: open code btrfs_map_sblock (bsc#1223731 CVE-2024-26944).
  - commit 5fa5c99
  - btrfs: rename __btrfs_map_block to btrfs_map_block (bsc#1223731
    CVE-2024-26944).
  - commit de51f30
  - btrfs: remove unused btrfs_map_block (bsc#1223731
    CVE-2024-26944).
  - commit 0ff7c2f
  - btrfs: optimize simple reads in btrfsic_map_block (bsc#1223731
    CVE-2024-26944).
  - commit 3260913
  - btrfs: remove unused BTRFS_MAP_DISCARD (bsc#1223731
    CVE-2024-26944).
  - commit 68b562a
  - btrfs: pass the new logical address to split_extent_map
    (bsc#1223731 CVE-2024-26944).
  - commit c2e8884
  - btrfs: defer splitting of ordered extents until I/O completion
    (bsc#1223731 CVE-2024-26944).
  - commit 5ae3e38
  - btrfs: handle completed ordered extents in
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit ddd9e87
  - btrfs: atomically insert the new extent in
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit 4030656
  - btrfs: split btrfs_alloc_ordered_extent to allocation and
    insertion helpers (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0002-btrfs-fix-qgroup_free_reserved_data-int-overflow.patch.
  - commit e1bc1c4
  - drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 (bsc#1227723 CVE-2024-39498)
  - commit bb19e55
  - btrfs: return the new ordered_extent from
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit c61ece3
  - btrfs: reorder conditions in btrfs_extract_ordered_extent
    (bsc#1223731 CVE-2024-26944).
  - commit 7ad1725
  - btrfs: move split_extent_map to extent_map.c (bsc#1223731
    CVE-2024-26944).
  - commit 4667690
  - btrfs: record orig_physical only for the original bio
    (bsc#1223731 CVE-2024-26944).
  - commit f1ddea8
  - btrfs: optimize the logical to physical mapping for zoned writes
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0002-btrfs-fix-qgroup_free_reserved_data-int-overflow.patch.
  - commit 59cfe96
  - ionic: fix use after netif_napi_del() (CVE-2024-39502
    bsc#1227755).
  - commit a8905bd
  - netfilter: flowtable: validate pppoe header (CVE-2024-27016
    bsc#1223807).
  - commit 4c0256f
  - i40e: fix: remove needless retries of NVM update (bsc#1227736).
  - commit df4f038
  - spi: spi-microchip-core: Fix the number of chip selects
    supported (git-fixes).
  - spi: atmel-quadspi: Add missing check for clk_prepare
    (git-fixes).
  - gpio: mc33880: Convert comma to semicolon (git-fixes).
  - pwm: stm32: Always do lazy disabling (git-fixes).
  - hwmon: (max6697) Fix swapped temp{1,8} critical alarms
    (git-fixes).
  - hwmon: (max6697) Fix underflow when writing limit attributes
    (git-fixes).
  - hwmon: (adt7475) Fix default duty on fan is disabled
    (git-fixes).
  - platform/chrome: cros_ec_debugfs: fix wrong EC message version
    (git-fixes).
  - char: tpm: Fix possible memory leak in
    tpm_bios_measurements_open() (git-fixes).
  - tools/memory-model: Fix bug in lock.cat (git-fixes).
  - drm/gma500: fix null pointer dereference in
    cdv_intel_lvds_get_modes (git-fixes).
  - drm/gma500: fix null pointer dereference in
    psb_intel_lvds_get_modes (git-fixes).
  - drm/meson: fix canvas release in bind function (git-fixes).
  - commit 027008e
  - Move upstreamed patches into sorted section
  - commit da52786
  - ipv6: prevent NULL dereference in ip6_output() (CVE-2024-36901 bsc#1225711)
  - commit 299bf13
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004 bsc#1224545)
  - commit 42d6eee
  - nbd: null check for nla_nest_start (CVE-2024-27025 bsc#1223778)
  - commit a23796b

++++ kernel-default:

  - blacklist.conf: add 54cbc058d86b
    commit 54cbc058d86b ("fs/aio: Make io_cancel() generate completions
    again") was later reverted upstream by commit 28468cbed92e, so blacklist
    it.
  - commit bc9be4f
  - btrfs: remove the need_raid_map parameter from btrfs_map_block()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: skip splitting and logical rewriting on pre-alloc
    write (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: do not zone finish data relocation block group
    (bsc#1223731 CVE-2024-26944).
  - btrfs: add comments for btrfs_map_block() (bsc#1223731
    CVE-2024-26944).
  - commit 0c47c71
  - Revert "gfs2: fix glock shrinker ref issues" (git-fixes).
  - commit f7bfdba
  - gfs2: Fix "ignore unlock failures after withdraw" (git-fixes).
  - commit 519ac22
  - gfs2: Don't forget to complete delayed withdraw (git-fixes).
  - commit 7f71d47
  - gfs2: Fix invalid metadata access in punch_hole (git-fixes).
  - commit 1be0540
  - gfs2: Rename gfs2_lookup_{ simple => meta } (git-fixes).
  - commit d7e53ef
  - gfs2: Use mapping->gfp_mask for metadata inodes (git-fixes).
  - commit 78503fa
  - gfs2: convert to ctime accessor functions (git-fixes).
  - commit b024418
  - gfs2: Get rid of gfs2_alloc_blocks generation parameter
    (git-fixes).
  - commit e229d26
  - dlm: fix user space lock decision to copy lvb (git-fixes).
  - commit 9a5eade
  - ocfs2: fix DIO failure due to insufficient transaction credits
    (git-fixes).
  - commit cf885b6
  - ocfs2: use coarse time for new created files (git-fixes).
  - commit 61f3cb7
  - ocfs2: fix races between hole punching and AIO+DIO (git-fixes).
  - commit bdcd35b
  - filelock: fix potential use-after-free in posix_lock_inode
    (git-fixes).
  - commit 4ceada4
  - fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()
    (git-fixes).
  - commit 047ac8f
  - tracefs: Add missing lockdown check to tracefs_create_dir()
    (git-fixes).
  - commit 65b8efc
  - f2fs: fix error path of __f2fs_build_free_nids (git-fixes).
  - commit 6c1efec
  - btrfs: zoned: re-enable metadata over-commit for zoned mode
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: don't activate non-DATA BG on allocation
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: no longer count fresh BG region as zone unusable
    (bsc#1223731 CVE-2024-26944).
  - commit cc48fd8
  - smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103,
    CVE-2024-39468).
  - commit 1548cc0
  - orangefs: fix out-of-bounds fsid access (git-fixes).
  - commit 8d69475
  - btrfs: zoned: activate metadata block group on write time
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: reserve zones for an active metadata/system
    block group (bsc#1223731 CVE-2024-26944).
  - commit 00c0b10
  - btrfs: zoned: update meta write pointer on zone finish
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: defer advancing meta write pointer (bsc#1223731
    CVE-2024-26944).
  - commit 9625328
  - net/mlx5: Always stop health timer during driver removal
    (CVE-2024-40906 bsc#1227763).
  - commit 3630f6e
  - btrfs: zoned: return int from btrfs_check_meta_write_pointer
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: introduce block group context to
    btrfs_eb_write_context (bsc#1223731 CVE-2024-26944).
  - btrfs: introduce struct to consolidate extent buffer write
    context (bsc#1223731 CVE-2024-26944).
  - commit d8f8b66
  - btrfs: zoned: use vcalloc instead of for vzalloc in
    btrfs_get_dev_zone_info (bsc#1223731 CVE-2024-26944).
  - commit 4837f02
  - btrfs: open code need_full_stripe conditions (bsc#1223731
    CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-be-a-bit-more-careful-when-setting-mirror.patch.
  - commit 0011c1e
  - nilfs2: fix incorrect inode allocation from reserved inodes
    (git-fixes).
  - commit 9ce9b3c
  - nilfs2: convert persistent object allocator to use kmap_local
    (git-fixes).
  - commit dc36fd2
  - netfilter: nf_tables: restore set elements when delete set fails
    (CVE-2024-27012 bsc#1223804).
  - commit 8ba3bb4
  - jffs2: Fix potential illegal address access in jffs2_free_inode
    (git-fixes).
  - commit 282ccaf
  - hfsplus: fix to avoid false alarm of circular locking
    (git-fixes).
  - commit 490432a
  - btrfs: open code btrfs_map_sblock (bsc#1223731 CVE-2024-26944).
  - commit 5fa5c99
  - btrfs: rename __btrfs_map_block to btrfs_map_block (bsc#1223731
    CVE-2024-26944).
  - commit de51f30
  - btrfs: remove unused btrfs_map_block (bsc#1223731
    CVE-2024-26944).
  - commit 0ff7c2f
  - btrfs: optimize simple reads in btrfsic_map_block (bsc#1223731
    CVE-2024-26944).
  - commit 3260913
  - btrfs: remove unused BTRFS_MAP_DISCARD (bsc#1223731
    CVE-2024-26944).
  - commit 68b562a
  - btrfs: pass the new logical address to split_extent_map
    (bsc#1223731 CVE-2024-26944).
  - commit c2e8884
  - btrfs: defer splitting of ordered extents until I/O completion
    (bsc#1223731 CVE-2024-26944).
  - commit 5ae3e38
  - btrfs: handle completed ordered extents in
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit ddd9e87
  - btrfs: atomically insert the new extent in
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit 4030656
  - btrfs: split btrfs_alloc_ordered_extent to allocation and
    insertion helpers (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0002-btrfs-fix-qgroup_free_reserved_data-int-overflow.patch.
  - commit e1bc1c4
  - drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 (bsc#1227723 CVE-2024-39498)
  - commit bb19e55
  - btrfs: return the new ordered_extent from
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit c61ece3
  - btrfs: reorder conditions in btrfs_extract_ordered_extent
    (bsc#1223731 CVE-2024-26944).
  - commit 7ad1725
  - btrfs: move split_extent_map to extent_map.c (bsc#1223731
    CVE-2024-26944).
  - commit 4667690
  - btrfs: record orig_physical only for the original bio
    (bsc#1223731 CVE-2024-26944).
  - commit f1ddea8
  - btrfs: optimize the logical to physical mapping for zoned writes
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0002-btrfs-fix-qgroup_free_reserved_data-int-overflow.patch.
  - commit 59cfe96
  - ionic: fix use after netif_napi_del() (CVE-2024-39502
    bsc#1227755).
  - commit a8905bd
  - netfilter: flowtable: validate pppoe header (CVE-2024-27016
    bsc#1223807).
  - commit 4c0256f
  - i40e: fix: remove needless retries of NVM update (bsc#1227736).
  - commit df4f038
  - spi: spi-microchip-core: Fix the number of chip selects
    supported (git-fixes).
  - spi: atmel-quadspi: Add missing check for clk_prepare
    (git-fixes).
  - gpio: mc33880: Convert comma to semicolon (git-fixes).
  - pwm: stm32: Always do lazy disabling (git-fixes).
  - hwmon: (max6697) Fix swapped temp{1,8} critical alarms
    (git-fixes).
  - hwmon: (max6697) Fix underflow when writing limit attributes
    (git-fixes).
  - hwmon: (adt7475) Fix default duty on fan is disabled
    (git-fixes).
  - platform/chrome: cros_ec_debugfs: fix wrong EC message version
    (git-fixes).
  - char: tpm: Fix possible memory leak in
    tpm_bios_measurements_open() (git-fixes).
  - tools/memory-model: Fix bug in lock.cat (git-fixes).
  - drm/gma500: fix null pointer dereference in
    cdv_intel_lvds_get_modes (git-fixes).
  - drm/gma500: fix null pointer dereference in
    psb_intel_lvds_get_modes (git-fixes).
  - drm/meson: fix canvas release in bind function (git-fixes).
  - commit 027008e
  - Move upstreamed patches into sorted section
  - commit da52786
  - ipv6: prevent NULL dereference in ip6_output() (CVE-2024-36901 bsc#1225711)
  - commit 299bf13
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004 bsc#1224545)
  - commit 42d6eee
  - nbd: null check for nla_nest_start (CVE-2024-27025 bsc#1223778)
  - commit a23796b

++++ kernel-default:

  - blacklist.conf: add 54cbc058d86b
    commit 54cbc058d86b ("fs/aio: Make io_cancel() generate completions
    again") was later reverted upstream by commit 28468cbed92e, so blacklist
    it.
  - commit bc9be4f
  - btrfs: remove the need_raid_map parameter from btrfs_map_block()
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: skip splitting and logical rewriting on pre-alloc
    write (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: do not zone finish data relocation block group
    (bsc#1223731 CVE-2024-26944).
  - btrfs: add comments for btrfs_map_block() (bsc#1223731
    CVE-2024-26944).
  - commit 0c47c71
  - Revert "gfs2: fix glock shrinker ref issues" (git-fixes).
  - commit f7bfdba
  - gfs2: Fix "ignore unlock failures after withdraw" (git-fixes).
  - commit 519ac22
  - gfs2: Don't forget to complete delayed withdraw (git-fixes).
  - commit 7f71d47
  - gfs2: Fix invalid metadata access in punch_hole (git-fixes).
  - commit 1be0540
  - gfs2: Rename gfs2_lookup_{ simple => meta } (git-fixes).
  - commit d7e53ef
  - gfs2: Use mapping->gfp_mask for metadata inodes (git-fixes).
  - commit 78503fa
  - gfs2: convert to ctime accessor functions (git-fixes).
  - commit b024418
  - gfs2: Get rid of gfs2_alloc_blocks generation parameter
    (git-fixes).
  - commit e229d26
  - dlm: fix user space lock decision to copy lvb (git-fixes).
  - commit 9a5eade
  - ocfs2: fix DIO failure due to insufficient transaction credits
    (git-fixes).
  - commit cf885b6
  - ocfs2: use coarse time for new created files (git-fixes).
  - commit 61f3cb7
  - ocfs2: fix races between hole punching and AIO+DIO (git-fixes).
  - commit bdcd35b
  - filelock: fix potential use-after-free in posix_lock_inode
    (git-fixes).
  - commit 4ceada4
  - fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()
    (git-fixes).
  - commit 047ac8f
  - tracefs: Add missing lockdown check to tracefs_create_dir()
    (git-fixes).
  - commit 65b8efc
  - f2fs: fix error path of __f2fs_build_free_nids (git-fixes).
  - commit 6c1efec
  - btrfs: zoned: re-enable metadata over-commit for zoned mode
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: don't activate non-DATA BG on allocation
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: no longer count fresh BG region as zone unusable
    (bsc#1223731 CVE-2024-26944).
  - commit cc48fd8
  - smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103,
    CVE-2024-39468).
  - commit 1548cc0
  - orangefs: fix out-of-bounds fsid access (git-fixes).
  - commit 8d69475
  - btrfs: zoned: activate metadata block group on write time
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: reserve zones for an active metadata/system
    block group (bsc#1223731 CVE-2024-26944).
  - commit 00c0b10
  - btrfs: zoned: update meta write pointer on zone finish
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: defer advancing meta write pointer (bsc#1223731
    CVE-2024-26944).
  - commit 9625328
  - net/mlx5: Always stop health timer during driver removal
    (CVE-2024-40906 bsc#1227763).
  - commit 3630f6e
  - btrfs: zoned: return int from btrfs_check_meta_write_pointer
    (bsc#1223731 CVE-2024-26944).
  - btrfs: zoned: introduce block group context to
    btrfs_eb_write_context (bsc#1223731 CVE-2024-26944).
  - btrfs: introduce struct to consolidate extent buffer write
    context (bsc#1223731 CVE-2024-26944).
  - commit d8f8b66
  - btrfs: zoned: use vcalloc instead of for vzalloc in
    btrfs_get_dev_zone_info (bsc#1223731 CVE-2024-26944).
  - commit 4837f02
  - btrfs: open code need_full_stripe conditions (bsc#1223731
    CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-be-a-bit-more-careful-when-setting-mirror.patch.
  - commit 0011c1e
  - nilfs2: fix incorrect inode allocation from reserved inodes
    (git-fixes).
  - commit 9ce9b3c
  - nilfs2: convert persistent object allocator to use kmap_local
    (git-fixes).
  - commit dc36fd2
  - netfilter: nf_tables: restore set elements when delete set fails
    (CVE-2024-27012 bsc#1223804).
  - commit 8ba3bb4
  - jffs2: Fix potential illegal address access in jffs2_free_inode
    (git-fixes).
  - commit 282ccaf
  - hfsplus: fix to avoid false alarm of circular locking
    (git-fixes).
  - commit 490432a
  - btrfs: open code btrfs_map_sblock (bsc#1223731 CVE-2024-26944).
  - commit 5fa5c99
  - btrfs: rename __btrfs_map_block to btrfs_map_block (bsc#1223731
    CVE-2024-26944).
  - commit de51f30
  - btrfs: remove unused btrfs_map_block (bsc#1223731
    CVE-2024-26944).
  - commit 0ff7c2f
  - btrfs: optimize simple reads in btrfsic_map_block (bsc#1223731
    CVE-2024-26944).
  - commit 3260913
  - btrfs: remove unused BTRFS_MAP_DISCARD (bsc#1223731
    CVE-2024-26944).
  - commit 68b562a
  - btrfs: pass the new logical address to split_extent_map
    (bsc#1223731 CVE-2024-26944).
  - commit c2e8884
  - btrfs: defer splitting of ordered extents until I/O completion
    (bsc#1223731 CVE-2024-26944).
  - commit 5ae3e38
  - btrfs: handle completed ordered extents in
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit ddd9e87
  - btrfs: atomically insert the new extent in
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit 4030656
  - btrfs: split btrfs_alloc_ordered_extent to allocation and
    insertion helpers (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0002-btrfs-fix-qgroup_free_reserved_data-int-overflow.patch.
  - commit e1bc1c4
  - drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 (bsc#1227723 CVE-2024-39498)
  - commit bb19e55
  - btrfs: return the new ordered_extent from
    btrfs_split_ordered_extent (bsc#1223731 CVE-2024-26944).
  - commit c61ece3
  - btrfs: reorder conditions in btrfs_extract_ordered_extent
    (bsc#1223731 CVE-2024-26944).
  - commit 7ad1725
  - btrfs: move split_extent_map to extent_map.c (bsc#1223731
    CVE-2024-26944).
  - commit 4667690
  - btrfs: record orig_physical only for the original bio
    (bsc#1223731 CVE-2024-26944).
  - commit f1ddea8
  - btrfs: optimize the logical to physical mapping for zoned writes
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0002-btrfs-fix-qgroup_free_reserved_data-int-overflow.patch.
  - commit 59cfe96
  - ionic: fix use after netif_napi_del() (CVE-2024-39502
    bsc#1227755).
  - commit a8905bd
  - netfilter: flowtable: validate pppoe header (CVE-2024-27016
    bsc#1223807).
  - commit 4c0256f
  - i40e: fix: remove needless retries of NVM update (bsc#1227736).
  - commit df4f038
  - spi: spi-microchip-core: Fix the number of chip selects
    supported (git-fixes).
  - spi: atmel-quadspi: Add missing check for clk_prepare
    (git-fixes).
  - gpio: mc33880: Convert comma to semicolon (git-fixes).
  - pwm: stm32: Always do lazy disabling (git-fixes).
  - hwmon: (max6697) Fix swapped temp{1,8} critical alarms
    (git-fixes).
  - hwmon: (max6697) Fix underflow when writing limit attributes
    (git-fixes).
  - hwmon: (adt7475) Fix default duty on fan is disabled
    (git-fixes).
  - platform/chrome: cros_ec_debugfs: fix wrong EC message version
    (git-fixes).
  - char: tpm: Fix possible memory leak in
    tpm_bios_measurements_open() (git-fixes).
  - tools/memory-model: Fix bug in lock.cat (git-fixes).
  - drm/gma500: fix null pointer dereference in
    cdv_intel_lvds_get_modes (git-fixes).
  - drm/gma500: fix null pointer dereference in
    psb_intel_lvds_get_modes (git-fixes).
  - drm/meson: fix canvas release in bind function (git-fixes).
  - commit 027008e
  - Move upstreamed patches into sorted section
  - commit da52786
  - ipv6: prevent NULL dereference in ip6_output() (CVE-2024-36901 bsc#1225711)
  - commit 299bf13
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004 bsc#1224545)
  - commit 42d6eee
  - nbd: null check for nla_nest_start (CVE-2024-27025 bsc#1223778)
  - commit a23796b

------------------------------------------------------------------
------------------  2024-7-15  -  Jul 15 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add <file> directive to incorporate custom files
    Usually custom files are managed by placing them as overlay
    files or archives. However, overlay files must be structured
    inside of a root/ subdirectory and archive files are binary
    data. It is therefore not straight forward to just reference
    one or more files as source files to the image description
    to be placed into the image. This commit adds a new <file>
    element which allows to do this. This Fixes #1953

++++ python-kiwi:

  - Add <file> directive to incorporate custom files
    Usually custom files are managed by placing them as overlay
    files or archives. However, overlay files must be structured
    inside of a root/ subdirectory and archive files are binary
    data. It is therefore not straight forward to just reference
    one or more files as source files to the image description
    to be placed into the image. This commit adds a new <file>
    element which allows to do this. This Fixes #1953

++++ python-kiwi:

  - Add <file> directive to incorporate custom files
    Usually custom files are managed by placing them as overlay
    files or archives. However, overlay files must be structured
    inside of a root/ subdirectory and archive files are binary
    data. It is therefore not straight forward to just reference
    one or more files as source files to the image description
    to be placed into the image. This commit adds a new <file>
    element which allows to do this. This Fixes #1953

++++ kernel-default:

  - btrfs: rename the bytenr field in struct btrfs_ordered_sum to
    logical (bsc#1223731 CVE-2024-26944).
  - btrfs: mark the len field in struct btrfs_ordered_sum as
    unsigned (bsc#1223731 CVE-2024-26944).
  - btrfs: don't call btrfs_record_physical_zoned for failed append
    (bsc#1223731 CVE-2024-26944).
  - btrfs: optimize out btrfs_is_zoned for !CONFIG_BLK_DEV_ZONED
    (bsc#1223731 CVE-2024-26944).
  - commit 7e64d12
  - btrfs: use SECTOR_SHIFT to convert LBA to physical offset
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-don-t-warn-if-discard-range-is-not-aligned-to-.patch.
  - commit ad23354
  - btrfs: don't hold an extra reference for redirtied buffers
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0003-btrfs-free-qgroup-pertrans-reserve-on-transaction-ab.patch.
  - commit 47897b2
  - btrfs: export bitmap_test_range_all_{set,zero} (bsc#1223731
    CVE-2024-26944).
  - commit fcba900
  - Update patch reference for ath12k fix (CVE-2024-40979 bsc#1227855)
  - commit 0463455
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
    (CVE-2024-35853 bsc#1224604).
  - commit d46e600
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during
    activity update (CVE-2024-35854 bsc#1224636).
  - commit 7cd7b18
  - phonet/pep: fix racy skb_queue_empty() use (CVE-2024-27402
    bsc#1224414).
  - commit 9f9d7b5
  - kprobe/ftrace: fix build error due to bad function definition
    (git-fixes).
  - commit 16bb0c0
  - net: prevent mss overflow in skb_segment() (CVE-2023-52435
    bsc#1220138).
  - commit b718cb4
  - netfilter: nf_tables: do not compare internal table flags on
    updates (CVE-2024-27065 bsc#1223836).
  - commit 0e49dd8
  - tracing/net_sched: NULL pointer dereference in
    perf_trace_qdisc_reset() (git-fixes).
  - commit c773566
  - tracing: Build event generation tests only as modules
    (git-fixes).
  - commit dd7f603
  - usb: ucsi: stm32: fix command completion handling (git-fixes).
  - commit 3155170
  - Bluetooth: qca: set power_ctrl_enabled on NULL returned by
    gpiod_get_optional() (git-fixes).
  - commit 3a34099
  - cachefiles: add output string to
    cachefiles_obj_[get|put]_ondemand_fd (git-fixes).
  - commit 12446de
  - iommu/vt-d: Allocate DMAR fault interrupts locally
    (bsc#1224767).
  - commit 85bf7e2
  - iommu/amd: Fix panic accessing amd_iommu_enable_faulting
    (bsc#1224767).
  - commit 567c8c9
  - netfilter: flowtable: incorrect pppoe tuple (CVE-2024-27015
    bsc#1223806).
  - commit e834f51
  - netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
    (CVE-2024-27064 bsc#1223740).
  - commit daf6634
  - blacklist.conf: feature, not fix
  - commit 7a64b31
  - kprobe/ftrace: bail out if ftrace was killed (git-fixes).
  - commit 43ba702
  - tipc: Check the bearer type before calling
    tipc_udp_nl_bearer_add() (CVE-2024-26663 bsc#1222326).
  - commit fff5ef3
  - blacklist.conf: add not-relevant tracing fixes
  - commit b158327
  - Update
    patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
    (bsc#1222893).
  - commit eebb09a
  - wifi: ath11k: Add coldboot calibration support for QCN9074
    (bsc#1227149).
  - wifi: ath11k: Split coldboot calibration hw_param (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-boot-failure-with-one-MSI-vector.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit e553d75
  - wifi: ath9k: avoid using uninitialized array (bsc#1227149).
  - Refresh patches.suse/wifi-ath9k-fix-fortify-warnings.patch.
  - commit 7a06512
  - iommu: Fix compilation without CONFIG_IOMMU_INTEL (git-fixes).
  - commit dcdbf4a
  - wifi: mt76: mt7615: add missing chanctx ops (bsc#1227149).
  - wifi: mt76: mt7915: add missing chanctx ops (bsc#1227149).
  - commit 5e9fc63

++++ kernel-default:

  - btrfs: rename the bytenr field in struct btrfs_ordered_sum to
    logical (bsc#1223731 CVE-2024-26944).
  - btrfs: mark the len field in struct btrfs_ordered_sum as
    unsigned (bsc#1223731 CVE-2024-26944).
  - btrfs: don't call btrfs_record_physical_zoned for failed append
    (bsc#1223731 CVE-2024-26944).
  - btrfs: optimize out btrfs_is_zoned for !CONFIG_BLK_DEV_ZONED
    (bsc#1223731 CVE-2024-26944).
  - commit 7e64d12
  - btrfs: use SECTOR_SHIFT to convert LBA to physical offset
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-don-t-warn-if-discard-range-is-not-aligned-to-.patch.
  - commit ad23354
  - btrfs: don't hold an extra reference for redirtied buffers
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0003-btrfs-free-qgroup-pertrans-reserve-on-transaction-ab.patch.
  - commit 47897b2
  - btrfs: export bitmap_test_range_all_{set,zero} (bsc#1223731
    CVE-2024-26944).
  - commit fcba900
  - Update patch reference for ath12k fix (CVE-2024-40979 bsc#1227855)
  - commit 0463455
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
    (CVE-2024-35853 bsc#1224604).
  - commit d46e600
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during
    activity update (CVE-2024-35854 bsc#1224636).
  - commit 7cd7b18
  - phonet/pep: fix racy skb_queue_empty() use (CVE-2024-27402
    bsc#1224414).
  - commit 9f9d7b5
  - kprobe/ftrace: fix build error due to bad function definition
    (git-fixes).
  - commit 16bb0c0
  - net: prevent mss overflow in skb_segment() (CVE-2023-52435
    bsc#1220138).
  - commit b718cb4
  - netfilter: nf_tables: do not compare internal table flags on
    updates (CVE-2024-27065 bsc#1223836).
  - commit 0e49dd8
  - tracing/net_sched: NULL pointer dereference in
    perf_trace_qdisc_reset() (git-fixes).
  - commit c773566
  - tracing: Build event generation tests only as modules
    (git-fixes).
  - commit dd7f603
  - usb: ucsi: stm32: fix command completion handling (git-fixes).
  - commit 3155170
  - Bluetooth: qca: set power_ctrl_enabled on NULL returned by
    gpiod_get_optional() (git-fixes).
  - commit 3a34099
  - cachefiles: add output string to
    cachefiles_obj_[get|put]_ondemand_fd (git-fixes).
  - commit 12446de
  - iommu/vt-d: Allocate DMAR fault interrupts locally
    (bsc#1224767).
  - commit 85bf7e2
  - iommu/amd: Fix panic accessing amd_iommu_enable_faulting
    (bsc#1224767).
  - commit 567c8c9
  - netfilter: flowtable: incorrect pppoe tuple (CVE-2024-27015
    bsc#1223806).
  - commit e834f51
  - netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
    (CVE-2024-27064 bsc#1223740).
  - commit daf6634
  - blacklist.conf: feature, not fix
  - commit 7a64b31
  - kprobe/ftrace: bail out if ftrace was killed (git-fixes).
  - commit 43ba702
  - tipc: Check the bearer type before calling
    tipc_udp_nl_bearer_add() (CVE-2024-26663 bsc#1222326).
  - commit fff5ef3
  - blacklist.conf: add not-relevant tracing fixes
  - commit b158327
  - Update
    patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
    (bsc#1222893).
  - commit eebb09a
  - wifi: ath11k: Add coldboot calibration support for QCN9074
    (bsc#1227149).
  - wifi: ath11k: Split coldboot calibration hw_param (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-boot-failure-with-one-MSI-vector.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit e553d75
  - wifi: ath9k: avoid using uninitialized array (bsc#1227149).
  - Refresh patches.suse/wifi-ath9k-fix-fortify-warnings.patch.
  - commit 7a06512
  - iommu: Fix compilation without CONFIG_IOMMU_INTEL (git-fixes).
  - commit dcdbf4a
  - wifi: mt76: mt7615: add missing chanctx ops (bsc#1227149).
  - wifi: mt76: mt7915: add missing chanctx ops (bsc#1227149).
  - commit 5e9fc63

++++ kernel-default:

  - btrfs: rename the bytenr field in struct btrfs_ordered_sum to
    logical (bsc#1223731 CVE-2024-26944).
  - btrfs: mark the len field in struct btrfs_ordered_sum as
    unsigned (bsc#1223731 CVE-2024-26944).
  - btrfs: don't call btrfs_record_physical_zoned for failed append
    (bsc#1223731 CVE-2024-26944).
  - btrfs: optimize out btrfs_is_zoned for !CONFIG_BLK_DEV_ZONED
    (bsc#1223731 CVE-2024-26944).
  - commit 7e64d12
  - btrfs: use SECTOR_SHIFT to convert LBA to physical offset
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/btrfs-don-t-warn-if-discard-range-is-not-aligned-to-.patch.
  - commit ad23354
  - btrfs: don't hold an extra reference for redirtied buffers
    (bsc#1223731 CVE-2024-26944).
  - Refresh
    patches.suse/0003-btrfs-free-qgroup-pertrans-reserve-on-transaction-ab.patch.
  - commit 47897b2
  - btrfs: export bitmap_test_range_all_{set,zero} (bsc#1223731
    CVE-2024-26944).
  - commit fcba900
  - Update patch reference for ath12k fix (CVE-2024-40979 bsc#1227855)
  - commit 0463455
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
    (CVE-2024-35853 bsc#1224604).
  - commit d46e600
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during
    activity update (CVE-2024-35854 bsc#1224636).
  - commit 7cd7b18
  - phonet/pep: fix racy skb_queue_empty() use (CVE-2024-27402
    bsc#1224414).
  - commit 9f9d7b5
  - kprobe/ftrace: fix build error due to bad function definition
    (git-fixes).
  - commit 16bb0c0
  - net: prevent mss overflow in skb_segment() (CVE-2023-52435
    bsc#1220138).
  - commit b718cb4
  - netfilter: nf_tables: do not compare internal table flags on
    updates (CVE-2024-27065 bsc#1223836).
  - commit 0e49dd8
  - tracing/net_sched: NULL pointer dereference in
    perf_trace_qdisc_reset() (git-fixes).
  - commit c773566
  - tracing: Build event generation tests only as modules
    (git-fixes).
  - commit dd7f603
  - usb: ucsi: stm32: fix command completion handling (git-fixes).
  - commit 3155170
  - Bluetooth: qca: set power_ctrl_enabled on NULL returned by
    gpiod_get_optional() (git-fixes).
  - commit 3a34099
  - cachefiles: add output string to
    cachefiles_obj_[get|put]_ondemand_fd (git-fixes).
  - commit 12446de
  - iommu/vt-d: Allocate DMAR fault interrupts locally
    (bsc#1224767).
  - commit 85bf7e2
  - iommu/amd: Fix panic accessing amd_iommu_enable_faulting
    (bsc#1224767).
  - commit 567c8c9
  - netfilter: flowtable: incorrect pppoe tuple (CVE-2024-27015
    bsc#1223806).
  - commit e834f51
  - netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
    (CVE-2024-27064 bsc#1223740).
  - commit daf6634
  - blacklist.conf: feature, not fix
  - commit 7a64b31
  - kprobe/ftrace: bail out if ftrace was killed (git-fixes).
  - commit 43ba702
  - tipc: Check the bearer type before calling
    tipc_udp_nl_bearer_add() (CVE-2024-26663 bsc#1222326).
  - commit fff5ef3
  - blacklist.conf: add not-relevant tracing fixes
  - commit b158327
  - Update
    patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
    (bsc#1222893).
  - commit eebb09a
  - wifi: ath11k: Add coldboot calibration support for QCN9074
    (bsc#1227149).
  - wifi: ath11k: Split coldboot calibration hw_param (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-boot-failure-with-one-MSI-vector.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit e553d75
  - wifi: ath9k: avoid using uninitialized array (bsc#1227149).
  - Refresh patches.suse/wifi-ath9k-fix-fortify-warnings.patch.
  - commit 7a06512
  - iommu: Fix compilation without CONFIG_IOMMU_INTEL (git-fixes).
  - commit dcdbf4a
  - wifi: mt76: mt7615: add missing chanctx ops (bsc#1227149).
  - wifi: mt76: mt7915: add missing chanctx ops (bsc#1227149).
  - commit 5e9fc63

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ openssl-3:

  - Add reproducible.patch to fix bsc#1223336
    aes-gcm-avx512.pl: fix non-reproducibility issue

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311-core:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ libzypp:

  - Translation: updated .pot file.
  - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793)
    Older zypp-plugins reject stomp headers including a '-'. Like the
    'content-length' header we may send.
  - Fix int overflow in Provider (fixes #559)
    This patch fixes an issue in safe_strtonum which caused
    timestamps to overflow in the Provider message parser.
  - Fix error reporting on repoindex.xml parse error (bsc#1227625)
  - version 17.35.3 (35)

++++ libzypp:

  - Translation: updated .pot file.
  - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793)
    Older zypp-plugins reject stomp headers including a '-'. Like the
    'content-length' header we may send.
  - Fix int overflow in Provider (fixes #559)
    This patch fixes an issue in safe_strtonum which caused
    timestamps to overflow in the Provider message parser.
  - Fix error reporting on repoindex.xml parse error (bsc#1227625)
  - version 17.35.3 (35)

++++ libzypp:

  - Translation: updated .pot file.
  - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793)
    Older zypp-plugins reject stomp headers including a '-'. Like the
    'content-length' header we may send.
  - Fix int overflow in Provider (fixes #559)
    This patch fixes an issue in safe_strtonum which caused
    timestamps to overflow in the Provider message parser.
  - Fix error reporting on repoindex.xml parse error (bsc#1227625)
  - version 17.35.3 (35)

++++ libzypp:

  - Translation: updated .pot file.
  - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793)
    Older zypp-plugins reject stomp headers including a '-'. Like the
    'content-length' header we may send.
  - Fix int overflow in Provider (fixes #559)
    This patch fixes an issue in safe_strtonum which caused
    timestamps to overflow in the Provider message parser.
  - Fix error reporting on repoindex.xml parse error (bsc#1227625)
  - version 17.35.3 (35)

++++ libzypp:

  - Translation: updated .pot file.
  - Conflict with python zypp-plugin < 0.6.4 (bsc#1227793)
    Older zypp-plugins reject stomp headers including a '-'. Like the
    'content-length' header we may send.
  - Fix int overflow in Provider (fixes #559)
    This patch fixes an issue in safe_strtonum which caused
    timestamps to overflow in the Provider message parser.
  - Fix error reporting on repoindex.xml parse error (bsc#1227625)
  - version 17.35.3 (35)

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ python311:

  - Stop using %%defattr, it seems to be breaking proper executable
    attributes on /usr/bin/ scripts (bsc#1227378).

++++ zypp-plugin:

  - Fix stomp header regex to include '-' (bsc#1227793)
  - version 0.6.4
  - Fix stomp header regex to include '-' (bsc#1227793)
  - version 0.6.4

------------------------------------------------------------------
------------------  2024-7-14  -  Jul 14 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.0.24 → 10.0.25

++++ python-kiwi:

  - Bump version: 10.0.24 → 10.0.25

++++ python-kiwi:

  - Bump version: 10.0.24 → 10.0.25

++++ kernel-default:

  - kABI workaround for wireless updates (bsc#1227149).
  - commit 956c903
  - i2c: rcar: bring hardware to known state when probing
    (git-fixes).
  - i2c: testunit: avoid re-issued work after read message
    (git-fixes).
  - i2c: mark HostNotify target address as used (git-fixes).
  - i2c: testunit: correct Kconfig description (git-fixes).
  - commit 834d4d5

++++ kernel-default:

  - kABI workaround for wireless updates (bsc#1227149).
  - commit 956c903
  - i2c: rcar: bring hardware to known state when probing
    (git-fixes).
  - i2c: testunit: avoid re-issued work after read message
    (git-fixes).
  - i2c: mark HostNotify target address as used (git-fixes).
  - i2c: testunit: correct Kconfig description (git-fixes).
  - commit 834d4d5

++++ kernel-default:

  - kABI workaround for wireless updates (bsc#1227149).
  - commit 956c903
  - i2c: rcar: bring hardware to known state when probing
    (git-fixes).
  - i2c: testunit: avoid re-issued work after read message
    (git-fixes).
  - i2c: mark HostNotify target address as used (git-fixes).
  - i2c: testunit: correct Kconfig description (git-fixes).
  - commit 834d4d5

------------------------------------------------------------------
------------------  2024-7-13  -  Jul 13 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - supported.conf: update for mt76 stuff (bsc#1227149)
  - commit 276fbe5
  - kabi/severities: cover all mt76 modules (bsc#1227149)
  - commit 8877f2f
  - wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
    (bsc#1227149).
  - commit a3d6465
  - wifi: mac80211: fix monitor channel with chanctx emulation
    (bsc#1227149).
  - wifi: cfg80211: validate HE operation element parsing
    (bsc#1227149).
  - wifi: mac80211: don't select link ID if not provided in scan
    request (bsc#1227149).
  - wifi: mac80211: check EHT/TTLM action frame length
    (bsc#1227149).
  - wifi: mac80211: correctly set active links upon TTLM
    (bsc#1227149).
  - wifi: cfg80211: set correct param change count in ML element
    (bsc#1227149).
  - wifi: mac80211: use deflink and fix typo in link ID check
    (bsc#1227149).
  - commit e4d62d6
  - kabi/severities: ignore kABI changes Realtek WiFi drivers (bsc#1227149)
    All those symbols are local and used for its own helpers
  - commit c402c7b
  - wifi: rtlwifi: Ignore IEEE80211_CONF_CHANGE_RETRY_LIMITS
    (bsc#1227149).
  - wifi: rtw89: wow: refine WoWLAN flows of HCI interrupts and
    low power mode (bsc#1227149).
  - wifi: rtl8xxxu: enable MFP support with security flag of RX
    descriptor (bsc#1227149).
  - wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if
    no 6 GHz sband (bsc#1227149).
  - wifi: rtw89: 8852c: add quirk to set PCI BER for certain
    platforms (bsc#1227149).
  - wifi: rtw89: download firmware with five times retry
    (bsc#1227149).
  - commit 70ec305
  - wifi: rtw89: coex: fix configuration for shared antenna for
    8922A (bsc#1227149).
  - wifi: rtw89: wow: move release offload packet earlier for
    WoWLAN mode (bsc#1227149).
  - wifi: rtw89: wow: set security engine options for 802.11ax
    chips only (bsc#1227149).
  - wifi: rtw89: update suspend/resume for different generation
    (bsc#1227149).
  - wifi: rtw89: wow: update config mac function with different
    generation (bsc#1227149).
  - wifi: rtw89: update DMA function with different generation
    (bsc#1227149).
  - wifi: rtw89: wow: update WoWLAN status register for different
    generation (bsc#1227149).
  - wifi: rtw89: wow: update WoWLAN reason register for different
    chips (bsc#1227149).
  - wifi: rtw89: coex: Add coexistence policy to decrease WiFi
    packet CRC-ERR (bsc#1227149).
  - wifi: rtw89: coex: When Bluetooth not available don't set
    power/gain (bsc#1227149).
  - wifi: rtw89: coex: add return value to ensure H2C command is
    success or not (bsc#1227149).
  - wifi: rtw89: coex: Reorder H2C command index to align with
    firmware (bsc#1227149).
  - wifi: rtw89: coex: add BTC ctrl_info version 7 and related logic
    (bsc#1227149).
  - wifi: rtw89: coex: add init_info H2C command format version 7
    (bsc#1227149).
  - wifi: rtw89: 8922a: add coexistence helpers of SW grant
    (bsc#1227149).
  - wifi: rtw89: mac: add coexistence helpers {cfg/get}_plt
    (bsc#1227149).
  - wifi: rtlwifi: Remove rtl_intf_ops.read_efuse_byte
    (bsc#1227149).
  - wifi: rtl8xxxu: fix mixed declarations in rtl8xxxu_set_aifs()
    (bsc#1227149).
  - wifi: rtw89: pci: implement PCI CLK/ASPM/L1SS for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: Update EHT PHY beamforming capability
    (bsc#1227149).
  - wifi: rtw89: advertise missing extended scan feature
    (bsc#1227149).
  - wifi: rtlwifi: set initial values for unexpected cases of USB
    endpoint priority (bsc#1227149).
  - wifi: rtl8xxxu: check vif before using in rtl8xxxu_tx()
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192cu: Fix TX aggregation (bsc#1227149).
  - commit e9149f1
  - wifi: rtw89: 8922a: add helper of set_channel (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel RF part (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel BB part (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel MAC part (bsc#1227149).
  - wifi: rtlwifi: rtl_usb: Store the endpoint addresses
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192cu: Fix 2T2R chip type detection
    (bsc#1227149).
  - wifi: rtw89: 8922a: declare to support two chanctx
    (bsc#1227149).
  - wifi: rtw89: chan: support MCC on Wi-Fi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: implement MRC H2C command functions
    (bsc#1227149).
  - wifi: rtw89: mac: implement MRC C2H event handling
    (bsc#1227149).
  - wifi: rtw89: fw: add definition of H2C command and C2H event
    for MRC series (bsc#1227149).
  - wifi: rtw89: change qutoa to DBCC by default for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: reference quota mode when setting Tx power
    (bsc#1227149).
  - wifi: rtw89: 8922a: implement AP mode related reg for BE
    generation (bsc#1227149).
  - wifi: rtw89: 8922a: correct register definition and merge IO
    for ctrl_nbtg_bt_tx() (bsc#1227149).
  - wifi: rtw89: differentiate narrow_bw_ru_dis setting according
    to chip gen (bsc#1227149).
  - wifi: rtw89: use PLCP information to match BSS_COLOR and AID
    (bsc#1227149).
  - wifi: rtw89: mac: reset PHY-1 hardware when going to
    enable/disable (bsc#1227149).
  - wifi: rtw89: mac: correct MUEDCA setting for MAC-1
    (bsc#1227149).
  - wifi: rtw89: mac: return held quota of DLE when changing MAC-1
    (bsc#1227149).
  - wifi: rtw89: load BB parameters to PHY-1 (bsc#1227149).
  - wifi: rtw89: correct PHY register offset for PHY-1
    (bsc#1227149).
  - wifi: rtw89: chan: MCC take reconfig into account (bsc#1227149).
  - wifi: rtw89: chan: move handling from add/remove to
    assign/unassign for MLO (bsc#1227149).
  - wifi: rtw89: chan: tweak weight recalc ahead before MLO
    (bsc#1227149).
  - wifi: rtw89: chan: tweak bitmap recalc ahead before MLO
    (bsc#1227149).
  - wifi: rtw89: chan: add sub-entity swap function to cover
    replacing (bsc#1227149).
  - wifi: rtw89: drop TIMING_BEACON_ONLY and sync beacon TSF by self
    (bsc#1227149).
  - wifi: rtl8xxxu: update rate mask per sta (bsc#1227149).
  - wifi: rtw89: fw: download firmware with key data for secure boot
    (bsc#1227149).
  - wifi: rtw89: fw: parse secure section from firmware file
    (bsc#1227149).
  - wifi: rtw89: fw: read firmware secure information from efuse
    (bsc#1227149).
  - wifi: rtw89: fw: consider checksum length of security data
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::rfk_hw_init (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::rfk_init_late to do initial
    RF calibrations later (bsc#1227149).
  - commit 28c4b55
  - wifi: rtw89: 8922a: rfk: implement chip_ops to call RF
    calibrations (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger TSSI (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger TXGAPK
    (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger DACK (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger DPK (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger RX DCK
    (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger IQK (bsc#1227149).
  - wifi: rtw89: rfk: send channel information to firmware for RF
    calibrations (bsc#1227149).
  - wifi: rtw89: rfk: add a completion to wait RF calibration
    report from C2H event (bsc#1227149).
  - wifi: rtl8xxxu: Add TP-Link TL-WN823N V2 (bsc#1227149).
  - wifi: rtl8xxxu: fix error messages (bsc#1227149).
  - wifi: rtw89: 8922a: add more fields to beacon H2C command to
    support multi-links (bsc#1227149).
  - wifi: rtw89: update ps_state register for chips with different
    generation (bsc#1227149).
  - wifi: rtw89: add new H2C for PS mode in 802.11be chip
    (bsc#1227149).
  - wifi: rtw89: 8922a: add ieee80211_ops::hw_scan (bsc#1227149).
  - wifi: rtw89: prepare scan leaf functions for wifi 7 ICs
    (bsc#1227149).
  - wifi: rtw89: debug: add FW log component for scan (bsc#1227149).
  - wifi: rtw89: update scan C2H messages for wifi 7 IC
    (bsc#1227149).
  - wifi: rtw89: 8922a: set chip_ops FEM and GPIO to NULL
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops to get thermal value
    (bsc#1227149).
  - wifi: rtw89: 8922a: add RF read/write v2 (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::cfg_txrx_path (bsc#1227149).
  - wifi: rtw89: 8922a: implement {stop,resume}_sch_tx and cfg_ppdu
    (bsc#1227149).
  - wifi: rtw89: 8922a: hook handlers of TX/RX descriptors to
    chip_ops (bsc#1227149).
  - wifi: rtw89: pci: validate RX tag for RXQ and RPQ (bsc#1227149).
  - wifi: rtw89: pci: interrupt v2 refine IMR for SER (bsc#1227149).
  - wifi: rtw89: pci: update SER timer unit and timeout time
    (bsc#1227149).
  - wifi: rtw89: fix disabling concurrent mode TX hang issue
    (bsc#1227149).
  - wifi: rtw89: fix HW scan timeout due to TSF sync issue
    (bsc#1227149).
  - wifi: rtw89: add wait/completion for abort scan (bsc#1227149).
  - wifi: rtw89: disable RTS when broadcast/multicast (bsc#1227149).
  - wifi: rtw89: Set default CQM config if not present
    (bsc#1227149).
  - wifi: rtw89: refine hardware scan C2H events (bsc#1227149).
  - wifi: rtw89: refine add_chan H2C command to encode_bits
    (bsc#1227149).
  - wifi: rtw89: 8922a: add BTG functions to assist BT coexistence
    to control TX/RX (bsc#1227149).
  - wifi: rtw89: 8922a: add TX power related ops (bsc#1227149).
  - wifi: rtw89: 8922a: add register definitions of H2C, C2H,
    page, RRSR and EDCCA (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops related to BB init
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::{enable,disable}_bb_rf
    (bsc#1227149).
  - wifi: rtw89: add mlo_dbcc_mode for WiFi 7 chips (bsc#1227149).
  - wifi: rtlwifi: Speed up firmware loading for USB (bsc#1227149).
  - wifi: rtl8xxxu: add missing number of sec cam entries for all
    variants (bsc#1227149).
  - wifi: rtl8xxxu: make instances of iface limit and combination
    to be static const (bsc#1227149).
  - wifi: rtl8xxxu: convert EN_DESC_ID of TX descriptor to le32 type
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192de: Don't read register in
    _rtl92de_query_rxphystatus (bsc#1227149).
  - wifi: rtw89: fw: extend JOIN H2C command to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: fw: use struct to fill JOIN H2C command
    (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to reset DMAC table for WiFi 7
    (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to reset CMAC table for WiFi 7
    (bsc#1227149).
  - wifi: rtw89: fw: update TX AMPDU parameter to CMAC table
    (bsc#1227149).
  - wifi: rtw89: fw: add chip_ops to update CMAC table to associated
    station (bsc#1227149).
  - wifi: rtw89: fw: fill CMAC table to associated station for
    WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to update security CAM v2
    (bsc#1227149).
  - wifi: rtw89: declare EXT NSS BW of VHT capability (bsc#1227149).
  - wifi: rtw89: add EHT capabilities for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: change supported bandwidths of chip_info to bit
    mask (bsc#1227149).
  - wifi: rtw89: adjust init_he_cap() to add EHT cap into
    iftype_data (bsc#1227149).
  - wifi: rtw88: use kstrtoX_from_user() in debugfs handlers
    (bsc#1227149).
  - wifi: rtl8xxxu: enable channel switch support (bsc#1227149).
  - wifi: rtlwifi: rtl_usb: Use sync register writes (bsc#1227149).
  - commit 055a697
  - wifi: rtlwifi: cleanup few rtlxxx_tx_fill_desc() routines
    (bsc#1227149).
  - wifi: rtw89: add chip_ops::update_beacon to abstract update
    beacon operation (bsc#1227149).
  - wifi: rtw89: add H2C command to download beacon frame for WiFi
    7 chips (bsc#1227149).
  - wifi: rtw89: use struct to fill H2C command to download beacon
    frame (bsc#1227149).
  - wifi: rtw89: add new H2C command to pause/sleep transmitting
    by MAC ID (bsc#1227149).
  - wifi: rtw89: refine H2C command that pause transmitting by
    MAC ID (bsc#1227149).
  - wifi: rtw89: fw: use struct to fill BA CAM H2C commands
    (bsc#1227149).
  - wifi: rtw89: 8922a: update BA CAM number to 24 (bsc#1227149).
  - wifi: rtw89: add chip_ops::h2c_ba_cam() to configure BA CAM
    (bsc#1227149).
  - wifi: rtw89: mac: add feature_init to initialize BA CAM V1
    (bsc#1227149).
  - wifi: rtw89: add firmware H2C command of BA CAM V1
    (bsc#1227149).
  - wifi: rtl8xxxu: Fix off by one initial RTS rate (bsc#1227149).
  - wifi: rtl8xxxu: Fix LED control code of RTL8192FU (bsc#1227149).
  - wifi: rtl8xxxu: declare concurrent mode support for 8188f
    (bsc#1227149).
  - wifi: rtl8xxxu: make supporting AP mode only on port 0
    transparent (bsc#1227149).
  - wifi: rtl8xxxu: add hw crypto support for AP mode (bsc#1227149).
  - wifi: rtl8xxxu: remove obsolete priv->vif (bsc#1227149).
  - wifi: rtl8xxxu: add macids for STA mode (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interface in start_ap()
    (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    bss_info_changed() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    {add,remove}_interface() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    watchdog_callback() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    configure_filter() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    update_beacon_work_callback() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in set_aifs()
    (bsc#1227149).
  - wifi: rtl8xxxu: support setting bssid register for multiple
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: don't parse CFO, if both interfaces are
    connected in STA mode (bsc#1227149).
  - wifi: rtl8xxxu: extend check for matching bssid to both
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: extend wifi connected check to both interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: support setting mac address register for both
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: 8188e: convert usage of priv->vif to
    priv->vifs[0] (bsc#1227149).
  - wifi: rtl8xxxu: support setting linktype for both interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: prepare supporting two virtual interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: remove assignment of priv->vif in
    rtl8xxxu_bss_info_changed() (bsc#1227149).
  - wifi: rtw88: 8822ce: refine power parameters for RFE type 5
    (bsc#1227149).
  - wifi: rtw89: mac: Fix spelling mistakes "notfify" -> "notify"
    (bsc#1227149).
  - wifi: rtw89: phy: set channel_info for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: phy: add BB wrapper of TX power for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: 8922a: add NCTL pre-settings for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: phy: ignore special data from BB parameter file
    (bsc#1227149).
  - wifi: rtw89: 8922a: update the register used in DIG and the
    DIG flow (bsc#1227149).
  - wifi: rtw89: 8922a: set RX gain along with set_channel operation
    (bsc#1227149).
  - wifi: rtw89: phy: add parser to support RX gain dynamic setting
    flow (bsc#1227149).
  - wifi: rtw89: phy: move bb_gain_info used by WiFi 6 chips to
    union (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R37 (bsc#1227149).
  - wifi: rtw89: 8852b: update TX power tables to R36 (bsc#1227149).
  - wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: phy: using calculate_bit_shift()
    (bsc#1227149).
  - wifi: rtw89: coex: To improve Wi-Fi performance while BT is idle
    (bsc#1227149).
  - wifi: rtw89: coex: Translate antenna configuration from ID to
    string (bsc#1227149).
  - commit d99b9e1
  - wifi: rtw89: coex: Update RF parameter control setting logic
    (bsc#1227149).
  - wifi: rtw89: coex: Add Bluetooth RSSI level information
    (bsc#1227149).
  - wifi: rtw89: coex: Set Bluetooth scan low-priority when Wi-Fi
    link/scan (bsc#1227149).
  - wifi: rtw89: coex: Update coexistence policy for Wi-Fi LPS
    (bsc#1227149).
  - wifi: rtw89: coex: Still show hardware grant signal info even
    Wi-Fi is PS (bsc#1227149).
  - wifi: rtw89: coex: Update BTG control related logic
    (bsc#1227149).
  - wifi: rtw89: coex: Add Pre-AGC control to enhance Wi-Fi RX
    performance (bsc#1227149).
  - wifi: rtw89: coex: Record down Wi-Fi initial mode information
    (bsc#1227149).
  - wifi: rtw89: coex: Fix wrong Wi-Fi role info and FDDT parameter
    members (bsc#1227149).
  - wifi: rtw88: use cfg80211_ssid_eq() instead of rtw_ssid_equal()
    (bsc#1227149).
  - wifi: rtw89: mac: implement to configure TX/RX engines for
    WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: mac: add sys_init and filter option for WiFi 7
    chips (bsc#1227149).
  - wifi: rtw89: only reset BB/RF for existing WiFi 6 chips while
    starting up (bsc#1227149).
  - wifi: rtw89: add DBCC H2C to notify firmware the status
    (bsc#1227149).
  - wifi: rtw89: mac: add suffix _ax to MAC functions (bsc#1227149).
  - wifi: rtw89: mac: add flags to check if CMAC and DMAC are
    enabled (bsc#1227149).
  - wifi: rtw89: 8922a: add power on/off functions (bsc#1227149).
  - wifi: rtw89: add XTAL SI for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: phy: print out RFK log with formatted string
    (bsc#1227149).
  - wifi: rtw89: parse and print out RFK log from C2H events
    (bsc#1227149).
  - wifi: rtw89: add C2H event handlers of RFK log and report
    (bsc#1227149).
  - wifi: rtw89: load RFK log format string from firmware file
    (bsc#1227149).
  - wifi: rtw89: fw: add version field to BB MCU firmware element
    (bsc#1227149).
  - wifi: rtw89: fw: load TX power track tables from fw_element
    (bsc#1227149).
  - wifi: rtw88: Use random MAC when efuse MAC invalid
    (bsc#1227149).
  - wifi: rtw89: avoid stringop-overflow warning (bsc#1227149).
  - wifi: rtw89: mac: refine SER setting during WiFi CPU power on
    (bsc#1227149).
  - wifi: rtw89: 8922a: dump MAC registers when SER occurs
    (bsc#1227149).
  - wifi: rtw89: 8922a: add SER IMR tables (bsc#1227149).
  - wifi: rtw89: fw: extend program counter dump for Wi-Fi 7 chip
    (bsc#1227149).
  - wifi: rtw89: 8922a: configure CRASH_TRIGGER FW feature
    (bsc#1227149).
  - wifi: rtw89: fix misbehavior of TX beacon in concurrent mode
    (bsc#1227149).
  - wifi: rtw89: refine remain on channel flow to improve P2P
    connection (bsc#1227149).
  - wifi: rtw89: Refine active scan behavior in 6 GHz (bsc#1227149).
  - wifi: rtw89: fix not entering PS mode after AP stops
    (bsc#1227149).
  - wifi: rtlwifi: Remove bridge vendor/device ids (bsc#1227149).
  - wifi: rtlwifi: Remove unused PCI related defines and struct
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Access full PMCS reg and use
    pci_regs.h (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Add pdev into
    _rtl8821ae_clear_pci_pme_status() (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Use pci_find_capability()
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Reverse PM Capability exists check
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Remove unnecessary PME_Status bit set
    (bsc#1227149).
  - wifi: rtlwifi: Convert to use PCIe capability accessors
    (bsc#1227149).
  - wifi: rtw89: mac: functions to configure hardware engine and
    quota for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: mac: use pointer to access functions of hardware
    engine and quota (bsc#1227149).
  - wifi: rtw89: mac: move code related to hardware engine to
    individual functions (bsc#1227149).
  - wifi: rtw89: mac: check queue empty according to chip gen
    (bsc#1227149).
  - wifi: rtw89: refine element naming used by queue empty check
    (bsc#1227149).
  - wifi: rtw89: add reserved size as factor of DLE used size
    (bsc#1227149).
  - wifi: rtw89: mac: add to get DLE reserved quota (bsc#1227149).
  - commit cf41ac5
  - wifi: rtw89: 8922a: extend and add quota number (bsc#1227149).
  - wifi: rtw89: debug: remove wrapper of rtw89_debug()
    (bsc#1227149).
  - wifi: rtw89: debug: add debugfs entry to disable dynamic
    mechanism (bsc#1227149).
  - wifi: rtw89: phy: dynamically adjust EDCCA threshold
    (bsc#1227149).
  - wifi: rtw89: debug: add to check if debug mask is enabled
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: phy: remove some useless code
    (bsc#1227149).
  - wifi: rtw88: debug: remove wrapper of rtw_dbg() (bsc#1227149).
  - wifi: rtw89: 8922a: read efuse content from physical map
    (bsc#1227149).
  - wifi: rtw89: 8922a: read efuse content via efuse map struct
    from logic map (bsc#1227149).
  - wifi: rtw89: 8852c: read RX gain offset from efuse for 6GHz
    channels (bsc#1227149).
  - wifi: rtw89: mac: add to access efuse for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: mac: use mac_gen pointer to access about efuse
    (bsc#1227149).
  - wifi: rtw89: 8922a: add 8922A basic chip info (bsc#1227149).
  - wifi: rtlwifi: drop unused const_amdpci_aspm (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R65-R44
    (bsc#1227149).
  - wifi: rtw89: regd: handle policy of 6 GHz according to BIOS
    (bsc#1227149).
  - wifi: rtw89: acpi: process 6 GHz band policy from DSM
    (bsc#1227149).
  - wifi: rtlwifi: simplify rtl_action_proc() and rtl_tx_agg_start()
    (bsc#1227149).
  - wifi: rtw89: pci: update interrupt mitigation register for
    8922AE (bsc#1227149).
  - wifi: rtw89: pci: correct interrupt mitigation register for
    8852CE (bsc#1227149).
  - wifi: rtw89: 8922ae: add v2 interrupt handlers for 8922AE
    (bsc#1227149).
  - wifi: rtw89: pci: generalize interrupt status bits of interrupt
    handlers (bsc#1227149).
  - wifi: rtw89: pci: add pre_deinit to be called after probe
    complete (bsc#1227149).
  - wifi: rtw89: pci: stop/start DMA for level 1 recovery according
    to chip gen (bsc#1227149).
  - wifi: rtw89: pci: reset BDRAM according to chip gen
    (bsc#1227149).
  - wifi: rtw88: simplify __rtw_tx_work() (bsc#1227149).
  - wifi: rtw89: coex: use struct assignment to replace memcpy()
    to append TDMA content (bsc#1227149).
  - wifi: rtw89: pci: implement PCI mac_post_init for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: pci: add LTR v2 for WiFi 7 chip (bsc#1227149).
  - wifi: rtw89: pci: implement PCI mac_pre_init for WiFi 7 chips
    (bsc#1227149).
  - commit dcfcac7
  - wifi: rtw89: pci: use gen_def pointer to configure
    mac_{pre,post}_init and clear PCI ring index (bsc#1227149).
  - wifi: rtw89: pci: add PCI generation information to pci_info
    for each chip (bsc#1227149).
  - wifi: rtw89: extend PHY status parser to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: consider RX info for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: configure PPDU max user by chip (bsc#1227149).
  - wifi: rtw89: set entry size of address CAM to H2C field by chip
    (bsc#1227149).
  - wifi: rtw89: pci: generalize code of PCI control DMA IO for
    WiFi 7 (bsc#1227149).
  - wifi: rtw89: pci: add new RX ring design to determine full RX
    ring efficiently (bsc#1227149).
  - wifi: rtw89: pci: define PCI ring address for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: 8922ae: add 8922AE PCI entry and basic info
    (bsc#1227149).
  - wifi: rtlwifi: rtl92ee_dm_dynamic_primary_cca_check(): fix
    typo in function name (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_phy (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_hal (bsc#1227149).
  - wifi: rtw89: cleanup firmware elements parsing (bsc#1227149).
  - wifi: rtlwifi: drop chk_switch_dmdp() from HAL interface
    (bsc#1227149).
  - wifi: rtlwifi: drop fill_fake_txdesc() from HAL interface
    (bsc#1227149).
  - wifi: rtlwifi: drop pre_fill_tx_bd_desc() from HAL interface
    (bsc#1227149).
  - wifi: rtw89: move software DCFO compensation setting to proper
    position (bsc#1227149).
  - wifi: rtw89: correct the DCFO tracking flow to improve CFO
    compensation (bsc#1227149).
  - wifi: rtw89: modify the register setting and the flow of CFO
    tracking (bsc#1227149).
  - wifi: rtw89: phy: generalize valid bit of BSS color
    (bsc#1227149).
  - wifi: rtw89: phy: change naming related BT coexistence functions
    (bsc#1227149).
  - wifi: rtw88: dump firmware debug information in abnormal state
    (bsc#1227149).
  - wifi: rtw88: debug: add to check if debug mask is enabled
    (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_ps_ctl (bsc#1227149).
  - wifi: rtw89: mac: do bf_monitor only if WiFi 6 chips
    (bsc#1227149).
  - wifi: rtw89: mac: set bf_assoc capabilities according to chip
    gen (bsc#1227149).
  - wifi: rtw89: mac: set bfee_ctrl() according to chip gen
    (bsc#1227149).
  - wifi: rtw89: mac: add registers of MU-EDCA parameters for WiFi
    7 chips (bsc#1227149).
  - wifi: rtw89: mac: generalize register of MU-EDCA switch
    according to chip gen (bsc#1227149).
  - wifi: rtw89: mac: update RTS threshold according to chip gen
    (bsc#1227149).
  - wifi: rtlwifi: simplify TX command fill callbacks (bsc#1227149).
  - wifi: rtw89: coex: add annotation __counted_by() to struct
    rtw89_btc_btf_set_mon_reg (bsc#1227149).
  - wifi: rtw89: coex: add annotation __counted_by() for struct
    rtw89_btc_btf_set_slot_table (bsc#1227149).
  - wifi: rtw89: add EHT radiotap in monitor mode (bsc#1227149).
  - wifi: rtw89: show EHT rate in debugfs (bsc#1227149).
  - wifi: rtw89: parse TX EHT rate selected by firmware from RA
    C2H report (bsc#1227149).
  - wifi: rtw89: Add EHT rate mask as parameters of RA H2C command
    (bsc#1227149).
  - wifi: rtw89: parse EHT information from RX descriptor and PPDU
    status packet (bsc#1227149).
  - wifi: rtlwifi: use convenient list_count_nodes() (bsc#1227149).
  - commit 53661e1
  - wifi: rtlwifi: use unsigned long for bt_coexist_8723 timestamp
    (bsc#1227149).
  - wifi: rtw88: 8821c: tweak CCK TX filter setting for SRRC
    regulation (bsc#1227149).
  - wifi: rtw88: regd: update regulatory map to R64-R42
    (bsc#1227149).
  - wifi: rtw88: 8822c: update TX power limit to V70 (bsc#1227149).
  - wifi: rtw88: 8821c: update TX power limit to V67 (bsc#1227149).
  - wifi: rtw88: regd: configure QATAR and UK (bsc#1227149).
  - wifi: rtlwifi: remove unreachable code in
    rtl92d_dm_check_edca_turbo() (bsc#1227149).
  - wifi: rtw89: debug: txpwr table supports Wi-Fi 7 chips
    (bsc#1227149).
  - wifi: rtw89: debug: show txpwr table according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power RU limit according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power limit according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power offset according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power by rate according to chip gen
    (bsc#1227149).
  - wifi: rtw89: mac: get TX power control register according to
    chip gen (bsc#1227149).
  - wifi: rtlwifi: use unsigned long for rtl_bssid_entry timestamp
    (bsc#1227149).
  - wifi: rtw89: refine bandwidth 160MHz uplink OFDMA performance
    (bsc#1227149).
  - wifi: rtw89: refine uplink trigger based control mechanism
    (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R34 (bsc#1227149).
  - wifi: rtw89: 8852b: update TX power tables to R35 (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R67 (bsc#1227149).
  - wifi: rtw89: regd: configure Thailand in regulation type
    (bsc#1227149).
  - wifi: rtlwifi: cleanup few rtlxxxx_set_hw_reg() routines
    (bsc#1227149).
  - wifi: rtw89: declare MCC in interface combination (bsc#1227149).
  - wifi: rtw89: 8852c: declare to support two chanctx
    (bsc#1227149).
  - wifi: rtw89: pause/proceed MCC for ROC and HW scan
    (bsc#1227149).
  - wifi: rtw89: mcc: fix NoA start time when GO is auxiliary
    (bsc#1227149).
  - wifi: rtw89: load TX power related tables from FW elements
    (bsc#1227149).
  - wifi: rtw89: phy: extend TX power common stuffs for Wi-Fi 7
    chips (bsc#1227149).
  - wifi: rtw89: load TX power by rate when RFE parms setup
    (bsc#1227149).
  - wifi: rtw89: phy: refine helpers used for raw TX power
    (bsc#1227149).
  - commit 62f3f4a
  - wifi: rtw89: indicate TX power by rate table inside RFE
    parameter (bsc#1227149).
  - wifi: rtw89: indicate TX shape table inside RFE parameter
    (bsc#1227149).
  - wifi: rtw89: add subband index of primary channel to struct
    rtw89_chan (bsc#1227149).
  - wifi: rtl8xxxu: Add a description about the device ID
    0x7392:0xb722 (bsc#1227149).
  - wifi: rtw89: add mac_gen pointer to access mac port registers
    (bsc#1227149).
  - wifi: rtw89: consolidate registers of mac port to struct
    (bsc#1227149).
  - wifi: rtw89: add chip_info::txwd_info size to generalize TX
    WD submit (bsc#1227149).
  - wifi: rtw89: add to fill TX descriptor v2 (bsc#1227149).
  - wifi: rtw89: add to fill TX descriptor for firmware command v2
    (bsc#1227149).
  - wifi: rtw89: add to query RX descriptor format v2 (bsc#1227149).
  - wifi: rtw89: mcc: deal with beacon NoA if GO exists
    (bsc#1227149).
  - wifi: rtw89: mcc: deal with BT slot change (bsc#1227149).
  - wifi: rtw89: mcc: deal with P2P PS change (bsc#1227149).
  - wifi: rtw89: mcc: track beacon offset and update when needed
    (bsc#1227149).
  - wifi: rtw89: mcc: update role bitmap when changed (bsc#1227149).
  - wifi: rtw89: 52c: rfk: disable DPK during MCC (bsc#1227149).
  - wifi: rtw89: rfk: disable driver tracking during MCC
    (bsc#1227149).
  - wifi: rtw89: 52c: rfk: refine MCC channel info notification
    (bsc#1227149).
  - wifi: rtw89: 8922a: set memory heap address for secure firmware
    (bsc#1227149).
  - wifi: rtw89: fw: refine download flow to support variant
    firmware suits (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::bb_preinit to enable BB
    before downloading firmware (bsc#1227149).
  - wifi: rtw89: fw: propagate an argument include_bb for BB MCU
    firmware (bsc#1227149).
  - wifi: rtw89: fw: add checking type for variant type of firmware
    (bsc#1227149).
  - wifi: rtw89: fw: implement supported functions of download
    firmware for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: generalize download firmware flow by mac_gen
    pointers (bsc#1227149).
  - wifi: rtw89: fw: move polling function of firmware path ready
    to an individual function (bsc#1227149).
  - wifi: rtw89: mcc: trigger FW to start/stop MCC (bsc#1227149).
  - wifi: rtw89: fix typo of rtw89_fw_h2c_mcc_macid_bitmap()
    (bsc#1227149).
  - wifi: rtw89: mcc: decide pattern and calculate parameters
    (bsc#1227149).
  - wifi: rtw89: mcc: consider and determine BT duration
    (bsc#1227149).
  - commit bd46e4d
  - wifi: rtw89: mcc: fill fundamental configurations (bsc#1227149).
  - wifi: rtw89: mcc: initialize start flow (bsc#1227149).
  - wifi: rtw89: 8852c: Fix TSSI causes transmit power inaccuracy
    (bsc#1227149).
  - wifi: rtw89: 8852c: Update bandedge parameters for better
    performance (bsc#1227149).
  - wifi: rtl8xxxu: mark TOTOLINK N150UA V5/N150UA-B as tested
    (bsc#1227149).
  - wifi: rtw88: fix typo rtw8822cu_probe (bsc#1227149).
  - wifi: rtlwifi: rtl8723: Remove unused function
    rtl8723_cmd_send_packet() (bsc#1227149).
  - wifi: rtw89: Fix clang -Wimplicit-fallthrough in
    rtw89_query_sar() (bsc#1227149).
  - wifi: rtw89: phy: modify register setting of ENV_MNTR, PHYSTS
    and DIG (bsc#1227149).
  - wifi: rtw89: phy: add phy_gen_def::cr_base to support WiFi 7
    chips (bsc#1227149).
  - wifi: rtw89: mac: define register address of rx_filter to
    generalize code (bsc#1227149).
  - wifi: rtw89: mac: define internal memory address for WiFi 7 chip
    (bsc#1227149).
  - wifi: rtw89: mac: generalize code to indirectly access WiFi
    internal memory (bsc#1227149).
  - wifi: rtw89: mac: add mac_gen_def::band1_offset to map MAC
    band1 register address (bsc#1227149).
  - wifi: rtw89: initialize multi-channel handling (bsc#1227149).
  - wifi: rtw89: provide functions to configure NoA for beacon
    update (bsc#1227149).
  - wifi: rtw89: call rtw89_chan_get() by vif chanctx if aware of
    vif (bsc#1227149).
  - wifi: rtw89: sar: let caller decide the center frequency to
    query (bsc#1227149).
  - wifi: rtw89: refine rtw89_correct_cck_chan() by
    rtw89_hw_to_nl80211_band() (bsc#1227149).
  - wifi: rtw89: add function prototype for coex request duration
    (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R64-R43
    (bsc#1227149).
  - wifi: rtw89: fix a width vs precision bug (bsc#1227149).
  - wifi: rtlwifi: use eth_broadcast_addr() to assign broadcast
    address (bsc#1227149).
  - wifi: rtw89: Introduce Time Averaged SAR (TAS) feature
    (bsc#1227149).
  - wifi: rtw89: return failure if needed firmware elements are
    not recognized (bsc#1227149).
  - wifi: rtw89: add to parse firmware elements of BB and RF tables
    (bsc#1227149).
  - wifi: rtw89: introduce infrastructure of firmware elements
    (bsc#1227149).
  - wifi: rtw89: add firmware suit for BB MCU 0/1 (bsc#1227149).
  - wifi: rtw89: add firmware parser for v1 format (bsc#1227149).
  - wifi: rtw89: introduce v1 format of firmware header
    (bsc#1227149).
  - wifi: rtw89: support firmware log with formatted text
    (bsc#1227149).
  - wifi: rtw89: recognize log format from firmware file
    (bsc#1227149).
  - wifi: rtw89: get data rate mode/NSS/MCS v1 from RX descriptor
    (bsc#1227149).
  - wifi: rtw89: add to display hardware rates v1 histogram in
    debugfs (bsc#1227149).
  - wifi: rtw89: add C2H RA event V1 to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: use struct to access RA report (bsc#1227149).
  - wifi: rtw89: use struct to access firmware C2H event header
    (bsc#1227149).
  - wifi: rtw89: add H2C RA command V1 to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: use struct to set RA H2C command (bsc#1227149).
  - wifi: rtw89: phy: rate pattern handles HW rate by chip gen
    (bsc#1227149).
  - commit cdaa97d
  - wifi: rtlwifi: simplify LED management (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-simplify-non-chanctx-drivers.patch.
  - commit 34b32c5
  - wifi: rtw89: define hardware rate v1 for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: add chip_info::chip_gen to determine chip
    generation (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8723BU (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8192EU (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8710BU (RTL8188GU)
    (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8192FU (bsc#1227149).
  - wifi: rtw88: simplify vif iterators (bsc#1227149).
  - wifi: rtw88: remove unused USB bulkout size set (bsc#1227149).
  - wifi: rtw88: remove unused and set but unused leftovers
    (bsc#1227149).
  - wifi: rtlwifi: cleanup USB interface (bsc#1227149).
  - wifi: rtw89: use struct to parse firmware header (bsc#1227149).
  - wifi: rtw89: TX power stuffs replace confusing naming of _max
    with _num (bsc#1227149).
  - wifi: rtw89: 8851b: configure to force 1 TX power value
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: update IQK to version 0x8
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add LCK track (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R28 (bsc#1227149).
  - wifi: rtw89: 8851b: update RF radio A parameters to R28
    (bsc#1227149).
  - wifi: rtw88: fix not entering PS mode after AP stops
    (bsc#1227149).
  - wifi: rtw88: refine register based H2C command (bsc#1227149).
  - wifi: rtw88: Stop high queue during scan (bsc#1227149).
  - wifi: rtw88: Skip high queue in hci_flush (bsc#1227149).
  - wifi: rtw88: Fix AP mode incorrect DTIM behavior (bsc#1227149).
  - wifi: rtw88: use struct instead of macros to set TX desc
    (bsc#1227149).
  - wifi: rtw88: process VO packets without workqueue to avoid
    PTK rekey failed (bsc#1227149).
  - wifi: rtw88: Fix action frame transmission fail before
    association (bsc#1227149).
  - wifi: rtw89: fix spelling typo of IQK debug messages
    (bsc#1227149).
  - wifi: rtw89: cleanup rtw89_iqk_info and related code
    (bsc#1227149).
  - wifi: rtw89: cleanup private data structures (bsc#1227149).
  - wifi: rtw88: add missing unwind goto for
    __rtw_download_firmware() (bsc#1227149).
  - commit 9b282ce
  - wifi: rtlwifi: remove misused flag from HAL data (bsc#1227149).
  - wifi: rtlwifi: remove unused dualmac control leftovers
    (bsc#1227149).
  - wifi: rtlwifi: remove unused timer and related code
    (bsc#1227149).
  - wifi: rtw89: 8852c: update RF radio A/B parameters to R63
    (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (3 of 3) (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (2 of 3) (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (1 of 3) (bsc#1227149).
  - wifi: rtw89: process regulatory for 6 GHz power type
    (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R64-R40
    (bsc#1227149).
  - wifi: rtw89: regd: judge 6 GHz according to chip and BIOS
    (bsc#1227149).
  - commit f81b870
  - wifi: rtw89: refine clearing supported bands to check 2/5 GHz
    first (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-annotate-iftype_data-pointer-with-spar.patch.
  - commit 1873f0a
  - wifi: rtw89: 8851b: configure CRASH_TRIGGER feature for 8851B
    (bsc#1227149).
  - wifi: rtw89: set TX power without precondition during setting
    channel (bsc#1227149).
  - wifi: rtw89: debug: txpwr table access only valid page according
    to chip (bsc#1227149).
  - wifi: rtw89: 8851b: enable hw_scan support (bsc#1227149).
  - wifi: rtlwifi: use helper function rtl_get_hdr() (bsc#1227149).
  - wifi: rtw89: use flexible array member in rtw89_btc_btf_tlv
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: Fix spelling mistake KIP_RESOTRE ->
    KIP_RESTORE (bsc#1227149).
  - wifi: rtw89: use struct to access register-based H2C/C2H
    (bsc#1227149).
  - wifi: rtw89: use struct and le32_get_bits() to access RX
    descriptor (bsc#1227149).
  - commit 21eb4e8
  - Update config files: update for the realtek wifi driver updates (bsc#1227149)
  - commit 33b8d09
  - wifi: rtw89: use struct and le32_get_bits() to access received
    PHY status IEs (bsc#1227149).
  - wifi: rtw89: use struct and le32_get_bits to access RX info
    (bsc#1227149).
  - wifi: rtw89: add chip_ops::query_rxdesc() and rxd_len as
    helpers to support newer chips (bsc#1227149).
  - wifi: rtw89: 8851b: add 8851be to Makefile and Kconfig
    (bsc#1227149).
  - wifi: rtw89: add tx_wake notify for 8851B (bsc#1227149).
  - wifi: rtw89: enlarge supported length of read_reg debugfs entry
    (bsc#1227149).
  - wifi: rtw89: 8851b: add RF configurations (bsc#1227149).
  - wifi: rtw89: 8851b: add MAC configurations to chip_info
    (bsc#1227149).
  - wifi: rtw89: 8851b: fill BB related capabilities to chip_info
    (bsc#1227149).
  - wifi: rtw89: 8851b: add TX power related functions
    (bsc#1227149).
  - commit 66eef0c
  - Update config files: update for the realtek wifi driver updates (bsc#1227149)
  - commit 75bc634
  - wifi: rtw89: refine packet offload handling under SER
    (bsc#1227149).
  - wifi: rtw89: tweak H2C TX waiting function for SER
    (bsc#1227149).
  - wifi: rtw89: ser: reset total_sta_assoc and tdls_peer when L2
    (bsc#1227149).
  - wifi: rtw88: Add support for the SDIO based RTL8723DS chipset
    (bsc#1227149).
  - wifi: rtw88: rtw8723d: Implement RTL8723DS (SDIO) efuse parsing
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add TSSI (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add DPK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add RX DCK (bsc#1227149).
  - wifi: rtw89: 8851b: add to parse efuse content (bsc#1227149).
  - wifi: rtw89: 8851b: add set channel function (bsc#1227149).
  - wifi: rtw89: 8851b: add basic power on function (bsc#1227149).
  - wifi: rtw89: 8851b: add BT coexistence support function
    (bsc#1227149).
  - wifi: rtw89: 8851b: configure GPIO according to RFE type
    (bsc#1227149).
  - wifi: rtw89: 8851b: add to read efuse version to recognize
    hardware version B (bsc#1227149).
  - wifi: rtl8xxxu: Rename some registers (bsc#1227149).
  - wifi: rtl8xxxu: Support new chip RTL8192FU (bsc#1227149).
  - wifi: rtw89: suppress the log for specific SER called
    CMDPSR_FRZTO (bsc#1227149).
  - wifi: rtw89: ser: L1 add pre-M0 and post-M0 states
    (bsc#1227149).
  - wifi: rtw89: pci: fix interrupt enable mask for HALT C2H of
    RTL8851B (bsc#1227149).
  - wifi: rtw89: support U-NII-4 channels on 5GHz band
    (bsc#1227149).
  - wifi: rtw89: regd: judge UNII-4 according to BIOS and chip
    (bsc#1227149).
  - wifi: rtw89: introduce realtek ACPI DSM method (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add IQK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add DACK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add RCK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add AACK (bsc#1227149).
  - wifi: rtw89: 8851b: add set_channel_rf() (bsc#1227149).
  - wifi: rtw89: 8851b: add DLE mem and HFC quota (bsc#1227149).
  - wifi: rtw89: 8851b: add support WoWLAN to 8851B (bsc#1227149).
  - wifi: rtw89: change naming of BA CAM from V1 to V0_EXT
    (bsc#1227149).
  - commit a1de2dd
  - wifi: rtw89: use chip_info::small_fifo_size to choose debug_mask
    (bsc#1227149).
  - wifi: rtw89: add CFO XTAL registers field to support 8851B
    (bsc#1227149).
  - wifi: rtw89: 8851b: add NCTL post table (bsc#1227149).
  - wifi: rtw89: 8851be: add 8851BE PCI entry and fill PCI
    capabilities (bsc#1227149).
  - wifi: rtw89: 8851b: add 8851B basic chip_info (bsc#1227149).
  - wifi: rtw89: scan offload wait for FW done ACK (bsc#1227149).
  - wifi: rtw89: mac: handle C2H receive/done ACK in interrupt
    context (bsc#1227149).
  - wifi: rtw89: packet offload wait for FW response (bsc#1227149).
  - wifi: rtw89: refine packet offload delete flow of 6 GHz probe
    (bsc#1227149).
  - wifi: rtw89: release bit in rtw89_fw_h2c_del_pkt_offload()
    (bsc#1227149).
  - wifi: rtw89: add EVM for antenna diversity (bsc#1227149).
  - wifi: rtw89: add RSSI based antenna diversity (bsc#1227149).
  - wifi: rtw89: initialize antenna for antenna diversity
    (bsc#1227149).
  - wifi: rtw89: add EVM and SNR statistics to debugfs
    (bsc#1227149).
  - wifi: rtw89: add RSSI statistics for the case of antenna
    diversity to debugfs (bsc#1227149).
  - wifi: rtw89: set capability of TX antenna diversity
    (bsc#1227149).
  - wifi: rtw89: use struct rtw89_phy_sts_ie0 instead of macro to
    access PHY IE0 status (bsc#1227149).
  - wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_*
    (bsc#1227149).
  - wifi: rtw88: fix incorrect error codes in
    rtw_debugfs_copy_from_user (bsc#1227149).
  - wifi: rtl8xxxu: rtl8xxxu_rx_complete(): remove unnecessary
    return (bsc#1227149).
  - commit fef25cd
  - wifi: rtl8xxxu: Add sta_add() and sta_remove() callbacks
    (bsc#1227149).
  - commit a27e0ec
  - wifi: rtl8xxxu: Support USB RX aggregation for the newer chips
    (bsc#1227149).
  - wifi: rtl8xxxu: Set maximum number of supported stations
    (bsc#1227149).
  - wifi: rtl8xxxu: Declare AP mode support for 8188f (bsc#1227149).
  - wifi: rtl8xxxu: Remove usage of tx_info->control.rates[0].flags
    (bsc#1227149).
  - wifi: rtl8xxxu: Remove usage of ieee80211_get_tx_rate()
    (bsc#1227149).
  - wifi: rtl8xxxu: Clean up filter configuration (bsc#1227149).
  - wifi: rtl8xxxu: Enable hw seq for mgmt/non-QoS data frames
    (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter macid to update_rate_mask
    (bsc#1227149).
  - wifi: rtl8xxxu: Put the macid in txdesc (bsc#1227149).
  - commit 6125130
  - wifi: radiotap: add bandwidth definition of EHT U-SIG
    (bsc#1227149).
  - wifi: ieee80211: add UL-bandwidth definition of trigger frame
    (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter force to
    rtl8xxxu_refresh_rate_mask (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter role to report_connect
    (bsc#1227149).
  - wifi: rtl8xxxu: Actually use macid in
    rtl8xxxu_gen2_report_connect (bsc#1227149).
  - wifi: rtl8xxxu: Allow creating interface in AP mode
    (bsc#1227149).
  - wifi: rtl8xxxu: Allow setting rts threshold to -1 (bsc#1227149).
  - wifi: rtl8xxxu: Add set_tim() callback (bsc#1227149).
  - wifi: rtl8xxxu: Add beacon functions (bsc#1227149).
  - wifi: rtl8xxxu: Select correct queue for beacon frames
    (bsc#1227149).
  - wifi: rtl8xxxu: Add start_ap() callback (bsc#1227149).
  - commit 02b75ed
  - wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1227149
    CVE-2023-47210 bsc#1225601 CVE-2023-38417 bsc#1225600).
  - commit ea4853c
  - wifi: iwlwifi: bump FW API to 89 for AX/BZ/SC devices
    (bsc#1227149 CVE-2023-47210 bsc#1225601 CVE-2023-38417
    bsc#1225600).
  - commit bc49209
  - ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods
    by MAX_BDL_ENTRIES (stable-fixes).
  - ASoC: rt711-sdw: add missing readable registers (stable-fixes).
  - ALSA: hda/realtek: Enable Mute LED on HP 250 G7 (stable-fixes).
  - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
    (stable-fixes).
  - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU (stable-fixes).
  - commit 1ddd32b
  - hpet: Support 32-bit userspace (git-fixes).
  - misc: fastrpc: Restrict untrusted app to attach to privileged PD
    (git-fixes).
  - misc: fastrpc: Fix ownership reassignment of remote heap
    (git-fixes).
  - misc: fastrpc: Fix memory leak in audio daemon attach operation
    (git-fixes).
  - misc: fastrpc: Avoid updating PD type for capability request
    (git-fixes).
  - misc: fastrpc: Copy the complete capability structure to user
    (git-fixes).
  - misc: fastrpc: Fix DSP capabilities request (git-fixes).
  - USB: serial: mos7840: fix crash on resume (git-fixes).
  - USB: core: Fix duplicate endpoint bug by clearing reserved
    bits in the descriptor (git-fixes).
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
    (git-fixes).
  - ASoC: SOF: Intel: hda: fix null deref on system suspend entry
    (git-fixes).
  - firmware: cs_dsp: Prevent buffer overrun when processing V2
    alg headers (git-fixes).
  - firmware: cs_dsp: Validate payload length before processing
    block (git-fixes).
  - firmware: cs_dsp: Return error if block header overflows file
    (git-fixes).
  - firmware: cs_dsp: Fix overflow checking of wmfw header
    (git-fixes).
  - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Lenovo
    ThinBook 13x Gen4 (git-fixes).
  - commit 34ebce1

++++ kernel-default:

  - supported.conf: update for mt76 stuff (bsc#1227149)
  - commit 276fbe5
  - kabi/severities: cover all mt76 modules (bsc#1227149)
  - commit 8877f2f
  - wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
    (bsc#1227149).
  - commit a3d6465
  - wifi: mac80211: fix monitor channel with chanctx emulation
    (bsc#1227149).
  - wifi: cfg80211: validate HE operation element parsing
    (bsc#1227149).
  - wifi: mac80211: don't select link ID if not provided in scan
    request (bsc#1227149).
  - wifi: mac80211: check EHT/TTLM action frame length
    (bsc#1227149).
  - wifi: mac80211: correctly set active links upon TTLM
    (bsc#1227149).
  - wifi: cfg80211: set correct param change count in ML element
    (bsc#1227149).
  - wifi: mac80211: use deflink and fix typo in link ID check
    (bsc#1227149).
  - commit e4d62d6
  - kabi/severities: ignore kABI changes Realtek WiFi drivers (bsc#1227149)
    All those symbols are local and used for its own helpers
  - commit c402c7b
  - wifi: rtlwifi: Ignore IEEE80211_CONF_CHANGE_RETRY_LIMITS
    (bsc#1227149).
  - wifi: rtw89: wow: refine WoWLAN flows of HCI interrupts and
    low power mode (bsc#1227149).
  - wifi: rtl8xxxu: enable MFP support with security flag of RX
    descriptor (bsc#1227149).
  - wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if
    no 6 GHz sband (bsc#1227149).
  - wifi: rtw89: 8852c: add quirk to set PCI BER for certain
    platforms (bsc#1227149).
  - wifi: rtw89: download firmware with five times retry
    (bsc#1227149).
  - commit 70ec305
  - wifi: rtw89: coex: fix configuration for shared antenna for
    8922A (bsc#1227149).
  - wifi: rtw89: wow: move release offload packet earlier for
    WoWLAN mode (bsc#1227149).
  - wifi: rtw89: wow: set security engine options for 802.11ax
    chips only (bsc#1227149).
  - wifi: rtw89: update suspend/resume for different generation
    (bsc#1227149).
  - wifi: rtw89: wow: update config mac function with different
    generation (bsc#1227149).
  - wifi: rtw89: update DMA function with different generation
    (bsc#1227149).
  - wifi: rtw89: wow: update WoWLAN status register for different
    generation (bsc#1227149).
  - wifi: rtw89: wow: update WoWLAN reason register for different
    chips (bsc#1227149).
  - wifi: rtw89: coex: Add coexistence policy to decrease WiFi
    packet CRC-ERR (bsc#1227149).
  - wifi: rtw89: coex: When Bluetooth not available don't set
    power/gain (bsc#1227149).
  - wifi: rtw89: coex: add return value to ensure H2C command is
    success or not (bsc#1227149).
  - wifi: rtw89: coex: Reorder H2C command index to align with
    firmware (bsc#1227149).
  - wifi: rtw89: coex: add BTC ctrl_info version 7 and related logic
    (bsc#1227149).
  - wifi: rtw89: coex: add init_info H2C command format version 7
    (bsc#1227149).
  - wifi: rtw89: 8922a: add coexistence helpers of SW grant
    (bsc#1227149).
  - wifi: rtw89: mac: add coexistence helpers {cfg/get}_plt
    (bsc#1227149).
  - wifi: rtlwifi: Remove rtl_intf_ops.read_efuse_byte
    (bsc#1227149).
  - wifi: rtl8xxxu: fix mixed declarations in rtl8xxxu_set_aifs()
    (bsc#1227149).
  - wifi: rtw89: pci: implement PCI CLK/ASPM/L1SS for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: Update EHT PHY beamforming capability
    (bsc#1227149).
  - wifi: rtw89: advertise missing extended scan feature
    (bsc#1227149).
  - wifi: rtlwifi: set initial values for unexpected cases of USB
    endpoint priority (bsc#1227149).
  - wifi: rtl8xxxu: check vif before using in rtl8xxxu_tx()
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192cu: Fix TX aggregation (bsc#1227149).
  - commit e9149f1
  - wifi: rtw89: 8922a: add helper of set_channel (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel RF part (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel BB part (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel MAC part (bsc#1227149).
  - wifi: rtlwifi: rtl_usb: Store the endpoint addresses
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192cu: Fix 2T2R chip type detection
    (bsc#1227149).
  - wifi: rtw89: 8922a: declare to support two chanctx
    (bsc#1227149).
  - wifi: rtw89: chan: support MCC on Wi-Fi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: implement MRC H2C command functions
    (bsc#1227149).
  - wifi: rtw89: mac: implement MRC C2H event handling
    (bsc#1227149).
  - wifi: rtw89: fw: add definition of H2C command and C2H event
    for MRC series (bsc#1227149).
  - wifi: rtw89: change qutoa to DBCC by default for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: reference quota mode when setting Tx power
    (bsc#1227149).
  - wifi: rtw89: 8922a: implement AP mode related reg for BE
    generation (bsc#1227149).
  - wifi: rtw89: 8922a: correct register definition and merge IO
    for ctrl_nbtg_bt_tx() (bsc#1227149).
  - wifi: rtw89: differentiate narrow_bw_ru_dis setting according
    to chip gen (bsc#1227149).
  - wifi: rtw89: use PLCP information to match BSS_COLOR and AID
    (bsc#1227149).
  - wifi: rtw89: mac: reset PHY-1 hardware when going to
    enable/disable (bsc#1227149).
  - wifi: rtw89: mac: correct MUEDCA setting for MAC-1
    (bsc#1227149).
  - wifi: rtw89: mac: return held quota of DLE when changing MAC-1
    (bsc#1227149).
  - wifi: rtw89: load BB parameters to PHY-1 (bsc#1227149).
  - wifi: rtw89: correct PHY register offset for PHY-1
    (bsc#1227149).
  - wifi: rtw89: chan: MCC take reconfig into account (bsc#1227149).
  - wifi: rtw89: chan: move handling from add/remove to
    assign/unassign for MLO (bsc#1227149).
  - wifi: rtw89: chan: tweak weight recalc ahead before MLO
    (bsc#1227149).
  - wifi: rtw89: chan: tweak bitmap recalc ahead before MLO
    (bsc#1227149).
  - wifi: rtw89: chan: add sub-entity swap function to cover
    replacing (bsc#1227149).
  - wifi: rtw89: drop TIMING_BEACON_ONLY and sync beacon TSF by self
    (bsc#1227149).
  - wifi: rtl8xxxu: update rate mask per sta (bsc#1227149).
  - wifi: rtw89: fw: download firmware with key data for secure boot
    (bsc#1227149).
  - wifi: rtw89: fw: parse secure section from firmware file
    (bsc#1227149).
  - wifi: rtw89: fw: read firmware secure information from efuse
    (bsc#1227149).
  - wifi: rtw89: fw: consider checksum length of security data
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::rfk_hw_init (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::rfk_init_late to do initial
    RF calibrations later (bsc#1227149).
  - commit 28c4b55
  - wifi: rtw89: 8922a: rfk: implement chip_ops to call RF
    calibrations (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger TSSI (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger TXGAPK
    (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger DACK (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger DPK (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger RX DCK
    (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger IQK (bsc#1227149).
  - wifi: rtw89: rfk: send channel information to firmware for RF
    calibrations (bsc#1227149).
  - wifi: rtw89: rfk: add a completion to wait RF calibration
    report from C2H event (bsc#1227149).
  - wifi: rtl8xxxu: Add TP-Link TL-WN823N V2 (bsc#1227149).
  - wifi: rtl8xxxu: fix error messages (bsc#1227149).
  - wifi: rtw89: 8922a: add more fields to beacon H2C command to
    support multi-links (bsc#1227149).
  - wifi: rtw89: update ps_state register for chips with different
    generation (bsc#1227149).
  - wifi: rtw89: add new H2C for PS mode in 802.11be chip
    (bsc#1227149).
  - wifi: rtw89: 8922a: add ieee80211_ops::hw_scan (bsc#1227149).
  - wifi: rtw89: prepare scan leaf functions for wifi 7 ICs
    (bsc#1227149).
  - wifi: rtw89: debug: add FW log component for scan (bsc#1227149).
  - wifi: rtw89: update scan C2H messages for wifi 7 IC
    (bsc#1227149).
  - wifi: rtw89: 8922a: set chip_ops FEM and GPIO to NULL
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops to get thermal value
    (bsc#1227149).
  - wifi: rtw89: 8922a: add RF read/write v2 (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::cfg_txrx_path (bsc#1227149).
  - wifi: rtw89: 8922a: implement {stop,resume}_sch_tx and cfg_ppdu
    (bsc#1227149).
  - wifi: rtw89: 8922a: hook handlers of TX/RX descriptors to
    chip_ops (bsc#1227149).
  - wifi: rtw89: pci: validate RX tag for RXQ and RPQ (bsc#1227149).
  - wifi: rtw89: pci: interrupt v2 refine IMR for SER (bsc#1227149).
  - wifi: rtw89: pci: update SER timer unit and timeout time
    (bsc#1227149).
  - wifi: rtw89: fix disabling concurrent mode TX hang issue
    (bsc#1227149).
  - wifi: rtw89: fix HW scan timeout due to TSF sync issue
    (bsc#1227149).
  - wifi: rtw89: add wait/completion for abort scan (bsc#1227149).
  - wifi: rtw89: disable RTS when broadcast/multicast (bsc#1227149).
  - wifi: rtw89: Set default CQM config if not present
    (bsc#1227149).
  - wifi: rtw89: refine hardware scan C2H events (bsc#1227149).
  - wifi: rtw89: refine add_chan H2C command to encode_bits
    (bsc#1227149).
  - wifi: rtw89: 8922a: add BTG functions to assist BT coexistence
    to control TX/RX (bsc#1227149).
  - wifi: rtw89: 8922a: add TX power related ops (bsc#1227149).
  - wifi: rtw89: 8922a: add register definitions of H2C, C2H,
    page, RRSR and EDCCA (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops related to BB init
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::{enable,disable}_bb_rf
    (bsc#1227149).
  - wifi: rtw89: add mlo_dbcc_mode for WiFi 7 chips (bsc#1227149).
  - wifi: rtlwifi: Speed up firmware loading for USB (bsc#1227149).
  - wifi: rtl8xxxu: add missing number of sec cam entries for all
    variants (bsc#1227149).
  - wifi: rtl8xxxu: make instances of iface limit and combination
    to be static const (bsc#1227149).
  - wifi: rtl8xxxu: convert EN_DESC_ID of TX descriptor to le32 type
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192de: Don't read register in
    _rtl92de_query_rxphystatus (bsc#1227149).
  - wifi: rtw89: fw: extend JOIN H2C command to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: fw: use struct to fill JOIN H2C command
    (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to reset DMAC table for WiFi 7
    (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to reset CMAC table for WiFi 7
    (bsc#1227149).
  - wifi: rtw89: fw: update TX AMPDU parameter to CMAC table
    (bsc#1227149).
  - wifi: rtw89: fw: add chip_ops to update CMAC table to associated
    station (bsc#1227149).
  - wifi: rtw89: fw: fill CMAC table to associated station for
    WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to update security CAM v2
    (bsc#1227149).
  - wifi: rtw89: declare EXT NSS BW of VHT capability (bsc#1227149).
  - wifi: rtw89: add EHT capabilities for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: change supported bandwidths of chip_info to bit
    mask (bsc#1227149).
  - wifi: rtw89: adjust init_he_cap() to add EHT cap into
    iftype_data (bsc#1227149).
  - wifi: rtw88: use kstrtoX_from_user() in debugfs handlers
    (bsc#1227149).
  - wifi: rtl8xxxu: enable channel switch support (bsc#1227149).
  - wifi: rtlwifi: rtl_usb: Use sync register writes (bsc#1227149).
  - commit 055a697
  - wifi: rtlwifi: cleanup few rtlxxx_tx_fill_desc() routines
    (bsc#1227149).
  - wifi: rtw89: add chip_ops::update_beacon to abstract update
    beacon operation (bsc#1227149).
  - wifi: rtw89: add H2C command to download beacon frame for WiFi
    7 chips (bsc#1227149).
  - wifi: rtw89: use struct to fill H2C command to download beacon
    frame (bsc#1227149).
  - wifi: rtw89: add new H2C command to pause/sleep transmitting
    by MAC ID (bsc#1227149).
  - wifi: rtw89: refine H2C command that pause transmitting by
    MAC ID (bsc#1227149).
  - wifi: rtw89: fw: use struct to fill BA CAM H2C commands
    (bsc#1227149).
  - wifi: rtw89: 8922a: update BA CAM number to 24 (bsc#1227149).
  - wifi: rtw89: add chip_ops::h2c_ba_cam() to configure BA CAM
    (bsc#1227149).
  - wifi: rtw89: mac: add feature_init to initialize BA CAM V1
    (bsc#1227149).
  - wifi: rtw89: add firmware H2C command of BA CAM V1
    (bsc#1227149).
  - wifi: rtl8xxxu: Fix off by one initial RTS rate (bsc#1227149).
  - wifi: rtl8xxxu: Fix LED control code of RTL8192FU (bsc#1227149).
  - wifi: rtl8xxxu: declare concurrent mode support for 8188f
    (bsc#1227149).
  - wifi: rtl8xxxu: make supporting AP mode only on port 0
    transparent (bsc#1227149).
  - wifi: rtl8xxxu: add hw crypto support for AP mode (bsc#1227149).
  - wifi: rtl8xxxu: remove obsolete priv->vif (bsc#1227149).
  - wifi: rtl8xxxu: add macids for STA mode (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interface in start_ap()
    (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    bss_info_changed() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    {add,remove}_interface() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    watchdog_callback() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    configure_filter() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    update_beacon_work_callback() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in set_aifs()
    (bsc#1227149).
  - wifi: rtl8xxxu: support setting bssid register for multiple
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: don't parse CFO, if both interfaces are
    connected in STA mode (bsc#1227149).
  - wifi: rtl8xxxu: extend check for matching bssid to both
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: extend wifi connected check to both interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: support setting mac address register for both
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: 8188e: convert usage of priv->vif to
    priv->vifs[0] (bsc#1227149).
  - wifi: rtl8xxxu: support setting linktype for both interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: prepare supporting two virtual interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: remove assignment of priv->vif in
    rtl8xxxu_bss_info_changed() (bsc#1227149).
  - wifi: rtw88: 8822ce: refine power parameters for RFE type 5
    (bsc#1227149).
  - wifi: rtw89: mac: Fix spelling mistakes "notfify" -> "notify"
    (bsc#1227149).
  - wifi: rtw89: phy: set channel_info for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: phy: add BB wrapper of TX power for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: 8922a: add NCTL pre-settings for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: phy: ignore special data from BB parameter file
    (bsc#1227149).
  - wifi: rtw89: 8922a: update the register used in DIG and the
    DIG flow (bsc#1227149).
  - wifi: rtw89: 8922a: set RX gain along with set_channel operation
    (bsc#1227149).
  - wifi: rtw89: phy: add parser to support RX gain dynamic setting
    flow (bsc#1227149).
  - wifi: rtw89: phy: move bb_gain_info used by WiFi 6 chips to
    union (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R37 (bsc#1227149).
  - wifi: rtw89: 8852b: update TX power tables to R36 (bsc#1227149).
  - wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: phy: using calculate_bit_shift()
    (bsc#1227149).
  - wifi: rtw89: coex: To improve Wi-Fi performance while BT is idle
    (bsc#1227149).
  - wifi: rtw89: coex: Translate antenna configuration from ID to
    string (bsc#1227149).
  - commit d99b9e1
  - wifi: rtw89: coex: Update RF parameter control setting logic
    (bsc#1227149).
  - wifi: rtw89: coex: Add Bluetooth RSSI level information
    (bsc#1227149).
  - wifi: rtw89: coex: Set Bluetooth scan low-priority when Wi-Fi
    link/scan (bsc#1227149).
  - wifi: rtw89: coex: Update coexistence policy for Wi-Fi LPS
    (bsc#1227149).
  - wifi: rtw89: coex: Still show hardware grant signal info even
    Wi-Fi is PS (bsc#1227149).
  - wifi: rtw89: coex: Update BTG control related logic
    (bsc#1227149).
  - wifi: rtw89: coex: Add Pre-AGC control to enhance Wi-Fi RX
    performance (bsc#1227149).
  - wifi: rtw89: coex: Record down Wi-Fi initial mode information
    (bsc#1227149).
  - wifi: rtw89: coex: Fix wrong Wi-Fi role info and FDDT parameter
    members (bsc#1227149).
  - wifi: rtw88: use cfg80211_ssid_eq() instead of rtw_ssid_equal()
    (bsc#1227149).
  - wifi: rtw89: mac: implement to configure TX/RX engines for
    WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: mac: add sys_init and filter option for WiFi 7
    chips (bsc#1227149).
  - wifi: rtw89: only reset BB/RF for existing WiFi 6 chips while
    starting up (bsc#1227149).
  - wifi: rtw89: add DBCC H2C to notify firmware the status
    (bsc#1227149).
  - wifi: rtw89: mac: add suffix _ax to MAC functions (bsc#1227149).
  - wifi: rtw89: mac: add flags to check if CMAC and DMAC are
    enabled (bsc#1227149).
  - wifi: rtw89: 8922a: add power on/off functions (bsc#1227149).
  - wifi: rtw89: add XTAL SI for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: phy: print out RFK log with formatted string
    (bsc#1227149).
  - wifi: rtw89: parse and print out RFK log from C2H events
    (bsc#1227149).
  - wifi: rtw89: add C2H event handlers of RFK log and report
    (bsc#1227149).
  - wifi: rtw89: load RFK log format string from firmware file
    (bsc#1227149).
  - wifi: rtw89: fw: add version field to BB MCU firmware element
    (bsc#1227149).
  - wifi: rtw89: fw: load TX power track tables from fw_element
    (bsc#1227149).
  - wifi: rtw88: Use random MAC when efuse MAC invalid
    (bsc#1227149).
  - wifi: rtw89: avoid stringop-overflow warning (bsc#1227149).
  - wifi: rtw89: mac: refine SER setting during WiFi CPU power on
    (bsc#1227149).
  - wifi: rtw89: 8922a: dump MAC registers when SER occurs
    (bsc#1227149).
  - wifi: rtw89: 8922a: add SER IMR tables (bsc#1227149).
  - wifi: rtw89: fw: extend program counter dump for Wi-Fi 7 chip
    (bsc#1227149).
  - wifi: rtw89: 8922a: configure CRASH_TRIGGER FW feature
    (bsc#1227149).
  - wifi: rtw89: fix misbehavior of TX beacon in concurrent mode
    (bsc#1227149).
  - wifi: rtw89: refine remain on channel flow to improve P2P
    connection (bsc#1227149).
  - wifi: rtw89: Refine active scan behavior in 6 GHz (bsc#1227149).
  - wifi: rtw89: fix not entering PS mode after AP stops
    (bsc#1227149).
  - wifi: rtlwifi: Remove bridge vendor/device ids (bsc#1227149).
  - wifi: rtlwifi: Remove unused PCI related defines and struct
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Access full PMCS reg and use
    pci_regs.h (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Add pdev into
    _rtl8821ae_clear_pci_pme_status() (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Use pci_find_capability()
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Reverse PM Capability exists check
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Remove unnecessary PME_Status bit set
    (bsc#1227149).
  - wifi: rtlwifi: Convert to use PCIe capability accessors
    (bsc#1227149).
  - wifi: rtw89: mac: functions to configure hardware engine and
    quota for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: mac: use pointer to access functions of hardware
    engine and quota (bsc#1227149).
  - wifi: rtw89: mac: move code related to hardware engine to
    individual functions (bsc#1227149).
  - wifi: rtw89: mac: check queue empty according to chip gen
    (bsc#1227149).
  - wifi: rtw89: refine element naming used by queue empty check
    (bsc#1227149).
  - wifi: rtw89: add reserved size as factor of DLE used size
    (bsc#1227149).
  - wifi: rtw89: mac: add to get DLE reserved quota (bsc#1227149).
  - commit cf41ac5
  - wifi: rtw89: 8922a: extend and add quota number (bsc#1227149).
  - wifi: rtw89: debug: remove wrapper of rtw89_debug()
    (bsc#1227149).
  - wifi: rtw89: debug: add debugfs entry to disable dynamic
    mechanism (bsc#1227149).
  - wifi: rtw89: phy: dynamically adjust EDCCA threshold
    (bsc#1227149).
  - wifi: rtw89: debug: add to check if debug mask is enabled
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: phy: remove some useless code
    (bsc#1227149).
  - wifi: rtw88: debug: remove wrapper of rtw_dbg() (bsc#1227149).
  - wifi: rtw89: 8922a: read efuse content from physical map
    (bsc#1227149).
  - wifi: rtw89: 8922a: read efuse content via efuse map struct
    from logic map (bsc#1227149).
  - wifi: rtw89: 8852c: read RX gain offset from efuse for 6GHz
    channels (bsc#1227149).
  - wifi: rtw89: mac: add to access efuse for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: mac: use mac_gen pointer to access about efuse
    (bsc#1227149).
  - wifi: rtw89: 8922a: add 8922A basic chip info (bsc#1227149).
  - wifi: rtlwifi: drop unused const_amdpci_aspm (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R65-R44
    (bsc#1227149).
  - wifi: rtw89: regd: handle policy of 6 GHz according to BIOS
    (bsc#1227149).
  - wifi: rtw89: acpi: process 6 GHz band policy from DSM
    (bsc#1227149).
  - wifi: rtlwifi: simplify rtl_action_proc() and rtl_tx_agg_start()
    (bsc#1227149).
  - wifi: rtw89: pci: update interrupt mitigation register for
    8922AE (bsc#1227149).
  - wifi: rtw89: pci: correct interrupt mitigation register for
    8852CE (bsc#1227149).
  - wifi: rtw89: 8922ae: add v2 interrupt handlers for 8922AE
    (bsc#1227149).
  - wifi: rtw89: pci: generalize interrupt status bits of interrupt
    handlers (bsc#1227149).
  - wifi: rtw89: pci: add pre_deinit to be called after probe
    complete (bsc#1227149).
  - wifi: rtw89: pci: stop/start DMA for level 1 recovery according
    to chip gen (bsc#1227149).
  - wifi: rtw89: pci: reset BDRAM according to chip gen
    (bsc#1227149).
  - wifi: rtw88: simplify __rtw_tx_work() (bsc#1227149).
  - wifi: rtw89: coex: use struct assignment to replace memcpy()
    to append TDMA content (bsc#1227149).
  - wifi: rtw89: pci: implement PCI mac_post_init for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: pci: add LTR v2 for WiFi 7 chip (bsc#1227149).
  - wifi: rtw89: pci: implement PCI mac_pre_init for WiFi 7 chips
    (bsc#1227149).
  - commit dcfcac7
  - wifi: rtw89: pci: use gen_def pointer to configure
    mac_{pre,post}_init and clear PCI ring index (bsc#1227149).
  - wifi: rtw89: pci: add PCI generation information to pci_info
    for each chip (bsc#1227149).
  - wifi: rtw89: extend PHY status parser to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: consider RX info for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: configure PPDU max user by chip (bsc#1227149).
  - wifi: rtw89: set entry size of address CAM to H2C field by chip
    (bsc#1227149).
  - wifi: rtw89: pci: generalize code of PCI control DMA IO for
    WiFi 7 (bsc#1227149).
  - wifi: rtw89: pci: add new RX ring design to determine full RX
    ring efficiently (bsc#1227149).
  - wifi: rtw89: pci: define PCI ring address for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: 8922ae: add 8922AE PCI entry and basic info
    (bsc#1227149).
  - wifi: rtlwifi: rtl92ee_dm_dynamic_primary_cca_check(): fix
    typo in function name (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_phy (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_hal (bsc#1227149).
  - wifi: rtw89: cleanup firmware elements parsing (bsc#1227149).
  - wifi: rtlwifi: drop chk_switch_dmdp() from HAL interface
    (bsc#1227149).
  - wifi: rtlwifi: drop fill_fake_txdesc() from HAL interface
    (bsc#1227149).
  - wifi: rtlwifi: drop pre_fill_tx_bd_desc() from HAL interface
    (bsc#1227149).
  - wifi: rtw89: move software DCFO compensation setting to proper
    position (bsc#1227149).
  - wifi: rtw89: correct the DCFO tracking flow to improve CFO
    compensation (bsc#1227149).
  - wifi: rtw89: modify the register setting and the flow of CFO
    tracking (bsc#1227149).
  - wifi: rtw89: phy: generalize valid bit of BSS color
    (bsc#1227149).
  - wifi: rtw89: phy: change naming related BT coexistence functions
    (bsc#1227149).
  - wifi: rtw88: dump firmware debug information in abnormal state
    (bsc#1227149).
  - wifi: rtw88: debug: add to check if debug mask is enabled
    (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_ps_ctl (bsc#1227149).
  - wifi: rtw89: mac: do bf_monitor only if WiFi 6 chips
    (bsc#1227149).
  - wifi: rtw89: mac: set bf_assoc capabilities according to chip
    gen (bsc#1227149).
  - wifi: rtw89: mac: set bfee_ctrl() according to chip gen
    (bsc#1227149).
  - wifi: rtw89: mac: add registers of MU-EDCA parameters for WiFi
    7 chips (bsc#1227149).
  - wifi: rtw89: mac: generalize register of MU-EDCA switch
    according to chip gen (bsc#1227149).
  - wifi: rtw89: mac: update RTS threshold according to chip gen
    (bsc#1227149).
  - wifi: rtlwifi: simplify TX command fill callbacks (bsc#1227149).
  - wifi: rtw89: coex: add annotation __counted_by() to struct
    rtw89_btc_btf_set_mon_reg (bsc#1227149).
  - wifi: rtw89: coex: add annotation __counted_by() for struct
    rtw89_btc_btf_set_slot_table (bsc#1227149).
  - wifi: rtw89: add EHT radiotap in monitor mode (bsc#1227149).
  - wifi: rtw89: show EHT rate in debugfs (bsc#1227149).
  - wifi: rtw89: parse TX EHT rate selected by firmware from RA
    C2H report (bsc#1227149).
  - wifi: rtw89: Add EHT rate mask as parameters of RA H2C command
    (bsc#1227149).
  - wifi: rtw89: parse EHT information from RX descriptor and PPDU
    status packet (bsc#1227149).
  - wifi: rtlwifi: use convenient list_count_nodes() (bsc#1227149).
  - commit 53661e1
  - wifi: rtlwifi: use unsigned long for bt_coexist_8723 timestamp
    (bsc#1227149).
  - wifi: rtw88: 8821c: tweak CCK TX filter setting for SRRC
    regulation (bsc#1227149).
  - wifi: rtw88: regd: update regulatory map to R64-R42
    (bsc#1227149).
  - wifi: rtw88: 8822c: update TX power limit to V70 (bsc#1227149).
  - wifi: rtw88: 8821c: update TX power limit to V67 (bsc#1227149).
  - wifi: rtw88: regd: configure QATAR and UK (bsc#1227149).
  - wifi: rtlwifi: remove unreachable code in
    rtl92d_dm_check_edca_turbo() (bsc#1227149).
  - wifi: rtw89: debug: txpwr table supports Wi-Fi 7 chips
    (bsc#1227149).
  - wifi: rtw89: debug: show txpwr table according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power RU limit according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power limit according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power offset according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power by rate according to chip gen
    (bsc#1227149).
  - wifi: rtw89: mac: get TX power control register according to
    chip gen (bsc#1227149).
  - wifi: rtlwifi: use unsigned long for rtl_bssid_entry timestamp
    (bsc#1227149).
  - wifi: rtw89: refine bandwidth 160MHz uplink OFDMA performance
    (bsc#1227149).
  - wifi: rtw89: refine uplink trigger based control mechanism
    (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R34 (bsc#1227149).
  - wifi: rtw89: 8852b: update TX power tables to R35 (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R67 (bsc#1227149).
  - wifi: rtw89: regd: configure Thailand in regulation type
    (bsc#1227149).
  - wifi: rtlwifi: cleanup few rtlxxxx_set_hw_reg() routines
    (bsc#1227149).
  - wifi: rtw89: declare MCC in interface combination (bsc#1227149).
  - wifi: rtw89: 8852c: declare to support two chanctx
    (bsc#1227149).
  - wifi: rtw89: pause/proceed MCC for ROC and HW scan
    (bsc#1227149).
  - wifi: rtw89: mcc: fix NoA start time when GO is auxiliary
    (bsc#1227149).
  - wifi: rtw89: load TX power related tables from FW elements
    (bsc#1227149).
  - wifi: rtw89: phy: extend TX power common stuffs for Wi-Fi 7
    chips (bsc#1227149).
  - wifi: rtw89: load TX power by rate when RFE parms setup
    (bsc#1227149).
  - wifi: rtw89: phy: refine helpers used for raw TX power
    (bsc#1227149).
  - commit 62f3f4a
  - wifi: rtw89: indicate TX power by rate table inside RFE
    parameter (bsc#1227149).
  - wifi: rtw89: indicate TX shape table inside RFE parameter
    (bsc#1227149).
  - wifi: rtw89: add subband index of primary channel to struct
    rtw89_chan (bsc#1227149).
  - wifi: rtl8xxxu: Add a description about the device ID
    0x7392:0xb722 (bsc#1227149).
  - wifi: rtw89: add mac_gen pointer to access mac port registers
    (bsc#1227149).
  - wifi: rtw89: consolidate registers of mac port to struct
    (bsc#1227149).
  - wifi: rtw89: add chip_info::txwd_info size to generalize TX
    WD submit (bsc#1227149).
  - wifi: rtw89: add to fill TX descriptor v2 (bsc#1227149).
  - wifi: rtw89: add to fill TX descriptor for firmware command v2
    (bsc#1227149).
  - wifi: rtw89: add to query RX descriptor format v2 (bsc#1227149).
  - wifi: rtw89: mcc: deal with beacon NoA if GO exists
    (bsc#1227149).
  - wifi: rtw89: mcc: deal with BT slot change (bsc#1227149).
  - wifi: rtw89: mcc: deal with P2P PS change (bsc#1227149).
  - wifi: rtw89: mcc: track beacon offset and update when needed
    (bsc#1227149).
  - wifi: rtw89: mcc: update role bitmap when changed (bsc#1227149).
  - wifi: rtw89: 52c: rfk: disable DPK during MCC (bsc#1227149).
  - wifi: rtw89: rfk: disable driver tracking during MCC
    (bsc#1227149).
  - wifi: rtw89: 52c: rfk: refine MCC channel info notification
    (bsc#1227149).
  - wifi: rtw89: 8922a: set memory heap address for secure firmware
    (bsc#1227149).
  - wifi: rtw89: fw: refine download flow to support variant
    firmware suits (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::bb_preinit to enable BB
    before downloading firmware (bsc#1227149).
  - wifi: rtw89: fw: propagate an argument include_bb for BB MCU
    firmware (bsc#1227149).
  - wifi: rtw89: fw: add checking type for variant type of firmware
    (bsc#1227149).
  - wifi: rtw89: fw: implement supported functions of download
    firmware for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: generalize download firmware flow by mac_gen
    pointers (bsc#1227149).
  - wifi: rtw89: fw: move polling function of firmware path ready
    to an individual function (bsc#1227149).
  - wifi: rtw89: mcc: trigger FW to start/stop MCC (bsc#1227149).
  - wifi: rtw89: fix typo of rtw89_fw_h2c_mcc_macid_bitmap()
    (bsc#1227149).
  - wifi: rtw89: mcc: decide pattern and calculate parameters
    (bsc#1227149).
  - wifi: rtw89: mcc: consider and determine BT duration
    (bsc#1227149).
  - commit bd46e4d
  - wifi: rtw89: mcc: fill fundamental configurations (bsc#1227149).
  - wifi: rtw89: mcc: initialize start flow (bsc#1227149).
  - wifi: rtw89: 8852c: Fix TSSI causes transmit power inaccuracy
    (bsc#1227149).
  - wifi: rtw89: 8852c: Update bandedge parameters for better
    performance (bsc#1227149).
  - wifi: rtl8xxxu: mark TOTOLINK N150UA V5/N150UA-B as tested
    (bsc#1227149).
  - wifi: rtw88: fix typo rtw8822cu_probe (bsc#1227149).
  - wifi: rtlwifi: rtl8723: Remove unused function
    rtl8723_cmd_send_packet() (bsc#1227149).
  - wifi: rtw89: Fix clang -Wimplicit-fallthrough in
    rtw89_query_sar() (bsc#1227149).
  - wifi: rtw89: phy: modify register setting of ENV_MNTR, PHYSTS
    and DIG (bsc#1227149).
  - wifi: rtw89: phy: add phy_gen_def::cr_base to support WiFi 7
    chips (bsc#1227149).
  - wifi: rtw89: mac: define register address of rx_filter to
    generalize code (bsc#1227149).
  - wifi: rtw89: mac: define internal memory address for WiFi 7 chip
    (bsc#1227149).
  - wifi: rtw89: mac: generalize code to indirectly access WiFi
    internal memory (bsc#1227149).
  - wifi: rtw89: mac: add mac_gen_def::band1_offset to map MAC
    band1 register address (bsc#1227149).
  - wifi: rtw89: initialize multi-channel handling (bsc#1227149).
  - wifi: rtw89: provide functions to configure NoA for beacon
    update (bsc#1227149).
  - wifi: rtw89: call rtw89_chan_get() by vif chanctx if aware of
    vif (bsc#1227149).
  - wifi: rtw89: sar: let caller decide the center frequency to
    query (bsc#1227149).
  - wifi: rtw89: refine rtw89_correct_cck_chan() by
    rtw89_hw_to_nl80211_band() (bsc#1227149).
  - wifi: rtw89: add function prototype for coex request duration
    (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R64-R43
    (bsc#1227149).
  - wifi: rtw89: fix a width vs precision bug (bsc#1227149).
  - wifi: rtlwifi: use eth_broadcast_addr() to assign broadcast
    address (bsc#1227149).
  - wifi: rtw89: Introduce Time Averaged SAR (TAS) feature
    (bsc#1227149).
  - wifi: rtw89: return failure if needed firmware elements are
    not recognized (bsc#1227149).
  - wifi: rtw89: add to parse firmware elements of BB and RF tables
    (bsc#1227149).
  - wifi: rtw89: introduce infrastructure of firmware elements
    (bsc#1227149).
  - wifi: rtw89: add firmware suit for BB MCU 0/1 (bsc#1227149).
  - wifi: rtw89: add firmware parser for v1 format (bsc#1227149).
  - wifi: rtw89: introduce v1 format of firmware header
    (bsc#1227149).
  - wifi: rtw89: support firmware log with formatted text
    (bsc#1227149).
  - wifi: rtw89: recognize log format from firmware file
    (bsc#1227149).
  - wifi: rtw89: get data rate mode/NSS/MCS v1 from RX descriptor
    (bsc#1227149).
  - wifi: rtw89: add to display hardware rates v1 histogram in
    debugfs (bsc#1227149).
  - wifi: rtw89: add C2H RA event V1 to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: use struct to access RA report (bsc#1227149).
  - wifi: rtw89: use struct to access firmware C2H event header
    (bsc#1227149).
  - wifi: rtw89: add H2C RA command V1 to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: use struct to set RA H2C command (bsc#1227149).
  - wifi: rtw89: phy: rate pattern handles HW rate by chip gen
    (bsc#1227149).
  - commit cdaa97d
  - wifi: rtlwifi: simplify LED management (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-simplify-non-chanctx-drivers.patch.
  - commit 34b32c5
  - wifi: rtw89: define hardware rate v1 for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: add chip_info::chip_gen to determine chip
    generation (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8723BU (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8192EU (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8710BU (RTL8188GU)
    (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8192FU (bsc#1227149).
  - wifi: rtw88: simplify vif iterators (bsc#1227149).
  - wifi: rtw88: remove unused USB bulkout size set (bsc#1227149).
  - wifi: rtw88: remove unused and set but unused leftovers
    (bsc#1227149).
  - wifi: rtlwifi: cleanup USB interface (bsc#1227149).
  - wifi: rtw89: use struct to parse firmware header (bsc#1227149).
  - wifi: rtw89: TX power stuffs replace confusing naming of _max
    with _num (bsc#1227149).
  - wifi: rtw89: 8851b: configure to force 1 TX power value
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: update IQK to version 0x8
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add LCK track (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R28 (bsc#1227149).
  - wifi: rtw89: 8851b: update RF radio A parameters to R28
    (bsc#1227149).
  - wifi: rtw88: fix not entering PS mode after AP stops
    (bsc#1227149).
  - wifi: rtw88: refine register based H2C command (bsc#1227149).
  - wifi: rtw88: Stop high queue during scan (bsc#1227149).
  - wifi: rtw88: Skip high queue in hci_flush (bsc#1227149).
  - wifi: rtw88: Fix AP mode incorrect DTIM behavior (bsc#1227149).
  - wifi: rtw88: use struct instead of macros to set TX desc
    (bsc#1227149).
  - wifi: rtw88: process VO packets without workqueue to avoid
    PTK rekey failed (bsc#1227149).
  - wifi: rtw88: Fix action frame transmission fail before
    association (bsc#1227149).
  - wifi: rtw89: fix spelling typo of IQK debug messages
    (bsc#1227149).
  - wifi: rtw89: cleanup rtw89_iqk_info and related code
    (bsc#1227149).
  - wifi: rtw89: cleanup private data structures (bsc#1227149).
  - wifi: rtw88: add missing unwind goto for
    __rtw_download_firmware() (bsc#1227149).
  - commit 9b282ce
  - wifi: rtlwifi: remove misused flag from HAL data (bsc#1227149).
  - wifi: rtlwifi: remove unused dualmac control leftovers
    (bsc#1227149).
  - wifi: rtlwifi: remove unused timer and related code
    (bsc#1227149).
  - wifi: rtw89: 8852c: update RF radio A/B parameters to R63
    (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (3 of 3) (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (2 of 3) (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (1 of 3) (bsc#1227149).
  - wifi: rtw89: process regulatory for 6 GHz power type
    (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R64-R40
    (bsc#1227149).
  - wifi: rtw89: regd: judge 6 GHz according to chip and BIOS
    (bsc#1227149).
  - commit f81b870
  - wifi: rtw89: refine clearing supported bands to check 2/5 GHz
    first (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-annotate-iftype_data-pointer-with-spar.patch.
  - commit 1873f0a
  - wifi: rtw89: 8851b: configure CRASH_TRIGGER feature for 8851B
    (bsc#1227149).
  - wifi: rtw89: set TX power without precondition during setting
    channel (bsc#1227149).
  - wifi: rtw89: debug: txpwr table access only valid page according
    to chip (bsc#1227149).
  - wifi: rtw89: 8851b: enable hw_scan support (bsc#1227149).
  - wifi: rtlwifi: use helper function rtl_get_hdr() (bsc#1227149).
  - wifi: rtw89: use flexible array member in rtw89_btc_btf_tlv
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: Fix spelling mistake KIP_RESOTRE ->
    KIP_RESTORE (bsc#1227149).
  - wifi: rtw89: use struct to access register-based H2C/C2H
    (bsc#1227149).
  - wifi: rtw89: use struct and le32_get_bits() to access RX
    descriptor (bsc#1227149).
  - commit 21eb4e8
  - Update config files: update for the realtek wifi driver updates (bsc#1227149)
  - commit 33b8d09
  - wifi: rtw89: use struct and le32_get_bits() to access received
    PHY status IEs (bsc#1227149).
  - wifi: rtw89: use struct and le32_get_bits to access RX info
    (bsc#1227149).
  - wifi: rtw89: add chip_ops::query_rxdesc() and rxd_len as
    helpers to support newer chips (bsc#1227149).
  - wifi: rtw89: 8851b: add 8851be to Makefile and Kconfig
    (bsc#1227149).
  - wifi: rtw89: add tx_wake notify for 8851B (bsc#1227149).
  - wifi: rtw89: enlarge supported length of read_reg debugfs entry
    (bsc#1227149).
  - wifi: rtw89: 8851b: add RF configurations (bsc#1227149).
  - wifi: rtw89: 8851b: add MAC configurations to chip_info
    (bsc#1227149).
  - wifi: rtw89: 8851b: fill BB related capabilities to chip_info
    (bsc#1227149).
  - wifi: rtw89: 8851b: add TX power related functions
    (bsc#1227149).
  - commit 66eef0c
  - Update config files: update for the realtek wifi driver updates (bsc#1227149)
  - commit 75bc634
  - wifi: rtw89: refine packet offload handling under SER
    (bsc#1227149).
  - wifi: rtw89: tweak H2C TX waiting function for SER
    (bsc#1227149).
  - wifi: rtw89: ser: reset total_sta_assoc and tdls_peer when L2
    (bsc#1227149).
  - wifi: rtw88: Add support for the SDIO based RTL8723DS chipset
    (bsc#1227149).
  - wifi: rtw88: rtw8723d: Implement RTL8723DS (SDIO) efuse parsing
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add TSSI (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add DPK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add RX DCK (bsc#1227149).
  - wifi: rtw89: 8851b: add to parse efuse content (bsc#1227149).
  - wifi: rtw89: 8851b: add set channel function (bsc#1227149).
  - wifi: rtw89: 8851b: add basic power on function (bsc#1227149).
  - wifi: rtw89: 8851b: add BT coexistence support function
    (bsc#1227149).
  - wifi: rtw89: 8851b: configure GPIO according to RFE type
    (bsc#1227149).
  - wifi: rtw89: 8851b: add to read efuse version to recognize
    hardware version B (bsc#1227149).
  - wifi: rtl8xxxu: Rename some registers (bsc#1227149).
  - wifi: rtl8xxxu: Support new chip RTL8192FU (bsc#1227149).
  - wifi: rtw89: suppress the log for specific SER called
    CMDPSR_FRZTO (bsc#1227149).
  - wifi: rtw89: ser: L1 add pre-M0 and post-M0 states
    (bsc#1227149).
  - wifi: rtw89: pci: fix interrupt enable mask for HALT C2H of
    RTL8851B (bsc#1227149).
  - wifi: rtw89: support U-NII-4 channels on 5GHz band
    (bsc#1227149).
  - wifi: rtw89: regd: judge UNII-4 according to BIOS and chip
    (bsc#1227149).
  - wifi: rtw89: introduce realtek ACPI DSM method (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add IQK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add DACK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add RCK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add AACK (bsc#1227149).
  - wifi: rtw89: 8851b: add set_channel_rf() (bsc#1227149).
  - wifi: rtw89: 8851b: add DLE mem and HFC quota (bsc#1227149).
  - wifi: rtw89: 8851b: add support WoWLAN to 8851B (bsc#1227149).
  - wifi: rtw89: change naming of BA CAM from V1 to V0_EXT
    (bsc#1227149).
  - commit a1de2dd
  - wifi: rtw89: use chip_info::small_fifo_size to choose debug_mask
    (bsc#1227149).
  - wifi: rtw89: add CFO XTAL registers field to support 8851B
    (bsc#1227149).
  - wifi: rtw89: 8851b: add NCTL post table (bsc#1227149).
  - wifi: rtw89: 8851be: add 8851BE PCI entry and fill PCI
    capabilities (bsc#1227149).
  - wifi: rtw89: 8851b: add 8851B basic chip_info (bsc#1227149).
  - wifi: rtw89: scan offload wait for FW done ACK (bsc#1227149).
  - wifi: rtw89: mac: handle C2H receive/done ACK in interrupt
    context (bsc#1227149).
  - wifi: rtw89: packet offload wait for FW response (bsc#1227149).
  - wifi: rtw89: refine packet offload delete flow of 6 GHz probe
    (bsc#1227149).
  - wifi: rtw89: release bit in rtw89_fw_h2c_del_pkt_offload()
    (bsc#1227149).
  - wifi: rtw89: add EVM for antenna diversity (bsc#1227149).
  - wifi: rtw89: add RSSI based antenna diversity (bsc#1227149).
  - wifi: rtw89: initialize antenna for antenna diversity
    (bsc#1227149).
  - wifi: rtw89: add EVM and SNR statistics to debugfs
    (bsc#1227149).
  - wifi: rtw89: add RSSI statistics for the case of antenna
    diversity to debugfs (bsc#1227149).
  - wifi: rtw89: set capability of TX antenna diversity
    (bsc#1227149).
  - wifi: rtw89: use struct rtw89_phy_sts_ie0 instead of macro to
    access PHY IE0 status (bsc#1227149).
  - wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_*
    (bsc#1227149).
  - wifi: rtw88: fix incorrect error codes in
    rtw_debugfs_copy_from_user (bsc#1227149).
  - wifi: rtl8xxxu: rtl8xxxu_rx_complete(): remove unnecessary
    return (bsc#1227149).
  - commit fef25cd
  - wifi: rtl8xxxu: Add sta_add() and sta_remove() callbacks
    (bsc#1227149).
  - commit a27e0ec
  - wifi: rtl8xxxu: Support USB RX aggregation for the newer chips
    (bsc#1227149).
  - wifi: rtl8xxxu: Set maximum number of supported stations
    (bsc#1227149).
  - wifi: rtl8xxxu: Declare AP mode support for 8188f (bsc#1227149).
  - wifi: rtl8xxxu: Remove usage of tx_info->control.rates[0].flags
    (bsc#1227149).
  - wifi: rtl8xxxu: Remove usage of ieee80211_get_tx_rate()
    (bsc#1227149).
  - wifi: rtl8xxxu: Clean up filter configuration (bsc#1227149).
  - wifi: rtl8xxxu: Enable hw seq for mgmt/non-QoS data frames
    (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter macid to update_rate_mask
    (bsc#1227149).
  - wifi: rtl8xxxu: Put the macid in txdesc (bsc#1227149).
  - commit 6125130
  - wifi: radiotap: add bandwidth definition of EHT U-SIG
    (bsc#1227149).
  - wifi: ieee80211: add UL-bandwidth definition of trigger frame
    (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter force to
    rtl8xxxu_refresh_rate_mask (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter role to report_connect
    (bsc#1227149).
  - wifi: rtl8xxxu: Actually use macid in
    rtl8xxxu_gen2_report_connect (bsc#1227149).
  - wifi: rtl8xxxu: Allow creating interface in AP mode
    (bsc#1227149).
  - wifi: rtl8xxxu: Allow setting rts threshold to -1 (bsc#1227149).
  - wifi: rtl8xxxu: Add set_tim() callback (bsc#1227149).
  - wifi: rtl8xxxu: Add beacon functions (bsc#1227149).
  - wifi: rtl8xxxu: Select correct queue for beacon frames
    (bsc#1227149).
  - wifi: rtl8xxxu: Add start_ap() callback (bsc#1227149).
  - commit 02b75ed
  - wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1227149
    CVE-2023-47210 bsc#1225601 CVE-2023-38417 bsc#1225600).
  - commit ea4853c
  - wifi: iwlwifi: bump FW API to 89 for AX/BZ/SC devices
    (bsc#1227149 CVE-2023-47210 bsc#1225601 CVE-2023-38417
    bsc#1225600).
  - commit bc49209
  - ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods
    by MAX_BDL_ENTRIES (stable-fixes).
  - ASoC: rt711-sdw: add missing readable registers (stable-fixes).
  - ALSA: hda/realtek: Enable Mute LED on HP 250 G7 (stable-fixes).
  - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
    (stable-fixes).
  - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU (stable-fixes).
  - commit 1ddd32b
  - hpet: Support 32-bit userspace (git-fixes).
  - misc: fastrpc: Restrict untrusted app to attach to privileged PD
    (git-fixes).
  - misc: fastrpc: Fix ownership reassignment of remote heap
    (git-fixes).
  - misc: fastrpc: Fix memory leak in audio daemon attach operation
    (git-fixes).
  - misc: fastrpc: Avoid updating PD type for capability request
    (git-fixes).
  - misc: fastrpc: Copy the complete capability structure to user
    (git-fixes).
  - misc: fastrpc: Fix DSP capabilities request (git-fixes).
  - USB: serial: mos7840: fix crash on resume (git-fixes).
  - USB: core: Fix duplicate endpoint bug by clearing reserved
    bits in the descriptor (git-fixes).
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
    (git-fixes).
  - ASoC: SOF: Intel: hda: fix null deref on system suspend entry
    (git-fixes).
  - firmware: cs_dsp: Prevent buffer overrun when processing V2
    alg headers (git-fixes).
  - firmware: cs_dsp: Validate payload length before processing
    block (git-fixes).
  - firmware: cs_dsp: Return error if block header overflows file
    (git-fixes).
  - firmware: cs_dsp: Fix overflow checking of wmfw header
    (git-fixes).
  - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Lenovo
    ThinBook 13x Gen4 (git-fixes).
  - commit 34ebce1

++++ kernel-default:

  - supported.conf: update for mt76 stuff (bsc#1227149)
  - commit 276fbe5
  - kabi/severities: cover all mt76 modules (bsc#1227149)
  - commit 8877f2f
  - wifi: mac80211: fix BSS_CHANGED_UNSOL_BCAST_PROBE_RESP
    (bsc#1227149).
  - commit a3d6465
  - wifi: mac80211: fix monitor channel with chanctx emulation
    (bsc#1227149).
  - wifi: cfg80211: validate HE operation element parsing
    (bsc#1227149).
  - wifi: mac80211: don't select link ID if not provided in scan
    request (bsc#1227149).
  - wifi: mac80211: check EHT/TTLM action frame length
    (bsc#1227149).
  - wifi: mac80211: correctly set active links upon TTLM
    (bsc#1227149).
  - wifi: cfg80211: set correct param change count in ML element
    (bsc#1227149).
  - wifi: mac80211: use deflink and fix typo in link ID check
    (bsc#1227149).
  - commit e4d62d6
  - kabi/severities: ignore kABI changes Realtek WiFi drivers (bsc#1227149)
    All those symbols are local and used for its own helpers
  - commit c402c7b
  - wifi: rtlwifi: Ignore IEEE80211_CONF_CHANGE_RETRY_LIMITS
    (bsc#1227149).
  - wifi: rtw89: wow: refine WoWLAN flows of HCI interrupts and
    low power mode (bsc#1227149).
  - wifi: rtl8xxxu: enable MFP support with security flag of RX
    descriptor (bsc#1227149).
  - wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if
    no 6 GHz sband (bsc#1227149).
  - wifi: rtw89: 8852c: add quirk to set PCI BER for certain
    platforms (bsc#1227149).
  - wifi: rtw89: download firmware with five times retry
    (bsc#1227149).
  - commit 70ec305
  - wifi: rtw89: coex: fix configuration for shared antenna for
    8922A (bsc#1227149).
  - wifi: rtw89: wow: move release offload packet earlier for
    WoWLAN mode (bsc#1227149).
  - wifi: rtw89: wow: set security engine options for 802.11ax
    chips only (bsc#1227149).
  - wifi: rtw89: update suspend/resume for different generation
    (bsc#1227149).
  - wifi: rtw89: wow: update config mac function with different
    generation (bsc#1227149).
  - wifi: rtw89: update DMA function with different generation
    (bsc#1227149).
  - wifi: rtw89: wow: update WoWLAN status register for different
    generation (bsc#1227149).
  - wifi: rtw89: wow: update WoWLAN reason register for different
    chips (bsc#1227149).
  - wifi: rtw89: coex: Add coexistence policy to decrease WiFi
    packet CRC-ERR (bsc#1227149).
  - wifi: rtw89: coex: When Bluetooth not available don't set
    power/gain (bsc#1227149).
  - wifi: rtw89: coex: add return value to ensure H2C command is
    success or not (bsc#1227149).
  - wifi: rtw89: coex: Reorder H2C command index to align with
    firmware (bsc#1227149).
  - wifi: rtw89: coex: add BTC ctrl_info version 7 and related logic
    (bsc#1227149).
  - wifi: rtw89: coex: add init_info H2C command format version 7
    (bsc#1227149).
  - wifi: rtw89: 8922a: add coexistence helpers of SW grant
    (bsc#1227149).
  - wifi: rtw89: mac: add coexistence helpers {cfg/get}_plt
    (bsc#1227149).
  - wifi: rtlwifi: Remove rtl_intf_ops.read_efuse_byte
    (bsc#1227149).
  - wifi: rtl8xxxu: fix mixed declarations in rtl8xxxu_set_aifs()
    (bsc#1227149).
  - wifi: rtw89: pci: implement PCI CLK/ASPM/L1SS for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: Update EHT PHY beamforming capability
    (bsc#1227149).
  - wifi: rtw89: advertise missing extended scan feature
    (bsc#1227149).
  - wifi: rtlwifi: set initial values for unexpected cases of USB
    endpoint priority (bsc#1227149).
  - wifi: rtl8xxxu: check vif before using in rtl8xxxu_tx()
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192cu: Fix TX aggregation (bsc#1227149).
  - commit e9149f1
  - wifi: rtw89: 8922a: add helper of set_channel (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel RF part (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel BB part (bsc#1227149).
  - wifi: rtw89: 8922a: add set_channel MAC part (bsc#1227149).
  - wifi: rtlwifi: rtl_usb: Store the endpoint addresses
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192cu: Fix 2T2R chip type detection
    (bsc#1227149).
  - wifi: rtw89: 8922a: declare to support two chanctx
    (bsc#1227149).
  - wifi: rtw89: chan: support MCC on Wi-Fi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: implement MRC H2C command functions
    (bsc#1227149).
  - wifi: rtw89: mac: implement MRC C2H event handling
    (bsc#1227149).
  - wifi: rtw89: fw: add definition of H2C command and C2H event
    for MRC series (bsc#1227149).
  - wifi: rtw89: change qutoa to DBCC by default for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: reference quota mode when setting Tx power
    (bsc#1227149).
  - wifi: rtw89: 8922a: implement AP mode related reg for BE
    generation (bsc#1227149).
  - wifi: rtw89: 8922a: correct register definition and merge IO
    for ctrl_nbtg_bt_tx() (bsc#1227149).
  - wifi: rtw89: differentiate narrow_bw_ru_dis setting according
    to chip gen (bsc#1227149).
  - wifi: rtw89: use PLCP information to match BSS_COLOR and AID
    (bsc#1227149).
  - wifi: rtw89: mac: reset PHY-1 hardware when going to
    enable/disable (bsc#1227149).
  - wifi: rtw89: mac: correct MUEDCA setting for MAC-1
    (bsc#1227149).
  - wifi: rtw89: mac: return held quota of DLE when changing MAC-1
    (bsc#1227149).
  - wifi: rtw89: load BB parameters to PHY-1 (bsc#1227149).
  - wifi: rtw89: correct PHY register offset for PHY-1
    (bsc#1227149).
  - wifi: rtw89: chan: MCC take reconfig into account (bsc#1227149).
  - wifi: rtw89: chan: move handling from add/remove to
    assign/unassign for MLO (bsc#1227149).
  - wifi: rtw89: chan: tweak weight recalc ahead before MLO
    (bsc#1227149).
  - wifi: rtw89: chan: tweak bitmap recalc ahead before MLO
    (bsc#1227149).
  - wifi: rtw89: chan: add sub-entity swap function to cover
    replacing (bsc#1227149).
  - wifi: rtw89: drop TIMING_BEACON_ONLY and sync beacon TSF by self
    (bsc#1227149).
  - wifi: rtl8xxxu: update rate mask per sta (bsc#1227149).
  - wifi: rtw89: fw: download firmware with key data for secure boot
    (bsc#1227149).
  - wifi: rtw89: fw: parse secure section from firmware file
    (bsc#1227149).
  - wifi: rtw89: fw: read firmware secure information from efuse
    (bsc#1227149).
  - wifi: rtw89: fw: consider checksum length of security data
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::rfk_hw_init (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::rfk_init_late to do initial
    RF calibrations later (bsc#1227149).
  - commit 28c4b55
  - wifi: rtw89: 8922a: rfk: implement chip_ops to call RF
    calibrations (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger TSSI (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger TXGAPK
    (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger DACK (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger DPK (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger RX DCK
    (bsc#1227149).
  - wifi: rtw89: rfk: add H2C command to trigger IQK (bsc#1227149).
  - wifi: rtw89: rfk: send channel information to firmware for RF
    calibrations (bsc#1227149).
  - wifi: rtw89: rfk: add a completion to wait RF calibration
    report from C2H event (bsc#1227149).
  - wifi: rtl8xxxu: Add TP-Link TL-WN823N V2 (bsc#1227149).
  - wifi: rtl8xxxu: fix error messages (bsc#1227149).
  - wifi: rtw89: 8922a: add more fields to beacon H2C command to
    support multi-links (bsc#1227149).
  - wifi: rtw89: update ps_state register for chips with different
    generation (bsc#1227149).
  - wifi: rtw89: add new H2C for PS mode in 802.11be chip
    (bsc#1227149).
  - wifi: rtw89: 8922a: add ieee80211_ops::hw_scan (bsc#1227149).
  - wifi: rtw89: prepare scan leaf functions for wifi 7 ICs
    (bsc#1227149).
  - wifi: rtw89: debug: add FW log component for scan (bsc#1227149).
  - wifi: rtw89: update scan C2H messages for wifi 7 IC
    (bsc#1227149).
  - wifi: rtw89: 8922a: set chip_ops FEM and GPIO to NULL
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops to get thermal value
    (bsc#1227149).
  - wifi: rtw89: 8922a: add RF read/write v2 (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::cfg_txrx_path (bsc#1227149).
  - wifi: rtw89: 8922a: implement {stop,resume}_sch_tx and cfg_ppdu
    (bsc#1227149).
  - wifi: rtw89: 8922a: hook handlers of TX/RX descriptors to
    chip_ops (bsc#1227149).
  - wifi: rtw89: pci: validate RX tag for RXQ and RPQ (bsc#1227149).
  - wifi: rtw89: pci: interrupt v2 refine IMR for SER (bsc#1227149).
  - wifi: rtw89: pci: update SER timer unit and timeout time
    (bsc#1227149).
  - wifi: rtw89: fix disabling concurrent mode TX hang issue
    (bsc#1227149).
  - wifi: rtw89: fix HW scan timeout due to TSF sync issue
    (bsc#1227149).
  - wifi: rtw89: add wait/completion for abort scan (bsc#1227149).
  - wifi: rtw89: disable RTS when broadcast/multicast (bsc#1227149).
  - wifi: rtw89: Set default CQM config if not present
    (bsc#1227149).
  - wifi: rtw89: refine hardware scan C2H events (bsc#1227149).
  - wifi: rtw89: refine add_chan H2C command to encode_bits
    (bsc#1227149).
  - wifi: rtw89: 8922a: add BTG functions to assist BT coexistence
    to control TX/RX (bsc#1227149).
  - wifi: rtw89: 8922a: add TX power related ops (bsc#1227149).
  - wifi: rtw89: 8922a: add register definitions of H2C, C2H,
    page, RRSR and EDCCA (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops related to BB init
    (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::{enable,disable}_bb_rf
    (bsc#1227149).
  - wifi: rtw89: add mlo_dbcc_mode for WiFi 7 chips (bsc#1227149).
  - wifi: rtlwifi: Speed up firmware loading for USB (bsc#1227149).
  - wifi: rtl8xxxu: add missing number of sec cam entries for all
    variants (bsc#1227149).
  - wifi: rtl8xxxu: make instances of iface limit and combination
    to be static const (bsc#1227149).
  - wifi: rtl8xxxu: convert EN_DESC_ID of TX descriptor to le32 type
    (bsc#1227149).
  - wifi: rtlwifi: rtl8192de: Don't read register in
    _rtl92de_query_rxphystatus (bsc#1227149).
  - wifi: rtw89: fw: extend JOIN H2C command to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: fw: use struct to fill JOIN H2C command
    (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to reset DMAC table for WiFi 7
    (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to reset CMAC table for WiFi 7
    (bsc#1227149).
  - wifi: rtw89: fw: update TX AMPDU parameter to CMAC table
    (bsc#1227149).
  - wifi: rtw89: fw: add chip_ops to update CMAC table to associated
    station (bsc#1227149).
  - wifi: rtw89: fw: fill CMAC table to associated station for
    WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: add H2C command to update security CAM v2
    (bsc#1227149).
  - wifi: rtw89: declare EXT NSS BW of VHT capability (bsc#1227149).
  - wifi: rtw89: add EHT capabilities for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: change supported bandwidths of chip_info to bit
    mask (bsc#1227149).
  - wifi: rtw89: adjust init_he_cap() to add EHT cap into
    iftype_data (bsc#1227149).
  - wifi: rtw88: use kstrtoX_from_user() in debugfs handlers
    (bsc#1227149).
  - wifi: rtl8xxxu: enable channel switch support (bsc#1227149).
  - wifi: rtlwifi: rtl_usb: Use sync register writes (bsc#1227149).
  - commit 055a697
  - wifi: rtlwifi: cleanup few rtlxxx_tx_fill_desc() routines
    (bsc#1227149).
  - wifi: rtw89: add chip_ops::update_beacon to abstract update
    beacon operation (bsc#1227149).
  - wifi: rtw89: add H2C command to download beacon frame for WiFi
    7 chips (bsc#1227149).
  - wifi: rtw89: use struct to fill H2C command to download beacon
    frame (bsc#1227149).
  - wifi: rtw89: add new H2C command to pause/sleep transmitting
    by MAC ID (bsc#1227149).
  - wifi: rtw89: refine H2C command that pause transmitting by
    MAC ID (bsc#1227149).
  - wifi: rtw89: fw: use struct to fill BA CAM H2C commands
    (bsc#1227149).
  - wifi: rtw89: 8922a: update BA CAM number to 24 (bsc#1227149).
  - wifi: rtw89: add chip_ops::h2c_ba_cam() to configure BA CAM
    (bsc#1227149).
  - wifi: rtw89: mac: add feature_init to initialize BA CAM V1
    (bsc#1227149).
  - wifi: rtw89: add firmware H2C command of BA CAM V1
    (bsc#1227149).
  - wifi: rtl8xxxu: Fix off by one initial RTS rate (bsc#1227149).
  - wifi: rtl8xxxu: Fix LED control code of RTL8192FU (bsc#1227149).
  - wifi: rtl8xxxu: declare concurrent mode support for 8188f
    (bsc#1227149).
  - wifi: rtl8xxxu: make supporting AP mode only on port 0
    transparent (bsc#1227149).
  - wifi: rtl8xxxu: add hw crypto support for AP mode (bsc#1227149).
  - wifi: rtl8xxxu: remove obsolete priv->vif (bsc#1227149).
  - wifi: rtl8xxxu: add macids for STA mode (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interface in start_ap()
    (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    bss_info_changed() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    {add,remove}_interface() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    watchdog_callback() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    configure_filter() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in
    update_beacon_work_callback() (bsc#1227149).
  - wifi: rtl8xxxu: support multiple interfaces in set_aifs()
    (bsc#1227149).
  - wifi: rtl8xxxu: support setting bssid register for multiple
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: don't parse CFO, if both interfaces are
    connected in STA mode (bsc#1227149).
  - wifi: rtl8xxxu: extend check for matching bssid to both
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: extend wifi connected check to both interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: support setting mac address register for both
    interfaces (bsc#1227149).
  - wifi: rtl8xxxu: 8188e: convert usage of priv->vif to
    priv->vifs[0] (bsc#1227149).
  - wifi: rtl8xxxu: support setting linktype for both interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: prepare supporting two virtual interfaces
    (bsc#1227149).
  - wifi: rtl8xxxu: remove assignment of priv->vif in
    rtl8xxxu_bss_info_changed() (bsc#1227149).
  - wifi: rtw88: 8822ce: refine power parameters for RFE type 5
    (bsc#1227149).
  - wifi: rtw89: mac: Fix spelling mistakes "notfify" -> "notify"
    (bsc#1227149).
  - wifi: rtw89: phy: set channel_info for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: phy: add BB wrapper of TX power for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: 8922a: add NCTL pre-settings for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: phy: ignore special data from BB parameter file
    (bsc#1227149).
  - wifi: rtw89: 8922a: update the register used in DIG and the
    DIG flow (bsc#1227149).
  - wifi: rtw89: 8922a: set RX gain along with set_channel operation
    (bsc#1227149).
  - wifi: rtw89: phy: add parser to support RX gain dynamic setting
    flow (bsc#1227149).
  - wifi: rtw89: phy: move bb_gain_info used by WiFi 6 chips to
    union (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R37 (bsc#1227149).
  - wifi: rtw89: 8852b: update TX power tables to R36 (bsc#1227149).
  - wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: phy: using calculate_bit_shift()
    (bsc#1227149).
  - wifi: rtw89: coex: To improve Wi-Fi performance while BT is idle
    (bsc#1227149).
  - wifi: rtw89: coex: Translate antenna configuration from ID to
    string (bsc#1227149).
  - commit d99b9e1
  - wifi: rtw89: coex: Update RF parameter control setting logic
    (bsc#1227149).
  - wifi: rtw89: coex: Add Bluetooth RSSI level information
    (bsc#1227149).
  - wifi: rtw89: coex: Set Bluetooth scan low-priority when Wi-Fi
    link/scan (bsc#1227149).
  - wifi: rtw89: coex: Update coexistence policy for Wi-Fi LPS
    (bsc#1227149).
  - wifi: rtw89: coex: Still show hardware grant signal info even
    Wi-Fi is PS (bsc#1227149).
  - wifi: rtw89: coex: Update BTG control related logic
    (bsc#1227149).
  - wifi: rtw89: coex: Add Pre-AGC control to enhance Wi-Fi RX
    performance (bsc#1227149).
  - wifi: rtw89: coex: Record down Wi-Fi initial mode information
    (bsc#1227149).
  - wifi: rtw89: coex: Fix wrong Wi-Fi role info and FDDT parameter
    members (bsc#1227149).
  - wifi: rtw88: use cfg80211_ssid_eq() instead of rtw_ssid_equal()
    (bsc#1227149).
  - wifi: rtw89: mac: implement to configure TX/RX engines for
    WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: mac: add sys_init and filter option for WiFi 7
    chips (bsc#1227149).
  - wifi: rtw89: only reset BB/RF for existing WiFi 6 chips while
    starting up (bsc#1227149).
  - wifi: rtw89: add DBCC H2C to notify firmware the status
    (bsc#1227149).
  - wifi: rtw89: mac: add suffix _ax to MAC functions (bsc#1227149).
  - wifi: rtw89: mac: add flags to check if CMAC and DMAC are
    enabled (bsc#1227149).
  - wifi: rtw89: 8922a: add power on/off functions (bsc#1227149).
  - wifi: rtw89: add XTAL SI for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: phy: print out RFK log with formatted string
    (bsc#1227149).
  - wifi: rtw89: parse and print out RFK log from C2H events
    (bsc#1227149).
  - wifi: rtw89: add C2H event handlers of RFK log and report
    (bsc#1227149).
  - wifi: rtw89: load RFK log format string from firmware file
    (bsc#1227149).
  - wifi: rtw89: fw: add version field to BB MCU firmware element
    (bsc#1227149).
  - wifi: rtw89: fw: load TX power track tables from fw_element
    (bsc#1227149).
  - wifi: rtw88: Use random MAC when efuse MAC invalid
    (bsc#1227149).
  - wifi: rtw89: avoid stringop-overflow warning (bsc#1227149).
  - wifi: rtw89: mac: refine SER setting during WiFi CPU power on
    (bsc#1227149).
  - wifi: rtw89: 8922a: dump MAC registers when SER occurs
    (bsc#1227149).
  - wifi: rtw89: 8922a: add SER IMR tables (bsc#1227149).
  - wifi: rtw89: fw: extend program counter dump for Wi-Fi 7 chip
    (bsc#1227149).
  - wifi: rtw89: 8922a: configure CRASH_TRIGGER FW feature
    (bsc#1227149).
  - wifi: rtw89: fix misbehavior of TX beacon in concurrent mode
    (bsc#1227149).
  - wifi: rtw89: refine remain on channel flow to improve P2P
    connection (bsc#1227149).
  - wifi: rtw89: Refine active scan behavior in 6 GHz (bsc#1227149).
  - wifi: rtw89: fix not entering PS mode after AP stops
    (bsc#1227149).
  - wifi: rtlwifi: Remove bridge vendor/device ids (bsc#1227149).
  - wifi: rtlwifi: Remove unused PCI related defines and struct
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Access full PMCS reg and use
    pci_regs.h (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Add pdev into
    _rtl8821ae_clear_pci_pme_status() (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Use pci_find_capability()
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Reverse PM Capability exists check
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: Remove unnecessary PME_Status bit set
    (bsc#1227149).
  - wifi: rtlwifi: Convert to use PCIe capability accessors
    (bsc#1227149).
  - wifi: rtw89: mac: functions to configure hardware engine and
    quota for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: mac: use pointer to access functions of hardware
    engine and quota (bsc#1227149).
  - wifi: rtw89: mac: move code related to hardware engine to
    individual functions (bsc#1227149).
  - wifi: rtw89: mac: check queue empty according to chip gen
    (bsc#1227149).
  - wifi: rtw89: refine element naming used by queue empty check
    (bsc#1227149).
  - wifi: rtw89: add reserved size as factor of DLE used size
    (bsc#1227149).
  - wifi: rtw89: mac: add to get DLE reserved quota (bsc#1227149).
  - commit cf41ac5
  - wifi: rtw89: 8922a: extend and add quota number (bsc#1227149).
  - wifi: rtw89: debug: remove wrapper of rtw89_debug()
    (bsc#1227149).
  - wifi: rtw89: debug: add debugfs entry to disable dynamic
    mechanism (bsc#1227149).
  - wifi: rtw89: phy: dynamically adjust EDCCA threshold
    (bsc#1227149).
  - wifi: rtw89: debug: add to check if debug mask is enabled
    (bsc#1227149).
  - wifi: rtlwifi: rtl8821ae: phy: remove some useless code
    (bsc#1227149).
  - wifi: rtw88: debug: remove wrapper of rtw_dbg() (bsc#1227149).
  - wifi: rtw89: 8922a: read efuse content from physical map
    (bsc#1227149).
  - wifi: rtw89: 8922a: read efuse content via efuse map struct
    from logic map (bsc#1227149).
  - wifi: rtw89: 8852c: read RX gain offset from efuse for 6GHz
    channels (bsc#1227149).
  - wifi: rtw89: mac: add to access efuse for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: mac: use mac_gen pointer to access about efuse
    (bsc#1227149).
  - wifi: rtw89: 8922a: add 8922A basic chip info (bsc#1227149).
  - wifi: rtlwifi: drop unused const_amdpci_aspm (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R65-R44
    (bsc#1227149).
  - wifi: rtw89: regd: handle policy of 6 GHz according to BIOS
    (bsc#1227149).
  - wifi: rtw89: acpi: process 6 GHz band policy from DSM
    (bsc#1227149).
  - wifi: rtlwifi: simplify rtl_action_proc() and rtl_tx_agg_start()
    (bsc#1227149).
  - wifi: rtw89: pci: update interrupt mitigation register for
    8922AE (bsc#1227149).
  - wifi: rtw89: pci: correct interrupt mitigation register for
    8852CE (bsc#1227149).
  - wifi: rtw89: 8922ae: add v2 interrupt handlers for 8922AE
    (bsc#1227149).
  - wifi: rtw89: pci: generalize interrupt status bits of interrupt
    handlers (bsc#1227149).
  - wifi: rtw89: pci: add pre_deinit to be called after probe
    complete (bsc#1227149).
  - wifi: rtw89: pci: stop/start DMA for level 1 recovery according
    to chip gen (bsc#1227149).
  - wifi: rtw89: pci: reset BDRAM according to chip gen
    (bsc#1227149).
  - wifi: rtw88: simplify __rtw_tx_work() (bsc#1227149).
  - wifi: rtw89: coex: use struct assignment to replace memcpy()
    to append TDMA content (bsc#1227149).
  - wifi: rtw89: pci: implement PCI mac_post_init for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: pci: add LTR v2 for WiFi 7 chip (bsc#1227149).
  - wifi: rtw89: pci: implement PCI mac_pre_init for WiFi 7 chips
    (bsc#1227149).
  - commit dcfcac7
  - wifi: rtw89: pci: use gen_def pointer to configure
    mac_{pre,post}_init and clear PCI ring index (bsc#1227149).
  - wifi: rtw89: pci: add PCI generation information to pci_info
    for each chip (bsc#1227149).
  - wifi: rtw89: extend PHY status parser to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: consider RX info for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: configure PPDU max user by chip (bsc#1227149).
  - wifi: rtw89: set entry size of address CAM to H2C field by chip
    (bsc#1227149).
  - wifi: rtw89: pci: generalize code of PCI control DMA IO for
    WiFi 7 (bsc#1227149).
  - wifi: rtw89: pci: add new RX ring design to determine full RX
    ring efficiently (bsc#1227149).
  - wifi: rtw89: pci: define PCI ring address for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: 8922ae: add 8922AE PCI entry and basic info
    (bsc#1227149).
  - wifi: rtlwifi: rtl92ee_dm_dynamic_primary_cca_check(): fix
    typo in function name (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_phy (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_hal (bsc#1227149).
  - wifi: rtw89: cleanup firmware elements parsing (bsc#1227149).
  - wifi: rtlwifi: drop chk_switch_dmdp() from HAL interface
    (bsc#1227149).
  - wifi: rtlwifi: drop fill_fake_txdesc() from HAL interface
    (bsc#1227149).
  - wifi: rtlwifi: drop pre_fill_tx_bd_desc() from HAL interface
    (bsc#1227149).
  - wifi: rtw89: move software DCFO compensation setting to proper
    position (bsc#1227149).
  - wifi: rtw89: correct the DCFO tracking flow to improve CFO
    compensation (bsc#1227149).
  - wifi: rtw89: modify the register setting and the flow of CFO
    tracking (bsc#1227149).
  - wifi: rtw89: phy: generalize valid bit of BSS color
    (bsc#1227149).
  - wifi: rtw89: phy: change naming related BT coexistence functions
    (bsc#1227149).
  - wifi: rtw88: dump firmware debug information in abnormal state
    (bsc#1227149).
  - wifi: rtw88: debug: add to check if debug mask is enabled
    (bsc#1227149).
  - wifi: rtlwifi: cleanup struct rtl_ps_ctl (bsc#1227149).
  - wifi: rtw89: mac: do bf_monitor only if WiFi 6 chips
    (bsc#1227149).
  - wifi: rtw89: mac: set bf_assoc capabilities according to chip
    gen (bsc#1227149).
  - wifi: rtw89: mac: set bfee_ctrl() according to chip gen
    (bsc#1227149).
  - wifi: rtw89: mac: add registers of MU-EDCA parameters for WiFi
    7 chips (bsc#1227149).
  - wifi: rtw89: mac: generalize register of MU-EDCA switch
    according to chip gen (bsc#1227149).
  - wifi: rtw89: mac: update RTS threshold according to chip gen
    (bsc#1227149).
  - wifi: rtlwifi: simplify TX command fill callbacks (bsc#1227149).
  - wifi: rtw89: coex: add annotation __counted_by() to struct
    rtw89_btc_btf_set_mon_reg (bsc#1227149).
  - wifi: rtw89: coex: add annotation __counted_by() for struct
    rtw89_btc_btf_set_slot_table (bsc#1227149).
  - wifi: rtw89: add EHT radiotap in monitor mode (bsc#1227149).
  - wifi: rtw89: show EHT rate in debugfs (bsc#1227149).
  - wifi: rtw89: parse TX EHT rate selected by firmware from RA
    C2H report (bsc#1227149).
  - wifi: rtw89: Add EHT rate mask as parameters of RA H2C command
    (bsc#1227149).
  - wifi: rtw89: parse EHT information from RX descriptor and PPDU
    status packet (bsc#1227149).
  - wifi: rtlwifi: use convenient list_count_nodes() (bsc#1227149).
  - commit 53661e1
  - wifi: rtlwifi: use unsigned long for bt_coexist_8723 timestamp
    (bsc#1227149).
  - wifi: rtw88: 8821c: tweak CCK TX filter setting for SRRC
    regulation (bsc#1227149).
  - wifi: rtw88: regd: update regulatory map to R64-R42
    (bsc#1227149).
  - wifi: rtw88: 8822c: update TX power limit to V70 (bsc#1227149).
  - wifi: rtw88: 8821c: update TX power limit to V67 (bsc#1227149).
  - wifi: rtw88: regd: configure QATAR and UK (bsc#1227149).
  - wifi: rtlwifi: remove unreachable code in
    rtl92d_dm_check_edca_turbo() (bsc#1227149).
  - wifi: rtw89: debug: txpwr table supports Wi-Fi 7 chips
    (bsc#1227149).
  - wifi: rtw89: debug: show txpwr table according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power RU limit according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power limit according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power offset according to chip gen
    (bsc#1227149).
  - wifi: rtw89: phy: set TX power by rate according to chip gen
    (bsc#1227149).
  - wifi: rtw89: mac: get TX power control register according to
    chip gen (bsc#1227149).
  - wifi: rtlwifi: use unsigned long for rtl_bssid_entry timestamp
    (bsc#1227149).
  - wifi: rtw89: refine bandwidth 160MHz uplink OFDMA performance
    (bsc#1227149).
  - wifi: rtw89: refine uplink trigger based control mechanism
    (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R34 (bsc#1227149).
  - wifi: rtw89: 8852b: update TX power tables to R35 (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R67 (bsc#1227149).
  - wifi: rtw89: regd: configure Thailand in regulation type
    (bsc#1227149).
  - wifi: rtlwifi: cleanup few rtlxxxx_set_hw_reg() routines
    (bsc#1227149).
  - wifi: rtw89: declare MCC in interface combination (bsc#1227149).
  - wifi: rtw89: 8852c: declare to support two chanctx
    (bsc#1227149).
  - wifi: rtw89: pause/proceed MCC for ROC and HW scan
    (bsc#1227149).
  - wifi: rtw89: mcc: fix NoA start time when GO is auxiliary
    (bsc#1227149).
  - wifi: rtw89: load TX power related tables from FW elements
    (bsc#1227149).
  - wifi: rtw89: phy: extend TX power common stuffs for Wi-Fi 7
    chips (bsc#1227149).
  - wifi: rtw89: load TX power by rate when RFE parms setup
    (bsc#1227149).
  - wifi: rtw89: phy: refine helpers used for raw TX power
    (bsc#1227149).
  - commit 62f3f4a
  - wifi: rtw89: indicate TX power by rate table inside RFE
    parameter (bsc#1227149).
  - wifi: rtw89: indicate TX shape table inside RFE parameter
    (bsc#1227149).
  - wifi: rtw89: add subband index of primary channel to struct
    rtw89_chan (bsc#1227149).
  - wifi: rtl8xxxu: Add a description about the device ID
    0x7392:0xb722 (bsc#1227149).
  - wifi: rtw89: add mac_gen pointer to access mac port registers
    (bsc#1227149).
  - wifi: rtw89: consolidate registers of mac port to struct
    (bsc#1227149).
  - wifi: rtw89: add chip_info::txwd_info size to generalize TX
    WD submit (bsc#1227149).
  - wifi: rtw89: add to fill TX descriptor v2 (bsc#1227149).
  - wifi: rtw89: add to fill TX descriptor for firmware command v2
    (bsc#1227149).
  - wifi: rtw89: add to query RX descriptor format v2 (bsc#1227149).
  - wifi: rtw89: mcc: deal with beacon NoA if GO exists
    (bsc#1227149).
  - wifi: rtw89: mcc: deal with BT slot change (bsc#1227149).
  - wifi: rtw89: mcc: deal with P2P PS change (bsc#1227149).
  - wifi: rtw89: mcc: track beacon offset and update when needed
    (bsc#1227149).
  - wifi: rtw89: mcc: update role bitmap when changed (bsc#1227149).
  - wifi: rtw89: 52c: rfk: disable DPK during MCC (bsc#1227149).
  - wifi: rtw89: rfk: disable driver tracking during MCC
    (bsc#1227149).
  - wifi: rtw89: 52c: rfk: refine MCC channel info notification
    (bsc#1227149).
  - wifi: rtw89: 8922a: set memory heap address for secure firmware
    (bsc#1227149).
  - wifi: rtw89: fw: refine download flow to support variant
    firmware suits (bsc#1227149).
  - wifi: rtw89: 8922a: add chip_ops::bb_preinit to enable BB
    before downloading firmware (bsc#1227149).
  - wifi: rtw89: fw: propagate an argument include_bb for BB MCU
    firmware (bsc#1227149).
  - wifi: rtw89: fw: add checking type for variant type of firmware
    (bsc#1227149).
  - wifi: rtw89: fw: implement supported functions of download
    firmware for WiFi 7 chips (bsc#1227149).
  - wifi: rtw89: fw: generalize download firmware flow by mac_gen
    pointers (bsc#1227149).
  - wifi: rtw89: fw: move polling function of firmware path ready
    to an individual function (bsc#1227149).
  - wifi: rtw89: mcc: trigger FW to start/stop MCC (bsc#1227149).
  - wifi: rtw89: fix typo of rtw89_fw_h2c_mcc_macid_bitmap()
    (bsc#1227149).
  - wifi: rtw89: mcc: decide pattern and calculate parameters
    (bsc#1227149).
  - wifi: rtw89: mcc: consider and determine BT duration
    (bsc#1227149).
  - commit bd46e4d
  - wifi: rtw89: mcc: fill fundamental configurations (bsc#1227149).
  - wifi: rtw89: mcc: initialize start flow (bsc#1227149).
  - wifi: rtw89: 8852c: Fix TSSI causes transmit power inaccuracy
    (bsc#1227149).
  - wifi: rtw89: 8852c: Update bandedge parameters for better
    performance (bsc#1227149).
  - wifi: rtl8xxxu: mark TOTOLINK N150UA V5/N150UA-B as tested
    (bsc#1227149).
  - wifi: rtw88: fix typo rtw8822cu_probe (bsc#1227149).
  - wifi: rtlwifi: rtl8723: Remove unused function
    rtl8723_cmd_send_packet() (bsc#1227149).
  - wifi: rtw89: Fix clang -Wimplicit-fallthrough in
    rtw89_query_sar() (bsc#1227149).
  - wifi: rtw89: phy: modify register setting of ENV_MNTR, PHYSTS
    and DIG (bsc#1227149).
  - wifi: rtw89: phy: add phy_gen_def::cr_base to support WiFi 7
    chips (bsc#1227149).
  - wifi: rtw89: mac: define register address of rx_filter to
    generalize code (bsc#1227149).
  - wifi: rtw89: mac: define internal memory address for WiFi 7 chip
    (bsc#1227149).
  - wifi: rtw89: mac: generalize code to indirectly access WiFi
    internal memory (bsc#1227149).
  - wifi: rtw89: mac: add mac_gen_def::band1_offset to map MAC
    band1 register address (bsc#1227149).
  - wifi: rtw89: initialize multi-channel handling (bsc#1227149).
  - wifi: rtw89: provide functions to configure NoA for beacon
    update (bsc#1227149).
  - wifi: rtw89: call rtw89_chan_get() by vif chanctx if aware of
    vif (bsc#1227149).
  - wifi: rtw89: sar: let caller decide the center frequency to
    query (bsc#1227149).
  - wifi: rtw89: refine rtw89_correct_cck_chan() by
    rtw89_hw_to_nl80211_band() (bsc#1227149).
  - wifi: rtw89: add function prototype for coex request duration
    (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R64-R43
    (bsc#1227149).
  - wifi: rtw89: fix a width vs precision bug (bsc#1227149).
  - wifi: rtlwifi: use eth_broadcast_addr() to assign broadcast
    address (bsc#1227149).
  - wifi: rtw89: Introduce Time Averaged SAR (TAS) feature
    (bsc#1227149).
  - wifi: rtw89: return failure if needed firmware elements are
    not recognized (bsc#1227149).
  - wifi: rtw89: add to parse firmware elements of BB and RF tables
    (bsc#1227149).
  - wifi: rtw89: introduce infrastructure of firmware elements
    (bsc#1227149).
  - wifi: rtw89: add firmware suit for BB MCU 0/1 (bsc#1227149).
  - wifi: rtw89: add firmware parser for v1 format (bsc#1227149).
  - wifi: rtw89: introduce v1 format of firmware header
    (bsc#1227149).
  - wifi: rtw89: support firmware log with formatted text
    (bsc#1227149).
  - wifi: rtw89: recognize log format from firmware file
    (bsc#1227149).
  - wifi: rtw89: get data rate mode/NSS/MCS v1 from RX descriptor
    (bsc#1227149).
  - wifi: rtw89: add to display hardware rates v1 histogram in
    debugfs (bsc#1227149).
  - wifi: rtw89: add C2H RA event V1 to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: use struct to access RA report (bsc#1227149).
  - wifi: rtw89: use struct to access firmware C2H event header
    (bsc#1227149).
  - wifi: rtw89: add H2C RA command V1 to support WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: use struct to set RA H2C command (bsc#1227149).
  - wifi: rtw89: phy: rate pattern handles HW rate by chip gen
    (bsc#1227149).
  - commit cdaa97d
  - wifi: rtlwifi: simplify LED management (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-simplify-non-chanctx-drivers.patch.
  - commit 34b32c5
  - wifi: rtw89: define hardware rate v1 for WiFi 7 chips
    (bsc#1227149).
  - wifi: rtw89: add chip_info::chip_gen to determine chip
    generation (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8723BU (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8192EU (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8710BU (RTL8188GU)
    (bsc#1227149).
  - wifi: rtl8xxxu: Enable AP mode for RTL8192FU (bsc#1227149).
  - wifi: rtw88: simplify vif iterators (bsc#1227149).
  - wifi: rtw88: remove unused USB bulkout size set (bsc#1227149).
  - wifi: rtw88: remove unused and set but unused leftovers
    (bsc#1227149).
  - wifi: rtlwifi: cleanup USB interface (bsc#1227149).
  - wifi: rtw89: use struct to parse firmware header (bsc#1227149).
  - wifi: rtw89: TX power stuffs replace confusing naming of _max
    with _num (bsc#1227149).
  - wifi: rtw89: 8851b: configure to force 1 TX power value
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: update IQK to version 0x8
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add LCK track (bsc#1227149).
  - wifi: rtw89: 8851b: update TX power tables to R28 (bsc#1227149).
  - wifi: rtw89: 8851b: update RF radio A parameters to R28
    (bsc#1227149).
  - wifi: rtw88: fix not entering PS mode after AP stops
    (bsc#1227149).
  - wifi: rtw88: refine register based H2C command (bsc#1227149).
  - wifi: rtw88: Stop high queue during scan (bsc#1227149).
  - wifi: rtw88: Skip high queue in hci_flush (bsc#1227149).
  - wifi: rtw88: Fix AP mode incorrect DTIM behavior (bsc#1227149).
  - wifi: rtw88: use struct instead of macros to set TX desc
    (bsc#1227149).
  - wifi: rtw88: process VO packets without workqueue to avoid
    PTK rekey failed (bsc#1227149).
  - wifi: rtw88: Fix action frame transmission fail before
    association (bsc#1227149).
  - wifi: rtw89: fix spelling typo of IQK debug messages
    (bsc#1227149).
  - wifi: rtw89: cleanup rtw89_iqk_info and related code
    (bsc#1227149).
  - wifi: rtw89: cleanup private data structures (bsc#1227149).
  - wifi: rtw88: add missing unwind goto for
    __rtw_download_firmware() (bsc#1227149).
  - commit 9b282ce
  - wifi: rtlwifi: remove misused flag from HAL data (bsc#1227149).
  - wifi: rtlwifi: remove unused dualmac control leftovers
    (bsc#1227149).
  - wifi: rtlwifi: remove unused timer and related code
    (bsc#1227149).
  - wifi: rtw89: 8852c: update RF radio A/B parameters to R63
    (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (3 of 3) (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (2 of 3) (bsc#1227149).
  - wifi: rtw89: 8852c: update TX power tables to R63 with 6 GHz
    power type (1 of 3) (bsc#1227149).
  - wifi: rtw89: process regulatory for 6 GHz power type
    (bsc#1227149).
  - wifi: rtw89: regd: update regulatory map to R64-R40
    (bsc#1227149).
  - wifi: rtw89: regd: judge 6 GHz according to chip and BIOS
    (bsc#1227149).
  - commit f81b870
  - wifi: rtw89: refine clearing supported bands to check 2/5 GHz
    first (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-annotate-iftype_data-pointer-with-spar.patch.
  - commit 1873f0a
  - wifi: rtw89: 8851b: configure CRASH_TRIGGER feature for 8851B
    (bsc#1227149).
  - wifi: rtw89: set TX power without precondition during setting
    channel (bsc#1227149).
  - wifi: rtw89: debug: txpwr table access only valid page according
    to chip (bsc#1227149).
  - wifi: rtw89: 8851b: enable hw_scan support (bsc#1227149).
  - wifi: rtlwifi: use helper function rtl_get_hdr() (bsc#1227149).
  - wifi: rtw89: use flexible array member in rtw89_btc_btf_tlv
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: Fix spelling mistake KIP_RESOTRE ->
    KIP_RESTORE (bsc#1227149).
  - wifi: rtw89: use struct to access register-based H2C/C2H
    (bsc#1227149).
  - wifi: rtw89: use struct and le32_get_bits() to access RX
    descriptor (bsc#1227149).
  - commit 21eb4e8
  - Update config files: update for the realtek wifi driver updates (bsc#1227149)
  - commit 33b8d09
  - wifi: rtw89: use struct and le32_get_bits() to access received
    PHY status IEs (bsc#1227149).
  - wifi: rtw89: use struct and le32_get_bits to access RX info
    (bsc#1227149).
  - wifi: rtw89: add chip_ops::query_rxdesc() and rxd_len as
    helpers to support newer chips (bsc#1227149).
  - wifi: rtw89: 8851b: add 8851be to Makefile and Kconfig
    (bsc#1227149).
  - wifi: rtw89: add tx_wake notify for 8851B (bsc#1227149).
  - wifi: rtw89: enlarge supported length of read_reg debugfs entry
    (bsc#1227149).
  - wifi: rtw89: 8851b: add RF configurations (bsc#1227149).
  - wifi: rtw89: 8851b: add MAC configurations to chip_info
    (bsc#1227149).
  - wifi: rtw89: 8851b: fill BB related capabilities to chip_info
    (bsc#1227149).
  - wifi: rtw89: 8851b: add TX power related functions
    (bsc#1227149).
  - commit 66eef0c
  - Update config files: update for the realtek wifi driver updates (bsc#1227149)
  - commit 75bc634
  - wifi: rtw89: refine packet offload handling under SER
    (bsc#1227149).
  - wifi: rtw89: tweak H2C TX waiting function for SER
    (bsc#1227149).
  - wifi: rtw89: ser: reset total_sta_assoc and tdls_peer when L2
    (bsc#1227149).
  - wifi: rtw88: Add support for the SDIO based RTL8723DS chipset
    (bsc#1227149).
  - wifi: rtw88: rtw8723d: Implement RTL8723DS (SDIO) efuse parsing
    (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add TSSI (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add DPK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add RX DCK (bsc#1227149).
  - wifi: rtw89: 8851b: add to parse efuse content (bsc#1227149).
  - wifi: rtw89: 8851b: add set channel function (bsc#1227149).
  - wifi: rtw89: 8851b: add basic power on function (bsc#1227149).
  - wifi: rtw89: 8851b: add BT coexistence support function
    (bsc#1227149).
  - wifi: rtw89: 8851b: configure GPIO according to RFE type
    (bsc#1227149).
  - wifi: rtw89: 8851b: add to read efuse version to recognize
    hardware version B (bsc#1227149).
  - wifi: rtl8xxxu: Rename some registers (bsc#1227149).
  - wifi: rtl8xxxu: Support new chip RTL8192FU (bsc#1227149).
  - wifi: rtw89: suppress the log for specific SER called
    CMDPSR_FRZTO (bsc#1227149).
  - wifi: rtw89: ser: L1 add pre-M0 and post-M0 states
    (bsc#1227149).
  - wifi: rtw89: pci: fix interrupt enable mask for HALT C2H of
    RTL8851B (bsc#1227149).
  - wifi: rtw89: support U-NII-4 channels on 5GHz band
    (bsc#1227149).
  - wifi: rtw89: regd: judge UNII-4 according to BIOS and chip
    (bsc#1227149).
  - wifi: rtw89: introduce realtek ACPI DSM method (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add IQK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add DACK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add RCK (bsc#1227149).
  - wifi: rtw89: 8851b: rfk: add AACK (bsc#1227149).
  - wifi: rtw89: 8851b: add set_channel_rf() (bsc#1227149).
  - wifi: rtw89: 8851b: add DLE mem and HFC quota (bsc#1227149).
  - wifi: rtw89: 8851b: add support WoWLAN to 8851B (bsc#1227149).
  - wifi: rtw89: change naming of BA CAM from V1 to V0_EXT
    (bsc#1227149).
  - commit a1de2dd
  - wifi: rtw89: use chip_info::small_fifo_size to choose debug_mask
    (bsc#1227149).
  - wifi: rtw89: add CFO XTAL registers field to support 8851B
    (bsc#1227149).
  - wifi: rtw89: 8851b: add NCTL post table (bsc#1227149).
  - wifi: rtw89: 8851be: add 8851BE PCI entry and fill PCI
    capabilities (bsc#1227149).
  - wifi: rtw89: 8851b: add 8851B basic chip_info (bsc#1227149).
  - wifi: rtw89: scan offload wait for FW done ACK (bsc#1227149).
  - wifi: rtw89: mac: handle C2H receive/done ACK in interrupt
    context (bsc#1227149).
  - wifi: rtw89: packet offload wait for FW response (bsc#1227149).
  - wifi: rtw89: refine packet offload delete flow of 6 GHz probe
    (bsc#1227149).
  - wifi: rtw89: release bit in rtw89_fw_h2c_del_pkt_offload()
    (bsc#1227149).
  - wifi: rtw89: add EVM for antenna diversity (bsc#1227149).
  - wifi: rtw89: add RSSI based antenna diversity (bsc#1227149).
  - wifi: rtw89: initialize antenna for antenna diversity
    (bsc#1227149).
  - wifi: rtw89: add EVM and SNR statistics to debugfs
    (bsc#1227149).
  - wifi: rtw89: add RSSI statistics for the case of antenna
    diversity to debugfs (bsc#1227149).
  - wifi: rtw89: set capability of TX antenna diversity
    (bsc#1227149).
  - wifi: rtw89: use struct rtw89_phy_sts_ie0 instead of macro to
    access PHY IE0 status (bsc#1227149).
  - wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_*
    (bsc#1227149).
  - wifi: rtw88: fix incorrect error codes in
    rtw_debugfs_copy_from_user (bsc#1227149).
  - wifi: rtl8xxxu: rtl8xxxu_rx_complete(): remove unnecessary
    return (bsc#1227149).
  - commit fef25cd
  - wifi: rtl8xxxu: Add sta_add() and sta_remove() callbacks
    (bsc#1227149).
  - commit a27e0ec
  - wifi: rtl8xxxu: Support USB RX aggregation for the newer chips
    (bsc#1227149).
  - wifi: rtl8xxxu: Set maximum number of supported stations
    (bsc#1227149).
  - wifi: rtl8xxxu: Declare AP mode support for 8188f (bsc#1227149).
  - wifi: rtl8xxxu: Remove usage of tx_info->control.rates[0].flags
    (bsc#1227149).
  - wifi: rtl8xxxu: Remove usage of ieee80211_get_tx_rate()
    (bsc#1227149).
  - wifi: rtl8xxxu: Clean up filter configuration (bsc#1227149).
  - wifi: rtl8xxxu: Enable hw seq for mgmt/non-QoS data frames
    (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter macid to update_rate_mask
    (bsc#1227149).
  - wifi: rtl8xxxu: Put the macid in txdesc (bsc#1227149).
  - commit 6125130
  - wifi: radiotap: add bandwidth definition of EHT U-SIG
    (bsc#1227149).
  - wifi: ieee80211: add UL-bandwidth definition of trigger frame
    (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter force to
    rtl8xxxu_refresh_rate_mask (bsc#1227149).
  - wifi: rtl8xxxu: Add parameter role to report_connect
    (bsc#1227149).
  - wifi: rtl8xxxu: Actually use macid in
    rtl8xxxu_gen2_report_connect (bsc#1227149).
  - wifi: rtl8xxxu: Allow creating interface in AP mode
    (bsc#1227149).
  - wifi: rtl8xxxu: Allow setting rts threshold to -1 (bsc#1227149).
  - wifi: rtl8xxxu: Add set_tim() callback (bsc#1227149).
  - wifi: rtl8xxxu: Add beacon functions (bsc#1227149).
  - wifi: rtl8xxxu: Select correct queue for beacon frames
    (bsc#1227149).
  - wifi: rtl8xxxu: Add start_ap() callback (bsc#1227149).
  - commit 02b75ed
  - wifi: iwlwifi: bump FW API to 90 for BZ/SC devices (bsc#1227149
    CVE-2023-47210 bsc#1225601 CVE-2023-38417 bsc#1225600).
  - commit ea4853c
  - wifi: iwlwifi: bump FW API to 89 for AX/BZ/SC devices
    (bsc#1227149 CVE-2023-47210 bsc#1225601 CVE-2023-38417
    bsc#1225600).
  - commit bc49209
  - ASoC: SOF: Intel: hda-pcm: Limit the maximum number of periods
    by MAX_BDL_ENTRIES (stable-fixes).
  - ASoC: rt711-sdw: add missing readable registers (stable-fixes).
  - ALSA: hda/realtek: Enable Mute LED on HP 250 G7 (stable-fixes).
  - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
    (stable-fixes).
  - ALSA: hda/realtek: add quirk for Clevo V5[46]0TU (stable-fixes).
  - commit 1ddd32b
  - hpet: Support 32-bit userspace (git-fixes).
  - misc: fastrpc: Restrict untrusted app to attach to privileged PD
    (git-fixes).
  - misc: fastrpc: Fix ownership reassignment of remote heap
    (git-fixes).
  - misc: fastrpc: Fix memory leak in audio daemon attach operation
    (git-fixes).
  - misc: fastrpc: Avoid updating PD type for capability request
    (git-fixes).
  - misc: fastrpc: Copy the complete capability structure to user
    (git-fixes).
  - misc: fastrpc: Fix DSP capabilities request (git-fixes).
  - USB: serial: mos7840: fix crash on resume (git-fixes).
  - USB: core: Fix duplicate endpoint bug by clearing reserved
    bits in the descriptor (git-fixes).
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
    (git-fixes).
  - ASoC: SOF: Intel: hda: fix null deref on system suspend entry
    (git-fixes).
  - firmware: cs_dsp: Prevent buffer overrun when processing V2
    alg headers (git-fixes).
  - firmware: cs_dsp: Validate payload length before processing
    block (git-fixes).
  - firmware: cs_dsp: Return error if block header overflows file
    (git-fixes).
  - firmware: cs_dsp: Fix overflow checking of wmfw header
    (git-fixes).
  - ALSA: hda: cs35l41: Fix swapped l/r audio channels for Lenovo
    ThinBook 13x Gen4 (git-fixes).
  - commit 34ebce1

++++ kernel-firmware:

  - Update to version 20240712 (git commit ed874ed83cac):
    * amdgpu: update DMCUB to v0.0.225.0 for Various AMDGPU Asics
    * qcom: add gpu firmwares for x1e80100 chipset (bsc#1219458)
    * linux-firmware: add firmware for qat_402xx devices
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update SDMA 6.0.3 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update PSP 13.0.8 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update SDMA 6.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update PSP 13.0.11 firmware
    * amdgpu: update GC 11.0.4 firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update SDMA 6.0.1 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VPE 6.1.1 firmware
    * amdgpu: update VCN 4.0.6 firmware
    * amdgpu: update SDMA 6.1.1 firmware
    * amdgpu: update PSP 14.0.1 firmware
    * amdgpu: update GC 11.5.1 firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update SDMA 6.1.0 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update SMU 13.0.7 firmware
    * amdgpu: update SDMA 6.0.2 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update raven2 firmware
    * amdgpu: update aldebaran firmware
    * linux-firmware: Update AMD cpu microcode
    * linux-firmware: Add ISH firmware file for Intel Lunar Lake platform
    * amdgpu: update DMCUB to v0.0.224.0 for Various AMDGPU Asics
    * cirrus: cs35l41: Update various firmware for ASUS laptops using CS35L41
    * amdgpu: Update ISP FW for isp v4.1.1

++++ kernel-firmware:

  - Update to version 20240712 (git commit ed874ed83cac):
    (bsc#1229069, CVE-2023-31315)
    * amdgpu: update DMCUB to v0.0.225.0 for Various AMDGPU Asics
    * qcom: add gpu firmwares for x1e80100 chipset (bsc#1219458)
    * linux-firmware: add firmware for qat_402xx devices
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update SDMA 6.0.3 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update PSP 13.0.8 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update SDMA 6.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update PSP 13.0.11 firmware
    * amdgpu: update GC 11.0.4 firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update SDMA 6.0.1 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VPE 6.1.1 firmware
    * amdgpu: update VCN 4.0.6 firmware
    * amdgpu: update SDMA 6.1.1 firmware
    * amdgpu: update PSP 14.0.1 firmware
    * amdgpu: update GC 11.5.1 firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update SDMA 6.1.0 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update SMU 13.0.7 firmware
    * amdgpu: update SDMA 6.0.2 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update raven2 firmware
    * amdgpu: update aldebaran firmware
    * linux-firmware: Update AMD cpu microcode
    * linux-firmware: Add ISH firmware file for Intel Lunar Lake platform
    * amdgpu: update DMCUB to v0.0.224.0 for Various AMDGPU Asics
    * cirrus: cs35l41: Update various firmware for ASUS laptops using CS35L41
    * amdgpu: Update ISP FW for isp v4.1.1

++++ kernel-firmware:

  - Update to version 20240712 (git commit ed874ed83cac):
    (bsc#1229069, CVE-2023-31315)
    * amdgpu: update DMCUB to v0.0.225.0 for Various AMDGPU Asics
    * qcom: add gpu firmwares for x1e80100 chipset (bsc#1219458)
    * linux-firmware: add firmware for qat_402xx devices
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update SDMA 6.0.3 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update PSP 13.0.8 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update SDMA 6.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update PSP 13.0.11 firmware
    * amdgpu: update GC 11.0.4 firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update SDMA 6.0.1 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VPE 6.1.1 firmware
    * amdgpu: update VCN 4.0.6 firmware
    * amdgpu: update SDMA 6.1.1 firmware
    * amdgpu: update PSP 14.0.1 firmware
    * amdgpu: update GC 11.5.1 firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update SDMA 6.1.0 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update SMU 13.0.7 firmware
    * amdgpu: update SDMA 6.0.2 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update raven2 firmware
    * amdgpu: update aldebaran firmware
    * linux-firmware: Update AMD cpu microcode
    * linux-firmware: Add ISH firmware file for Intel Lunar Lake platform
    * amdgpu: update DMCUB to v0.0.224.0 for Various AMDGPU Asics
    * cirrus: cs35l41: Update various firmware for ASUS laptops using CS35L41
    * amdgpu: Update ISP FW for isp v4.1.1

------------------------------------------------------------------
------------------  2024-7-12  -  Jul 12 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix mocking of test_process_result_bundle_as_rpm
  - Fixed logging behavior of Compress::get_format
    The get_format() method allows to check which compression format
    a given input stream has. This is done by calling the supported
    compression tools in a row and let them check if they can deal
    with the provided data or not. As a result error messages are
    logged for streams that some tool doesn't understand. However,
    those error messages are no errors and only the result of the
    checking. This information in the kiwi log file is confusing
    and several users already complained when they see information
    like:
    EXEC: Failed with stderr: /usr/bin/xz: ...: File format not recognized
    This commit changes how the compression tooling is called in a
    way that no exception is raised (which leads to the above error message)
    but the result returncode is used to decide on the success or
    error of the respective compression tooling.
  - Allow to set custom ISO Application ID
    Add new <type ... application_id="..."/> attribute to be set in
    the ISO header main block. The application ID was used as identifier
    in the legacy initrd code from former kiwi versions. Because of
    this there is still the compat layer which sets an App ID as MBR
    identifier string unless the new application_id overwrites it.
    This Fixes #1810
  - Bump version: 10.0.23 → 10.0.24

++++ python-kiwi:

  - Fix mocking of test_process_result_bundle_as_rpm
  - Fixed logging behavior of Compress::get_format
    The get_format() method allows to check which compression format
    a given input stream has. This is done by calling the supported
    compression tools in a row and let them check if they can deal
    with the provided data or not. As a result error messages are
    logged for streams that some tool doesn't understand. However,
    those error messages are no errors and only the result of the
    checking. This information in the kiwi log file is confusing
    and several users already complained when they see information
    like:
    EXEC: Failed with stderr: /usr/bin/xz: ...: File format not recognized
    This commit changes how the compression tooling is called in a
    way that no exception is raised (which leads to the above error message)
    but the result returncode is used to decide on the success or
    error of the respective compression tooling.
  - Allow to set custom ISO Application ID
    Add new <type ... application_id="..."/> attribute to be set in
    the ISO header main block. The application ID was used as identifier
    in the legacy initrd code from former kiwi versions. Because of
    this there is still the compat layer which sets an App ID as MBR
    identifier string unless the new application_id overwrites it.
    This Fixes #1810
  - Bump version: 10.0.23 → 10.0.24

++++ python-kiwi:

  - Fix mocking of test_process_result_bundle_as_rpm
  - Fixed logging behavior of Compress::get_format
    The get_format() method allows to check which compression format
    a given input stream has. This is done by calling the supported
    compression tools in a row and let them check if they can deal
    with the provided data or not. As a result error messages are
    logged for streams that some tool doesn't understand. However,
    those error messages are no errors and only the result of the
    checking. This information in the kiwi log file is confusing
    and several users already complained when they see information
    like:
    EXEC: Failed with stderr: /usr/bin/xz: ...: File format not recognized
    This commit changes how the compression tooling is called in a
    way that no exception is raised (which leads to the above error message)
    but the result returncode is used to decide on the success or
    error of the respective compression tooling.
  - Allow to set custom ISO Application ID
    Add new <type ... application_id="..."/> attribute to be set in
    the ISO header main block. The application ID was used as identifier
    in the legacy initrd code from former kiwi versions. Because of
    this there is still the compat layer which sets an App ID as MBR
    identifier string unless the new application_id overwrites it.
    This Fixes #1810
  - Bump version: 10.0.23 → 10.0.24

++++ kernel-default:

  - net/smc: avoid data corruption caused by decline (bsc#1225088
    CVE-2023-52775).
  - commit 621e8ca
  - net: openvswitch: fix overwriting ct original tuple for  ICMPv6
    (bsc#1226783 CVE-2024-38558).
  - commit 748cf39
  - ipv6: sr: fix missing sk_buff release in seg6_input_core
    (bsc#1227626 CVE-2024-39490).
  - commit 3d59f52
  - mptcp: fix data re-injection from stale subflow (bsc#1223010
    CVE-2024-26826).
  - commit f3a102e
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    (bsc#1220942 CVE-2024-26615).
  - commit f21afb0
  - kabi/severities: cover all ath/* drivers (bsc#1227149)
    All symbols in ath/* network drivers are local and can be ignored
  - commit d902566
  - Refresh kabi workaround ath updates (bsc#1227149#)
  - commit b0fa38b
  - wifi: mac80211: simplify non-chanctx drivers (bsc#1227149).
  - commit eeb4722
  - wifi: ath11k: move power type check to ASSOC stage when
    connecting to 6 GHz AP (bsc#1227149).
  - wifi: ath11k: fix WCN6750 firmware crash caused by 17 num_vdevs
    (bsc#1227149).
  - wifi: ath12k: fix the problem that down grade phy mode operation
    (bsc#1227149).
  - wifi: ath12k: check M3 buffer size as well whey trying to
    reuse it (bsc#1227149).
  - wifi: ath12k: fix kernel crash during resume (bsc#1227149).
  - wifi: ath9k: work around memset overflow warning (bsc#1227149).
  - wifi: ath12k: use correct flag field for 320 MHz channels
    (bsc#1227149).
  - commit 58db5ff
  - wifi: ath11k: use RCU when accessing struct inet6_dev::ac_list
    (bsc#1227149).
  - wifi: ath12k: fix license in p2p.c and p2p.h (bsc#1227149).
  - wifi: ath11k: constify MHI channel and controller configs
    (bsc#1227149).
  - wifi: ath12k: add rcu lock for ath12k_wmi_p2p_noa_event()
    (bsc#1227149).
  - wifi: ath11k: remove unused scan_events from struct
    scan_req_params (bsc#1227149).
  - wifi: ath11k: add support for QCA2066 (bsc#1227149).
  - wifi: ath11k: move pci.ops registration ahead (bsc#1227149).
  - commit 29f553c
  - wifi: ath11k: provide address list if chip supports 2 stations
    (bsc#1227149).
  - wifi: ath11k: support 2 station interfaces (bsc#1227149).
  - wifi: ath12k: remove the unused scan_events from
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: ath12k: Remove unused scan_flags from struct
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: ath12k: Do not use scan_flags from struct
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: carl9170: Remove redundant assignment to pointer super
    (bsc#1227149).
  - wifi: ath11k: Remove scan_flags union from struct
    scan_req_params (bsc#1227149).
  - wifi: ath11k: Do not directly use scan_flags in struct
    scan_req_params (bsc#1227149).
  - wifi: ath12k: Fix uninitialized use of ret in
    ath12k_mac_allocate() (bsc#1227149).
  - wifi: ath11k: Really consistently use ath11k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath12k: advertise P2P dev support for WCN7850
    (bsc#1227149).
  - wifi: ath12k: designating channel frequency for ROC scan
    (bsc#1227149).
  - wifi: ath12k: move peer delete after vdev stop of station for
    WCN7850 (bsc#1227149).
  - wifi: ath12k: allow specific mgmt frame tx while vdev is not up
    (bsc#1227149).
  - wifi: ath12k: change WLAN_SCAN_PARAMS_MAX_IE_LEN from 256 to
    512 (bsc#1227149).
  - wifi: ath12k: implement remain on channel for P2P mode
    (bsc#1227149).
  - wifi: ath12k: implement handling of P2P NoA event (bsc#1227149).
  - wifi: ath12k: add P2P IE in beacon template (bsc#1227149).
  - wifi: ath12k: change interface combination for P2P mode
    (bsc#1227149).
  - wifi: ath12k: fix broken structure wmi_vdev_create_cmd
    (bsc#1227149).
  - commit 21d36c7
  - wifi: ath11k: initialize eirp_power before use (bsc#1227149).
  - wifi: ath12k: enable 802.11 power save mode in station mode
    (bsc#1227149).
  - wifi: ath12k: refactor the rfkill worker (bsc#1227149).
  - wifi: ath12k: add processing for TWT disable event
    (bsc#1227149).
  - wifi: ath12k: add processing for TWT enable event (bsc#1227149).
  - wifi: ath12k: disable QMI PHY capability learn in split-phy
    QCN9274 (bsc#1227149).
  - wifi: ath12k: Read board id to support split-PHY QCN9274
    (bsc#1227149).
  - wifi: ath12k: fix PCI read and write (bsc#1227149).
  - wifi: ath12k: add MAC id support in WBM error path
    (bsc#1227149).
  - wifi: ath12k: subscribe required word mask from rx tlv
    (bsc#1227149).
  - commit c884365
  - wifi: ath12k: remove hal_desc_sz from hw params (bsc#1227149).
  - wifi: ath12k: split hal_ops to support RX TLVs word mask
    compaction (bsc#1227149).
  - wifi: ath12k: fix firmware assert during insmod in memory
    segment mode (bsc#1227149).
  - wifi: ath12k: Add logic to write QRTR node id to scratch
    (bsc#1227149).
  - wifi: ath12k: fix fetching MCBC flag for QCN9274 (bsc#1227149).
  - wifi: ath12k: add support for peer meta data version
    (bsc#1227149).
  - wifi: ath12k: fetch correct pdev id from
    WMI_SERVICE_READY_EXT_EVENTID (bsc#1227149).
  - wifi: ath12k: indicate NON MBSSID vdev by default during vdev
    start (bsc#1227149).
  - wifi: ath12k: add firmware-2.bin support (bsc#1227149).
  - wifi: ath9k:  remove redundant assignment to variable ret
    (bsc#1227149).
  - commit 777dc1c
  - wifi: ath11k: fix connection failure due to unexpected peer
    delete (bsc#1227149).
  - wifi: ath11k: avoid forward declaration of
    ath11k_mac_start_vdev_delay() (bsc#1227149).
  - wifi: ath11k: rename ath11k_start_vdev_delay() (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wcn36xx (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for ar5523 (bsc#1227149).
  - commit d2a4b44
  - wifi: ath11k: remove invalid peer create logic (bsc#1227149).
  - wifi: ath11k: enable 36 bit mask for stream DMA (bsc#1227149).
  - wifi: ath10k: Fix enum ath10k_fw_crash_dump_type kernel-doc
    (bsc#1227149).
  - wifi: ath10k: Fix htt_data_tx_completion kernel-doc warning
    (bsc#1227149).
  - wifi: ath10k: fix htt_q_state_conf & htt_q_state kernel-doc
    (bsc#1227149).
  - wifi: ath10k: correctly document enum wmi_tlv_tx_pause_id
    (bsc#1227149).
  - wifi: ath10k: add missing wmi_10_4_feature_mask documentation
    (bsc#1227149).
  - wifi: ath12k: add support for collecting firmware log
    (bsc#1227149).
  - wifi: ath12k: Introduce the container for mac80211 hw
    (bsc#1227149).
  - wifi: ath12k: Refactor the mac80211 hw access from link/radio
    (bsc#1227149).
  - commit 614fabb
  - iommu/vt-d: Improve ITE fault handling if target device isn't
    present (git-fixes).
  - commit 134a3a5
  - wifi: ath12k: change MAC buffer ring size to 2048 (bsc#1227149).
  - wifi: ath12k: add support for BA1024 (bsc#1227149).
  - wifi: ath12k: fix wrong definitions of hal_reo_update_rx_queue
    (bsc#1227149).
  - wifi: ath10k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath11k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath12k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath12k: add QMI PHY capability learn support
    (bsc#1227149).
  - wifi: ath12k: refactor QMI MLO host capability helper function
    (bsc#1227149).
  - wifi: ath11k: document HAL_RX_BUF_RBM_SW4_BM (bsc#1227149).
  - wifi: ath12k: ath12k_start_vdev_delay(): convert to use ar
    (bsc#1227149).
  - commit dd312dc
  - wifi: ath12k: refactor ath12k_mac_op_flush() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_ampdu_action()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_configure_filter()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_update_vif_offload()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_stop() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_start() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_conf_tx() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_bss_assoc() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_config() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_register() and
    ath12k_mac_unregister() (bsc#1227149).
  - commit b6ca728
  - wifi: ath12k: refactor ath12k_mac_setup_channels_rates()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_allocate() and
    ath12k_mac_destroy() (bsc#1227149).
  - wifi: ath12k: relocate ath12k_dp_pdev_pre_alloc() call
    (bsc#1227149).
  - wifi: ath12k: Use initializers for QMI message buffers
    (bsc#1227149).
  - wifi: ath12k: Add missing qmi_txn_cancel() calls (bsc#1227149).
  - wifi: ath12k: Remove unnecessary struct qmi_txn initializers
    (bsc#1227149).
  - wifi: ath11k: use WMI_VDEV_SET_TPC_POWER_CMDID when
    EXT_TPC_REG_SUPPORT for 6 GHz (bsc#1227149).
  - wifi: ath11k: add handler for WMI_VDEV_SET_TPC_POWER_CMDID
    (bsc#1227149).
  - wifi: ath11k: add WMI_TLV_SERVICE_EXT_TPC_REG_SUPPORT service
    bit (bsc#1227149).
  - wifi: ath11k: fill parameters for vdev set tpc power WMI command
    (bsc#1227149).
  - commit 3c338b0
  - wifi: ath11k: save max transmit power in vdev start response
    event from firmware (bsc#1227149).
  - commit 279ae7a
  - wifi: ath11k: add parse of transmit power envelope element
    (bsc#1227149).
  - commit e295f89
  - wifi: ath11k: save power spectral density(PSD) of regulatory
    rule (bsc#1227149).
  - wifi: ath11k: update regulatory rules when connect to AP on
    6 GHz band for station (bsc#1227149).
  - wifi: ath11k: update regulatory rules when interface added
    (bsc#1227149).
  - wifi: ath11k: fix a possible dead lock caused by ab->base_lock
    (bsc#1227149).
  - wifi: ath11k: store cur_regulatory_info for each radio
    (bsc#1227149).
  - wifi: ath11k: add support to select 6 GHz regulatory type
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_wmi_tlv_parse_alloc()
    (bsc#1227149).
  - wifi: ath11k: fix IOMMU errors on buffer rings (bsc#1227149).
  - commit d84dbd2
  - wifi: ath12k: Make QMI message rules const (bsc#1227149).
  - wifi: ath12k: support default regdb while searching board-2.bin
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: add support to search regdb data in board-2.bin
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: remove unused ATH12K_BD_IE_BOARD_EXT
    (bsc#1227149).
  - wifi: ath12k: add fallback board name without variant while
    searching board-2.bin (bsc#1227149).
  - wifi: ath12k: add string type to search board data in
    board-2.bin for WCN7850 (bsc#1227149).
  - wifi: ath10k: remove duplicate memset() in 10.4 TDLS peer update
    (bsc#1227149).
  - wifi: ath10k: use flexible array in struct
    wmi_tdls_peer_capabilities (bsc#1227149).
  - wifi: ath10k: remove unused template structs (bsc#1227149).
  - wifi: ath10k: remove struct wmi_pdev_chanlist_update_event
    (bsc#1227149).
  - commit e73f8dc
  - wifi: ath10k: use flexible arrays for WMI start scan TLVs
    (bsc#1227149).
  - wifi: ath10k: use flexible array in struct wmi_host_mem_chunks
    (bsc#1227149).
  - wifi: ath9k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath9k: delete some unused/duplicate macros (bsc#1227149).
  - wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc()
    (bsc#1227149).
  - wifi: ath11k: rely on mac80211 debugfs handling for vif
    (bsc#1227149).
  - wifi: ath11k: workaround too long expansion sparse warnings
    (bsc#1227149).
  - Revert "wifi: ath12k: use ATH12K_PCI_IRQ_DP_OFFSET for DP IRQ"
    (bsc#1227149).
  - wifi: ath9k: reset survey of current channel after a scan
    started (bsc#1227149).
  - wifi: ath12k: fix the issue that the multicast/broadcast
    indicator is not read correctly for WCN7850 (bsc#1227149).
  - commit 6cf204e
  - wifi: ath11k: Fix ath11k_htc_record flexible record
    (bsc#1227149).
  - wifi: ath5k: remove unused ath5k_eeprom_info::ee_antenna
    (bsc#1227149).
  - wifi: ath10k: add support to allow broadcast action frame RX
    (bsc#1227149).
  - wifi: ath12k: avoid repeated wiphy access from hw (bsc#1227149).
  - wifi: ath12k: set IRQ affinity to CPU0 in case of one MSI vector
    (bsc#1227149).
  - wifi: ath12k: do not restore ASPM in case of single MSI vector
    (bsc#1227149).
  - wifi: ath12k: add support one MSI vector (bsc#1227149).
  - wifi: ath12k: refactor multiple MSI vector implementation
    (bsc#1227149).
  - wifi: ath12k: use ATH12K_PCI_IRQ_DP_OFFSET for DP IRQ
    (bsc#1227149).
  - wifi: ath12k: add CE and ext IRQ flag to indicate irq_handler
    (bsc#1227149).
  - commit 908caeb
  - wifi: ath12k: get msi_data again after request_irq is called
    (bsc#1227149).
  - wifi: wcn36xx: Convert to platform remove callback returning
    void (bsc#1227149).
  - wifi: ath5k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath12k: avoid repeated hw access from ar (bsc#1227149).
  - wifi: ath12k: Optimize the mac80211 hw data access
    (bsc#1227149).
  - wifi: ath12k: add 320 MHz bandwidth enums (bsc#1227149).
  - wifi: ath11k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath11k: remove ath11k_htc_record::pauload[] (bsc#1227149).
  - wifi: ath10k: Use DECLARE_FLEX_ARRAY() for ath10k_htc_record
    (bsc#1227149).
  - wifi: ath10k: remove ath10k_htc_record::pauload[] (bsc#1227149).
  - commit 67bc0a7
  - wifi: ath10k: Update Qualcomm Innovation Center, Inc. copyrights
    (bsc#1227149).
  - commit e13fd24
  - wifi: ath11k: Update Qualcomm Innovation Center, Inc. copyrights
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-do-not-dump-SRNG-statistics-during-resum.patch.
  - Refresh
    patches.suse/wifi-ath11k-fix-warning-on-DMA-ring-capabilities-eve.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - Refresh
    patches.suse/wifi-ath11k-thermal-don-t-try-to-register-multiple-t.patch.
  - commit a886227
  - wifi: ath9k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath12k: refactor DP Rxdma ring structure (bsc#1227149).
  - wifi: ath12k: avoid explicit HW conversion argument in Rxdma
    replenish (bsc#1227149).
  - wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish
    (bsc#1227149).
  - wifi: ath12k: avoid explicit mac id argument in Rxdma replenish
    (bsc#1227149).
  - wifi: ath12k: fix the error handler of rfkill config
    (bsc#1227149).
  - wifi: ath12k: use select for CRYPTO_MICHAEL_MIC (bsc#1227149).
  - wifi: ath11k: use select for CRYPTO_MICHAEL_MIC (bsc#1227149).
  - commit a869013
  - wifi: ath12k: Consolidate WMI peer flags (bsc#1227149).
  - wifi: ath11k: Consolidate WMI peer flags (bsc#1227149).
  - wifi: ath12k: Remove obsolete struct wmi_peer_flags_map
    * peer_flags (bsc#1227149).
  - wifi: ath11k: Remove obsolete struct wmi_peer_flags_map
    * peer_flags (bsc#1227149).
  - wifi: ath12k: Remove struct ath12k::ops (bsc#1227149).
  - wifi: ath11k: Remove struct ath11k::ops (bsc#1227149).
  - wifi: ath10k: Remove unused struct ath10k_htc_frame
    (bsc#1227149).
  - wifi: ath10k: simplify __ath10k_htt_tx_txq_recalc()
    (bsc#1227149).
  - wifi: ath11k: Remove unneeded semicolon (bsc#1227149).
  - wifi: ath10k: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - commit e59240f
  - wifi: ath12k: drop NULL pointer check in
    ath12k_update_per_peer_tx_stats() (bsc#1227149).
  - Revert "wifi: ath11k: call ath11k_mac_fils_discovery() without
    condition" (bsc#1227149).
  - wifi: ath12k: Introduce and use ath12k_sta_to_arsta()
    (bsc#1227149).
  - wifi: ath12k: rename the sc naming convention to ab
    (bsc#1227149).
  - wifi: ath12k: rename the wmi_sc naming convention to wmi_ab
    (bsc#1227149).
  - commit f93677e
  - bus: mhi: host: allow MHI client drivers to provide the firmware
    via a pointer (bsc#1227149).
  - commit 494649c
  - wifi: ath11k: add firmware-2.bin support (bsc#1227149).
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit 677d325
  - wifi: ath11k: qmi: refactor ath11k_qmi_m3_load() (bsc#1227149).
  - commit 296ac8f
  - wifi: ath11k: rename the sc naming convention to ab
    (bsc#1227149).
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - Refresh
    patches.suse/wifi-ath11k-thermal-don-t-try-to-register-multiple-t.patch.
  - commit 6eedd0d
  - wifi: ath11k: rename the wmi_sc naming convention to wmi_ab
    (bsc#1227149).
  - wifi: ath6kl: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - commit cd59b03
  - wifi: ath5k: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: ath12k: Remove ath12k_base::bd_api (bsc#1227149).
  - wifi: ath11k: Remove ath11k_base::bd_api (bsc#1227149).
  - wifi: ath12k: Enable Mesh support for QCN9274 (bsc#1227149).
  - wifi: ath12k: register EHT mesh capabilities (bsc#1227149).
  - wifi: ath11k: Use device_get_match_data() (bsc#1227149).
  - wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
    (bsc#1227149).
  - wifi: ath11k: Remove unused struct ath11k_htc_frame
    (bsc#1227149).
  - wifi: ath12k: fix invalid m3 buffer address (bsc#1227149).
  - wifi: ath12k: add ath12k_qmi_free_resource() for recovery
    (bsc#1227149).
  - commit a18a8d4
  - wifi: ath12k: configure RDDM size to MHI for device recovery
    (bsc#1227149).
  - wifi: ath12k: add parsing of phy bitmap for reg rules
    (bsc#1227149).
  - wifi: ath11k: add parsing of phy bitmap for reg rules
    (bsc#1227149).
  - wifi: ath11k: ath11k_debugfs_register(): fix format-truncation
    warning (bsc#1227149).
  - wifi: ath12k: Consistently use ath12k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath11k: call ath11k_mac_fils_discovery() without condition
    (bsc#1227149).
  - wifi: ath12k: remove redundant memset() in
    ath12k_hal_reo_qdesc_setup() (bsc#1227149).
  - wifi: ath9k_htc: fix format-truncation warning (bsc#1227149).
  - wifi: ath12k: fix debug messages (bsc#1227149).
  - wifi: ath11k: fix CAC running state during virtual interface
    start (bsc#1227149).
  - commit c2f2e92
  - wifi: ath10k: simplify ath10k_peer_create() (bsc#1227149).
  - wifi: ath10k: indicate to mac80211 scan complete with aborted
    flag for ATH10K_SCAN_STARTING state (bsc#1227149).
  - wifi: ath: dfs_pattern_detector: Use flex array to simplify code
    (bsc#1227149).
  - wifi: carl9170: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath10k: consistently use kstrtoX_from_user() functions
    (bsc#1227149).
  - wifi: ath12k: add keep backward compatibility of PHY mode to
    avoid firmware crash (bsc#1227149).
  - wifi: ath12k: add read variant from SMBIOS for download board
    data (bsc#1227149).
  - wifi: ath12k: do not drop data frames from unassociated stations
    (bsc#1227149).
  - wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data
    handling (bsc#1227149).
  - wifi: ath11k: fix ath11k_mac_op_remain_on_channel() stack usage
    (bsc#1227149).
  - commit b844022
  - wifi: ath12k: add msdu_end structure for WCN7850 (bsc#1227149).
  - wifi: ath12k: Set default beacon mode to burst mode
    (bsc#1227149).
  - wifi: ath12k: call ath12k_mac_fils_discovery() without condition
    (bsc#1227149).
  - wifi: ath11k: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath12k: enable IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: change to treat alpha code na as world wide
    regdomain (bsc#1227149).
  - wifi: ath12k: indicate scan complete for scan canceled when
    scan running (bsc#1227149).
  - wifi: ath12k: indicate to mac80211 scan complete with aborted
    flag for ATH12K_SCAN_STARTING state (bsc#1227149).
  - wifi: ath12k: fix recovery fail while firmware crash when
    doing channel switch (bsc#1227149).
  - wifi: ath12k: add support for hardware rfkill for WCN7850
    (bsc#1227149).
  - commit 087627b
  - wifi: ath11k: use kstrtoul_from_user() where appropriate
    (bsc#1227149).
  - wifi: ath11k: remove unused members of 'struct ath11k_base'
    (bsc#1227149).
  - wifi: ath11k: drop redundant check in
    ath11k_dp_rx_mon_dest_process() (bsc#1227149).
  - wifi: ath11k: drop NULL pointer check in
    ath11k_update_per_peer_tx_stats() (bsc#1227149).
  - wifi: ath10k: drop HTT_DATA_TX_STATUS_DOWNLOAD_FAIL
    (bsc#1227149).
  - wifi: ath10k: Annotate struct ath10k_ce_ring with __counted_by
    (bsc#1227149).
  - wifi: wcn36xx: Annotate struct wcn36xx_hal_ind_msg with
    __counted_by (bsc#1227149).
  - wifi: ath12k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath10k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath6kl: remove unnecessary (void*) conversions
    (bsc#1227149).
  - commit 3f20dbc
  - wifi: ath5k: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: wcn36xx: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ar5523: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath9k: clean up function ath9k_hif_usb_resume
    (bsc#1227149).
  - wifi: ath11k: add chip id board name while searching board-2.bin
    for WCN6855 (bsc#1227149).
  - wifi: ath12k: change to initialize recovery variables earlier
    in ath12k_core_reset() (bsc#1227149).
  - wifi: ath12k: enable 320 MHz bandwidth for 6 GHz band in EHT
    PHY capability for WCN7850 (bsc#1227149).
  - wifi: ath9k: use u32 for txgain indexes (bsc#1227149).
  - wifi: ath9k: simplify ar9003_hw_process_ini() (bsc#1227149).
  - wifi: ath12k: fix radar detection in 160 MHz (bsc#1227149).
  - commit 0b35606
  - wifi: ath12k: fix WARN_ON during ath12k_mac_update_vif_chan
    (bsc#1227149).
  - wifi: ath11k: fix tid bitmap is 0 in peer rx mu stats
    (bsc#1227149).
  - wifi: ath11k: move references from rsvd2 to info fields
    (bsc#1227149).
  - wifi: ath11k: mhi: add a warning message for MHI_CB_EE_RDDM
    crash (bsc#1227149).
  - wifi: ath: Use is_multicast_ether_addr() to check multicast
    Ether address (bsc#1227149).
  - wifi: ath12k: Remove unused declarations (bsc#1227149).
  - wifi: ath5k: ath5k_hw_get_median_noise_floor(): use swap()
    (bsc#1227149).
  - wifi: ath: remove unused-but-set parameter (bsc#1227149).
  - wifi: ath11k: Remove unused declarations (bsc#1227149).
  - wifi: ath10k: fix Wvoid-pointer-to-enum-cast warning
    (bsc#1227149).
  - commit 1f3c3b8
  - wifi: ath11k: fix Wvoid-pointer-to-enum-cast warning
    (bsc#1227149).
  - wifi: ath11k: simplify the code with module_platform_driver
    (bsc#1227149).
  - wifi: ath12k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath11k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath10k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath11k: Consistently use ath11k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath9k: Remove unused declarations (bsc#1227149).
  - wifi: ath9k: Remove unnecessary ternary operators (bsc#1227149).
  - wifi: ath9k: consistently use kstrtoX_from_user() functions
    (bsc#1227149).
  - wifi: ath9k: fix parameter check in ath9k_init_debug()
    (bsc#1227149).
  - commit 6c737fb
  - wifi: ath5k: Remove redundant dev_err() (bsc#1227149).
  - wifi: ath12k: avoid deadlock by change ieee80211_queue_work
    for regd_update_work (bsc#1227149).
  - wifi: ath12k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
    (bsc#1227149).
  - wifi: ath12k: relax list iteration in ath12k_mac_vif_unref()
    (bsc#1227149).
  - wifi: ath12k: configure puncturing bitmap (bsc#1227149).
  - wifi: ath12k: parse WMI service ready ext2 event (bsc#1227149).
  - wifi: ath12k: add MLO header in peer association (bsc#1227149).
  - wifi: ath12k: peer assoc for 320 MHz (bsc#1227149).
  - wifi: ath12k: add WMI support for EHT peer (bsc#1227149).
  - wifi: ath12k: prepare EHT peer assoc parameters (bsc#1227149).
  - commit 3191784
  - wifi: ath12k: add EHT PHY modes (bsc#1227149).
  - wifi: ath12k: propagate EHT capabilities to userspace
    (bsc#1227149).
  - wifi: ath12k: WMI support to process EHT capabilities
    (bsc#1227149).
  - wifi: ath12k: move HE capabilities processing to a new function
    (bsc#1227149).
  - commit 7fb64df
  - wifi: ath12k: rename HE capabilities setup/copy functions
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-annotate-iftype_data-pointer-with-spar.patch.
  - commit ddfeb0d
  - wifi: ath12k: change to use dynamic memory for channel list
    of scan (bsc#1227149).
  - wifi: ath12k: trigger station disconnect on hardware restart
    (bsc#1227149).
  - wifi: ath12k: Use pdev_id rather than mac_id to get pdev
    (bsc#1227149).
  - wifi: ath12k: correct the data_type from QMI_OPT_FLAG to
    QMI_UNSIGNED_1_BYTE for mlo_capable (bsc#1227149).
  - wifi: ath11k: Remove cal_done check during probe (bsc#1227149).
  - commit e204950
  - wifi: ath11k: simplify
    ath11k_mac_validate_vht_he_fixed_rate_settings() (bsc#1227149).
  - wifi: ath6kl: Remove error checking for debugfs_create_dir()
    (bsc#1227149).
  - wifi: ath5k: remove phydir check from ath5k_debug_init_device()
    (bsc#1227149).
  - wifi: drivers: Explicitly include correct DT includes
    (bsc#1227149).
  - wifi: ath10k: improve structure padding (bsc#1227149).
  - wifi: ath12k: fix conf_mutex in
    ath12k_mac_op_unassign_vif_chanctx() (bsc#1227149).
  - wifi: ath11k: debug: add ATH11K_DBG_CE (bsc#1227149).
  - commit 3345b7e
  - wifi: ath11k: htc: cleanup debug messages (bsc#1227149).
  - wifi: ath11k: don't use %pK (bsc#1227149).
  - wifi: ath11k: hal: cleanup debug message (bsc#1227149).
  - wifi: ath11k: debug: use all upper case in ATH11k_DBG_HAL
    (bsc#1227149).
  - wifi: ath11k: dp: cleanup debug message (bsc#1227149).
  - wifi: ath11k: pci: cleanup debug logging (bsc#1227149).
  - wifi: ath11k: wmi: add unified command debug messages
    (bsc#1227149).
  - wifi: ath11k: wmi: use common error handling style
    (bsc#1227149).
  - wifi: ath11k: wmi: cleanup error handling in
    ath11k_wmi_send_init_country_cmd() (bsc#1227149).
  - wifi: ath11k: remove unsupported event handlers (bsc#1227149).
  - commit 37105bd
  - wifi: ath11k: add WMI event debug messages (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch.
  - Refresh
    patches.suse/wifi-ath11k-fix-temperature-event-locking.patch.
  - commit 572fd2c
  - wifi: ath11k: remove manual mask names from debug messages
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch.
  - commit a7ae7bf
  - wifi: ath11k: print debug level in debug messages (bsc#1227149).
  - wifi: ath11k: debug: remove unused ATH11K_DBG_ANY (bsc#1227149).
  - wifi: ath12k: delete the timer rx_replenish_retry during rmmod
    (bsc#1227149).
  - wifi: ath12k: Use msdu_end to check MCBC (bsc#1227149).
  - wifi: ath12k: check hardware major version for WCN7850
    (bsc#1227149).
  - wifi: ath11k: update proper pdev/vdev id for testmode command
    (bsc#1227149).
  - wifi: atk10k: Don't opencode ath10k_pci_priv() in
    ath10k_ahb_priv() (bsc#1227149).
  - wifi: ath10k: Convert to platform remove callback returning void
    (bsc#1227149).
  - commit cafd8ed
  - wifi: ath10k: Drop checks that are always false (bsc#1227149).
  - wifi: ath10k: Drop cleaning of driver data from probe error
    path and remove (bsc#1227149).
  - wifi: ath11k: Add HTT stats for PHY reset case (bsc#1227149).
  - commit dde2040
  - wifi: ath11k: Allow ath11k to boot without caldata in ftm mode
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-do-not-dump-SRNG-statistics-during-resum.patch.
  - commit adbddfc
  - wifi: ath11k: factory test mode support (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-warning-on-DMA-ring-capabilities-eve.patch.
  - Refresh
    patches.suse/wifi-ath11k-rearrange-IRQ-enable-disable-in-reset-pa.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit 030f59a
  - wifi: ath11k: remove unused function ath11k_tm_event_wmi()
    (bsc#1227149).
  - wifi: ath12k: Add support to parse new WMI event for 6 GHz
    regulatory (bsc#1227149).
  - wifi: wil6210: wmi: Replace zero-length array with
    DECLARE_FLEX_ARRAY() helper (bsc#1227149).
  - wifi: wil6210: fw: Replace zero-length arrays with
    DECLARE_FLEX_ARRAY() helper (bsc#1227149).
  - wifi: ath11k: Send HT fixed rate in WMI peer fixed param
    (bsc#1227149).
  - wifi: ath11k: Relocate the func
    ath11k_mac_bitrate_mask_num_ht_rates() and change hweight16
    to hweight8 (bsc#1227149).
  - wifi: ath12k: increase vdev setup timeout (bsc#1227149).
  - wifi: ath11k: EMA beacon support (bsc#1227149).
  - wifi: ath11k: MBSSID beacon support (bsc#1227149).
  - wifi: ath11k: refactor vif parameter configurations
    (bsc#1227149).
  - wifi: ath11k: MBSSID parameter configuration in AP mode
    (bsc#1227149).
  - wifi: ath11k: rename MBSSID fields in wmi_vdev_up_cmd
    (bsc#1227149).
  - wifi: ath11k: MBSSID configuration during vdev create/start
    (bsc#1227149).
  - wifi: ath11k: driver settings for MBSSID and EMA (bsc#1227149).
  - wifi: ath: work around false-positive stringop-overread warning
    (bsc#1227149).
  - wifi: ath11k: Use list_count_nodes() (bsc#1227149).
  - wifi: ath10k: Use list_count_nodes() (bsc#1227149).
  - wifi: ath12k: fix potential wmi_mgmt_tx_queue race condition
    (bsc#1227149).
  - wifi: ath12k: add wait operation for tx management packets
    for flush from mac80211 (bsc#1227149).
  - wifi: ath12k: Remove some dead code (bsc#1227149).
  - wifi: ath12k: send WMI_PEER_REORDER_QUEUE_SETUP_CMDID when
    ADDBA session starts (bsc#1227149).
  - wifi: ath12k: set PERST pin no pull request for WCN7850
    (bsc#1227149).
  - wifi: ath12k: add qmi_cnss_feature_bitmap field to hardware
    parameters (bsc#1227149).
  - wifi: ath10/11/12k: Use alloc_ordered_workqueue() to create
    ordered workqueues (bsc#1227149).
  - commit 1763ceb
  - net: phy: microchip: lan87xx: reinit PHY after cable test
    (git-fixes).
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync()
    call in isr (git-fixes).
  - drm/amdgpu/atomfirmware: silence UBSAN warning (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Valve Galileo
    (stable-fixes).
  - nilfs2: add missing check for inode numbers on directory entries
    (stable-fixes).
  - nilfs2: fix inode number range checks (stable-fixes).
  - drm/amdgpu: silence UBSAN warning (stable-fixes).
  - spi: cadence: Ensure data lines set to low during dummy-cycle
    period (stable-fixes).
  - regmap-i2c: Subtract reg size from max_write (stable-fixes).
  - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
    (stable-fixes).
  - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT
    IVW 11.6" tablet (stable-fixes).
  - nfc/nci: Add the inconsistency check between the input data
    length and count (stable-fixes).
  - Input: ff-core - prefer struct_size over open coded arithmetic
    (stable-fixes).
  - cdrom: rearrange last_media_change check to avoid unintentional
    overflow (stable-fixes).
  - serial: imx: Raise TX trigger level to 8 (stable-fixes).
  - usb: xhci: prevent potential failure in handle_tx_event()
    for Transfer events without TRB (stable-fixes).
  - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on
    lvts_data (stable-fixes).
  - firmware: dmi: Stop decoding on broken entry (stable-fixes).
  - i2c: i801: Annotate apanel_addr as __ro_after_init
    (stable-fixes).
  - media: dvb-frontends: tda10048: Fix integer overflow
    (stable-fixes).
  - media: s2255: Use refcount_t instead of atomic_t for
    num_channels (stable-fixes).
  - media: dvb-frontends: tda18271c2dd: Remove casting during div
    (stable-fixes).
  - media: dw2102: fix a potential buffer overflow (git-fixes).
  - media: dw2102: Don't translate i2c read into write
    (stable-fixes).
  - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    (stable-fixes).
  - media: dvb: as102-fe: Fix as10x_register_addr packing
    (stable-fixes).
  - drm/amdgpu: fix the warning about the expression (int)size -
    len (stable-fixes).
  - drm/amdgpu: fix uninitialized scalar variable warning
    (stable-fixes).
  - drm/amd/display: Fix uninitialized variables in DM
    (stable-fixes).
  - drm/amd/display: Skip finding free audio for unknown engine_id
    (stable-fixes).
  - drm/amd/display: Check pipe offset before setting vblank
    (stable-fixes).
  - drm/amd/display: Check index msg_id before read or write
    (stable-fixes).
  - drm/amdgpu: Initialize timestamp for some legacy SOCs
    (stable-fixes).
  - drm/amdgpu: Using uninitialized value *size when calling
    amdgpu_vce_cs_reloc (stable-fixes).
  - drm/amdgpu: Fix uninitialized variable warnings (stable-fixes).
  - drm/lima: fix shared irq handling on driver remove
    (stable-fixes).
  - wifi: mt76: mt7996: add sanity checks for background radar
    trigger (stable-fixes).
  - wifi: mt76: replace skb_put with skb_put_zero (stable-fixes).
  - crypto: aead,cipher - zeroize key buffer after use
    (stable-fixes).
  - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
    (stable-fixes).
  - commit 240e65e

++++ kernel-default:

  - net/smc: avoid data corruption caused by decline (bsc#1225088
    CVE-2023-52775).
  - commit 621e8ca
  - net: openvswitch: fix overwriting ct original tuple for  ICMPv6
    (bsc#1226783 CVE-2024-38558).
  - commit 748cf39
  - ipv6: sr: fix missing sk_buff release in seg6_input_core
    (bsc#1227626 CVE-2024-39490).
  - commit 3d59f52
  - mptcp: fix data re-injection from stale subflow (bsc#1223010
    CVE-2024-26826).
  - commit f3a102e
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    (bsc#1220942 CVE-2024-26615).
  - commit f21afb0
  - kabi/severities: cover all ath/* drivers (bsc#1227149)
    All symbols in ath/* network drivers are local and can be ignored
  - commit d902566
  - Refresh kabi workaround ath updates (bsc#1227149#)
  - commit b0fa38b
  - wifi: mac80211: simplify non-chanctx drivers (bsc#1227149).
  - commit eeb4722
  - wifi: ath11k: move power type check to ASSOC stage when
    connecting to 6 GHz AP (bsc#1227149).
  - wifi: ath11k: fix WCN6750 firmware crash caused by 17 num_vdevs
    (bsc#1227149).
  - wifi: ath12k: fix the problem that down grade phy mode operation
    (bsc#1227149).
  - wifi: ath12k: check M3 buffer size as well whey trying to
    reuse it (bsc#1227149).
  - wifi: ath12k: fix kernel crash during resume (bsc#1227149).
  - wifi: ath9k: work around memset overflow warning (bsc#1227149).
  - wifi: ath12k: use correct flag field for 320 MHz channels
    (bsc#1227149).
  - commit 58db5ff
  - wifi: ath11k: use RCU when accessing struct inet6_dev::ac_list
    (bsc#1227149).
  - wifi: ath12k: fix license in p2p.c and p2p.h (bsc#1227149).
  - wifi: ath11k: constify MHI channel and controller configs
    (bsc#1227149).
  - wifi: ath12k: add rcu lock for ath12k_wmi_p2p_noa_event()
    (bsc#1227149).
  - wifi: ath11k: remove unused scan_events from struct
    scan_req_params (bsc#1227149).
  - wifi: ath11k: add support for QCA2066 (bsc#1227149).
  - wifi: ath11k: move pci.ops registration ahead (bsc#1227149).
  - commit 29f553c
  - wifi: ath11k: provide address list if chip supports 2 stations
    (bsc#1227149).
  - wifi: ath11k: support 2 station interfaces (bsc#1227149).
  - wifi: ath12k: remove the unused scan_events from
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: ath12k: Remove unused scan_flags from struct
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: ath12k: Do not use scan_flags from struct
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: carl9170: Remove redundant assignment to pointer super
    (bsc#1227149).
  - wifi: ath11k: Remove scan_flags union from struct
    scan_req_params (bsc#1227149).
  - wifi: ath11k: Do not directly use scan_flags in struct
    scan_req_params (bsc#1227149).
  - wifi: ath12k: Fix uninitialized use of ret in
    ath12k_mac_allocate() (bsc#1227149).
  - wifi: ath11k: Really consistently use ath11k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath12k: advertise P2P dev support for WCN7850
    (bsc#1227149).
  - wifi: ath12k: designating channel frequency for ROC scan
    (bsc#1227149).
  - wifi: ath12k: move peer delete after vdev stop of station for
    WCN7850 (bsc#1227149).
  - wifi: ath12k: allow specific mgmt frame tx while vdev is not up
    (bsc#1227149).
  - wifi: ath12k: change WLAN_SCAN_PARAMS_MAX_IE_LEN from 256 to
    512 (bsc#1227149).
  - wifi: ath12k: implement remain on channel for P2P mode
    (bsc#1227149).
  - wifi: ath12k: implement handling of P2P NoA event (bsc#1227149).
  - wifi: ath12k: add P2P IE in beacon template (bsc#1227149).
  - wifi: ath12k: change interface combination for P2P mode
    (bsc#1227149).
  - wifi: ath12k: fix broken structure wmi_vdev_create_cmd
    (bsc#1227149).
  - commit 21d36c7
  - wifi: ath11k: initialize eirp_power before use (bsc#1227149).
  - wifi: ath12k: enable 802.11 power save mode in station mode
    (bsc#1227149).
  - wifi: ath12k: refactor the rfkill worker (bsc#1227149).
  - wifi: ath12k: add processing for TWT disable event
    (bsc#1227149).
  - wifi: ath12k: add processing for TWT enable event (bsc#1227149).
  - wifi: ath12k: disable QMI PHY capability learn in split-phy
    QCN9274 (bsc#1227149).
  - wifi: ath12k: Read board id to support split-PHY QCN9274
    (bsc#1227149).
  - wifi: ath12k: fix PCI read and write (bsc#1227149).
  - wifi: ath12k: add MAC id support in WBM error path
    (bsc#1227149).
  - wifi: ath12k: subscribe required word mask from rx tlv
    (bsc#1227149).
  - commit c884365
  - wifi: ath12k: remove hal_desc_sz from hw params (bsc#1227149).
  - wifi: ath12k: split hal_ops to support RX TLVs word mask
    compaction (bsc#1227149).
  - wifi: ath12k: fix firmware assert during insmod in memory
    segment mode (bsc#1227149).
  - wifi: ath12k: Add logic to write QRTR node id to scratch
    (bsc#1227149).
  - wifi: ath12k: fix fetching MCBC flag for QCN9274 (bsc#1227149).
  - wifi: ath12k: add support for peer meta data version
    (bsc#1227149).
  - wifi: ath12k: fetch correct pdev id from
    WMI_SERVICE_READY_EXT_EVENTID (bsc#1227149).
  - wifi: ath12k: indicate NON MBSSID vdev by default during vdev
    start (bsc#1227149).
  - wifi: ath12k: add firmware-2.bin support (bsc#1227149).
  - wifi: ath9k:  remove redundant assignment to variable ret
    (bsc#1227149).
  - commit 777dc1c
  - wifi: ath11k: fix connection failure due to unexpected peer
    delete (bsc#1227149).
  - wifi: ath11k: avoid forward declaration of
    ath11k_mac_start_vdev_delay() (bsc#1227149).
  - wifi: ath11k: rename ath11k_start_vdev_delay() (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wcn36xx (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for ar5523 (bsc#1227149).
  - commit d2a4b44
  - wifi: ath11k: remove invalid peer create logic (bsc#1227149).
  - wifi: ath11k: enable 36 bit mask for stream DMA (bsc#1227149).
  - wifi: ath10k: Fix enum ath10k_fw_crash_dump_type kernel-doc
    (bsc#1227149).
  - wifi: ath10k: Fix htt_data_tx_completion kernel-doc warning
    (bsc#1227149).
  - wifi: ath10k: fix htt_q_state_conf & htt_q_state kernel-doc
    (bsc#1227149).
  - wifi: ath10k: correctly document enum wmi_tlv_tx_pause_id
    (bsc#1227149).
  - wifi: ath10k: add missing wmi_10_4_feature_mask documentation
    (bsc#1227149).
  - wifi: ath12k: add support for collecting firmware log
    (bsc#1227149).
  - wifi: ath12k: Introduce the container for mac80211 hw
    (bsc#1227149).
  - wifi: ath12k: Refactor the mac80211 hw access from link/radio
    (bsc#1227149).
  - commit 614fabb
  - iommu/vt-d: Improve ITE fault handling if target device isn't
    present (git-fixes).
  - commit 134a3a5
  - wifi: ath12k: change MAC buffer ring size to 2048 (bsc#1227149).
  - wifi: ath12k: add support for BA1024 (bsc#1227149).
  - wifi: ath12k: fix wrong definitions of hal_reo_update_rx_queue
    (bsc#1227149).
  - wifi: ath10k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath11k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath12k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath12k: add QMI PHY capability learn support
    (bsc#1227149).
  - wifi: ath12k: refactor QMI MLO host capability helper function
    (bsc#1227149).
  - wifi: ath11k: document HAL_RX_BUF_RBM_SW4_BM (bsc#1227149).
  - wifi: ath12k: ath12k_start_vdev_delay(): convert to use ar
    (bsc#1227149).
  - commit dd312dc
  - wifi: ath12k: refactor ath12k_mac_op_flush() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_ampdu_action()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_configure_filter()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_update_vif_offload()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_stop() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_start() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_conf_tx() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_bss_assoc() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_config() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_register() and
    ath12k_mac_unregister() (bsc#1227149).
  - commit b6ca728
  - wifi: ath12k: refactor ath12k_mac_setup_channels_rates()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_allocate() and
    ath12k_mac_destroy() (bsc#1227149).
  - wifi: ath12k: relocate ath12k_dp_pdev_pre_alloc() call
    (bsc#1227149).
  - wifi: ath12k: Use initializers for QMI message buffers
    (bsc#1227149).
  - wifi: ath12k: Add missing qmi_txn_cancel() calls (bsc#1227149).
  - wifi: ath12k: Remove unnecessary struct qmi_txn initializers
    (bsc#1227149).
  - wifi: ath11k: use WMI_VDEV_SET_TPC_POWER_CMDID when
    EXT_TPC_REG_SUPPORT for 6 GHz (bsc#1227149).
  - wifi: ath11k: add handler for WMI_VDEV_SET_TPC_POWER_CMDID
    (bsc#1227149).
  - wifi: ath11k: add WMI_TLV_SERVICE_EXT_TPC_REG_SUPPORT service
    bit (bsc#1227149).
  - wifi: ath11k: fill parameters for vdev set tpc power WMI command
    (bsc#1227149).
  - commit 3c338b0
  - wifi: ath11k: save max transmit power in vdev start response
    event from firmware (bsc#1227149).
  - commit 279ae7a
  - wifi: ath11k: add parse of transmit power envelope element
    (bsc#1227149).
  - commit e295f89
  - wifi: ath11k: save power spectral density(PSD) of regulatory
    rule (bsc#1227149).
  - wifi: ath11k: update regulatory rules when connect to AP on
    6 GHz band for station (bsc#1227149).
  - wifi: ath11k: update regulatory rules when interface added
    (bsc#1227149).
  - wifi: ath11k: fix a possible dead lock caused by ab->base_lock
    (bsc#1227149).
  - wifi: ath11k: store cur_regulatory_info for each radio
    (bsc#1227149).
  - wifi: ath11k: add support to select 6 GHz regulatory type
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_wmi_tlv_parse_alloc()
    (bsc#1227149).
  - wifi: ath11k: fix IOMMU errors on buffer rings (bsc#1227149).
  - commit d84dbd2
  - wifi: ath12k: Make QMI message rules const (bsc#1227149).
  - wifi: ath12k: support default regdb while searching board-2.bin
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: add support to search regdb data in board-2.bin
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: remove unused ATH12K_BD_IE_BOARD_EXT
    (bsc#1227149).
  - wifi: ath12k: add fallback board name without variant while
    searching board-2.bin (bsc#1227149).
  - wifi: ath12k: add string type to search board data in
    board-2.bin for WCN7850 (bsc#1227149).
  - wifi: ath10k: remove duplicate memset() in 10.4 TDLS peer update
    (bsc#1227149).
  - wifi: ath10k: use flexible array in struct
    wmi_tdls_peer_capabilities (bsc#1227149).
  - wifi: ath10k: remove unused template structs (bsc#1227149).
  - wifi: ath10k: remove struct wmi_pdev_chanlist_update_event
    (bsc#1227149).
  - commit e73f8dc
  - wifi: ath10k: use flexible arrays for WMI start scan TLVs
    (bsc#1227149).
  - wifi: ath10k: use flexible array in struct wmi_host_mem_chunks
    (bsc#1227149).
  - wifi: ath9k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath9k: delete some unused/duplicate macros (bsc#1227149).
  - wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc()
    (bsc#1227149).
  - wifi: ath11k: rely on mac80211 debugfs handling for vif
    (bsc#1227149).
  - wifi: ath11k: workaround too long expansion sparse warnings
    (bsc#1227149).
  - Revert "wifi: ath12k: use ATH12K_PCI_IRQ_DP_OFFSET for DP IRQ"
    (bsc#1227149).
  - wifi: ath9k: reset survey of current channel after a scan
    started (bsc#1227149).
  - wifi: ath12k: fix the issue that the multicast/broadcast
    indicator is not read correctly for WCN7850 (bsc#1227149).
  - commit 6cf204e
  - wifi: ath11k: Fix ath11k_htc_record flexible record
    (bsc#1227149).
  - wifi: ath5k: remove unused ath5k_eeprom_info::ee_antenna
    (bsc#1227149).
  - wifi: ath10k: add support to allow broadcast action frame RX
    (bsc#1227149).
  - wifi: ath12k: avoid repeated wiphy access from hw (bsc#1227149).
  - wifi: ath12k: set IRQ affinity to CPU0 in case of one MSI vector
    (bsc#1227149).
  - wifi: ath12k: do not restore ASPM in case of single MSI vector
    (bsc#1227149).
  - wifi: ath12k: add support one MSI vector (bsc#1227149).
  - wifi: ath12k: refactor multiple MSI vector implementation
    (bsc#1227149).
  - wifi: ath12k: use ATH12K_PCI_IRQ_DP_OFFSET for DP IRQ
    (bsc#1227149).
  - wifi: ath12k: add CE and ext IRQ flag to indicate irq_handler
    (bsc#1227149).
  - commit 908caeb
  - wifi: ath12k: get msi_data again after request_irq is called
    (bsc#1227149).
  - wifi: wcn36xx: Convert to platform remove callback returning
    void (bsc#1227149).
  - wifi: ath5k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath12k: avoid repeated hw access from ar (bsc#1227149).
  - wifi: ath12k: Optimize the mac80211 hw data access
    (bsc#1227149).
  - wifi: ath12k: add 320 MHz bandwidth enums (bsc#1227149).
  - wifi: ath11k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath11k: remove ath11k_htc_record::pauload[] (bsc#1227149).
  - wifi: ath10k: Use DECLARE_FLEX_ARRAY() for ath10k_htc_record
    (bsc#1227149).
  - wifi: ath10k: remove ath10k_htc_record::pauload[] (bsc#1227149).
  - commit 67bc0a7
  - wifi: ath10k: Update Qualcomm Innovation Center, Inc. copyrights
    (bsc#1227149).
  - commit e13fd24
  - wifi: ath11k: Update Qualcomm Innovation Center, Inc. copyrights
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-do-not-dump-SRNG-statistics-during-resum.patch.
  - Refresh
    patches.suse/wifi-ath11k-fix-warning-on-DMA-ring-capabilities-eve.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - Refresh
    patches.suse/wifi-ath11k-thermal-don-t-try-to-register-multiple-t.patch.
  - commit a886227
  - wifi: ath9k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath12k: refactor DP Rxdma ring structure (bsc#1227149).
  - wifi: ath12k: avoid explicit HW conversion argument in Rxdma
    replenish (bsc#1227149).
  - wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish
    (bsc#1227149).
  - wifi: ath12k: avoid explicit mac id argument in Rxdma replenish
    (bsc#1227149).
  - wifi: ath12k: fix the error handler of rfkill config
    (bsc#1227149).
  - wifi: ath12k: use select for CRYPTO_MICHAEL_MIC (bsc#1227149).
  - wifi: ath11k: use select for CRYPTO_MICHAEL_MIC (bsc#1227149).
  - commit a869013
  - wifi: ath12k: Consolidate WMI peer flags (bsc#1227149).
  - wifi: ath11k: Consolidate WMI peer flags (bsc#1227149).
  - wifi: ath12k: Remove obsolete struct wmi_peer_flags_map
    * peer_flags (bsc#1227149).
  - wifi: ath11k: Remove obsolete struct wmi_peer_flags_map
    * peer_flags (bsc#1227149).
  - wifi: ath12k: Remove struct ath12k::ops (bsc#1227149).
  - wifi: ath11k: Remove struct ath11k::ops (bsc#1227149).
  - wifi: ath10k: Remove unused struct ath10k_htc_frame
    (bsc#1227149).
  - wifi: ath10k: simplify __ath10k_htt_tx_txq_recalc()
    (bsc#1227149).
  - wifi: ath11k: Remove unneeded semicolon (bsc#1227149).
  - wifi: ath10k: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - commit e59240f
  - wifi: ath12k: drop NULL pointer check in
    ath12k_update_per_peer_tx_stats() (bsc#1227149).
  - Revert "wifi: ath11k: call ath11k_mac_fils_discovery() without
    condition" (bsc#1227149).
  - wifi: ath12k: Introduce and use ath12k_sta_to_arsta()
    (bsc#1227149).
  - wifi: ath12k: rename the sc naming convention to ab
    (bsc#1227149).
  - wifi: ath12k: rename the wmi_sc naming convention to wmi_ab
    (bsc#1227149).
  - commit f93677e
  - bus: mhi: host: allow MHI client drivers to provide the firmware
    via a pointer (bsc#1227149).
  - commit 494649c
  - wifi: ath11k: add firmware-2.bin support (bsc#1227149).
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit 677d325
  - wifi: ath11k: qmi: refactor ath11k_qmi_m3_load() (bsc#1227149).
  - commit 296ac8f
  - wifi: ath11k: rename the sc naming convention to ab
    (bsc#1227149).
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - Refresh
    patches.suse/wifi-ath11k-thermal-don-t-try-to-register-multiple-t.patch.
  - commit 6eedd0d
  - wifi: ath11k: rename the wmi_sc naming convention to wmi_ab
    (bsc#1227149).
  - wifi: ath6kl: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - commit cd59b03
  - wifi: ath5k: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: ath12k: Remove ath12k_base::bd_api (bsc#1227149).
  - wifi: ath11k: Remove ath11k_base::bd_api (bsc#1227149).
  - wifi: ath12k: Enable Mesh support for QCN9274 (bsc#1227149).
  - wifi: ath12k: register EHT mesh capabilities (bsc#1227149).
  - wifi: ath11k: Use device_get_match_data() (bsc#1227149).
  - wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
    (bsc#1227149).
  - wifi: ath11k: Remove unused struct ath11k_htc_frame
    (bsc#1227149).
  - wifi: ath12k: fix invalid m3 buffer address (bsc#1227149).
  - wifi: ath12k: add ath12k_qmi_free_resource() for recovery
    (bsc#1227149).
  - commit a18a8d4
  - wifi: ath12k: configure RDDM size to MHI for device recovery
    (bsc#1227149).
  - wifi: ath12k: add parsing of phy bitmap for reg rules
    (bsc#1227149).
  - wifi: ath11k: add parsing of phy bitmap for reg rules
    (bsc#1227149).
  - wifi: ath11k: ath11k_debugfs_register(): fix format-truncation
    warning (bsc#1227149).
  - wifi: ath12k: Consistently use ath12k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath11k: call ath11k_mac_fils_discovery() without condition
    (bsc#1227149).
  - wifi: ath12k: remove redundant memset() in
    ath12k_hal_reo_qdesc_setup() (bsc#1227149).
  - wifi: ath9k_htc: fix format-truncation warning (bsc#1227149).
  - wifi: ath12k: fix debug messages (bsc#1227149).
  - wifi: ath11k: fix CAC running state during virtual interface
    start (bsc#1227149).
  - commit c2f2e92
  - wifi: ath10k: simplify ath10k_peer_create() (bsc#1227149).
  - wifi: ath10k: indicate to mac80211 scan complete with aborted
    flag for ATH10K_SCAN_STARTING state (bsc#1227149).
  - wifi: ath: dfs_pattern_detector: Use flex array to simplify code
    (bsc#1227149).
  - wifi: carl9170: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath10k: consistently use kstrtoX_from_user() functions
    (bsc#1227149).
  - wifi: ath12k: add keep backward compatibility of PHY mode to
    avoid firmware crash (bsc#1227149).
  - wifi: ath12k: add read variant from SMBIOS for download board
    data (bsc#1227149).
  - wifi: ath12k: do not drop data frames from unassociated stations
    (bsc#1227149).
  - wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data
    handling (bsc#1227149).
  - wifi: ath11k: fix ath11k_mac_op_remain_on_channel() stack usage
    (bsc#1227149).
  - commit b844022
  - wifi: ath12k: add msdu_end structure for WCN7850 (bsc#1227149).
  - wifi: ath12k: Set default beacon mode to burst mode
    (bsc#1227149).
  - wifi: ath12k: call ath12k_mac_fils_discovery() without condition
    (bsc#1227149).
  - wifi: ath11k: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath12k: enable IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: change to treat alpha code na as world wide
    regdomain (bsc#1227149).
  - wifi: ath12k: indicate scan complete for scan canceled when
    scan running (bsc#1227149).
  - wifi: ath12k: indicate to mac80211 scan complete with aborted
    flag for ATH12K_SCAN_STARTING state (bsc#1227149).
  - wifi: ath12k: fix recovery fail while firmware crash when
    doing channel switch (bsc#1227149).
  - wifi: ath12k: add support for hardware rfkill for WCN7850
    (bsc#1227149).
  - commit 087627b
  - wifi: ath11k: use kstrtoul_from_user() where appropriate
    (bsc#1227149).
  - wifi: ath11k: remove unused members of 'struct ath11k_base'
    (bsc#1227149).
  - wifi: ath11k: drop redundant check in
    ath11k_dp_rx_mon_dest_process() (bsc#1227149).
  - wifi: ath11k: drop NULL pointer check in
    ath11k_update_per_peer_tx_stats() (bsc#1227149).
  - wifi: ath10k: drop HTT_DATA_TX_STATUS_DOWNLOAD_FAIL
    (bsc#1227149).
  - wifi: ath10k: Annotate struct ath10k_ce_ring with __counted_by
    (bsc#1227149).
  - wifi: wcn36xx: Annotate struct wcn36xx_hal_ind_msg with
    __counted_by (bsc#1227149).
  - wifi: ath12k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath10k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath6kl: remove unnecessary (void*) conversions
    (bsc#1227149).
  - commit 3f20dbc
  - wifi: ath5k: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: wcn36xx: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ar5523: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath9k: clean up function ath9k_hif_usb_resume
    (bsc#1227149).
  - wifi: ath11k: add chip id board name while searching board-2.bin
    for WCN6855 (bsc#1227149).
  - wifi: ath12k: change to initialize recovery variables earlier
    in ath12k_core_reset() (bsc#1227149).
  - wifi: ath12k: enable 320 MHz bandwidth for 6 GHz band in EHT
    PHY capability for WCN7850 (bsc#1227149).
  - wifi: ath9k: use u32 for txgain indexes (bsc#1227149).
  - wifi: ath9k: simplify ar9003_hw_process_ini() (bsc#1227149).
  - wifi: ath12k: fix radar detection in 160 MHz (bsc#1227149).
  - commit 0b35606
  - wifi: ath12k: fix WARN_ON during ath12k_mac_update_vif_chan
    (bsc#1227149).
  - wifi: ath11k: fix tid bitmap is 0 in peer rx mu stats
    (bsc#1227149).
  - wifi: ath11k: move references from rsvd2 to info fields
    (bsc#1227149).
  - wifi: ath11k: mhi: add a warning message for MHI_CB_EE_RDDM
    crash (bsc#1227149).
  - wifi: ath: Use is_multicast_ether_addr() to check multicast
    Ether address (bsc#1227149).
  - wifi: ath12k: Remove unused declarations (bsc#1227149).
  - wifi: ath5k: ath5k_hw_get_median_noise_floor(): use swap()
    (bsc#1227149).
  - wifi: ath: remove unused-but-set parameter (bsc#1227149).
  - wifi: ath11k: Remove unused declarations (bsc#1227149).
  - wifi: ath10k: fix Wvoid-pointer-to-enum-cast warning
    (bsc#1227149).
  - commit 1f3c3b8
  - wifi: ath11k: fix Wvoid-pointer-to-enum-cast warning
    (bsc#1227149).
  - wifi: ath11k: simplify the code with module_platform_driver
    (bsc#1227149).
  - wifi: ath12k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath11k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath10k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath11k: Consistently use ath11k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath9k: Remove unused declarations (bsc#1227149).
  - wifi: ath9k: Remove unnecessary ternary operators (bsc#1227149).
  - wifi: ath9k: consistently use kstrtoX_from_user() functions
    (bsc#1227149).
  - wifi: ath9k: fix parameter check in ath9k_init_debug()
    (bsc#1227149).
  - commit 6c737fb
  - wifi: ath5k: Remove redundant dev_err() (bsc#1227149).
  - wifi: ath12k: avoid deadlock by change ieee80211_queue_work
    for regd_update_work (bsc#1227149).
  - wifi: ath12k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
    (bsc#1227149).
  - wifi: ath12k: relax list iteration in ath12k_mac_vif_unref()
    (bsc#1227149).
  - wifi: ath12k: configure puncturing bitmap (bsc#1227149).
  - wifi: ath12k: parse WMI service ready ext2 event (bsc#1227149).
  - wifi: ath12k: add MLO header in peer association (bsc#1227149).
  - wifi: ath12k: peer assoc for 320 MHz (bsc#1227149).
  - wifi: ath12k: add WMI support for EHT peer (bsc#1227149).
  - wifi: ath12k: prepare EHT peer assoc parameters (bsc#1227149).
  - commit 3191784
  - wifi: ath12k: add EHT PHY modes (bsc#1227149).
  - wifi: ath12k: propagate EHT capabilities to userspace
    (bsc#1227149).
  - wifi: ath12k: WMI support to process EHT capabilities
    (bsc#1227149).
  - wifi: ath12k: move HE capabilities processing to a new function
    (bsc#1227149).
  - commit 7fb64df
  - wifi: ath12k: rename HE capabilities setup/copy functions
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-annotate-iftype_data-pointer-with-spar.patch.
  - commit ddfeb0d
  - wifi: ath12k: change to use dynamic memory for channel list
    of scan (bsc#1227149).
  - wifi: ath12k: trigger station disconnect on hardware restart
    (bsc#1227149).
  - wifi: ath12k: Use pdev_id rather than mac_id to get pdev
    (bsc#1227149).
  - wifi: ath12k: correct the data_type from QMI_OPT_FLAG to
    QMI_UNSIGNED_1_BYTE for mlo_capable (bsc#1227149).
  - wifi: ath11k: Remove cal_done check during probe (bsc#1227149).
  - commit e204950
  - wifi: ath11k: simplify
    ath11k_mac_validate_vht_he_fixed_rate_settings() (bsc#1227149).
  - wifi: ath6kl: Remove error checking for debugfs_create_dir()
    (bsc#1227149).
  - wifi: ath5k: remove phydir check from ath5k_debug_init_device()
    (bsc#1227149).
  - wifi: drivers: Explicitly include correct DT includes
    (bsc#1227149).
  - wifi: ath10k: improve structure padding (bsc#1227149).
  - wifi: ath12k: fix conf_mutex in
    ath12k_mac_op_unassign_vif_chanctx() (bsc#1227149).
  - wifi: ath11k: debug: add ATH11K_DBG_CE (bsc#1227149).
  - commit 3345b7e
  - wifi: ath11k: htc: cleanup debug messages (bsc#1227149).
  - wifi: ath11k: don't use %pK (bsc#1227149).
  - wifi: ath11k: hal: cleanup debug message (bsc#1227149).
  - wifi: ath11k: debug: use all upper case in ATH11k_DBG_HAL
    (bsc#1227149).
  - wifi: ath11k: dp: cleanup debug message (bsc#1227149).
  - wifi: ath11k: pci: cleanup debug logging (bsc#1227149).
  - wifi: ath11k: wmi: add unified command debug messages
    (bsc#1227149).
  - wifi: ath11k: wmi: use common error handling style
    (bsc#1227149).
  - wifi: ath11k: wmi: cleanup error handling in
    ath11k_wmi_send_init_country_cmd() (bsc#1227149).
  - wifi: ath11k: remove unsupported event handlers (bsc#1227149).
  - commit 37105bd
  - wifi: ath11k: add WMI event debug messages (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch.
  - Refresh
    patches.suse/wifi-ath11k-fix-temperature-event-locking.patch.
  - commit 572fd2c
  - wifi: ath11k: remove manual mask names from debug messages
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch.
  - commit a7ae7bf
  - wifi: ath11k: print debug level in debug messages (bsc#1227149).
  - wifi: ath11k: debug: remove unused ATH11K_DBG_ANY (bsc#1227149).
  - wifi: ath12k: delete the timer rx_replenish_retry during rmmod
    (bsc#1227149).
  - wifi: ath12k: Use msdu_end to check MCBC (bsc#1227149).
  - wifi: ath12k: check hardware major version for WCN7850
    (bsc#1227149).
  - wifi: ath11k: update proper pdev/vdev id for testmode command
    (bsc#1227149).
  - wifi: atk10k: Don't opencode ath10k_pci_priv() in
    ath10k_ahb_priv() (bsc#1227149).
  - wifi: ath10k: Convert to platform remove callback returning void
    (bsc#1227149).
  - commit cafd8ed
  - wifi: ath10k: Drop checks that are always false (bsc#1227149).
  - wifi: ath10k: Drop cleaning of driver data from probe error
    path and remove (bsc#1227149).
  - wifi: ath11k: Add HTT stats for PHY reset case (bsc#1227149).
  - commit dde2040
  - wifi: ath11k: Allow ath11k to boot without caldata in ftm mode
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-do-not-dump-SRNG-statistics-during-resum.patch.
  - commit adbddfc
  - wifi: ath11k: factory test mode support (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-warning-on-DMA-ring-capabilities-eve.patch.
  - Refresh
    patches.suse/wifi-ath11k-rearrange-IRQ-enable-disable-in-reset-pa.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit 030f59a
  - wifi: ath11k: remove unused function ath11k_tm_event_wmi()
    (bsc#1227149).
  - wifi: ath12k: Add support to parse new WMI event for 6 GHz
    regulatory (bsc#1227149).
  - wifi: wil6210: wmi: Replace zero-length array with
    DECLARE_FLEX_ARRAY() helper (bsc#1227149).
  - wifi: wil6210: fw: Replace zero-length arrays with
    DECLARE_FLEX_ARRAY() helper (bsc#1227149).
  - wifi: ath11k: Send HT fixed rate in WMI peer fixed param
    (bsc#1227149).
  - wifi: ath11k: Relocate the func
    ath11k_mac_bitrate_mask_num_ht_rates() and change hweight16
    to hweight8 (bsc#1227149).
  - wifi: ath12k: increase vdev setup timeout (bsc#1227149).
  - wifi: ath11k: EMA beacon support (bsc#1227149).
  - wifi: ath11k: MBSSID beacon support (bsc#1227149).
  - wifi: ath11k: refactor vif parameter configurations
    (bsc#1227149).
  - wifi: ath11k: MBSSID parameter configuration in AP mode
    (bsc#1227149).
  - wifi: ath11k: rename MBSSID fields in wmi_vdev_up_cmd
    (bsc#1227149).
  - wifi: ath11k: MBSSID configuration during vdev create/start
    (bsc#1227149).
  - wifi: ath11k: driver settings for MBSSID and EMA (bsc#1227149).
  - wifi: ath: work around false-positive stringop-overread warning
    (bsc#1227149).
  - wifi: ath11k: Use list_count_nodes() (bsc#1227149).
  - wifi: ath10k: Use list_count_nodes() (bsc#1227149).
  - wifi: ath12k: fix potential wmi_mgmt_tx_queue race condition
    (bsc#1227149).
  - wifi: ath12k: add wait operation for tx management packets
    for flush from mac80211 (bsc#1227149).
  - wifi: ath12k: Remove some dead code (bsc#1227149).
  - wifi: ath12k: send WMI_PEER_REORDER_QUEUE_SETUP_CMDID when
    ADDBA session starts (bsc#1227149).
  - wifi: ath12k: set PERST pin no pull request for WCN7850
    (bsc#1227149).
  - wifi: ath12k: add qmi_cnss_feature_bitmap field to hardware
    parameters (bsc#1227149).
  - wifi: ath10/11/12k: Use alloc_ordered_workqueue() to create
    ordered workqueues (bsc#1227149).
  - commit 1763ceb
  - net: phy: microchip: lan87xx: reinit PHY after cable test
    (git-fixes).
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync()
    call in isr (git-fixes).
  - drm/amdgpu/atomfirmware: silence UBSAN warning (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Valve Galileo
    (stable-fixes).
  - nilfs2: add missing check for inode numbers on directory entries
    (stable-fixes).
  - nilfs2: fix inode number range checks (stable-fixes).
  - drm/amdgpu: silence UBSAN warning (stable-fixes).
  - spi: cadence: Ensure data lines set to low during dummy-cycle
    period (stable-fixes).
  - regmap-i2c: Subtract reg size from max_write (stable-fixes).
  - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
    (stable-fixes).
  - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT
    IVW 11.6" tablet (stable-fixes).
  - nfc/nci: Add the inconsistency check between the input data
    length and count (stable-fixes).
  - Input: ff-core - prefer struct_size over open coded arithmetic
    (stable-fixes).
  - cdrom: rearrange last_media_change check to avoid unintentional
    overflow (stable-fixes).
  - serial: imx: Raise TX trigger level to 8 (stable-fixes).
  - usb: xhci: prevent potential failure in handle_tx_event()
    for Transfer events without TRB (stable-fixes).
  - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on
    lvts_data (stable-fixes).
  - firmware: dmi: Stop decoding on broken entry (stable-fixes).
  - i2c: i801: Annotate apanel_addr as __ro_after_init
    (stable-fixes).
  - media: dvb-frontends: tda10048: Fix integer overflow
    (stable-fixes).
  - media: s2255: Use refcount_t instead of atomic_t for
    num_channels (stable-fixes).
  - media: dvb-frontends: tda18271c2dd: Remove casting during div
    (stable-fixes).
  - media: dw2102: fix a potential buffer overflow (git-fixes).
  - media: dw2102: Don't translate i2c read into write
    (stable-fixes).
  - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    (stable-fixes).
  - media: dvb: as102-fe: Fix as10x_register_addr packing
    (stable-fixes).
  - drm/amdgpu: fix the warning about the expression (int)size -
    len (stable-fixes).
  - drm/amdgpu: fix uninitialized scalar variable warning
    (stable-fixes).
  - drm/amd/display: Fix uninitialized variables in DM
    (stable-fixes).
  - drm/amd/display: Skip finding free audio for unknown engine_id
    (stable-fixes).
  - drm/amd/display: Check pipe offset before setting vblank
    (stable-fixes).
  - drm/amd/display: Check index msg_id before read or write
    (stable-fixes).
  - drm/amdgpu: Initialize timestamp for some legacy SOCs
    (stable-fixes).
  - drm/amdgpu: Using uninitialized value *size when calling
    amdgpu_vce_cs_reloc (stable-fixes).
  - drm/amdgpu: Fix uninitialized variable warnings (stable-fixes).
  - drm/lima: fix shared irq handling on driver remove
    (stable-fixes).
  - wifi: mt76: mt7996: add sanity checks for background radar
    trigger (stable-fixes).
  - wifi: mt76: replace skb_put with skb_put_zero (stable-fixes).
  - crypto: aead,cipher - zeroize key buffer after use
    (stable-fixes).
  - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
    (stable-fixes).
  - commit 240e65e

++++ kernel-default:

  - net/smc: avoid data corruption caused by decline (bsc#1225088
    CVE-2023-52775).
  - commit 621e8ca
  - net: openvswitch: fix overwriting ct original tuple for  ICMPv6
    (bsc#1226783 CVE-2024-38558).
  - commit 748cf39
  - ipv6: sr: fix missing sk_buff release in seg6_input_core
    (bsc#1227626 CVE-2024-39490).
  - commit 3d59f52
  - mptcp: fix data re-injection from stale subflow (bsc#1223010
    CVE-2024-26826).
  - commit f3a102e
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    (bsc#1220942 CVE-2024-26615).
  - commit f21afb0
  - kabi/severities: cover all ath/* drivers (bsc#1227149)
    All symbols in ath/* network drivers are local and can be ignored
  - commit d902566
  - Refresh kabi workaround ath updates (bsc#1227149#)
  - commit b0fa38b
  - wifi: mac80211: simplify non-chanctx drivers (bsc#1227149).
  - commit eeb4722
  - wifi: ath11k: move power type check to ASSOC stage when
    connecting to 6 GHz AP (bsc#1227149).
  - wifi: ath11k: fix WCN6750 firmware crash caused by 17 num_vdevs
    (bsc#1227149).
  - wifi: ath12k: fix the problem that down grade phy mode operation
    (bsc#1227149).
  - wifi: ath12k: check M3 buffer size as well whey trying to
    reuse it (bsc#1227149).
  - wifi: ath12k: fix kernel crash during resume (bsc#1227149).
  - wifi: ath9k: work around memset overflow warning (bsc#1227149).
  - wifi: ath12k: use correct flag field for 320 MHz channels
    (bsc#1227149).
  - commit 58db5ff
  - wifi: ath11k: use RCU when accessing struct inet6_dev::ac_list
    (bsc#1227149).
  - wifi: ath12k: fix license in p2p.c and p2p.h (bsc#1227149).
  - wifi: ath11k: constify MHI channel and controller configs
    (bsc#1227149).
  - wifi: ath12k: add rcu lock for ath12k_wmi_p2p_noa_event()
    (bsc#1227149).
  - wifi: ath11k: remove unused scan_events from struct
    scan_req_params (bsc#1227149).
  - wifi: ath11k: add support for QCA2066 (bsc#1227149).
  - wifi: ath11k: move pci.ops registration ahead (bsc#1227149).
  - commit 29f553c
  - wifi: ath11k: provide address list if chip supports 2 stations
    (bsc#1227149).
  - wifi: ath11k: support 2 station interfaces (bsc#1227149).
  - wifi: ath12k: remove the unused scan_events from
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: ath12k: Remove unused scan_flags from struct
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: ath12k: Do not use scan_flags from struct
    ath12k_wmi_scan_req_arg (bsc#1227149).
  - wifi: carl9170: Remove redundant assignment to pointer super
    (bsc#1227149).
  - wifi: ath11k: Remove scan_flags union from struct
    scan_req_params (bsc#1227149).
  - wifi: ath11k: Do not directly use scan_flags in struct
    scan_req_params (bsc#1227149).
  - wifi: ath12k: Fix uninitialized use of ret in
    ath12k_mac_allocate() (bsc#1227149).
  - wifi: ath11k: Really consistently use ath11k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath12k: advertise P2P dev support for WCN7850
    (bsc#1227149).
  - wifi: ath12k: designating channel frequency for ROC scan
    (bsc#1227149).
  - wifi: ath12k: move peer delete after vdev stop of station for
    WCN7850 (bsc#1227149).
  - wifi: ath12k: allow specific mgmt frame tx while vdev is not up
    (bsc#1227149).
  - wifi: ath12k: change WLAN_SCAN_PARAMS_MAX_IE_LEN from 256 to
    512 (bsc#1227149).
  - wifi: ath12k: implement remain on channel for P2P mode
    (bsc#1227149).
  - wifi: ath12k: implement handling of P2P NoA event (bsc#1227149).
  - wifi: ath12k: add P2P IE in beacon template (bsc#1227149).
  - wifi: ath12k: change interface combination for P2P mode
    (bsc#1227149).
  - wifi: ath12k: fix broken structure wmi_vdev_create_cmd
    (bsc#1227149).
  - commit 21d36c7
  - wifi: ath11k: initialize eirp_power before use (bsc#1227149).
  - wifi: ath12k: enable 802.11 power save mode in station mode
    (bsc#1227149).
  - wifi: ath12k: refactor the rfkill worker (bsc#1227149).
  - wifi: ath12k: add processing for TWT disable event
    (bsc#1227149).
  - wifi: ath12k: add processing for TWT enable event (bsc#1227149).
  - wifi: ath12k: disable QMI PHY capability learn in split-phy
    QCN9274 (bsc#1227149).
  - wifi: ath12k: Read board id to support split-PHY QCN9274
    (bsc#1227149).
  - wifi: ath12k: fix PCI read and write (bsc#1227149).
  - wifi: ath12k: add MAC id support in WBM error path
    (bsc#1227149).
  - wifi: ath12k: subscribe required word mask from rx tlv
    (bsc#1227149).
  - commit c884365
  - wifi: ath12k: remove hal_desc_sz from hw params (bsc#1227149).
  - wifi: ath12k: split hal_ops to support RX TLVs word mask
    compaction (bsc#1227149).
  - wifi: ath12k: fix firmware assert during insmod in memory
    segment mode (bsc#1227149).
  - wifi: ath12k: Add logic to write QRTR node id to scratch
    (bsc#1227149).
  - wifi: ath12k: fix fetching MCBC flag for QCN9274 (bsc#1227149).
  - wifi: ath12k: add support for peer meta data version
    (bsc#1227149).
  - wifi: ath12k: fetch correct pdev id from
    WMI_SERVICE_READY_EXT_EVENTID (bsc#1227149).
  - wifi: ath12k: indicate NON MBSSID vdev by default during vdev
    start (bsc#1227149).
  - wifi: ath12k: add firmware-2.bin support (bsc#1227149).
  - wifi: ath9k:  remove redundant assignment to variable ret
    (bsc#1227149).
  - commit 777dc1c
  - wifi: ath11k: fix connection failure due to unexpected peer
    delete (bsc#1227149).
  - wifi: ath11k: avoid forward declaration of
    ath11k_mac_start_vdev_delay() (bsc#1227149).
  - wifi: ath11k: rename ath11k_start_vdev_delay() (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for wcn36xx (bsc#1227149).
  - wifi: fill in MODULE_DESCRIPTION()s for ar5523 (bsc#1227149).
  - commit d2a4b44
  - wifi: ath11k: remove invalid peer create logic (bsc#1227149).
  - wifi: ath11k: enable 36 bit mask for stream DMA (bsc#1227149).
  - wifi: ath10k: Fix enum ath10k_fw_crash_dump_type kernel-doc
    (bsc#1227149).
  - wifi: ath10k: Fix htt_data_tx_completion kernel-doc warning
    (bsc#1227149).
  - wifi: ath10k: fix htt_q_state_conf & htt_q_state kernel-doc
    (bsc#1227149).
  - wifi: ath10k: correctly document enum wmi_tlv_tx_pause_id
    (bsc#1227149).
  - wifi: ath10k: add missing wmi_10_4_feature_mask documentation
    (bsc#1227149).
  - wifi: ath12k: add support for collecting firmware log
    (bsc#1227149).
  - wifi: ath12k: Introduce the container for mac80211 hw
    (bsc#1227149).
  - wifi: ath12k: Refactor the mac80211 hw access from link/radio
    (bsc#1227149).
  - commit 614fabb
  - iommu/vt-d: Improve ITE fault handling if target device isn't
    present (git-fixes).
  - commit 134a3a5
  - wifi: ath12k: change MAC buffer ring size to 2048 (bsc#1227149).
  - wifi: ath12k: add support for BA1024 (bsc#1227149).
  - wifi: ath12k: fix wrong definitions of hal_reo_update_rx_queue
    (bsc#1227149).
  - wifi: ath10k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath11k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath12k: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: ath12k: add QMI PHY capability learn support
    (bsc#1227149).
  - wifi: ath12k: refactor QMI MLO host capability helper function
    (bsc#1227149).
  - wifi: ath11k: document HAL_RX_BUF_RBM_SW4_BM (bsc#1227149).
  - wifi: ath12k: ath12k_start_vdev_delay(): convert to use ar
    (bsc#1227149).
  - commit dd312dc
  - wifi: ath12k: refactor ath12k_mac_op_flush() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_ampdu_action()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_configure_filter()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_update_vif_offload()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_stop() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_start() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_conf_tx() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_bss_assoc() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_op_config() (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_register() and
    ath12k_mac_unregister() (bsc#1227149).
  - commit b6ca728
  - wifi: ath12k: refactor ath12k_mac_setup_channels_rates()
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_mac_allocate() and
    ath12k_mac_destroy() (bsc#1227149).
  - wifi: ath12k: relocate ath12k_dp_pdev_pre_alloc() call
    (bsc#1227149).
  - wifi: ath12k: Use initializers for QMI message buffers
    (bsc#1227149).
  - wifi: ath12k: Add missing qmi_txn_cancel() calls (bsc#1227149).
  - wifi: ath12k: Remove unnecessary struct qmi_txn initializers
    (bsc#1227149).
  - wifi: ath11k: use WMI_VDEV_SET_TPC_POWER_CMDID when
    EXT_TPC_REG_SUPPORT for 6 GHz (bsc#1227149).
  - wifi: ath11k: add handler for WMI_VDEV_SET_TPC_POWER_CMDID
    (bsc#1227149).
  - wifi: ath11k: add WMI_TLV_SERVICE_EXT_TPC_REG_SUPPORT service
    bit (bsc#1227149).
  - wifi: ath11k: fill parameters for vdev set tpc power WMI command
    (bsc#1227149).
  - commit 3c338b0
  - wifi: ath11k: save max transmit power in vdev start response
    event from firmware (bsc#1227149).
  - commit 279ae7a
  - wifi: ath11k: add parse of transmit power envelope element
    (bsc#1227149).
  - commit e295f89
  - wifi: ath11k: save power spectral density(PSD) of regulatory
    rule (bsc#1227149).
  - wifi: ath11k: update regulatory rules when connect to AP on
    6 GHz band for station (bsc#1227149).
  - wifi: ath11k: update regulatory rules when interface added
    (bsc#1227149).
  - wifi: ath11k: fix a possible dead lock caused by ab->base_lock
    (bsc#1227149).
  - wifi: ath11k: store cur_regulatory_info for each radio
    (bsc#1227149).
  - wifi: ath11k: add support to select 6 GHz regulatory type
    (bsc#1227149).
  - wifi: ath12k: refactor ath12k_wmi_tlv_parse_alloc()
    (bsc#1227149).
  - wifi: ath11k: fix IOMMU errors on buffer rings (bsc#1227149).
  - commit d84dbd2
  - wifi: ath12k: Make QMI message rules const (bsc#1227149).
  - wifi: ath12k: support default regdb while searching board-2.bin
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: add support to search regdb data in board-2.bin
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: remove unused ATH12K_BD_IE_BOARD_EXT
    (bsc#1227149).
  - wifi: ath12k: add fallback board name without variant while
    searching board-2.bin (bsc#1227149).
  - wifi: ath12k: add string type to search board data in
    board-2.bin for WCN7850 (bsc#1227149).
  - wifi: ath10k: remove duplicate memset() in 10.4 TDLS peer update
    (bsc#1227149).
  - wifi: ath10k: use flexible array in struct
    wmi_tdls_peer_capabilities (bsc#1227149).
  - wifi: ath10k: remove unused template structs (bsc#1227149).
  - wifi: ath10k: remove struct wmi_pdev_chanlist_update_event
    (bsc#1227149).
  - commit e73f8dc
  - wifi: ath10k: use flexible arrays for WMI start scan TLVs
    (bsc#1227149).
  - wifi: ath10k: use flexible array in struct wmi_host_mem_chunks
    (bsc#1227149).
  - wifi: ath9k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath9k: delete some unused/duplicate macros (bsc#1227149).
  - wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc()
    (bsc#1227149).
  - wifi: ath11k: rely on mac80211 debugfs handling for vif
    (bsc#1227149).
  - wifi: ath11k: workaround too long expansion sparse warnings
    (bsc#1227149).
  - Revert "wifi: ath12k: use ATH12K_PCI_IRQ_DP_OFFSET for DP IRQ"
    (bsc#1227149).
  - wifi: ath9k: reset survey of current channel after a scan
    started (bsc#1227149).
  - wifi: ath12k: fix the issue that the multicast/broadcast
    indicator is not read correctly for WCN7850 (bsc#1227149).
  - commit 6cf204e
  - wifi: ath11k: Fix ath11k_htc_record flexible record
    (bsc#1227149).
  - wifi: ath5k: remove unused ath5k_eeprom_info::ee_antenna
    (bsc#1227149).
  - wifi: ath10k: add support to allow broadcast action frame RX
    (bsc#1227149).
  - wifi: ath12k: avoid repeated wiphy access from hw (bsc#1227149).
  - wifi: ath12k: set IRQ affinity to CPU0 in case of one MSI vector
    (bsc#1227149).
  - wifi: ath12k: do not restore ASPM in case of single MSI vector
    (bsc#1227149).
  - wifi: ath12k: add support one MSI vector (bsc#1227149).
  - wifi: ath12k: refactor multiple MSI vector implementation
    (bsc#1227149).
  - wifi: ath12k: use ATH12K_PCI_IRQ_DP_OFFSET for DP IRQ
    (bsc#1227149).
  - wifi: ath12k: add CE and ext IRQ flag to indicate irq_handler
    (bsc#1227149).
  - commit 908caeb
  - wifi: ath12k: get msi_data again after request_irq is called
    (bsc#1227149).
  - wifi: wcn36xx: Convert to platform remove callback returning
    void (bsc#1227149).
  - wifi: ath5k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath12k: avoid repeated hw access from ar (bsc#1227149).
  - wifi: ath12k: Optimize the mac80211 hw data access
    (bsc#1227149).
  - wifi: ath12k: add 320 MHz bandwidth enums (bsc#1227149).
  - wifi: ath11k: Convert to platform remove callback returning void
    (bsc#1227149).
  - wifi: ath11k: remove ath11k_htc_record::pauload[] (bsc#1227149).
  - wifi: ath10k: Use DECLARE_FLEX_ARRAY() for ath10k_htc_record
    (bsc#1227149).
  - wifi: ath10k: remove ath10k_htc_record::pauload[] (bsc#1227149).
  - commit 67bc0a7
  - wifi: ath10k: Update Qualcomm Innovation Center, Inc. copyrights
    (bsc#1227149).
  - commit e13fd24
  - wifi: ath11k: Update Qualcomm Innovation Center, Inc. copyrights
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-do-not-dump-SRNG-statistics-during-resum.patch.
  - Refresh
    patches.suse/wifi-ath11k-fix-warning-on-DMA-ring-capabilities-eve.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - Refresh
    patches.suse/wifi-ath11k-thermal-don-t-try-to-register-multiple-t.patch.
  - commit a886227
  - wifi: ath9k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath12k: refactor DP Rxdma ring structure (bsc#1227149).
  - wifi: ath12k: avoid explicit HW conversion argument in Rxdma
    replenish (bsc#1227149).
  - wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish
    (bsc#1227149).
  - wifi: ath12k: avoid explicit mac id argument in Rxdma replenish
    (bsc#1227149).
  - wifi: ath12k: fix the error handler of rfkill config
    (bsc#1227149).
  - wifi: ath12k: use select for CRYPTO_MICHAEL_MIC (bsc#1227149).
  - wifi: ath11k: use select for CRYPTO_MICHAEL_MIC (bsc#1227149).
  - commit a869013
  - wifi: ath12k: Consolidate WMI peer flags (bsc#1227149).
  - wifi: ath11k: Consolidate WMI peer flags (bsc#1227149).
  - wifi: ath12k: Remove obsolete struct wmi_peer_flags_map
    * peer_flags (bsc#1227149).
  - wifi: ath11k: Remove obsolete struct wmi_peer_flags_map
    * peer_flags (bsc#1227149).
  - wifi: ath12k: Remove struct ath12k::ops (bsc#1227149).
  - wifi: ath11k: Remove struct ath11k::ops (bsc#1227149).
  - wifi: ath10k: Remove unused struct ath10k_htc_frame
    (bsc#1227149).
  - wifi: ath10k: simplify __ath10k_htt_tx_txq_recalc()
    (bsc#1227149).
  - wifi: ath11k: Remove unneeded semicolon (bsc#1227149).
  - wifi: ath10k: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - commit e59240f
  - wifi: ath12k: drop NULL pointer check in
    ath12k_update_per_peer_tx_stats() (bsc#1227149).
  - Revert "wifi: ath11k: call ath11k_mac_fils_discovery() without
    condition" (bsc#1227149).
  - wifi: ath12k: Introduce and use ath12k_sta_to_arsta()
    (bsc#1227149).
  - wifi: ath12k: rename the sc naming convention to ab
    (bsc#1227149).
  - wifi: ath12k: rename the wmi_sc naming convention to wmi_ab
    (bsc#1227149).
  - commit f93677e
  - bus: mhi: host: allow MHI client drivers to provide the firmware
    via a pointer (bsc#1227149).
  - commit 494649c
  - wifi: ath11k: add firmware-2.bin support (bsc#1227149).
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit 677d325
  - wifi: ath11k: qmi: refactor ath11k_qmi_m3_load() (bsc#1227149).
  - commit 296ac8f
  - wifi: ath11k: rename the sc naming convention to ab
    (bsc#1227149).
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - Refresh
    patches.suse/wifi-ath11k-thermal-don-t-try-to-register-multiple-t.patch.
  - commit 6eedd0d
  - wifi: ath11k: rename the wmi_sc naming convention to wmi_ab
    (bsc#1227149).
  - wifi: ath6kl: replace deprecated strncpy with memcpy
    (bsc#1227149).
  - commit cd59b03
  - wifi: ath5k: replace deprecated strncpy with strscpy
    (bsc#1227149).
  - wifi: ath12k: Remove ath12k_base::bd_api (bsc#1227149).
  - wifi: ath11k: Remove ath11k_base::bd_api (bsc#1227149).
  - wifi: ath12k: Enable Mesh support for QCN9274 (bsc#1227149).
  - wifi: ath12k: register EHT mesh capabilities (bsc#1227149).
  - wifi: ath11k: Use device_get_match_data() (bsc#1227149).
  - wifi: ath11k: Introduce and use ath11k_sta_to_arsta()
    (bsc#1227149).
  - wifi: ath11k: Remove unused struct ath11k_htc_frame
    (bsc#1227149).
  - wifi: ath12k: fix invalid m3 buffer address (bsc#1227149).
  - wifi: ath12k: add ath12k_qmi_free_resource() for recovery
    (bsc#1227149).
  - commit a18a8d4
  - wifi: ath12k: configure RDDM size to MHI for device recovery
    (bsc#1227149).
  - wifi: ath12k: add parsing of phy bitmap for reg rules
    (bsc#1227149).
  - wifi: ath11k: add parsing of phy bitmap for reg rules
    (bsc#1227149).
  - wifi: ath11k: ath11k_debugfs_register(): fix format-truncation
    warning (bsc#1227149).
  - wifi: ath12k: Consistently use ath12k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath11k: call ath11k_mac_fils_discovery() without condition
    (bsc#1227149).
  - wifi: ath12k: remove redundant memset() in
    ath12k_hal_reo_qdesc_setup() (bsc#1227149).
  - wifi: ath9k_htc: fix format-truncation warning (bsc#1227149).
  - wifi: ath12k: fix debug messages (bsc#1227149).
  - wifi: ath11k: fix CAC running state during virtual interface
    start (bsc#1227149).
  - commit c2f2e92
  - wifi: ath10k: simplify ath10k_peer_create() (bsc#1227149).
  - wifi: ath10k: indicate to mac80211 scan complete with aborted
    flag for ATH10K_SCAN_STARTING state (bsc#1227149).
  - wifi: ath: dfs_pattern_detector: Use flex array to simplify code
    (bsc#1227149).
  - wifi: carl9170: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath10k: consistently use kstrtoX_from_user() functions
    (bsc#1227149).
  - wifi: ath12k: add keep backward compatibility of PHY mode to
    avoid firmware crash (bsc#1227149).
  - wifi: ath12k: add read variant from SMBIOS for download board
    data (bsc#1227149).
  - wifi: ath12k: do not drop data frames from unassociated stations
    (bsc#1227149).
  - wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data
    handling (bsc#1227149).
  - wifi: ath11k: fix ath11k_mac_op_remain_on_channel() stack usage
    (bsc#1227149).
  - commit b844022
  - wifi: ath12k: add msdu_end structure for WCN7850 (bsc#1227149).
  - wifi: ath12k: Set default beacon mode to burst mode
    (bsc#1227149).
  - wifi: ath12k: call ath12k_mac_fils_discovery() without condition
    (bsc#1227149).
  - wifi: ath11k: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath12k: enable IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS
    for WCN7850 (bsc#1227149).
  - wifi: ath12k: change to treat alpha code na as world wide
    regdomain (bsc#1227149).
  - wifi: ath12k: indicate scan complete for scan canceled when
    scan running (bsc#1227149).
  - wifi: ath12k: indicate to mac80211 scan complete with aborted
    flag for ATH12K_SCAN_STARTING state (bsc#1227149).
  - wifi: ath12k: fix recovery fail while firmware crash when
    doing channel switch (bsc#1227149).
  - wifi: ath12k: add support for hardware rfkill for WCN7850
    (bsc#1227149).
  - commit 087627b
  - wifi: ath11k: use kstrtoul_from_user() where appropriate
    (bsc#1227149).
  - wifi: ath11k: remove unused members of 'struct ath11k_base'
    (bsc#1227149).
  - wifi: ath11k: drop redundant check in
    ath11k_dp_rx_mon_dest_process() (bsc#1227149).
  - wifi: ath11k: drop NULL pointer check in
    ath11k_update_per_peer_tx_stats() (bsc#1227149).
  - wifi: ath10k: drop HTT_DATA_TX_STATUS_DOWNLOAD_FAIL
    (bsc#1227149).
  - wifi: ath10k: Annotate struct ath10k_ce_ring with __counted_by
    (bsc#1227149).
  - wifi: wcn36xx: Annotate struct wcn36xx_hal_ind_msg with
    __counted_by (bsc#1227149).
  - wifi: ath12k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath10k: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath6kl: remove unnecessary (void*) conversions
    (bsc#1227149).
  - commit 3f20dbc
  - wifi: ath5k: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: wcn36xx: remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ar5523: Remove unnecessary (void*) conversions
    (bsc#1227149).
  - wifi: ath9k: clean up function ath9k_hif_usb_resume
    (bsc#1227149).
  - wifi: ath11k: add chip id board name while searching board-2.bin
    for WCN6855 (bsc#1227149).
  - wifi: ath12k: change to initialize recovery variables earlier
    in ath12k_core_reset() (bsc#1227149).
  - wifi: ath12k: enable 320 MHz bandwidth for 6 GHz band in EHT
    PHY capability for WCN7850 (bsc#1227149).
  - wifi: ath9k: use u32 for txgain indexes (bsc#1227149).
  - wifi: ath9k: simplify ar9003_hw_process_ini() (bsc#1227149).
  - wifi: ath12k: fix radar detection in 160 MHz (bsc#1227149).
  - commit 0b35606
  - wifi: ath12k: fix WARN_ON during ath12k_mac_update_vif_chan
    (bsc#1227149).
  - wifi: ath11k: fix tid bitmap is 0 in peer rx mu stats
    (bsc#1227149).
  - wifi: ath11k: move references from rsvd2 to info fields
    (bsc#1227149).
  - wifi: ath11k: mhi: add a warning message for MHI_CB_EE_RDDM
    crash (bsc#1227149).
  - wifi: ath: Use is_multicast_ether_addr() to check multicast
    Ether address (bsc#1227149).
  - wifi: ath12k: Remove unused declarations (bsc#1227149).
  - wifi: ath5k: ath5k_hw_get_median_noise_floor(): use swap()
    (bsc#1227149).
  - wifi: ath: remove unused-but-set parameter (bsc#1227149).
  - wifi: ath11k: Remove unused declarations (bsc#1227149).
  - wifi: ath10k: fix Wvoid-pointer-to-enum-cast warning
    (bsc#1227149).
  - commit 1f3c3b8
  - wifi: ath11k: fix Wvoid-pointer-to-enum-cast warning
    (bsc#1227149).
  - wifi: ath11k: simplify the code with module_platform_driver
    (bsc#1227149).
  - wifi: ath12k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath11k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath10k: Fix a few spelling errors (bsc#1227149).
  - wifi: ath11k: Consistently use ath11k_vif_to_arvif()
    (bsc#1227149).
  - wifi: ath9k: Remove unused declarations (bsc#1227149).
  - wifi: ath9k: Remove unnecessary ternary operators (bsc#1227149).
  - wifi: ath9k: consistently use kstrtoX_from_user() functions
    (bsc#1227149).
  - wifi: ath9k: fix parameter check in ath9k_init_debug()
    (bsc#1227149).
  - commit 6c737fb
  - wifi: ath5k: Remove redundant dev_err() (bsc#1227149).
  - wifi: ath12k: avoid deadlock by change ieee80211_queue_work
    for regd_update_work (bsc#1227149).
  - wifi: ath12k: add handler for scan event WMI_SCAN_EVENT_DEQUEUED
    (bsc#1227149).
  - wifi: ath12k: relax list iteration in ath12k_mac_vif_unref()
    (bsc#1227149).
  - wifi: ath12k: configure puncturing bitmap (bsc#1227149).
  - wifi: ath12k: parse WMI service ready ext2 event (bsc#1227149).
  - wifi: ath12k: add MLO header in peer association (bsc#1227149).
  - wifi: ath12k: peer assoc for 320 MHz (bsc#1227149).
  - wifi: ath12k: add WMI support for EHT peer (bsc#1227149).
  - wifi: ath12k: prepare EHT peer assoc parameters (bsc#1227149).
  - commit 3191784
  - wifi: ath12k: add EHT PHY modes (bsc#1227149).
  - wifi: ath12k: propagate EHT capabilities to userspace
    (bsc#1227149).
  - wifi: ath12k: WMI support to process EHT capabilities
    (bsc#1227149).
  - wifi: ath12k: move HE capabilities processing to a new function
    (bsc#1227149).
  - commit 7fb64df
  - wifi: ath12k: rename HE capabilities setup/copy functions
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-annotate-iftype_data-pointer-with-spar.patch.
  - commit ddfeb0d
  - wifi: ath12k: change to use dynamic memory for channel list
    of scan (bsc#1227149).
  - wifi: ath12k: trigger station disconnect on hardware restart
    (bsc#1227149).
  - wifi: ath12k: Use pdev_id rather than mac_id to get pdev
    (bsc#1227149).
  - wifi: ath12k: correct the data_type from QMI_OPT_FLAG to
    QMI_UNSIGNED_1_BYTE for mlo_capable (bsc#1227149).
  - wifi: ath11k: Remove cal_done check during probe (bsc#1227149).
  - commit e204950
  - wifi: ath11k: simplify
    ath11k_mac_validate_vht_he_fixed_rate_settings() (bsc#1227149).
  - wifi: ath6kl: Remove error checking for debugfs_create_dir()
    (bsc#1227149).
  - wifi: ath5k: remove phydir check from ath5k_debug_init_device()
    (bsc#1227149).
  - wifi: drivers: Explicitly include correct DT includes
    (bsc#1227149).
  - wifi: ath10k: improve structure padding (bsc#1227149).
  - wifi: ath12k: fix conf_mutex in
    ath12k_mac_op_unassign_vif_chanctx() (bsc#1227149).
  - wifi: ath11k: debug: add ATH11K_DBG_CE (bsc#1227149).
  - commit 3345b7e
  - wifi: ath11k: htc: cleanup debug messages (bsc#1227149).
  - wifi: ath11k: don't use %pK (bsc#1227149).
  - wifi: ath11k: hal: cleanup debug message (bsc#1227149).
  - wifi: ath11k: debug: use all upper case in ATH11k_DBG_HAL
    (bsc#1227149).
  - wifi: ath11k: dp: cleanup debug message (bsc#1227149).
  - wifi: ath11k: pci: cleanup debug logging (bsc#1227149).
  - wifi: ath11k: wmi: add unified command debug messages
    (bsc#1227149).
  - wifi: ath11k: wmi: use common error handling style
    (bsc#1227149).
  - wifi: ath11k: wmi: cleanup error handling in
    ath11k_wmi_send_init_country_cmd() (bsc#1227149).
  - wifi: ath11k: remove unsupported event handlers (bsc#1227149).
  - commit 37105bd
  - wifi: ath11k: add WMI event debug messages (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch.
  - Refresh
    patches.suse/wifi-ath11k-fix-temperature-event-locking.patch.
  - commit 572fd2c
  - wifi: ath11k: remove manual mask names from debug messages
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch.
  - commit a7ae7bf
  - wifi: ath11k: print debug level in debug messages (bsc#1227149).
  - wifi: ath11k: debug: remove unused ATH11K_DBG_ANY (bsc#1227149).
  - wifi: ath12k: delete the timer rx_replenish_retry during rmmod
    (bsc#1227149).
  - wifi: ath12k: Use msdu_end to check MCBC (bsc#1227149).
  - wifi: ath12k: check hardware major version for WCN7850
    (bsc#1227149).
  - wifi: ath11k: update proper pdev/vdev id for testmode command
    (bsc#1227149).
  - wifi: atk10k: Don't opencode ath10k_pci_priv() in
    ath10k_ahb_priv() (bsc#1227149).
  - wifi: ath10k: Convert to platform remove callback returning void
    (bsc#1227149).
  - commit cafd8ed
  - wifi: ath10k: Drop checks that are always false (bsc#1227149).
  - wifi: ath10k: Drop cleaning of driver data from probe error
    path and remove (bsc#1227149).
  - wifi: ath11k: Add HTT stats for PHY reset case (bsc#1227149).
  - commit dde2040
  - wifi: ath11k: Allow ath11k to boot without caldata in ftm mode
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-do-not-dump-SRNG-statistics-during-resum.patch.
  - commit adbddfc
  - wifi: ath11k: factory test mode support (bsc#1227149).
  - Refresh
    patches.suse/wifi-ath11k-fix-warning-on-DMA-ring-capabilities-eve.patch.
  - Refresh
    patches.suse/wifi-ath11k-rearrange-IRQ-enable-disable-in-reset-pa.patch.
  - Refresh patches.suse/wifi-ath11k-support-hibernation.patch.
  - commit 030f59a
  - wifi: ath11k: remove unused function ath11k_tm_event_wmi()
    (bsc#1227149).
  - wifi: ath12k: Add support to parse new WMI event for 6 GHz
    regulatory (bsc#1227149).
  - wifi: wil6210: wmi: Replace zero-length array with
    DECLARE_FLEX_ARRAY() helper (bsc#1227149).
  - wifi: wil6210: fw: Replace zero-length arrays with
    DECLARE_FLEX_ARRAY() helper (bsc#1227149).
  - wifi: ath11k: Send HT fixed rate in WMI peer fixed param
    (bsc#1227149).
  - wifi: ath11k: Relocate the func
    ath11k_mac_bitrate_mask_num_ht_rates() and change hweight16
    to hweight8 (bsc#1227149).
  - wifi: ath12k: increase vdev setup timeout (bsc#1227149).
  - wifi: ath11k: EMA beacon support (bsc#1227149).
  - wifi: ath11k: MBSSID beacon support (bsc#1227149).
  - wifi: ath11k: refactor vif parameter configurations
    (bsc#1227149).
  - wifi: ath11k: MBSSID parameter configuration in AP mode
    (bsc#1227149).
  - wifi: ath11k: rename MBSSID fields in wmi_vdev_up_cmd
    (bsc#1227149).
  - wifi: ath11k: MBSSID configuration during vdev create/start
    (bsc#1227149).
  - wifi: ath11k: driver settings for MBSSID and EMA (bsc#1227149).
  - wifi: ath: work around false-positive stringop-overread warning
    (bsc#1227149).
  - wifi: ath11k: Use list_count_nodes() (bsc#1227149).
  - wifi: ath10k: Use list_count_nodes() (bsc#1227149).
  - wifi: ath12k: fix potential wmi_mgmt_tx_queue race condition
    (bsc#1227149).
  - wifi: ath12k: add wait operation for tx management packets
    for flush from mac80211 (bsc#1227149).
  - wifi: ath12k: Remove some dead code (bsc#1227149).
  - wifi: ath12k: send WMI_PEER_REORDER_QUEUE_SETUP_CMDID when
    ADDBA session starts (bsc#1227149).
  - wifi: ath12k: set PERST pin no pull request for WCN7850
    (bsc#1227149).
  - wifi: ath12k: add qmi_cnss_feature_bitmap field to hardware
    parameters (bsc#1227149).
  - wifi: ath10/11/12k: Use alloc_ordered_workqueue() to create
    ordered workqueues (bsc#1227149).
  - commit 1763ceb
  - net: phy: microchip: lan87xx: reinit PHY after cable test
    (git-fixes).
  - i2c: pnx: Fix potential deadlock warning from del_timer_sync()
    call in isr (git-fixes).
  - drm/amdgpu/atomfirmware: silence UBSAN warning (stable-fixes).
  - drm: panel-orientation-quirks: Add quirk for Valve Galileo
    (stable-fixes).
  - nilfs2: add missing check for inode numbers on directory entries
    (stable-fixes).
  - nilfs2: fix inode number range checks (stable-fixes).
  - drm/amdgpu: silence UBSAN warning (stable-fixes).
  - spi: cadence: Ensure data lines set to low during dummy-cycle
    period (stable-fixes).
  - regmap-i2c: Subtract reg size from max_write (stable-fixes).
  - platform/x86: touchscreen_dmi: Add info for the EZpad 6s Pro
    (stable-fixes).
  - platform/x86: touchscreen_dmi: Add info for GlobalSpace SolT
    IVW 11.6" tablet (stable-fixes).
  - nfc/nci: Add the inconsistency check between the input data
    length and count (stable-fixes).
  - Input: ff-core - prefer struct_size over open coded arithmetic
    (stable-fixes).
  - cdrom: rearrange last_media_change check to avoid unintentional
    overflow (stable-fixes).
  - serial: imx: Raise TX trigger level to 8 (stable-fixes).
  - usb: xhci: prevent potential failure in handle_tx_event()
    for Transfer events without TRB (stable-fixes).
  - thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on
    lvts_data (stable-fixes).
  - firmware: dmi: Stop decoding on broken entry (stable-fixes).
  - i2c: i801: Annotate apanel_addr as __ro_after_init
    (stable-fixes).
  - media: dvb-frontends: tda10048: Fix integer overflow
    (stable-fixes).
  - media: s2255: Use refcount_t instead of atomic_t for
    num_channels (stable-fixes).
  - media: dvb-frontends: tda18271c2dd: Remove casting during div
    (stable-fixes).
  - media: dw2102: fix a potential buffer overflow (git-fixes).
  - media: dw2102: Don't translate i2c read into write
    (stable-fixes).
  - media: dvb-usb: dib0700_devices: Add missing release_firmware()
    (stable-fixes).
  - media: dvb: as102-fe: Fix as10x_register_addr packing
    (stable-fixes).
  - drm/amdgpu: fix the warning about the expression (int)size -
    len (stable-fixes).
  - drm/amdgpu: fix uninitialized scalar variable warning
    (stable-fixes).
  - drm/amd/display: Fix uninitialized variables in DM
    (stable-fixes).
  - drm/amd/display: Skip finding free audio for unknown engine_id
    (stable-fixes).
  - drm/amd/display: Check pipe offset before setting vblank
    (stable-fixes).
  - drm/amd/display: Check index msg_id before read or write
    (stable-fixes).
  - drm/amdgpu: Initialize timestamp for some legacy SOCs
    (stable-fixes).
  - drm/amdgpu: Using uninitialized value *size when calling
    amdgpu_vce_cs_reloc (stable-fixes).
  - drm/amdgpu: Fix uninitialized variable warnings (stable-fixes).
  - drm/lima: fix shared irq handling on driver remove
    (stable-fixes).
  - wifi: mt76: mt7996: add sanity checks for background radar
    trigger (stable-fixes).
  - wifi: mt76: replace skb_put with skb_put_zero (stable-fixes).
  - crypto: aead,cipher - zeroize key buffer after use
    (stable-fixes).
  - crypto: hisilicon/debugfs - Fix debugfs uninit process issue
    (stable-fixes).
  - commit 240e65e

++++ liburing:

  - Fix buf-ring-nommap.t test failure
    * test-buf-ring-nommap-zero-the-ringbuf-memory.patch

++++ runc:

  - Update to runc v1.2.0~rc2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.2>.
  - Re-allow Go 1.22 builds for >= 1.22.4.

++++ runc:

  - Update to runc v1.2.0~rc2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.2>.
  - Re-allow Go 1.22 builds for >= 1.22.4.

++++ runc:

  - Update to runc v1.2.0~rc2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.2>.
  - Re-allow Go 1.22 builds for >= 1.22.4.

++++ runc:

  - Update to runc v1.2.0~rc2. Upstream changelog is available from
    <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.2>.
  - Re-allow Go 1.22 builds for >= 1.22.4.

------------------------------------------------------------------
------------------  2024-7-11  -  Jul 11 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Added integration test for SUSE agama installer
    This integration test builds a self-install ISO image which
    drops the SUSE Agama installer into a ramdisk for performing
    an interactive installation procedure to test Agama
  - Add --set-type-attr and --set-release-version
    Allow to set/overwrite type section attributes via the cmdline.
    Allow to set/add the release-version element via the cmdline.
    This Fixes #2478 and Fixes #2588

++++ python-kiwi:

  - Added integration test for SUSE agama installer
    This integration test builds a self-install ISO image which
    drops the SUSE Agama installer into a ramdisk for performing
    an interactive installation procedure to test Agama
  - Add --set-type-attr and --set-release-version
    Allow to set/overwrite type section attributes via the cmdline.
    Allow to set/add the release-version element via the cmdline.
    This Fixes #2478 and Fixes #2588

++++ python-kiwi:

  - Added integration test for SUSE agama installer
    This integration test builds a self-install ISO image which
    drops the SUSE Agama installer into a ramdisk for performing
    an interactive installation procedure to test Agama
  - Add --set-type-attr and --set-release-version
    Allow to set/overwrite type section attributes via the cmdline.
    Allow to set/add the release-version element via the cmdline.
    This Fixes #2478 and Fixes #2588

++++ kernel-default:

  - Refresh patches.kabi/wireless-kabi-workaround.patch (bsc#1227149)
    More fixes for 6.9 API updates
  - commit 25eb11c
  - wifi: iwlwifi: mvm: fix ROC version check (bsc#1227149).
  - wifi: iwlwifi: mvm: fix a crash on 7265 (bsc#1227149).
  - wifi: iwlwifi: Use request_module_nowait (bsc#1227149).
  - wifi: iwlwifi: mvm: don't always disable EMLSR due to BT coex
    (bsc#1227149).
  - wifi: iwlwifi: mvm: calculate EMLSR mode after connection
    (bsc#1227149).
  - wifi: iwlwifi: mvm: introduce esr_disable_reason (bsc#1227149).
  - wifi: iwlwifi: mvm: Do not warn on invalid link on scan complete
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8
    (bsc#1227149).
  - commit 74beb0b
  - net: mana: Fix possible double free in error handling path
    (git-fixes).
  - RDMA/mana_ib: Ignore optional access flags for MRs (git-fixes).
  - net: mana: Fix the extra HZ in mana_hwc_send_request
    (git-fixes).
  - commit cb4a2bd
  - wifi: iwlwifi: mvm: fix link ID management (bsc#1227149).
  - Revert "wifi: iwlwifi: bump FW API to 90 for BZ/SC devices"
    (bsc#1227149).
  - wifi: iwlwifi: mvm: handle debugfs names more carefully
    (bsc#1227149).
  - commit 1b2b558
  - wifi: iwlwifi: mvm: Configure the link mapping for non-MLD FW
    (bsc#1227149).
  - wifi: iwlwifi: mvm: consider having one active link
    (bsc#1227149).
  - wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
    (bsc#1227149).
  - wifi: iwlwifi: mvm: disable MLO for the time being
    (bsc#1227149).
  - wifi: cfg80211: add a flag to disable wireless extensions
    (bsc#1227149).
  - iwlwifi: mvm: Use for_each_thermal_trip() for walking trip
    points (bsc#1227149).
  - iwlwifi: mvm: Populate trip table before registering thermal
    zone (bsc#1227149).
  - iwlwifi: mvm: Drop unused fw_trips_index[] from
    iwl_mvm_thermal_device (bsc#1227149).
  - commit 53ce28e
  - wifi: mac80211: add link id to ieee80211_gtk_rekey_add()
    (bsc#1227149).
  - wifi: iwlwifi: load b0 version of ucode for HR1/HR2
    (bsc#1227149).
  - wifi: iwlwifi: handle per-phy statistics from fw (bsc#1227149).
  - wifi: iwlwifi: iwl-fh.h: fix kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: api: fix kernel-doc reference (bsc#1227149).
  - wifi: iwlwifi: mvm: unlock mvm if there is no primary link
    (bsc#1227149).
  - wifi: iwlwifi: mvm: partially support PHY context version 6
    (bsc#1227149).
  - commit 590b6b6
  - wifi: iwlwifi: cancel session protection only if there is one
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove IWL_MVM_STATUS_NEED_FLUSH_P2P
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check own capabilities for EMLSR
    (bsc#1227149).
  - wifi: iwlwifi: iwl-trans.h: clean up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: fw: file: clean up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: api: dbg-tlv: fix up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: error-dump: fix kernel-doc issues (bsc#1227149).
  - commit b9417e2
  - wifi: iwlwifi: mvm: fix thermal kernel-doc (bsc#1227149).
  - wifi: iwlwifi: don't use TRUE/FALSE with bool (bsc#1227149).
  - wifi: iwlwifi: api: fix constant version to match FW
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Extend support for P2P service discovery
    (bsc#1227149).
  - wifi: iwlwifi: mvm: work around A-MSDU size problem
    (bsc#1227149).
  - wifi: iwlwifi: nvm: parse the VLP/AFC bit from regulatory
    (bsc#1227149).
  - wifi: iwlwifi: iwlmvm: handle unprotected deauth/disassoc in d3
    (bsc#1227149).
  - wifi: iwlwifi: fix #ifdef CONFIG_ACPI check (bsc#1227149).
  - wifi: iwlwifi: queue: improve warning for no skb in reclaim
    (bsc#1227149).
  - wifi: iwlwifi: mvm: move BA notif messages before action
    (bsc#1227149).
  - commit da274a5
  - wifi: cfg80211: report unprotected deauth/disassoc in wowlan
    (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 8a7655b
  - wifi: nl80211: allow reporting wakeup for unprot deauth/disassoc
    (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit e91caa5
  - wifi: cfg80211: rename UHB to 6 GHz (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 72d3017
  - wifi: iwlwifi: mvm: show skb_mac_gso_segment() failure reason
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove flags for enable/disable beacon
    filter (bsc#1227149).
  - wifi: iwlwifi: pcie: Add new PCI device id and CNVI
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send the smart fifo command if not
    needed (bsc#1227149).
  - wifi: iwlwifi: fw: allow vmalloc for PNVM image (bsc#1227149).
  - wifi: iwlwifi: mvm: don't do duplicate detection for nullfunc
    packets (bsc#1227149).
  - wifi: iwlwifi: mvm: avoid garbage iPN (bsc#1227149).
  - wifi: iwlwifi: mvm: always update keys in D3 exit (bsc#1227149).
  - wifi: iwlwifi: mvm: limit pseudo-D3 to 60 seconds (bsc#1227149).
  - wifi: iwlwifi: mvm: combine condition/warning (bsc#1227149).
  - commit 9013bb7
  - wifi: iwlwifi: mvm: fix the key PN index (bsc#1227149).
  - wifi: iwlwifi: mvm: Keep connection in case of missed beacons
    during RX (bsc#1227149).
  - wifi: iwlwifi: properly check if link is active (bsc#1227149).
  - wifi: iwlwifi: take SGOM and UATS code out of ACPI ifdef
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't abort queue sync in CT-kill
    (bsc#1227149).
  - wifi: iwlwifi: mvm: define RX queue sync timeout as a macro
    (bsc#1227149).
  - wifi: iwlwifi: mvm: expand queue sync warning messages
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Declare support for secure LTF measurement
    (bsc#1227149).
  - wifi: iwlwifi: mvm: advertise support for protected ranging
    negotiation (bsc#1227149).
  - wifi: iwlwifi: mvm: remove one queue sync on BA session stop
    (bsc#1227149).
  - commit d32b4ac
  - wifi: iwlwifi: mvm: don't support reduced tx power on ack for
    new devices (bsc#1227149).
  - wifi: iwlwifi: use system_unbound_wq for debug dump
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove EHT code from mac80211.c
    (bsc#1227149).
  - wifi: iwlwifi: read mac step from aux register (bsc#1227149).
  - wifi: iwlwifi: adjust rx_phyinfo debugfs to MLO (bsc#1227149).
  - wifi: iwlwifi: mvm: const-ify chandef pointers (bsc#1227149).
  - wifi: iwlwifi: Add support for PPAG cmd v5 and PPAG revision 3
    (bsc#1227149).
  - wifi: iwlwifi: pcie: don't allow hw-rfkill to stop device on
    gen2 (bsc#1227149).
  - wifi: iwlwifi: add HONOR to PPAG approved list (bsc#1227149).
  - commit 6501846
  - wifi: mac80211: update beacon counters per link basis
    (bsc#1227149).
  - wifi: iwlwifi: return negative -EINVAL instead of positive
    EINVAL (bsc#1227149).
  - wifi: iwlwifi: fw: fix compiler warning for NULL string print
    (bsc#1227149).
  - wifi: iwlwifi: mvm: make functions public (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 88 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send BT_COEX_CI command on new devices
    (bsc#1227149).
  - wifi: iwlwifi: read DSM functions from UEFI (bsc#1227149).
  - commit 4b3d0a2
  - wifi: iwlwifi: prepare for reading DSM from UEFI (bsc#1227149).
  - wifi: iwlwifi: simplify getting DSM from ACPI (bsc#1227149).
  - wifi: iwlwifi: take send-DSM-to-FW flows out of ACPI ifdef
    (bsc#1227149).
  - wifi: iwlwifi: rfi: use a single DSM function for all RFI
    configurations (bsc#1227149).
  - wifi: iwlwifi: read ECKV table from UEFI (bsc#1227149).
  - wifi: iwlwifi: read WRDD table from UEFI (bsc#1227149).
  - wifi: iwlwifi: support link command version 2 (bsc#1227149).
  - wifi: iwlwifi: mvm: use fast balance scan in case of an active
    P2P GO (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send NDPs for new tx devices
    (bsc#1227149).
  - wifi: iwlwifi: read SPLC from UEFI (bsc#1227149).
  - commit 10d0457
  - wifi: iwlwifi: prepare for reading SPLC from UEFI (bsc#1227149).
  - wifi: iwlwifi: api: clean up some kernel-doc/typos
    (bsc#1227149).
  - wifi: iwlwifi: remove unused function prototype (bsc#1227149).
  - iwlwifi: fw: fix more kernel-doc warnings (bsc#1227149).
  - wifi: iwlwifi: read WTAS table from UEFI (bsc#1227149).
  - commit edb7009
  - wifi: iwlwifi: separate TAS 'read-from-BIOS' and 'send-to-FW'
    flows (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit cbe5734
  - wifi: iwlwifi: prepare for reading TAS table from UEFI
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit 37ff9f0
  - wifi: iwlwifi: don't check TAS block list size twice
    (bsc#1227149).
  - wifi: iwlwifi: read PPAG table from UEFI (bsc#1227149).
  - wifi: iwlwifi: validate PPAG table when sent to FW
    (bsc#1227149).
  - commit aab6534
  - wifi: iwlwifi: prepare for reading PPAG table from UEFI
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-fw-fix-compile-w-o-CONFIG_ACPI.patch.
  - commit b317fc2
  - wifi: iwlwifi: small cleanups in PPAG table flows (bsc#1227149).
  - wifi: iwlwifi: read SAR tables from UEFI (bsc#1227149).
  - wifi: iwlwifi: cleanup sending PER_CHAIN_LIMIT_OFFSET_CMD
    (bsc#1227149).
  - wifi: iwlwifi: prepare for reading SAR tables from UEFI
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check AP supports EMLSR (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: implement suspend with MLO
    (bsc#1227149).
  - wifi: iwlwifi: mvm: refactor duplicate chanctx condition
    (bsc#1227149).
  - wifi: iwlwifi: mvm: log dropped packets due to MIC error
    (bsc#1227149).
  - commit ab26861
  - wifi: iwlwifi: mvm: support SPP A-MSDUs (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-don-t-set-the-MFP-flag-for-the-GTK.patch.
  - commit d834590
  - wifi: mac80211: add support for SPP A-MSDUs (bsc#1227149).
  - commit 265cdf6
  - wifi: cfg80211: add support for SPP A-MSDUs (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit f498490
  - wifi: iwlwifi: implement GLAI ACPI table loading (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-fw-fix-compile-w-o-CONFIG_ACPI.patch.
  - commit 85303bc
  - wifi: iwlwifi: remove Gl A-step remnants (bsc#1227149).
  - wifi: iwlwifi: mvm: Fix FTM initiator flags (bsc#1227149).
  - wifi: iwlwifi: always have 'uats_enabled' (bsc#1227149).
  - wifi: iwlwifi: mvm: don't set trigger frame padding in AP mode
    (bsc#1227149).
  - wifi: iwlwifi: Fix spelling mistake "SESION" -> "SESSION"
    (bsc#1227149).
  - wifi: iwlwifi: mvm: add support for TID to link mapping neg
    request (bsc#1227149).
  - wifi: iwlwifi: cleanup uefi variables loading (bsc#1227149).
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
    (bsc#1227149).
  - wifi: iwlwifi: fw: dbg: ensure correct config name sizes
    (bsc#1227149).
  - commit ff842c3
  - wifi: ieee80211: add definitions for negotiated TID to Link map
    (bsc#1227149).
  - commit b1d66f3
  - wifi: mac80211: process and save negotiated TID to Link mapping
    request (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 32a5092
  - wifi: cfg80211: add RNR with reporting AP information
    (bsc#1227149).
  - commit 8fede1e
  - wifi: iwlwifi: implement can_activate_links callback
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-active-link-counting-during-rec.patch.
  - commit 7e399ce
  - wifi: iwlwifi: remove retry loops in start (bsc#1227149).
  - commit 3c4f0f3
  - wifi: iwlwifi: dbg-tlv: use struct_size() for allocation
    (bsc#1227149).
  - wifi: iwlwifi: dbg-tlv: avoid extra allocation/copy
    (bsc#1227149).
  - wifi: iwlwifi: fix some kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: disconnect on GTK rekey failure
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Add support for removing responder TKs
    (bsc#1227149).
  - wifi: iwlwifi: disable eSR when BT is active (bsc#1227149).
  - wifi: iwlwifi: add support for a wiphy_work rx handler
    (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 87 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: introduce PHY_CONTEXT_CMD_API_VER_5
    (bsc#1227149).
  - wifi: iwlwifi: skip affinity setting on non-SMP (bsc#1227149).
  - wifi: iwlwifi: nvm-parse: advertise common packet padding
    (bsc#1227149).
  - wifi: iwlwifi: change link id in time event to s8 (bsc#1227149).
  - wifi: iwlwifi: mvm: limit EHT 320 MHz MCS for STEP URM
    (bsc#1227149).
  - wifi: iwlwifi: disable 160 MHz based on subsystem device ID
    (bsc#1227149).
  - wifi: iwlwifi: make TB reallocation a debug message
    (bsc#1227149).
  - wifi: iwlwifi: Add support for new 802.11be device
    (bsc#1227149).
  - commit 6617b64
  - pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to
    hdmimix domain (CVE-2024-35942 bsc#1224589).
  - commit cf74548
  - platform/x86: toshiba_acpi: Fix array out-of-bounds access
    (git-fixes).
  - ACPI: processor_idle: Fix invalid comparison with insertion
    sort for latency (git-fixes).
  - commit ec2c4bc
  - KVM: SEV-ES: Delegate LBR virtualization to the processor
    (git-fixes).
  - commit ca0a7e8

++++ kernel-default:

  - Refresh patches.kabi/wireless-kabi-workaround.patch (bsc#1227149)
    More fixes for 6.9 API updates
  - commit 25eb11c
  - wifi: iwlwifi: mvm: fix ROC version check (bsc#1227149).
  - wifi: iwlwifi: mvm: fix a crash on 7265 (bsc#1227149).
  - wifi: iwlwifi: Use request_module_nowait (bsc#1227149).
  - wifi: iwlwifi: mvm: don't always disable EMLSR due to BT coex
    (bsc#1227149).
  - wifi: iwlwifi: mvm: calculate EMLSR mode after connection
    (bsc#1227149).
  - wifi: iwlwifi: mvm: introduce esr_disable_reason (bsc#1227149).
  - wifi: iwlwifi: mvm: Do not warn on invalid link on scan complete
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8
    (bsc#1227149).
  - commit 74beb0b
  - net: mana: Fix possible double free in error handling path
    (git-fixes).
  - RDMA/mana_ib: Ignore optional access flags for MRs (git-fixes).
  - net: mana: Fix the extra HZ in mana_hwc_send_request
    (git-fixes).
  - commit cb4a2bd
  - wifi: iwlwifi: mvm: fix link ID management (bsc#1227149).
  - Revert "wifi: iwlwifi: bump FW API to 90 for BZ/SC devices"
    (bsc#1227149).
  - wifi: iwlwifi: mvm: handle debugfs names more carefully
    (bsc#1227149).
  - commit 1b2b558
  - wifi: iwlwifi: mvm: Configure the link mapping for non-MLD FW
    (bsc#1227149).
  - wifi: iwlwifi: mvm: consider having one active link
    (bsc#1227149).
  - wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
    (bsc#1227149).
  - wifi: iwlwifi: mvm: disable MLO for the time being
    (bsc#1227149).
  - wifi: cfg80211: add a flag to disable wireless extensions
    (bsc#1227149).
  - iwlwifi: mvm: Use for_each_thermal_trip() for walking trip
    points (bsc#1227149).
  - iwlwifi: mvm: Populate trip table before registering thermal
    zone (bsc#1227149).
  - iwlwifi: mvm: Drop unused fw_trips_index[] from
    iwl_mvm_thermal_device (bsc#1227149).
  - commit 53ce28e
  - wifi: mac80211: add link id to ieee80211_gtk_rekey_add()
    (bsc#1227149).
  - wifi: iwlwifi: load b0 version of ucode for HR1/HR2
    (bsc#1227149).
  - wifi: iwlwifi: handle per-phy statistics from fw (bsc#1227149).
  - wifi: iwlwifi: iwl-fh.h: fix kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: api: fix kernel-doc reference (bsc#1227149).
  - wifi: iwlwifi: mvm: unlock mvm if there is no primary link
    (bsc#1227149).
  - wifi: iwlwifi: mvm: partially support PHY context version 6
    (bsc#1227149).
  - commit 590b6b6
  - wifi: iwlwifi: cancel session protection only if there is one
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove IWL_MVM_STATUS_NEED_FLUSH_P2P
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check own capabilities for EMLSR
    (bsc#1227149).
  - wifi: iwlwifi: iwl-trans.h: clean up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: fw: file: clean up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: api: dbg-tlv: fix up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: error-dump: fix kernel-doc issues (bsc#1227149).
  - commit b9417e2
  - wifi: iwlwifi: mvm: fix thermal kernel-doc (bsc#1227149).
  - wifi: iwlwifi: don't use TRUE/FALSE with bool (bsc#1227149).
  - wifi: iwlwifi: api: fix constant version to match FW
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Extend support for P2P service discovery
    (bsc#1227149).
  - wifi: iwlwifi: mvm: work around A-MSDU size problem
    (bsc#1227149).
  - wifi: iwlwifi: nvm: parse the VLP/AFC bit from regulatory
    (bsc#1227149).
  - wifi: iwlwifi: iwlmvm: handle unprotected deauth/disassoc in d3
    (bsc#1227149).
  - wifi: iwlwifi: fix #ifdef CONFIG_ACPI check (bsc#1227149).
  - wifi: iwlwifi: queue: improve warning for no skb in reclaim
    (bsc#1227149).
  - wifi: iwlwifi: mvm: move BA notif messages before action
    (bsc#1227149).
  - commit da274a5
  - wifi: cfg80211: report unprotected deauth/disassoc in wowlan
    (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 8a7655b
  - wifi: nl80211: allow reporting wakeup for unprot deauth/disassoc
    (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit e91caa5
  - wifi: cfg80211: rename UHB to 6 GHz (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 72d3017
  - wifi: iwlwifi: mvm: show skb_mac_gso_segment() failure reason
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove flags for enable/disable beacon
    filter (bsc#1227149).
  - wifi: iwlwifi: pcie: Add new PCI device id and CNVI
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send the smart fifo command if not
    needed (bsc#1227149).
  - wifi: iwlwifi: fw: allow vmalloc for PNVM image (bsc#1227149).
  - wifi: iwlwifi: mvm: don't do duplicate detection for nullfunc
    packets (bsc#1227149).
  - wifi: iwlwifi: mvm: avoid garbage iPN (bsc#1227149).
  - wifi: iwlwifi: mvm: always update keys in D3 exit (bsc#1227149).
  - wifi: iwlwifi: mvm: limit pseudo-D3 to 60 seconds (bsc#1227149).
  - wifi: iwlwifi: mvm: combine condition/warning (bsc#1227149).
  - commit 9013bb7
  - wifi: iwlwifi: mvm: fix the key PN index (bsc#1227149).
  - wifi: iwlwifi: mvm: Keep connection in case of missed beacons
    during RX (bsc#1227149).
  - wifi: iwlwifi: properly check if link is active (bsc#1227149).
  - wifi: iwlwifi: take SGOM and UATS code out of ACPI ifdef
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't abort queue sync in CT-kill
    (bsc#1227149).
  - wifi: iwlwifi: mvm: define RX queue sync timeout as a macro
    (bsc#1227149).
  - wifi: iwlwifi: mvm: expand queue sync warning messages
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Declare support for secure LTF measurement
    (bsc#1227149).
  - wifi: iwlwifi: mvm: advertise support for protected ranging
    negotiation (bsc#1227149).
  - wifi: iwlwifi: mvm: remove one queue sync on BA session stop
    (bsc#1227149).
  - commit d32b4ac
  - wifi: iwlwifi: mvm: don't support reduced tx power on ack for
    new devices (bsc#1227149).
  - wifi: iwlwifi: use system_unbound_wq for debug dump
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove EHT code from mac80211.c
    (bsc#1227149).
  - wifi: iwlwifi: read mac step from aux register (bsc#1227149).
  - wifi: iwlwifi: adjust rx_phyinfo debugfs to MLO (bsc#1227149).
  - wifi: iwlwifi: mvm: const-ify chandef pointers (bsc#1227149).
  - wifi: iwlwifi: Add support for PPAG cmd v5 and PPAG revision 3
    (bsc#1227149).
  - wifi: iwlwifi: pcie: don't allow hw-rfkill to stop device on
    gen2 (bsc#1227149).
  - wifi: iwlwifi: add HONOR to PPAG approved list (bsc#1227149).
  - commit 6501846
  - wifi: mac80211: update beacon counters per link basis
    (bsc#1227149).
  - wifi: iwlwifi: return negative -EINVAL instead of positive
    EINVAL (bsc#1227149).
  - wifi: iwlwifi: fw: fix compiler warning for NULL string print
    (bsc#1227149).
  - wifi: iwlwifi: mvm: make functions public (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 88 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send BT_COEX_CI command on new devices
    (bsc#1227149).
  - wifi: iwlwifi: read DSM functions from UEFI (bsc#1227149).
  - commit 4b3d0a2
  - wifi: iwlwifi: prepare for reading DSM from UEFI (bsc#1227149).
  - wifi: iwlwifi: simplify getting DSM from ACPI (bsc#1227149).
  - wifi: iwlwifi: take send-DSM-to-FW flows out of ACPI ifdef
    (bsc#1227149).
  - wifi: iwlwifi: rfi: use a single DSM function for all RFI
    configurations (bsc#1227149).
  - wifi: iwlwifi: read ECKV table from UEFI (bsc#1227149).
  - wifi: iwlwifi: read WRDD table from UEFI (bsc#1227149).
  - wifi: iwlwifi: support link command version 2 (bsc#1227149).
  - wifi: iwlwifi: mvm: use fast balance scan in case of an active
    P2P GO (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send NDPs for new tx devices
    (bsc#1227149).
  - wifi: iwlwifi: read SPLC from UEFI (bsc#1227149).
  - commit 10d0457
  - wifi: iwlwifi: prepare for reading SPLC from UEFI (bsc#1227149).
  - wifi: iwlwifi: api: clean up some kernel-doc/typos
    (bsc#1227149).
  - wifi: iwlwifi: remove unused function prototype (bsc#1227149).
  - iwlwifi: fw: fix more kernel-doc warnings (bsc#1227149).
  - wifi: iwlwifi: read WTAS table from UEFI (bsc#1227149).
  - commit edb7009
  - wifi: iwlwifi: separate TAS 'read-from-BIOS' and 'send-to-FW'
    flows (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit cbe5734
  - wifi: iwlwifi: prepare for reading TAS table from UEFI
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit 37ff9f0
  - wifi: iwlwifi: don't check TAS block list size twice
    (bsc#1227149).
  - wifi: iwlwifi: read PPAG table from UEFI (bsc#1227149).
  - wifi: iwlwifi: validate PPAG table when sent to FW
    (bsc#1227149).
  - commit aab6534
  - wifi: iwlwifi: prepare for reading PPAG table from UEFI
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-fw-fix-compile-w-o-CONFIG_ACPI.patch.
  - commit b317fc2
  - wifi: iwlwifi: small cleanups in PPAG table flows (bsc#1227149).
  - wifi: iwlwifi: read SAR tables from UEFI (bsc#1227149).
  - wifi: iwlwifi: cleanup sending PER_CHAIN_LIMIT_OFFSET_CMD
    (bsc#1227149).
  - wifi: iwlwifi: prepare for reading SAR tables from UEFI
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check AP supports EMLSR (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: implement suspend with MLO
    (bsc#1227149).
  - wifi: iwlwifi: mvm: refactor duplicate chanctx condition
    (bsc#1227149).
  - wifi: iwlwifi: mvm: log dropped packets due to MIC error
    (bsc#1227149).
  - commit ab26861
  - wifi: iwlwifi: mvm: support SPP A-MSDUs (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-don-t-set-the-MFP-flag-for-the-GTK.patch.
  - commit d834590
  - wifi: mac80211: add support for SPP A-MSDUs (bsc#1227149).
  - commit 265cdf6
  - wifi: cfg80211: add support for SPP A-MSDUs (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit f498490
  - wifi: iwlwifi: implement GLAI ACPI table loading (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-fw-fix-compile-w-o-CONFIG_ACPI.patch.
  - commit 85303bc
  - wifi: iwlwifi: remove Gl A-step remnants (bsc#1227149).
  - wifi: iwlwifi: mvm: Fix FTM initiator flags (bsc#1227149).
  - wifi: iwlwifi: always have 'uats_enabled' (bsc#1227149).
  - wifi: iwlwifi: mvm: don't set trigger frame padding in AP mode
    (bsc#1227149).
  - wifi: iwlwifi: Fix spelling mistake "SESION" -> "SESSION"
    (bsc#1227149).
  - wifi: iwlwifi: mvm: add support for TID to link mapping neg
    request (bsc#1227149).
  - wifi: iwlwifi: cleanup uefi variables loading (bsc#1227149).
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
    (bsc#1227149).
  - wifi: iwlwifi: fw: dbg: ensure correct config name sizes
    (bsc#1227149).
  - commit ff842c3
  - wifi: ieee80211: add definitions for negotiated TID to Link map
    (bsc#1227149).
  - commit b1d66f3
  - wifi: mac80211: process and save negotiated TID to Link mapping
    request (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 32a5092
  - wifi: cfg80211: add RNR with reporting AP information
    (bsc#1227149).
  - commit 8fede1e
  - wifi: iwlwifi: implement can_activate_links callback
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-active-link-counting-during-rec.patch.
  - commit 7e399ce
  - wifi: iwlwifi: remove retry loops in start (bsc#1227149).
  - commit 3c4f0f3
  - wifi: iwlwifi: dbg-tlv: use struct_size() for allocation
    (bsc#1227149).
  - wifi: iwlwifi: dbg-tlv: avoid extra allocation/copy
    (bsc#1227149).
  - wifi: iwlwifi: fix some kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: disconnect on GTK rekey failure
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Add support for removing responder TKs
    (bsc#1227149).
  - wifi: iwlwifi: disable eSR when BT is active (bsc#1227149).
  - wifi: iwlwifi: add support for a wiphy_work rx handler
    (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 87 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: introduce PHY_CONTEXT_CMD_API_VER_5
    (bsc#1227149).
  - wifi: iwlwifi: skip affinity setting on non-SMP (bsc#1227149).
  - wifi: iwlwifi: nvm-parse: advertise common packet padding
    (bsc#1227149).
  - wifi: iwlwifi: change link id in time event to s8 (bsc#1227149).
  - wifi: iwlwifi: mvm: limit EHT 320 MHz MCS for STEP URM
    (bsc#1227149).
  - wifi: iwlwifi: disable 160 MHz based on subsystem device ID
    (bsc#1227149).
  - wifi: iwlwifi: make TB reallocation a debug message
    (bsc#1227149).
  - wifi: iwlwifi: Add support for new 802.11be device
    (bsc#1227149).
  - commit 6617b64
  - pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to
    hdmimix domain (CVE-2024-35942 bsc#1224589).
  - commit cf74548
  - platform/x86: toshiba_acpi: Fix array out-of-bounds access
    (git-fixes).
  - ACPI: processor_idle: Fix invalid comparison with insertion
    sort for latency (git-fixes).
  - commit ec2c4bc
  - KVM: SEV-ES: Delegate LBR virtualization to the processor
    (git-fixes).
  - commit ca0a7e8

++++ kernel-default:

  - Refresh patches.kabi/wireless-kabi-workaround.patch (bsc#1227149)
    More fixes for 6.9 API updates
  - commit 25eb11c
  - wifi: iwlwifi: mvm: fix ROC version check (bsc#1227149).
  - wifi: iwlwifi: mvm: fix a crash on 7265 (bsc#1227149).
  - wifi: iwlwifi: Use request_module_nowait (bsc#1227149).
  - wifi: iwlwifi: mvm: don't always disable EMLSR due to BT coex
    (bsc#1227149).
  - wifi: iwlwifi: mvm: calculate EMLSR mode after connection
    (bsc#1227149).
  - wifi: iwlwifi: mvm: introduce esr_disable_reason (bsc#1227149).
  - wifi: iwlwifi: mvm: Do not warn on invalid link on scan complete
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support iwl_dev_tx_power_cmd_v8
    (bsc#1227149).
  - commit 74beb0b
  - net: mana: Fix possible double free in error handling path
    (git-fixes).
  - RDMA/mana_ib: Ignore optional access flags for MRs (git-fixes).
  - net: mana: Fix the extra HZ in mana_hwc_send_request
    (git-fixes).
  - commit cb4a2bd
  - wifi: iwlwifi: mvm: fix link ID management (bsc#1227149).
  - Revert "wifi: iwlwifi: bump FW API to 90 for BZ/SC devices"
    (bsc#1227149).
  - wifi: iwlwifi: mvm: handle debugfs names more carefully
    (bsc#1227149).
  - commit 1b2b558
  - wifi: iwlwifi: mvm: Configure the link mapping for non-MLD FW
    (bsc#1227149).
  - wifi: iwlwifi: mvm: consider having one active link
    (bsc#1227149).
  - wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
    (bsc#1227149).
  - wifi: iwlwifi: mvm: disable MLO for the time being
    (bsc#1227149).
  - wifi: cfg80211: add a flag to disable wireless extensions
    (bsc#1227149).
  - iwlwifi: mvm: Use for_each_thermal_trip() for walking trip
    points (bsc#1227149).
  - iwlwifi: mvm: Populate trip table before registering thermal
    zone (bsc#1227149).
  - iwlwifi: mvm: Drop unused fw_trips_index[] from
    iwl_mvm_thermal_device (bsc#1227149).
  - commit 53ce28e
  - wifi: mac80211: add link id to ieee80211_gtk_rekey_add()
    (bsc#1227149).
  - wifi: iwlwifi: load b0 version of ucode for HR1/HR2
    (bsc#1227149).
  - wifi: iwlwifi: handle per-phy statistics from fw (bsc#1227149).
  - wifi: iwlwifi: iwl-fh.h: fix kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: api: fix kernel-doc reference (bsc#1227149).
  - wifi: iwlwifi: mvm: unlock mvm if there is no primary link
    (bsc#1227149).
  - wifi: iwlwifi: mvm: partially support PHY context version 6
    (bsc#1227149).
  - commit 590b6b6
  - wifi: iwlwifi: cancel session protection only if there is one
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove IWL_MVM_STATUS_NEED_FLUSH_P2P
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check own capabilities for EMLSR
    (bsc#1227149).
  - wifi: iwlwifi: iwl-trans.h: clean up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: fw: file: clean up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: api: dbg-tlv: fix up kernel-doc (bsc#1227149).
  - wifi: iwlwifi: error-dump: fix kernel-doc issues (bsc#1227149).
  - commit b9417e2
  - wifi: iwlwifi: mvm: fix thermal kernel-doc (bsc#1227149).
  - wifi: iwlwifi: don't use TRUE/FALSE with bool (bsc#1227149).
  - wifi: iwlwifi: api: fix constant version to match FW
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Extend support for P2P service discovery
    (bsc#1227149).
  - wifi: iwlwifi: mvm: work around A-MSDU size problem
    (bsc#1227149).
  - wifi: iwlwifi: nvm: parse the VLP/AFC bit from regulatory
    (bsc#1227149).
  - wifi: iwlwifi: iwlmvm: handle unprotected deauth/disassoc in d3
    (bsc#1227149).
  - wifi: iwlwifi: fix #ifdef CONFIG_ACPI check (bsc#1227149).
  - wifi: iwlwifi: queue: improve warning for no skb in reclaim
    (bsc#1227149).
  - wifi: iwlwifi: mvm: move BA notif messages before action
    (bsc#1227149).
  - commit da274a5
  - wifi: cfg80211: report unprotected deauth/disassoc in wowlan
    (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 8a7655b
  - wifi: nl80211: allow reporting wakeup for unprot deauth/disassoc
    (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit e91caa5
  - wifi: cfg80211: rename UHB to 6 GHz (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 72d3017
  - wifi: iwlwifi: mvm: show skb_mac_gso_segment() failure reason
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove flags for enable/disable beacon
    filter (bsc#1227149).
  - wifi: iwlwifi: pcie: Add new PCI device id and CNVI
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send the smart fifo command if not
    needed (bsc#1227149).
  - wifi: iwlwifi: fw: allow vmalloc for PNVM image (bsc#1227149).
  - wifi: iwlwifi: mvm: don't do duplicate detection for nullfunc
    packets (bsc#1227149).
  - wifi: iwlwifi: mvm: avoid garbage iPN (bsc#1227149).
  - wifi: iwlwifi: mvm: always update keys in D3 exit (bsc#1227149).
  - wifi: iwlwifi: mvm: limit pseudo-D3 to 60 seconds (bsc#1227149).
  - wifi: iwlwifi: mvm: combine condition/warning (bsc#1227149).
  - commit 9013bb7
  - wifi: iwlwifi: mvm: fix the key PN index (bsc#1227149).
  - wifi: iwlwifi: mvm: Keep connection in case of missed beacons
    during RX (bsc#1227149).
  - wifi: iwlwifi: properly check if link is active (bsc#1227149).
  - wifi: iwlwifi: take SGOM and UATS code out of ACPI ifdef
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't abort queue sync in CT-kill
    (bsc#1227149).
  - wifi: iwlwifi: mvm: define RX queue sync timeout as a macro
    (bsc#1227149).
  - wifi: iwlwifi: mvm: expand queue sync warning messages
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Declare support for secure LTF measurement
    (bsc#1227149).
  - wifi: iwlwifi: mvm: advertise support for protected ranging
    negotiation (bsc#1227149).
  - wifi: iwlwifi: mvm: remove one queue sync on BA session stop
    (bsc#1227149).
  - commit d32b4ac
  - wifi: iwlwifi: mvm: don't support reduced tx power on ack for
    new devices (bsc#1227149).
  - wifi: iwlwifi: use system_unbound_wq for debug dump
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove EHT code from mac80211.c
    (bsc#1227149).
  - wifi: iwlwifi: read mac step from aux register (bsc#1227149).
  - wifi: iwlwifi: adjust rx_phyinfo debugfs to MLO (bsc#1227149).
  - wifi: iwlwifi: mvm: const-ify chandef pointers (bsc#1227149).
  - wifi: iwlwifi: Add support for PPAG cmd v5 and PPAG revision 3
    (bsc#1227149).
  - wifi: iwlwifi: pcie: don't allow hw-rfkill to stop device on
    gen2 (bsc#1227149).
  - wifi: iwlwifi: add HONOR to PPAG approved list (bsc#1227149).
  - commit 6501846
  - wifi: mac80211: update beacon counters per link basis
    (bsc#1227149).
  - wifi: iwlwifi: return negative -EINVAL instead of positive
    EINVAL (bsc#1227149).
  - wifi: iwlwifi: fw: fix compiler warning for NULL string print
    (bsc#1227149).
  - wifi: iwlwifi: mvm: make functions public (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 88 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send BT_COEX_CI command on new devices
    (bsc#1227149).
  - wifi: iwlwifi: read DSM functions from UEFI (bsc#1227149).
  - commit 4b3d0a2
  - wifi: iwlwifi: prepare for reading DSM from UEFI (bsc#1227149).
  - wifi: iwlwifi: simplify getting DSM from ACPI (bsc#1227149).
  - wifi: iwlwifi: take send-DSM-to-FW flows out of ACPI ifdef
    (bsc#1227149).
  - wifi: iwlwifi: rfi: use a single DSM function for all RFI
    configurations (bsc#1227149).
  - wifi: iwlwifi: read ECKV table from UEFI (bsc#1227149).
  - wifi: iwlwifi: read WRDD table from UEFI (bsc#1227149).
  - wifi: iwlwifi: support link command version 2 (bsc#1227149).
  - wifi: iwlwifi: mvm: use fast balance scan in case of an active
    P2P GO (bsc#1227149).
  - wifi: iwlwifi: mvm: don't send NDPs for new tx devices
    (bsc#1227149).
  - wifi: iwlwifi: read SPLC from UEFI (bsc#1227149).
  - commit 10d0457
  - wifi: iwlwifi: prepare for reading SPLC from UEFI (bsc#1227149).
  - wifi: iwlwifi: api: clean up some kernel-doc/typos
    (bsc#1227149).
  - wifi: iwlwifi: remove unused function prototype (bsc#1227149).
  - iwlwifi: fw: fix more kernel-doc warnings (bsc#1227149).
  - wifi: iwlwifi: read WTAS table from UEFI (bsc#1227149).
  - commit edb7009
  - wifi: iwlwifi: separate TAS 'read-from-BIOS' and 'send-to-FW'
    flows (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit cbe5734
  - wifi: iwlwifi: prepare for reading TAS table from UEFI
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit 37ff9f0
  - wifi: iwlwifi: don't check TAS block list size twice
    (bsc#1227149).
  - wifi: iwlwifi: read PPAG table from UEFI (bsc#1227149).
  - wifi: iwlwifi: validate PPAG table when sent to FW
    (bsc#1227149).
  - commit aab6534
  - wifi: iwlwifi: prepare for reading PPAG table from UEFI
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-fw-fix-compile-w-o-CONFIG_ACPI.patch.
  - commit b317fc2
  - wifi: iwlwifi: small cleanups in PPAG table flows (bsc#1227149).
  - wifi: iwlwifi: read SAR tables from UEFI (bsc#1227149).
  - wifi: iwlwifi: cleanup sending PER_CHAIN_LIMIT_OFFSET_CMD
    (bsc#1227149).
  - wifi: iwlwifi: prepare for reading SAR tables from UEFI
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check AP supports EMLSR (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: implement suspend with MLO
    (bsc#1227149).
  - wifi: iwlwifi: mvm: refactor duplicate chanctx condition
    (bsc#1227149).
  - wifi: iwlwifi: mvm: log dropped packets due to MIC error
    (bsc#1227149).
  - commit ab26861
  - wifi: iwlwifi: mvm: support SPP A-MSDUs (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-don-t-set-the-MFP-flag-for-the-GTK.patch.
  - commit d834590
  - wifi: mac80211: add support for SPP A-MSDUs (bsc#1227149).
  - commit 265cdf6
  - wifi: cfg80211: add support for SPP A-MSDUs (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit f498490
  - wifi: iwlwifi: implement GLAI ACPI table loading (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-fw-fix-compile-w-o-CONFIG_ACPI.patch.
  - commit 85303bc
  - wifi: iwlwifi: remove Gl A-step remnants (bsc#1227149).
  - wifi: iwlwifi: mvm: Fix FTM initiator flags (bsc#1227149).
  - wifi: iwlwifi: always have 'uats_enabled' (bsc#1227149).
  - wifi: iwlwifi: mvm: don't set trigger frame padding in AP mode
    (bsc#1227149).
  - wifi: iwlwifi: Fix spelling mistake "SESION" -> "SESSION"
    (bsc#1227149).
  - wifi: iwlwifi: mvm: add support for TID to link mapping neg
    request (bsc#1227149).
  - wifi: iwlwifi: cleanup uefi variables loading (bsc#1227149).
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
    (bsc#1227149).
  - wifi: iwlwifi: fw: dbg: ensure correct config name sizes
    (bsc#1227149).
  - commit ff842c3
  - wifi: ieee80211: add definitions for negotiated TID to Link map
    (bsc#1227149).
  - commit b1d66f3
  - wifi: mac80211: process and save negotiated TID to Link mapping
    request (bsc#1227149).
  - Refresh patches.kabi/wireless-kabi-workaround.patch.
  - commit 32a5092
  - wifi: cfg80211: add RNR with reporting AP information
    (bsc#1227149).
  - commit 8fede1e
  - wifi: iwlwifi: implement can_activate_links callback
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-active-link-counting-during-rec.patch.
  - commit 7e399ce
  - wifi: iwlwifi: remove retry loops in start (bsc#1227149).
  - commit 3c4f0f3
  - wifi: iwlwifi: dbg-tlv: use struct_size() for allocation
    (bsc#1227149).
  - wifi: iwlwifi: dbg-tlv: avoid extra allocation/copy
    (bsc#1227149).
  - wifi: iwlwifi: fix some kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: disconnect on GTK rekey failure
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Add support for removing responder TKs
    (bsc#1227149).
  - wifi: iwlwifi: disable eSR when BT is active (bsc#1227149).
  - wifi: iwlwifi: add support for a wiphy_work rx handler
    (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 87 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: introduce PHY_CONTEXT_CMD_API_VER_5
    (bsc#1227149).
  - wifi: iwlwifi: skip affinity setting on non-SMP (bsc#1227149).
  - wifi: iwlwifi: nvm-parse: advertise common packet padding
    (bsc#1227149).
  - wifi: iwlwifi: change link id in time event to s8 (bsc#1227149).
  - wifi: iwlwifi: mvm: limit EHT 320 MHz MCS for STEP URM
    (bsc#1227149).
  - wifi: iwlwifi: disable 160 MHz based on subsystem device ID
    (bsc#1227149).
  - wifi: iwlwifi: make TB reallocation a debug message
    (bsc#1227149).
  - wifi: iwlwifi: Add support for new 802.11be device
    (bsc#1227149).
  - commit 6617b64
  - pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to
    hdmimix domain (CVE-2024-35942 bsc#1224589).
  - commit cf74548
  - platform/x86: toshiba_acpi: Fix array out-of-bounds access
    (git-fixes).
  - ACPI: processor_idle: Fix invalid comparison with insertion
    sort for latency (git-fixes).
  - commit ec2c4bc
  - KVM: SEV-ES: Delegate LBR virtualization to the processor
    (git-fixes).
  - commit ca0a7e8

++++ libsolv:

  - removed dependency on external find program in the repo2solv tool
  - bindings: fix return value of repodata.add_solv()
  - new SOLVER_FLAG_FOCUS_NEW flag
  - bump version to 0.7.30

++++ libsolv:

  - removed dependency on external find program in the repo2solv tool
  - bindings: fix return value of repodata.add_solv()
  - new SOLVER_FLAG_FOCUS_NEW flag
  - bump version to 0.7.30

++++ libsolv:

  - removed dependency on external find program in the repo2solv tool
  - bindings: fix return value of repodata.add_solv()
  - new SOLVER_FLAG_FOCUS_NEW flag
  - bump version to 0.7.30

++++ libsolv:

  - removed dependency on external find program in the repo2solv tool
  - bindings: fix return value of repodata.add_solv()
  - new SOLVER_FLAG_FOCUS_NEW flag
  - bump version to 0.7.30

++++ systemd:

  - Import commit 10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b (merge of v254.14)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e87183896e2dbb0b2a78709c9ae0e37911b7fbcd...10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b
  - testsuite: move a misplaced %endif
  - Don't automatically clean unmodified config files up (bsc#1226415)
    Relying on the presence of .rpmsave for detecting unmodified main config files
    couldn't work as it created a time window in which some of the systemd
    services were restarted with no config file. That had the bad side effect to
    restart them with the upstream defaults, ignoring any user's customization.
  - Import commit e87183896e2dbb0b2a78709c9ae0e37911b7fbcd (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/952e82f83554e8f49b2246799dddc38257a0893a...e87183896e2dbb0b2a78709c9ae0e37911b7fbcd
  - Import commit 952e82f83554e8f49b2246799dddc38257a0893a
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)
  - Import commit 67a66ebcb994882ebfe0e9de3765628969e50067 (merge of v254.10)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/31f1148f75a1155d3eb37fd1a450096d669ec65b...67a66ebcb994882ebfe0e9de3765628969e50067
  - Make sure systemd-sysvcompat replaces systemd-sysvinit on upgrades (bsc#1218110)

++++ systemd:

  - Import commit 10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b (merge of v254.14)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e87183896e2dbb0b2a78709c9ae0e37911b7fbcd...10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b
  - testsuite: move a misplaced %endif
  - Don't automatically clean unmodified config files up (bsc#1226415)
    Relying on the presence of .rpmsave for detecting unmodified main config files
    couldn't work as it created a time window in which some of the systemd
    services were restarted with no config file. That had the bad side effect to
    restart them with the upstream defaults, ignoring any user's customization.
  - Import commit e87183896e2dbb0b2a78709c9ae0e37911b7fbcd (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/952e82f83554e8f49b2246799dddc38257a0893a...e87183896e2dbb0b2a78709c9ae0e37911b7fbcd
  - Import commit 952e82f83554e8f49b2246799dddc38257a0893a
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)
  - Import commit 67a66ebcb994882ebfe0e9de3765628969e50067 (merge of v254.10)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/31f1148f75a1155d3eb37fd1a450096d669ec65b...67a66ebcb994882ebfe0e9de3765628969e50067
  - Make sure systemd-sysvcompat replaces systemd-sysvinit on upgrades (bsc#1218110)

++++ systemd:

  - Import commit 10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b (merge of v254.14)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e87183896e2dbb0b2a78709c9ae0e37911b7fbcd...10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b
  - testsuite: move a misplaced %endif
  - Don't automatically clean unmodified config files up (bsc#1226415)
    Relying on the presence of .rpmsave for detecting unmodified main config files
    couldn't work as it created a time window in which some of the systemd
    services were restarted with no config file. That had the bad side effect to
    restart them with the upstream defaults, ignoring any user's customization.
  - Import commit e87183896e2dbb0b2a78709c9ae0e37911b7fbcd (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/952e82f83554e8f49b2246799dddc38257a0893a...e87183896e2dbb0b2a78709c9ae0e37911b7fbcd
  - Import commit 952e82f83554e8f49b2246799dddc38257a0893a
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)
  - Import commit 67a66ebcb994882ebfe0e9de3765628969e50067 (merge of v254.10)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/31f1148f75a1155d3eb37fd1a450096d669ec65b...67a66ebcb994882ebfe0e9de3765628969e50067
  - Make sure systemd-sysvcompat replaces systemd-sysvinit on upgrades (bsc#1218110)

++++ systemd:

  - Import commit 10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b (merge of v254.14)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e87183896e2dbb0b2a78709c9ae0e37911b7fbcd...10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b
  - testsuite: move a misplaced %endif
  - Don't automatically clean unmodified config files up (bsc#1226415)
    Relying on the presence of .rpmsave for detecting unmodified main config files
    couldn't work as it created a time window in which some of the systemd
    services were restarted with no config file. That had the bad side effect to
    restart them with the upstream defaults, ignoring any user's customization.
  - Import commit e87183896e2dbb0b2a78709c9ae0e37911b7fbcd (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/952e82f83554e8f49b2246799dddc38257a0893a...e87183896e2dbb0b2a78709c9ae0e37911b7fbcd
  - Import commit 952e82f83554e8f49b2246799dddc38257a0893a
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)
  - Import commit 67a66ebcb994882ebfe0e9de3765628969e50067 (merge of v254.10)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/31f1148f75a1155d3eb37fd1a450096d669ec65b...67a66ebcb994882ebfe0e9de3765628969e50067
  - Make sure systemd-sysvcompat replaces systemd-sysvinit on upgrades (bsc#1218110)

++++ systemd:

  - Import commit 10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b (merge of v254.14)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e87183896e2dbb0b2a78709c9ae0e37911b7fbcd...10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b
  - testsuite: move a misplaced %endif
  - Don't automatically clean unmodified config files up (bsc#1226415)
    Relying on the presence of .rpmsave for detecting unmodified main config files
    couldn't work as it created a time window in which some of the systemd
    services were restarted with no config file. That had the bad side effect to
    restart them with the upstream defaults, ignoring any user's customization.
  - Import commit e87183896e2dbb0b2a78709c9ae0e37911b7fbcd (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/952e82f83554e8f49b2246799dddc38257a0893a...e87183896e2dbb0b2a78709c9ae0e37911b7fbcd
  - Import commit 952e82f83554e8f49b2246799dddc38257a0893a
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)
  - Import commit 67a66ebcb994882ebfe0e9de3765628969e50067 (merge of v254.10)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/31f1148f75a1155d3eb37fd1a450096d669ec65b...67a66ebcb994882ebfe0e9de3765628969e50067
  - Make sure systemd-sysvcompat replaces systemd-sysvinit on upgrades (bsc#1218110)

++++ systemd:

  - Import commit 10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b (merge of v254.14)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e87183896e2dbb0b2a78709c9ae0e37911b7fbcd...10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b
  - testsuite: move a misplaced %endif
  - Don't automatically clean unmodified config files up (bsc#1226415)
    Relying on the presence of .rpmsave for detecting unmodified main config files
    couldn't work as it created a time window in which some of the systemd
    services were restarted with no config file. That had the bad side effect to
    restart them with the upstream defaults, ignoring any user's customization.
  - Import commit e87183896e2dbb0b2a78709c9ae0e37911b7fbcd (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/952e82f83554e8f49b2246799dddc38257a0893a...e87183896e2dbb0b2a78709c9ae0e37911b7fbcd
  - Import commit 952e82f83554e8f49b2246799dddc38257a0893a
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)
  - Import commit 67a66ebcb994882ebfe0e9de3765628969e50067 (merge of v254.10)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/31f1148f75a1155d3eb37fd1a450096d669ec65b...67a66ebcb994882ebfe0e9de3765628969e50067
  - Make sure systemd-sysvcompat replaces systemd-sysvinit on upgrades (bsc#1218110)

++++ systemd:

  - Import commit 10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b (merge of v254.14)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/e87183896e2dbb0b2a78709c9ae0e37911b7fbcd...10392b9b7c013cbc6c3dc70d8c623e22b0a7c78b
  - testsuite: move a misplaced %endif
  - Don't automatically clean unmodified config files up (bsc#1226415)
    Relying on the presence of .rpmsave for detecting unmodified main config files
    couldn't work as it created a time window in which some of the systemd
    services were restarted with no config file. That had the bad side effect to
    restart them with the upstream defaults, ignoring any user's customization.
  - Import commit e87183896e2dbb0b2a78709c9ae0e37911b7fbcd (merge of v254.11)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/952e82f83554e8f49b2246799dddc38257a0893a...e87183896e2dbb0b2a78709c9ae0e37911b7fbcd
  - Import commit 952e82f83554e8f49b2246799dddc38257a0893a
    d317008225 gpt-auto-generator: be more defensive when checking the presence of ESP in fstab
    fed117d448 journalctl: explicitly check < 0 for error
    41d9e82099 journalctl: make --until work again with --after-cursor and --lines (bsc#1221906)
  - Import commit 67a66ebcb994882ebfe0e9de3765628969e50067 (merge of v254.10)
    For a complete list of changes, visit:
    https://github.com/openSUSE/systemd/compare/31f1148f75a1155d3eb37fd1a450096d669ec65b...67a66ebcb994882ebfe0e9de3765628969e50067
  - Make sure systemd-sysvcompat replaces systemd-sysvinit on upgrades (bsc#1218110)

++++ nvidia-open-driver-G06-signed:

  - Update to version 555.42.06 for CUDA. This tag has become
    available in github, now.

------------------------------------------------------------------
------------------  2024-7-10  -  Jul 10 2024  -------------------
------------------------------------------------------------------

++++ container-selinux:

  - Update to version 2.232.1:
    * Bump to v2.232.1
    * TMT: fix srpm download syntax on rawhide
    * Bump to 2.232.0
    * Packit: remove `update_release` key from downstream jobs (#313)
    * Update container-selinux.8 man page
    * Add ownership of /usr/share/udica (#312)
    * Packit/TMT: upstream maintenance of downstream gating tests
    * extend container_engine_t again
    * Allow spc_t to use localectl
    * Allow spc_t to use timedatectl
    * introduce container_use_xserver_devices boolean to allow GPU access

++++ python-kiwi:

  - Update integration test for eficsm
    Update the type of the Secure profile of the live image integration
    test as well as the type of the simple-disk test to make use of the
    eficsm="false" attribute to switch off CSM mode and test an EFI only
    layout.
  - Add new eficsm type attribute
    Allow to produce EFI/UEFI images without hybrid CSM
    capabilities. This Fixes #2407
  - kiwi_plugin_architecture.rst
  - Revise kiwi_from_python.rst
  - Wait for loop device detach to complete
    Detaching a loop device via 'losetup -d' is an async operation.
    Once the command returns the loop can still be associated with
    the block special. Therefore this commit waits until the block
    device got released or a timeout is hit. This Fixes #2580

++++ python-kiwi:

  - Update integration test for eficsm
    Update the type of the Secure profile of the live image integration
    test as well as the type of the simple-disk test to make use of the
    eficsm="false" attribute to switch off CSM mode and test an EFI only
    layout.
  - Add new eficsm type attribute
    Allow to produce EFI/UEFI images without hybrid CSM
    capabilities. This Fixes #2407
  - kiwi_plugin_architecture.rst
  - Revise kiwi_from_python.rst
  - Wait for loop device detach to complete
    Detaching a loop device via 'losetup -d' is an async operation.
    Once the command returns the loop can still be associated with
    the block special. Therefore this commit waits until the block
    device got released or a timeout is hit. This Fixes #2580

++++ python-kiwi:

  - Update integration test for eficsm
    Update the type of the Secure profile of the live image integration
    test as well as the type of the simple-disk test to make use of the
    eficsm="false" attribute to switch off CSM mode and test an EFI only
    layout.
  - Add new eficsm type attribute
    Allow to produce EFI/UEFI images without hybrid CSM
    capabilities. This Fixes #2407
  - kiwi_plugin_architecture.rst
  - Revise kiwi_from_python.rst
  - Wait for loop device detach to complete
    Detaching a loop device via 'losetup -d' is an async operation.
    Once the command returns the loop can still be associated with
    the block special. Therefore this commit waits until the block
    device got released or a timeout is hit. This Fixes #2580

++++ kernel-default:

  - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC
    routes (git-fixes).
  - commit 6653b01
  - KVM: SEV-ES: Disallow SEV-ES guests when X86_FEATURE_LBRV is
    absent (git-fixes).
  - commit 1094992
  - KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
    (git-fixes).
  - commit 2cc4a9c
  - drivers/xen: Improve the late XenStore init protocol
    (git-fixes).
  - commit cb805fb
  - xen/x86: add extra pages to unpopulated-alloc if available
    (git-fixes).
  - commit d9de7d9
  - kunit: Fix checksum tests on big endian CPUs (git-fixed).
  - commit 91a58a6
  - KVM: arm64: Fix circular locking dependency (bsc#1222463 CVE-2024-26691).
  - commit 3273efe
  - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted (bsc#1225744, CVE-2024-36909).
  - uio_hv_generic: Don't free decrypted memory (bsc#1225717, CVE-2024-36910).
  - hv_netvsc: Don't free decrypted memory (bsc#1225745, CVE-2024-36911).
  - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752, CVE-2024-36912).
  - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753, CVE-2024-36913).
  - commit a78a9db
  - x86/speculation, objtool: Use absolute relocations for annotations (git-fixes).
  - commit 14e0989
  - x86/head/64: Move the __head definition to <asm/init.h> (git-fixes).
  - commit 36d1750
  - x86/csum: Remove unnecessary odd handling (git-fixes).
  - commit 439ef62
  - x86/csum: Fix clang -Wuninitialized in csum_partial() (git-fixes).
  - commit 98db437
  - x86/csum: Improve performance of `csum_partial` (git-fixes).
  - commit 131cca3
  - x86/boot: Ignore NMIs during very early boot (git-fixes).
  - commit 3c94948
  - x86/asm: Fix build of UML with KASAN (git-fixes).
  - commit 89fc5d7
  - blacklist.conf: Blacklist useless revert
  - commit 0a21e69
  - tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328 CVE-2024-26665).
  - commit f28b881
  - SUNRPC: avoid soft lockup when transmitting UDP to reachable
    server (bsc#1225272).
  - commit 3fc313b

++++ kernel-default:

  - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC
    routes (git-fixes).
  - commit 6653b01
  - KVM: SEV-ES: Disallow SEV-ES guests when X86_FEATURE_LBRV is
    absent (git-fixes).
  - commit 1094992
  - KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
    (git-fixes).
  - commit 2cc4a9c
  - drivers/xen: Improve the late XenStore init protocol
    (git-fixes).
  - commit cb805fb
  - xen/x86: add extra pages to unpopulated-alloc if available
    (git-fixes).
  - commit d9de7d9
  - kunit: Fix checksum tests on big endian CPUs (git-fixed).
  - commit 91a58a6
  - KVM: arm64: Fix circular locking dependency (bsc#1222463 CVE-2024-26691).
  - commit 3273efe
  - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted (bsc#1225744, CVE-2024-36909).
  - uio_hv_generic: Don't free decrypted memory (bsc#1225717, CVE-2024-36910).
  - hv_netvsc: Don't free decrypted memory (bsc#1225745, CVE-2024-36911).
  - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752, CVE-2024-36912).
  - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753, CVE-2024-36913).
  - commit a78a9db
  - x86/speculation, objtool: Use absolute relocations for annotations (git-fixes).
  - commit 14e0989
  - x86/head/64: Move the __head definition to <asm/init.h> (git-fixes).
  - commit 36d1750
  - x86/csum: Remove unnecessary odd handling (git-fixes).
  - commit 439ef62
  - x86/csum: Fix clang -Wuninitialized in csum_partial() (git-fixes).
  - commit 98db437
  - x86/csum: Improve performance of `csum_partial` (git-fixes).
  - commit 131cca3
  - x86/boot: Ignore NMIs during very early boot (git-fixes).
  - commit 3c94948
  - x86/asm: Fix build of UML with KASAN (git-fixes).
  - commit 89fc5d7
  - blacklist.conf: Blacklist useless revert
  - commit 0a21e69
  - tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328 CVE-2024-26665).
  - commit f28b881
  - SUNRPC: avoid soft lockup when transmitting UDP to reachable
    server (bsc#1225272).
  - commit 3fc313b

++++ kernel-default:

  - KVM: x86: Always sync PIR to IRR prior to scanning I/O APIC
    routes (git-fixes).
  - commit 6653b01
  - KVM: SEV-ES: Disallow SEV-ES guests when X86_FEATURE_LBRV is
    absent (git-fixes).
  - commit 1094992
  - KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked
    (git-fixes).
  - commit 2cc4a9c
  - drivers/xen: Improve the late XenStore init protocol
    (git-fixes).
  - commit cb805fb
  - xen/x86: add extra pages to unpopulated-alloc if available
    (git-fixes).
  - commit d9de7d9
  - kunit: Fix checksum tests on big endian CPUs (git-fixed).
  - commit 91a58a6
  - KVM: arm64: Fix circular locking dependency (bsc#1222463 CVE-2024-26691).
  - commit 3273efe
  - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted (bsc#1225744, CVE-2024-36909).
  - uio_hv_generic: Don't free decrypted memory (bsc#1225717, CVE-2024-36910).
  - hv_netvsc: Don't free decrypted memory (bsc#1225745, CVE-2024-36911).
  - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl (bsc#1225752, CVE-2024-36912).
  - Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails (bsc#1225753, CVE-2024-36913).
  - commit a78a9db
  - x86/speculation, objtool: Use absolute relocations for annotations (git-fixes).
  - commit 14e0989
  - x86/head/64: Move the __head definition to <asm/init.h> (git-fixes).
  - commit 36d1750
  - x86/csum: Remove unnecessary odd handling (git-fixes).
  - commit 439ef62
  - x86/csum: Fix clang -Wuninitialized in csum_partial() (git-fixes).
  - commit 98db437
  - x86/csum: Improve performance of `csum_partial` (git-fixes).
  - commit 131cca3
  - x86/boot: Ignore NMIs during very early boot (git-fixes).
  - commit 3c94948
  - x86/asm: Fix build of UML with KASAN (git-fixes).
  - commit 89fc5d7
  - blacklist.conf: Blacklist useless revert
  - commit 0a21e69
  - tunnels: fix out of bounds access when building IPv6 PMTU error (bsc#1222328 CVE-2024-26665).
  - commit f28b881
  - SUNRPC: avoid soft lockup when transmitting UDP to reachable
    server (bsc#1225272).
  - commit 3fc313b

++++ mozilla-nss:

  - Added nss-fips-safe-memset.patch, fixing bsc#1222811.
  - Removed some dead code from nss-fips-constructor-self-tests.patch.
  - Rebased nss-fips-approved-crypto-non-ec.patch on above changes.
  - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813,
    bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118.
  - Updated nss-fips-approved-crypto-non-ec.patch and
    nss-fips-constructor-self-tests.patch, fixing bsc#1222807,
    bsc#1222828, bsc#1222834.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804,
    bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116.
  - update to NSS 3.101.1
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
  - update to NSS 3.101
    * bmo#1900413 - add diagnostic assertions for SFTKObject refcount.
    * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed
    * bmo#1899883 - fix formatting issues.
    * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS.
    * bmo#1899593 - remove invalid acvp fuzz test vectors.
    * bmo#1898830 - pad short P-384 and P-521 signatures gtests.
    * bmo#1898627 - remove unused FreeBL ECC code.
    * bmo#1898830 - pad short P-384 and P-521 signatures.
    * bmo#1898825 - be less strict about ECDSA private key length.
    * bmo#1854439 - Integrate HACL* P-521.
    * bmo#1854438 - Integrate HACL* P-384.
    * bmo#1898074 - memory leak in create_objects_from_handles.
    * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1748105 - clean up escape handling
    * bmo#1896353 - Use lib::pkix as default validator instead of the old-one
    * bmo#1827444 - Need to add high level support for PQ signing.
    * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken
    * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects
    * bmo#1793811 - Implement support for PBMAC1 in PKCS#12
    * bmo#1897487 - disable VLA warnings for fuzz builds.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1893334 - add PK11_ReadDistrustAfterAttribute.
    * bmo#215997  - Clang-formatting of SEC_GetMgfTypeByOidTag update
    * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure
    * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile.
    * bmo#1830415 - Switch to the mozillareleases/image_builder image
  - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain)
  - Remove part of nss-fips-zeroization.patch that got removed upstream
  - update to NSS 3.100
  - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for
    faster Xyber operations.
  - bmo#1893752 - remove ckcapi.
  - bmo#1893162 - avoid a potential PK11GenericObject memory leak.
  - bmo#671060  - Remove incomplete ESDH code.
  - bmo#215997  - Decrypt RSA OAEP encrypted messages.
  - bmo#1887996 - Fix certutil CRLDP URI code.
  - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys.
  - bmo#676118  - Add ability to encrypt and decrypt CMS messages using ECDH.
  - bmo#676100  - Correct Templates for key agreement in smime/cmsasn.c.
  - bmo#1548723 - Moving the decodedCert allocation to NSS.
  - bmo#1885404 - Allow developers to speed up repeated local execution
    of NSS tests that depend on certificates.
  - update to NSS 3.99
    * Removing check for message len in ed25519 (bmo#1325335)
    * add ed25519 to SECU_ecName2params. (bmo#1884276)
    * add EdDSA wycheproof tests. (bmo#1325335)
    * nss/lib layer code for EDDSA. (bmo#1325335)
    * Adding EdDSA implementation. (bmo#1325335)
    * Exporting Certificate Compression types (bmo#1881027)
    * Updating ACVP docker to rust 1.74 (bmo#1880857)
    * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335)
    * Add NSS_CMSRecipient_IsSupported. (bmo#1877730)
  - update to NSS 3.98
    * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption
    in TLS
    * bmo#1879513 - Certificate Compression: enabling the check that
    the compression was advertised
    * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha
    * bmo#1879945 - Remove Email trust bit from OISTE WISeKey
    Global Root GC CA
    * bmo#1877344 - Replace `distutils.spawn.find_executable` with
    `shutil.which` within `mach` in `nss`
    * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to
    support Certificate compression
    * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation
    * bmo#1875356 - Add valgrind annotations to freebl kyber operations
    for constant-time execution tests
    * bmo#1870673 - Set nssckbi version number to 2.66
    * bmo#1874017 - Add Telekom Security roots
    * bmo#1873095 - Add D-Trust 2022 S/MIME roots
    * bmo#1865450 - Remove expired Security Communication RootCA1 root
    * bmo#1876179 - move keys to a slot that supports concatenation in
    PK11_ConcatSymKeys
    * bmo#1876800 - remove unmaintained tls-interop tests
    * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim
    flags
    * bmo#1874937 - bogo: add support for the -curves shim flag and
    update Kyber expectations
    * bmo#1874937 - bogo: adjust expectation for a key usage bit test
    * bmo#1757758 - mozpkix: add option to ignore invalid subject
    alternative names
    * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value
    * bmo#1876390 - take ownership of ecckilla shims
    * bmo#1874458 - add valgrind annotations to freebl/ec.c
    * bmo#864039  - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip
    * bmo#1875965 - Update zlib to 1.3.1
  - Use %patch -P N instead of deprecated %patchN.
  - update to NSS 3.97
    * bmo#1875506 - make Xyber768d00 opt-in by policy
    * bmo#1871631 - add libssl support for xyber768d00
    * bmo#1871630 - add PK11_ConcatSymKeys
    * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken
    * bmo#1871152 - add a FreeBL API for Kyber
    * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff
    * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo
    * bmo#1835828 - Removing the calls to RSA Blind from loader.*
    * bmo#1874111 - fix worker type for level3 mac tasks
    * bmo#1835828 - RSA Blind implementation
    * bmo#1869642 - Remove DSA selftests
    * bmo#1873296 - read KWP testvectors from JSON
    * bmo#1822450 - Backed out changeset dcb174139e4f
    * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation
    * bmo#1871219 - Wrap CC shell commands in gyp expansions
  - update to NSS 3.96.1
    * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh
    * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups)
    * bmo#1867408 - add a defensive check for large ssl_DefSend return values
    * bmo#1869378 - Add dependency to the taskcluster script for Darwin
    * bmo#1869378 - Upgrade version of the MacOS worker for the CI
  - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with
    explicit default trust flags" test needs longer than the allowed
    6 seconds on s390x
  - update to NSS 3.95
    * bmo#1842932 - Bump builtins version number.
    * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion
    Firmaprofesional CIF A62634068 root cert.
    * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates
    * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS.
    * bmo#1850982 - Remove Camerfirma root certificates from NSS.
    * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional
    Certificate.
    * bmo#1860670 - Add four Commscope root certificates to NSS.
    * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates.
    * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL*
    * bmo#1861728 - Include P-256 Scalar Validation from HACL*.
    * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes
    256 ECC without DER wrapping at the softoken level
    * bmo#1837987 - Add means to provide library parameters to C_Initialize
    * bmo#1573097 - clang format
    * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection.
    * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber
    * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber
    * bmo#1573097 - Fix Invalid casts in instance.c
  - update to NSS 3.94
    * bmo#1853737 - Updated code and commit ID for HACL*
    * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with
    current NSS
    * bmo#1827303 - Softoken C_ calls should use system FIPS setting
    to select NSC_ or FC_ variants
    * bmo#1774659 - NSS needs a database tool that can dump the low level
    representation of the database
    * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp
    * bmo#1852179 - avoid implicit conversion for ByteString
    * bmo#1818766 - update rust version for acvp docker
    * bmo#1852011 - Moving the init function of the mpi_ints before
    clean-up in ec.c
    * bmo#1615555 - P-256 ECDH and ECDSA from HACL*
    * bmo#1840510 - Add ACVP test vectors to the repository
    * bmo#1849077 - Stop relying on std::basic_string<uint8_t>
    * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp
  - rebased patches
  - added nss-fips-test.patch to fix broken test
  - Update to NSS 3.93:
    * bmo#1849471 - Update zlib in NSS to 1.3.
    * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs.
    * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980).
  - Rebase nss-fips-pct-pubkeys.patch.
  - update to NSS 3.92
    * bmo#1822935 - Set nssckbi version number to 2.62
    * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS
    * bmo#1839992 - Add 4 SSL.com Root CA certificates
    * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates
    * bmo#1840437 - Add LAWtrust Root CA2 (4096)
    * bmo#1822936 - Remove E-Tugra Certification Authority root
    * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root.
    * bmo#1840505 - Remove Hongkong Post Root CA 1
    * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3
    * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux
  - update to NSS 3.91
    * bmo#1837431 - Implementation of the HW support check for ADX instruction
    * bmo#1836925 - Removing the support of Curve25519
    * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData
    * bmo#1839327 - Adding args to enable-legacy-db build
    * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit
    default trust flags"
    * bmo#1837617 - Initialize flags in slot structures
    * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow
    * bmo#1829112 - Followup Fixes
    * bmo#1784253 - avoid processing unexpected inputs by checking for
    m_exptmod base sign
    * bmo#1826652 - add a limit check on order_k to avoid infinite loop
    * bmo#1834851 - Update HACL* to commit 5f6051d2
    * bmo#1753026 - add SHA3 to cryptohi and softoken
    * bmo#1753026 - HACL SHA3
    * bmo#1836781 - Disabling ASM C25519 for A but X86_64
  - removed upstreamed patch nss-fix-bmo1836925.patch
  - update to NSS 3.90.3
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1748105 - clean up escape handling.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1836925 - Disable ASM support for Curve25519.
    * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64.
  - remove upstreamed nss-fix-bmo1836925.patch

++++ mozilla-nss:

  - Added nss-fips-safe-memset.patch, fixing bsc#1222811.
  - Removed some dead code from nss-fips-constructor-self-tests.patch.
  - Rebased nss-fips-approved-crypto-non-ec.patch on above changes.
  - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813,
    bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118.
  - Updated nss-fips-approved-crypto-non-ec.patch and
    nss-fips-constructor-self-tests.patch, fixing bsc#1222807,
    bsc#1222828, bsc#1222834.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804,
    bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116.
  - update to NSS 3.101.1
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
  - update to NSS 3.101
    * bmo#1900413 - add diagnostic assertions for SFTKObject refcount.
    * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed
    * bmo#1899883 - fix formatting issues.
    * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS.
    * bmo#1899593 - remove invalid acvp fuzz test vectors.
    * bmo#1898830 - pad short P-384 and P-521 signatures gtests.
    * bmo#1898627 - remove unused FreeBL ECC code.
    * bmo#1898830 - pad short P-384 and P-521 signatures.
    * bmo#1898825 - be less strict about ECDSA private key length.
    * bmo#1854439 - Integrate HACL* P-521.
    * bmo#1854438 - Integrate HACL* P-384.
    * bmo#1898074 - memory leak in create_objects_from_handles.
    * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1748105 - clean up escape handling
    * bmo#1896353 - Use lib::pkix as default validator instead of the old-one
    * bmo#1827444 - Need to add high level support for PQ signing.
    * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken
    * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects
    * bmo#1793811 - Implement support for PBMAC1 in PKCS#12
    * bmo#1897487 - disable VLA warnings for fuzz builds.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1893334 - add PK11_ReadDistrustAfterAttribute.
    * bmo#215997  - Clang-formatting of SEC_GetMgfTypeByOidTag update
    * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure
    * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile.
    * bmo#1830415 - Switch to the mozillareleases/image_builder image
  - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain)
  - Remove part of nss-fips-zeroization.patch that got removed upstream
  - update to NSS 3.100
  - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for
    faster Xyber operations.
  - bmo#1893752 - remove ckcapi.
  - bmo#1893162 - avoid a potential PK11GenericObject memory leak.
  - bmo#671060  - Remove incomplete ESDH code.
  - bmo#215997  - Decrypt RSA OAEP encrypted messages.
  - bmo#1887996 - Fix certutil CRLDP URI code.
  - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys.
  - bmo#676118  - Add ability to encrypt and decrypt CMS messages using ECDH.
  - bmo#676100  - Correct Templates for key agreement in smime/cmsasn.c.
  - bmo#1548723 - Moving the decodedCert allocation to NSS.
  - bmo#1885404 - Allow developers to speed up repeated local execution
    of NSS tests that depend on certificates.
  - update to NSS 3.99
    * Removing check for message len in ed25519 (bmo#1325335)
    * add ed25519 to SECU_ecName2params. (bmo#1884276)
    * add EdDSA wycheproof tests. (bmo#1325335)
    * nss/lib layer code for EDDSA. (bmo#1325335)
    * Adding EdDSA implementation. (bmo#1325335)
    * Exporting Certificate Compression types (bmo#1881027)
    * Updating ACVP docker to rust 1.74 (bmo#1880857)
    * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335)
    * Add NSS_CMSRecipient_IsSupported. (bmo#1877730)
  - update to NSS 3.98
    * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption
    in TLS
    * bmo#1879513 - Certificate Compression: enabling the check that
    the compression was advertised
    * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha
    * bmo#1879945 - Remove Email trust bit from OISTE WISeKey
    Global Root GC CA
    * bmo#1877344 - Replace `distutils.spawn.find_executable` with
    `shutil.which` within `mach` in `nss`
    * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to
    support Certificate compression
    * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation
    * bmo#1875356 - Add valgrind annotations to freebl kyber operations
    for constant-time execution tests
    * bmo#1870673 - Set nssckbi version number to 2.66
    * bmo#1874017 - Add Telekom Security roots
    * bmo#1873095 - Add D-Trust 2022 S/MIME roots
    * bmo#1865450 - Remove expired Security Communication RootCA1 root
    * bmo#1876179 - move keys to a slot that supports concatenation in
    PK11_ConcatSymKeys
    * bmo#1876800 - remove unmaintained tls-interop tests
    * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim
    flags
    * bmo#1874937 - bogo: add support for the -curves shim flag and
    update Kyber expectations
    * bmo#1874937 - bogo: adjust expectation for a key usage bit test
    * bmo#1757758 - mozpkix: add option to ignore invalid subject
    alternative names
    * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value
    * bmo#1876390 - take ownership of ecckilla shims
    * bmo#1874458 - add valgrind annotations to freebl/ec.c
    * bmo#864039  - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip
    * bmo#1875965 - Update zlib to 1.3.1
  - Use %patch -P N instead of deprecated %patchN.
  - update to NSS 3.97
    * bmo#1875506 - make Xyber768d00 opt-in by policy
    * bmo#1871631 - add libssl support for xyber768d00
    * bmo#1871630 - add PK11_ConcatSymKeys
    * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken
    * bmo#1871152 - add a FreeBL API for Kyber
    * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff
    * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo
    * bmo#1835828 - Removing the calls to RSA Blind from loader.*
    * bmo#1874111 - fix worker type for level3 mac tasks
    * bmo#1835828 - RSA Blind implementation
    * bmo#1869642 - Remove DSA selftests
    * bmo#1873296 - read KWP testvectors from JSON
    * bmo#1822450 - Backed out changeset dcb174139e4f
    * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation
    * bmo#1871219 - Wrap CC shell commands in gyp expansions
  - update to NSS 3.96.1
    * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh
    * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups)
    * bmo#1867408 - add a defensive check for large ssl_DefSend return values
    * bmo#1869378 - Add dependency to the taskcluster script for Darwin
    * bmo#1869378 - Upgrade version of the MacOS worker for the CI
  - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with
    explicit default trust flags" test needs longer than the allowed
    6 seconds on s390x
  - update to NSS 3.95
    * bmo#1842932 - Bump builtins version number.
    * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion
    Firmaprofesional CIF A62634068 root cert.
    * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates
    * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS.
    * bmo#1850982 - Remove Camerfirma root certificates from NSS.
    * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional
    Certificate.
    * bmo#1860670 - Add four Commscope root certificates to NSS.
    * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates.
    * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL*
    * bmo#1861728 - Include P-256 Scalar Validation from HACL*.
    * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes
    256 ECC without DER wrapping at the softoken level
    * bmo#1837987 - Add means to provide library parameters to C_Initialize
    * bmo#1573097 - clang format
    * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection.
    * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber
    * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber
    * bmo#1573097 - Fix Invalid casts in instance.c
  - update to NSS 3.94
    * bmo#1853737 - Updated code and commit ID for HACL*
    * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with
    current NSS
    * bmo#1827303 - Softoken C_ calls should use system FIPS setting
    to select NSC_ or FC_ variants
    * bmo#1774659 - NSS needs a database tool that can dump the low level
    representation of the database
    * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp
    * bmo#1852179 - avoid implicit conversion for ByteString
    * bmo#1818766 - update rust version for acvp docker
    * bmo#1852011 - Moving the init function of the mpi_ints before
    clean-up in ec.c
    * bmo#1615555 - P-256 ECDH and ECDSA from HACL*
    * bmo#1840510 - Add ACVP test vectors to the repository
    * bmo#1849077 - Stop relying on std::basic_string<uint8_t>
    * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp
  - rebased patches
  - added nss-fips-test.patch to fix broken test
  - Update to NSS 3.93:
    * bmo#1849471 - Update zlib in NSS to 1.3.
    * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs.
    * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980).
  - Rebase nss-fips-pct-pubkeys.patch.
  - update to NSS 3.92
    * bmo#1822935 - Set nssckbi version number to 2.62
    * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS
    * bmo#1839992 - Add 4 SSL.com Root CA certificates
    * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates
    * bmo#1840437 - Add LAWtrust Root CA2 (4096)
    * bmo#1822936 - Remove E-Tugra Certification Authority root
    * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root.
    * bmo#1840505 - Remove Hongkong Post Root CA 1
    * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3
    * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux
  - update to NSS 3.91
    * bmo#1837431 - Implementation of the HW support check for ADX instruction
    * bmo#1836925 - Removing the support of Curve25519
    * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData
    * bmo#1839327 - Adding args to enable-legacy-db build
    * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit
    default trust flags"
    * bmo#1837617 - Initialize flags in slot structures
    * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow
    * bmo#1829112 - Followup Fixes
    * bmo#1784253 - avoid processing unexpected inputs by checking for
    m_exptmod base sign
    * bmo#1826652 - add a limit check on order_k to avoid infinite loop
    * bmo#1834851 - Update HACL* to commit 5f6051d2
    * bmo#1753026 - add SHA3 to cryptohi and softoken
    * bmo#1753026 - HACL SHA3
    * bmo#1836781 - Disabling ASM C25519 for A but X86_64
  - removed upstreamed patch nss-fix-bmo1836925.patch
  - update to NSS 3.90.3
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1748105 - clean up escape handling.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1836925 - Disable ASM support for Curve25519.
    * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64.
  - remove upstreamed nss-fix-bmo1836925.patch

++++ mozilla-nss:

  - Added nss-fips-safe-memset.patch, fixing bsc#1222811.
  - Removed some dead code from nss-fips-constructor-self-tests.patch.
  - Rebased nss-fips-approved-crypto-non-ec.patch on above changes.
  - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813,
    bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118.
  - Updated nss-fips-approved-crypto-non-ec.patch and
    nss-fips-constructor-self-tests.patch, fixing bsc#1222807,
    bsc#1222828, bsc#1222834.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804,
    bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116.
  - update to NSS 3.101.1
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
  - update to NSS 3.101
    * bmo#1900413 - add diagnostic assertions for SFTKObject refcount.
    * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed
    * bmo#1899883 - fix formatting issues.
    * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS.
    * bmo#1899593 - remove invalid acvp fuzz test vectors.
    * bmo#1898830 - pad short P-384 and P-521 signatures gtests.
    * bmo#1898627 - remove unused FreeBL ECC code.
    * bmo#1898830 - pad short P-384 and P-521 signatures.
    * bmo#1898825 - be less strict about ECDSA private key length.
    * bmo#1854439 - Integrate HACL* P-521.
    * bmo#1854438 - Integrate HACL* P-384.
    * bmo#1898074 - memory leak in create_objects_from_handles.
    * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1748105 - clean up escape handling
    * bmo#1896353 - Use lib::pkix as default validator instead of the old-one
    * bmo#1827444 - Need to add high level support for PQ signing.
    * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken
    * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects
    * bmo#1793811 - Implement support for PBMAC1 in PKCS#12
    * bmo#1897487 - disable VLA warnings for fuzz builds.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1893334 - add PK11_ReadDistrustAfterAttribute.
    * bmo#215997  - Clang-formatting of SEC_GetMgfTypeByOidTag update
    * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure
    * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile.
    * bmo#1830415 - Switch to the mozillareleases/image_builder image
  - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain)
  - Remove part of nss-fips-zeroization.patch that got removed upstream
  - update to NSS 3.100
  - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for
    faster Xyber operations.
  - bmo#1893752 - remove ckcapi.
  - bmo#1893162 - avoid a potential PK11GenericObject memory leak.
  - bmo#671060  - Remove incomplete ESDH code.
  - bmo#215997  - Decrypt RSA OAEP encrypted messages.
  - bmo#1887996 - Fix certutil CRLDP URI code.
  - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys.
  - bmo#676118  - Add ability to encrypt and decrypt CMS messages using ECDH.
  - bmo#676100  - Correct Templates for key agreement in smime/cmsasn.c.
  - bmo#1548723 - Moving the decodedCert allocation to NSS.
  - bmo#1885404 - Allow developers to speed up repeated local execution
    of NSS tests that depend on certificates.
  - update to NSS 3.99
    * Removing check for message len in ed25519 (bmo#1325335)
    * add ed25519 to SECU_ecName2params. (bmo#1884276)
    * add EdDSA wycheproof tests. (bmo#1325335)
    * nss/lib layer code for EDDSA. (bmo#1325335)
    * Adding EdDSA implementation. (bmo#1325335)
    * Exporting Certificate Compression types (bmo#1881027)
    * Updating ACVP docker to rust 1.74 (bmo#1880857)
    * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335)
    * Add NSS_CMSRecipient_IsSupported. (bmo#1877730)
  - update to NSS 3.98
    * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption
    in TLS
    * bmo#1879513 - Certificate Compression: enabling the check that
    the compression was advertised
    * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha
    * bmo#1879945 - Remove Email trust bit from OISTE WISeKey
    Global Root GC CA
    * bmo#1877344 - Replace `distutils.spawn.find_executable` with
    `shutil.which` within `mach` in `nss`
    * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to
    support Certificate compression
    * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation
    * bmo#1875356 - Add valgrind annotations to freebl kyber operations
    for constant-time execution tests
    * bmo#1870673 - Set nssckbi version number to 2.66
    * bmo#1874017 - Add Telekom Security roots
    * bmo#1873095 - Add D-Trust 2022 S/MIME roots
    * bmo#1865450 - Remove expired Security Communication RootCA1 root
    * bmo#1876179 - move keys to a slot that supports concatenation in
    PK11_ConcatSymKeys
    * bmo#1876800 - remove unmaintained tls-interop tests
    * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim
    flags
    * bmo#1874937 - bogo: add support for the -curves shim flag and
    update Kyber expectations
    * bmo#1874937 - bogo: adjust expectation for a key usage bit test
    * bmo#1757758 - mozpkix: add option to ignore invalid subject
    alternative names
    * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value
    * bmo#1876390 - take ownership of ecckilla shims
    * bmo#1874458 - add valgrind annotations to freebl/ec.c
    * bmo#864039  - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip
    * bmo#1875965 - Update zlib to 1.3.1
  - Use %patch -P N instead of deprecated %patchN.
  - update to NSS 3.97
    * bmo#1875506 - make Xyber768d00 opt-in by policy
    * bmo#1871631 - add libssl support for xyber768d00
    * bmo#1871630 - add PK11_ConcatSymKeys
    * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken
    * bmo#1871152 - add a FreeBL API for Kyber
    * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff
    * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo
    * bmo#1835828 - Removing the calls to RSA Blind from loader.*
    * bmo#1874111 - fix worker type for level3 mac tasks
    * bmo#1835828 - RSA Blind implementation
    * bmo#1869642 - Remove DSA selftests
    * bmo#1873296 - read KWP testvectors from JSON
    * bmo#1822450 - Backed out changeset dcb174139e4f
    * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation
    * bmo#1871219 - Wrap CC shell commands in gyp expansions
  - update to NSS 3.96.1
    * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh
    * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups)
    * bmo#1867408 - add a defensive check for large ssl_DefSend return values
    * bmo#1869378 - Add dependency to the taskcluster script for Darwin
    * bmo#1869378 - Upgrade version of the MacOS worker for the CI
  - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with
    explicit default trust flags" test needs longer than the allowed
    6 seconds on s390x
  - update to NSS 3.95
    * bmo#1842932 - Bump builtins version number.
    * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion
    Firmaprofesional CIF A62634068 root cert.
    * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates
    * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS.
    * bmo#1850982 - Remove Camerfirma root certificates from NSS.
    * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional
    Certificate.
    * bmo#1860670 - Add four Commscope root certificates to NSS.
    * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates.
    * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL*
    * bmo#1861728 - Include P-256 Scalar Validation from HACL*.
    * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes
    256 ECC without DER wrapping at the softoken level
    * bmo#1837987 - Add means to provide library parameters to C_Initialize
    * bmo#1573097 - clang format
    * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection.
    * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber
    * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber
    * bmo#1573097 - Fix Invalid casts in instance.c
  - update to NSS 3.94
    * bmo#1853737 - Updated code and commit ID for HACL*
    * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with
    current NSS
    * bmo#1827303 - Softoken C_ calls should use system FIPS setting
    to select NSC_ or FC_ variants
    * bmo#1774659 - NSS needs a database tool that can dump the low level
    representation of the database
    * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp
    * bmo#1852179 - avoid implicit conversion for ByteString
    * bmo#1818766 - update rust version for acvp docker
    * bmo#1852011 - Moving the init function of the mpi_ints before
    clean-up in ec.c
    * bmo#1615555 - P-256 ECDH and ECDSA from HACL*
    * bmo#1840510 - Add ACVP test vectors to the repository
    * bmo#1849077 - Stop relying on std::basic_string<uint8_t>
    * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp
  - rebased patches
  - added nss-fips-test.patch to fix broken test
  - Update to NSS 3.93:
    * bmo#1849471 - Update zlib in NSS to 1.3.
    * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs.
    * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980).
  - Rebase nss-fips-pct-pubkeys.patch.
  - update to NSS 3.92
    * bmo#1822935 - Set nssckbi version number to 2.62
    * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS
    * bmo#1839992 - Add 4 SSL.com Root CA certificates
    * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates
    * bmo#1840437 - Add LAWtrust Root CA2 (4096)
    * bmo#1822936 - Remove E-Tugra Certification Authority root
    * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root.
    * bmo#1840505 - Remove Hongkong Post Root CA 1
    * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3
    * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux
  - update to NSS 3.91
    * bmo#1837431 - Implementation of the HW support check for ADX instruction
    * bmo#1836925 - Removing the support of Curve25519
    * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData
    * bmo#1839327 - Adding args to enable-legacy-db build
    * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit
    default trust flags"
    * bmo#1837617 - Initialize flags in slot structures
    * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow
    * bmo#1829112 - Followup Fixes
    * bmo#1784253 - avoid processing unexpected inputs by checking for
    m_exptmod base sign
    * bmo#1826652 - add a limit check on order_k to avoid infinite loop
    * bmo#1834851 - Update HACL* to commit 5f6051d2
    * bmo#1753026 - add SHA3 to cryptohi and softoken
    * bmo#1753026 - HACL SHA3
    * bmo#1836781 - Disabling ASM C25519 for A but X86_64
  - removed upstreamed patch nss-fix-bmo1836925.patch
  - update to NSS 3.90.3
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1748105 - clean up escape handling.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1836925 - Disable ASM support for Curve25519.
    * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64.
  - remove upstreamed nss-fix-bmo1836925.patch

++++ mozilla-nss:

  - Added nss-fips-safe-memset.patch, fixing bsc#1222811.
  - Removed some dead code from nss-fips-constructor-self-tests.patch.
  - Rebased nss-fips-approved-crypto-non-ec.patch on above changes.
  - Added nss-fips-aes-gcm-restrict.patch, fixing bsc#1222830.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222813,
    bsc#1222814, bsc#1222821, bsc#1222822, bsc#1224118.
  - Updated nss-fips-approved-crypto-non-ec.patch and
    nss-fips-constructor-self-tests.patch, fixing bsc#1222807,
    bsc#1222828, bsc#1222834.
  - Updated nss-fips-approved-crypto-non-ec.patch, fixing bsc#1222804,
    bsc#1222826, bsc#1222833, bsc#1224113, bsc#1224115, bsc#1224116.
  - update to NSS 3.101.1
    * bmo#1901932 - missing sqlite header.
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
  - update to NSS 3.101
    * bmo#1900413 - add diagnostic assertions for SFTKObject refcount.
    * bmo#1899759 - freeing the slot in DeleteCertAndKey if authentication failed
    * bmo#1899883 - fix formatting issues.
    * bmo#1889671 - Add Firmaprofesional CA Root-A Web to NSS.
    * bmo#1899593 - remove invalid acvp fuzz test vectors.
    * bmo#1898830 - pad short P-384 and P-521 signatures gtests.
    * bmo#1898627 - remove unused FreeBL ECC code.
    * bmo#1898830 - pad short P-384 and P-521 signatures.
    * bmo#1898825 - be less strict about ECDSA private key length.
    * bmo#1854439 - Integrate HACL* P-521.
    * bmo#1854438 - Integrate HACL* P-384.
    * bmo#1898074 - memory leak in create_objects_from_handles.
    * bmo#1898858 - ensure all input is consumed in a few places in mozilla::pkix
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1748105 - clean up escape handling
    * bmo#1896353 - Use lib::pkix as default validator instead of the old-one
    * bmo#1827444 - Need to add high level support for PQ signing.
    * bmo#1548723 - Certificate Compression: changing the allocation/freeing of buffer + Improving the documentation
    * bmo#1884444 - SMIME/CMS and PKCS #12 do not integrate with modern NSS policy
    * bmo#1893404 - Allow for non-full length ecdsa signature when using softoken
    * bmo#1830415 - Modification of .taskcluster.yml due to mozlint indent defects
    * bmo#1793811 - Implement support for PBMAC1 in PKCS#12
    * bmo#1897487 - disable VLA warnings for fuzz builds.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1893334 - add PK11_ReadDistrustAfterAttribute.
    * bmo#215997  - Clang-formatting of SEC_GetMgfTypeByOidTag update
    * bmo#1895012 - Set SEC_ERROR_LIBRARY_FAILURE on self-test failure
    * bmo#1894572 - sftk_getParameters(): Fix fallback to default variable after error with configfile.
    * bmo#1830415 - Switch to the mozillareleases/image_builder image
  - Follow upstream changes in nss-fips-constructor-self-tests.patch (switch from ec_field_GFp to ec_field_plain)
  - Remove part of nss-fips-zeroization.patch that got removed upstream
  - update to NSS 3.100
  - bmo#1893029 - merge pk11_kyberSlotList into pk11_ecSlotList for
    faster Xyber operations.
  - bmo#1893752 - remove ckcapi.
  - bmo#1893162 - avoid a potential PK11GenericObject memory leak.
  - bmo#671060  - Remove incomplete ESDH code.
  - bmo#215997  - Decrypt RSA OAEP encrypted messages.
  - bmo#1887996 - Fix certutil CRLDP URI code.
  - bmo#1890069 - Don't set CKA_DERIVE for CKK_EC_EDWARDS private keys.
  - bmo#676118  - Add ability to encrypt and decrypt CMS messages using ECDH.
  - bmo#676100  - Correct Templates for key agreement in smime/cmsasn.c.
  - bmo#1548723 - Moving the decodedCert allocation to NSS.
  - bmo#1885404 - Allow developers to speed up repeated local execution
    of NSS tests that depend on certificates.
  - update to NSS 3.99
    * Removing check for message len in ed25519 (bmo#1325335)
    * add ed25519 to SECU_ecName2params. (bmo#1884276)
    * add EdDSA wycheproof tests. (bmo#1325335)
    * nss/lib layer code for EDDSA. (bmo#1325335)
    * Adding EdDSA implementation. (bmo#1325335)
    * Exporting Certificate Compression types (bmo#1881027)
    * Updating ACVP docker to rust 1.74 (bmo#1880857)
    * Updating HACL* to 0f136f28935822579c244f287e1d2a1908a7e552 (bmo#1325335)
    * Add NSS_CMSRecipient_IsSupported. (bmo#1877730)
  - update to NSS 3.98
    * bmo#1780432 - (CVE-2023-5388) Timing attack against RSA decryption
    in TLS
    * bmo#1879513 - Certificate Compression: enabling the check that
    the compression was advertised
    * bmo#1831552 - Move Windows workers to nss-1/b-win2022-alpha
    * bmo#1879945 - Remove Email trust bit from OISTE WISeKey
    Global Root GC CA
    * bmo#1877344 - Replace `distutils.spawn.find_executable` with
    `shutil.which` within `mach` in `nss`
    * bmo#1548723 - Certificate Compression: Updating nss_bogo_shim to
    support Certificate compression
    * bmo#1548723 - TLS Certificate Compression (RFC 8879) Implementation
    * bmo#1875356 - Add valgrind annotations to freebl kyber operations
    for constant-time execution tests
    * bmo#1870673 - Set nssckbi version number to 2.66
    * bmo#1874017 - Add Telekom Security roots
    * bmo#1873095 - Add D-Trust 2022 S/MIME roots
    * bmo#1865450 - Remove expired Security Communication RootCA1 root
    * bmo#1876179 - move keys to a slot that supports concatenation in
    PK11_ConcatSymKeys
    * bmo#1876800 - remove unmaintained tls-interop tests
    * bmo#1874937 - bogo: add support for the -ipv6 and -shim-id shim
    flags
    * bmo#1874937 - bogo: add support for the -curves shim flag and
    update Kyber expectations
    * bmo#1874937 - bogo: adjust expectation for a key usage bit test
    * bmo#1757758 - mozpkix: add option to ignore invalid subject
    alternative names
    * bmo#1841029 - Fix selfserv not stripping `publicname:` from -X value
    * bmo#1876390 - take ownership of ecckilla shims
    * bmo#1874458 - add valgrind annotations to freebl/ec.c
    * bmo#864039  - PR_INADDR_ANY needs PR_htonl before assignment to inet.ip
    * bmo#1875965 - Update zlib to 1.3.1
  - Use %patch -P N instead of deprecated %patchN.
  - update to NSS 3.97
    * bmo#1875506 - make Xyber768d00 opt-in by policy
    * bmo#1871631 - add libssl support for xyber768d00
    * bmo#1871630 - add PK11_ConcatSymKeys
    * bmo#1775046 - add Kyber and a PKCS#11 KEM interface to softoken
    * bmo#1871152 - add a FreeBL API for Kyber
    * bmo#1826451 - part 2: vendor github.com/pq-crystals/kyber/commit/e0d1c6ff
    * bmo#1826451 - part 1: add a script for vendoring kyber from pq-crystals repo
    * bmo#1835828 - Removing the calls to RSA Blind from loader.*
    * bmo#1874111 - fix worker type for level3 mac tasks
    * bmo#1835828 - RSA Blind implementation
    * bmo#1869642 - Remove DSA selftests
    * bmo#1873296 - read KWP testvectors from JSON
    * bmo#1822450 - Backed out changeset dcb174139e4f
    * bmo#1822450 - Fix CKM_PBE_SHA1_DES2_EDE_CBC derivation
    * bmo#1871219 - Wrap CC shell commands in gyp expansions
  - update to NSS 3.96.1
    * bmo#1869408 - Use pypi dependencies for MacOS worker in ./build_gyp.sh
    * bmo#1830978 - p7sign: add -a hash and -u certusage (also p7verify cleanups)
    * bmo#1867408 - add a defensive check for large ssl_DefSend return values
    * bmo#1869378 - Add dependency to the taskcluster script for Darwin
    * bmo#1869378 - Upgrade version of the MacOS worker for the CI
  - add nss-allow-slow-tests-s390x.patch: "certutil dump keys with
    explicit default trust flags" test needs longer than the allowed
    6 seconds on s390x
  - update to NSS 3.95
    * bmo#1842932 - Bump builtins version number.
    * bmo#1851044 - Remove Email trust bit from Autoridad de Certificacion
    Firmaprofesional CIF A62634068 root cert.
    * bmo#1855318 - Remove 4 DigiCert (Symantec/Verisign) Root Certificates
    * bmo#1851049 - Remove 3 TrustCor Root Certificates from NSS.
    * bmo#1850982 - Remove Camerfirma root certificates from NSS.
    * bmo#1842935 - Remove old Autoridad de Certificacion Firmaprofesional
    Certificate.
    * bmo#1860670 - Add four Commscope root certificates to NSS.
    * bmo#1850598 - Add TrustAsia Global Root CA G3 and G4 root certificates.
    * bmo#1863605 - Include P-384 and P-521 Scalar Validation from HACL*
    * bmo#1861728 - Include P-256 Scalar Validation from HACL*.
    * bmo#1861265 - After the HACL 256 ECC patch, NSS incorrectly encodes
    256 ECC without DER wrapping at the softoken level
    * bmo#1837987 - Add means to provide library parameters to C_Initialize
    * bmo#1573097 - clang format
    * bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection.
    * bmo#1858241 - Typo in ssl3_AppendHandshakeNumber
    * bmo#1858241 - Introducing input check of ssl3_AppendHandshakeNumber
    * bmo#1573097 - Fix Invalid casts in instance.c
  - update to NSS 3.94
    * bmo#1853737 - Updated code and commit ID for HACL*
    * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with
    current NSS
    * bmo#1827303 - Softoken C_ calls should use system FIPS setting
    to select NSC_ or FC_ variants
    * bmo#1774659 - NSS needs a database tool that can dump the low level
    representation of the database
    * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp
    * bmo#1852179 - avoid implicit conversion for ByteString
    * bmo#1818766 - update rust version for acvp docker
    * bmo#1852011 - Moving the init function of the mpi_ints before
    clean-up in ec.c
    * bmo#1615555 - P-256 ECDH and ECDSA from HACL*
    * bmo#1840510 - Add ACVP test vectors to the repository
    * bmo#1849077 - Stop relying on std::basic_string<uint8_t>
    * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp
  - rebased patches
  - added nss-fips-test.patch to fix broken test
  - Update to NSS 3.93:
    * bmo#1849471 - Update zlib in NSS to 1.3.
    * bmo#1848183 - softoken: iterate hashUpdate calls for long inputs.
    * bmo#1813401 - regenerate NameConstraints test certificates (boo#1214980).
  - Rebase nss-fips-pct-pubkeys.patch.
  - update to NSS 3.92
    * bmo#1822935 - Set nssckbi version number to 2.62
    * bmo#1833270 - Add 4 Atos TrustedRoot Root CA certificates to NSS
    * bmo#1839992 - Add 4 SSL.com Root CA certificates
    * bmo#1840429 - Add Sectigo E46 and R46 Root CA certificates
    * bmo#1840437 - Add LAWtrust Root CA2 (4096)
    * bmo#1822936 - Remove E-Tugra Certification Authority root
    * bmo#1827224 - Remove Camerfirma Chambers of Commerce Root.
    * bmo#1840505 - Remove Hongkong Post Root CA 1
    * bmo#1842928 - Remove E-Tugra Global Root CA ECC v3 and RSA v3
    * bmo#1842937 - Avoid redefining BYTE_ORDER on hppa Linux
  - update to NSS 3.91
    * bmo#1837431 - Implementation of the HW support check for ADX instruction
    * bmo#1836925 - Removing the support of Curve25519
    * bmo#1839795 - Fix comment about the addition of ticketSupportsEarlyData
    * bmo#1839327 - Adding args to enable-legacy-db build
    * bmo#1835357 - dbtests.sh failure in "certutil dump keys with explicit
    default trust flags"
    * bmo#1837617 - Initialize flags in slot structures
    * bmo#1835425 - Improve the length check of RSA input to avoid heap overflow
    * bmo#1829112 - Followup Fixes
    * bmo#1784253 - avoid processing unexpected inputs by checking for
    m_exptmod base sign
    * bmo#1826652 - add a limit check on order_k to avoid infinite loop
    * bmo#1834851 - Update HACL* to commit 5f6051d2
    * bmo#1753026 - add SHA3 to cryptohi and softoken
    * bmo#1753026 - HACL SHA3
    * bmo#1836781 - Disabling ASM C25519 for A but X86_64
  - removed upstreamed patch nss-fix-bmo1836925.patch
  - update to NSS 3.90.3
    * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
    * bmo#1748105 - clean up escape handling.
    * bmo#1895032 - remove redundant AllocItem implementation.
    * bmo#1836925 - Disable ASM support for Curve25519.
    * bmo#1836781 - Disable ASM support for Curve25519 for all but X86_64.
  - remove upstreamed nss-fix-bmo1836925.patch

++++ openssh:

  - Remove empty line at the end of sshd-sle.pamd (bsc#1227456)

++++ openssh:

  - Remove empty line at the end of sshd-sle.pamd (bsc#1227456)

++++ suseconnect-ng:

  - Update version to 1.11
  - Added uname as collector
  - Added SAP workload detection
  - Added detection of container runtimes
  - Multiple fixes on ARM64 detection
  - Use `read_values` for the CPU collector on Z
  - Fixed data collection for ppc64le
  - Grab the home directory from /etc/passwd if needed (bsc#1226128)

++++ suseconnect-ng:

  - Update version to 1.11
  - Added uname as collector
  - Added SAP workload detection
  - Added detection of container runtimes
  - Multiple fixes on ARM64 detection
  - Use `read_values` for the CPU collector on Z
  - Fixed data collection for ppc64le
  - Grab the home directory from /etc/passwd if needed (bsc#1226128)

++++ suseconnect-ng:

  - Update version to 1.11
  - Added uname as collector
  - Added SAP workload detection
  - Added detection of container runtimes
  - Multiple fixes on ARM64 detection
  - Use `read_values` for the CPU collector on Z
  - Fixed data collection for ppc64le
  - Grab the home directory from /etc/passwd if needed (bsc#1226128)

++++ suseconnect-ng:

  - Update version to 1.11
  - Added uname as collector
  - Added SAP workload detection
  - Added detection of container runtimes
  - Multiple fixes on ARM64 detection
  - Use `read_values` for the CPU collector on Z
  - Fixed data collection for ppc64le
  - Grab the home directory from /etc/passwd if needed (bsc#1226128)

++++ suseconnect-ng:

  - Update version to 1.11
  - Added uname as collector
  - Added SAP workload detection
  - Added detection of container runtimes
  - Multiple fixes on ARM64 detection
  - Use `read_values` for the CPU collector on Z
  - Fixed data collection for ppc64le
  - Grab the home directory from /etc/passwd if needed (bsc#1226128)

------------------------------------------------------------------
------------------  2024-7-9  -  Jul 9 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Update requires for kiwi-systemdeps-disk-images
    On Tumbleweed several changes caused tools like strings
    or the codepage for mtools to be missing in a standard
    installation. For building disk images especially EFI
    capable ones with vendor information kiwi needs the above
    tool. This commit adds the packages providing them on
    Tumbleweed to the meta systemdeps for disk images.
    This Fixes #2585

++++ python-kiwi:

  - Update requires for kiwi-systemdeps-disk-images
    On Tumbleweed several changes caused tools like strings
    or the codepage for mtools to be missing in a standard
    installation. For building disk images especially EFI
    capable ones with vendor information kiwi needs the above
    tool. This commit adds the packages providing them on
    Tumbleweed to the meta systemdeps for disk images.
    This Fixes #2585

++++ python-kiwi:

  - Update requires for kiwi-systemdeps-disk-images
    On Tumbleweed several changes caused tools like strings
    or the codepage for mtools to be missing in a standard
    installation. For building disk images especially EFI
    capable ones with vendor information kiwi needs the above
    tool. This commit adds the packages providing them on
    Tumbleweed to the meta systemdeps for disk images.
    This Fixes #2585

++++ kernel-default:

  - Move upstreamed turbostat patch into sorted section
  - commit 768422e
  - Move out-of-tree patch to the right section
  - commit a3dba46
  - powerpc/pseries: Fix scv instruction crash with kexec
    (bsc#1194869).
  - commit 245b529
  - powerpc/prom: Add CPU info to hardware description string later
    (bsc#1215199).
  - commit 75358e1
  - kernel-binary: vdso: Own module_dir
  - commit ff69986
  - enic: Validate length of nl attributes in enic_set_vf_port
    (CVE-2024-38659 bsc#1226883).
  - commit 82dab70
  - wifi: wilc1000: fix ies_len type in connect path (git-fixes).
  - commit 857b40a

++++ kernel-default:

  - Move upstreamed turbostat patch into sorted section
  - commit 768422e
  - Move out-of-tree patch to the right section
  - commit a3dba46
  - powerpc/pseries: Fix scv instruction crash with kexec
    (bsc#1194869).
  - commit 245b529
  - powerpc/prom: Add CPU info to hardware description string later
    (bsc#1215199).
  - commit 75358e1
  - kernel-binary: vdso: Own module_dir
  - commit ff69986
  - enic: Validate length of nl attributes in enic_set_vf_port
    (CVE-2024-38659 bsc#1226883).
  - commit 82dab70
  - wifi: wilc1000: fix ies_len type in connect path (git-fixes).
  - commit 857b40a

++++ kernel-default:

  - Move upstreamed turbostat patch into sorted section
  - commit 768422e
  - Move out-of-tree patch to the right section
  - commit a3dba46
  - powerpc/pseries: Fix scv instruction crash with kexec
    (bsc#1194869).
  - commit 245b529
  - powerpc/prom: Add CPU info to hardware description string later
    (bsc#1215199).
  - commit 75358e1
  - kernel-binary: vdso: Own module_dir
  - commit ff69986
  - enic: Validate length of nl attributes in enic_set_vf_port
    (CVE-2024-38659 bsc#1226883).
  - commit 82dab70
  - wifi: wilc1000: fix ies_len type in connect path (git-fixes).
  - commit 857b40a

++++ libzypp:

  - Keep UrlResolverPlugin API public (fixes #560)
  - Blacklist /snap executables for 'zypper ps' (bsc#1226014)
  - Fix handling of buddies when applying locks (bsc#1225267)
    Buddy pairs (like -release package and product) internally share
    the same status object. When applying locks from query results
    the locked bit must be set if either item is locked.
  - version 17.35.2 (35)

++++ libzypp:

  - Keep UrlResolverPlugin API public (fixes #560)
  - Blacklist /snap executables for 'zypper ps' (bsc#1226014)
  - Fix handling of buddies when applying locks (bsc#1225267)
    Buddy pairs (like -release package and product) internally share
    the same status object. When applying locks from query results
    the locked bit must be set if either item is locked.
  - version 17.35.2 (35)

++++ libzypp:

  - Keep UrlResolverPlugin API public (fixes #560)
  - Blacklist /snap executables for 'zypper ps' (bsc#1226014)
  - Fix handling of buddies when applying locks (bsc#1225267)
    Buddy pairs (like -release package and product) internally share
    the same status object. When applying locks from query results
    the locked bit must be set if either item is locked.
  - version 17.35.2 (35)

++++ libzypp:

  - Keep UrlResolverPlugin API public (fixes #560)
  - Blacklist /snap executables for 'zypper ps' (bsc#1226014)
  - Fix handling of buddies when applying locks (bsc#1225267)
    Buddy pairs (like -release package and product) internally share
    the same status object. When applying locks from query results
    the locked bit must be set if either item is locked.
  - version 17.35.2 (35)

++++ libzypp:

  - Keep UrlResolverPlugin API public (fixes #560)
  - Blacklist /snap executables for 'zypper ps' (bsc#1226014)
  - Fix handling of buddies when applying locks (bsc#1225267)
    Buddy pairs (like -release package and product) internally share
    the same status object. When applying locks from query results
    the locked bit must be set if either item is locked.
  - version 17.35.2 (35)

++++ nvidia-open-driver-G06-signed:

  - Update to 550.100 (boo#1227575)
    * Fixed a bug that caused OpenGL triple buffering to behave like
    double buffering.

------------------------------------------------------------------
------------------  2024-7-8  -  Jul 8 2024  -------------------
------------------------------------------------------------------

++++ ca-certificates-mozilla:

  - Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
  - Added: FIRMAPROFESIONAL CA ROOT-A WEB
  - Distrust: GLOBALTRUST 2020

++++ ca-certificates-mozilla:

  - Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
  - Added: FIRMAPROFESIONAL CA ROOT-A WEB
  - Distrust: GLOBALTRUST 2020

++++ ca-certificates-mozilla:

  - Updated to 2.68 state of Mozilla SSL root CAs (bsc#1227525)
  - Added: FIRMAPROFESIONAL CA ROOT-A WEB
  - Distrust: GLOBALTRUST 2020

++++ cups:

  - Replaced avoid_C99_mode_for_loop_initial_declarations.patch
    which is now the upstream fix
    https://github.com/OpenPrinting/cups/commit/a2b8872ea95564e065e3a08e2aa12a15515bc993
    see https://github.com/OpenPrinting/cups/issues/1000
    and https://github.com/OpenPrinting/cups/pull/1004

++++ cups:

  - Replaced avoid_C99_mode_for_loop_initial_declarations.patch
    which is now the upstream fix
    https://github.com/OpenPrinting/cups/commit/a2b8872ea95564e065e3a08e2aa12a15515bc993
    see https://github.com/OpenPrinting/cups/issues/1000
    and https://github.com/OpenPrinting/cups/pull/1004

++++ dracut:

  - Update to version 059+suse.567.gadd3169d:
    * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
    * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
    * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)

++++ dracut:

  - Update to version 059+suse.567.gadd3169d:
    * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
    * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
    * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)

++++ dracut:

  - Update to version 059+suse.567.gadd3169d:
    * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
    * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
    * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)

++++ dracut:

  - Update to version 059+suse.567.gadd3169d:
    * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
    * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
    * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)

++++ dracut:

  - Update to version 059+suse.567.gadd3169d:
    * feat(crypt): force the inclusion of crypttab entries with x-initrd.attach (bsc#1226529)
    * fix(mdraid): try to assemble the missing raid device (bsc#1226412)
    * fix(dracut-install): continue parsing if ldd prints "cannot be preloaded" (bsc#1208690)

++++ python-kiwi:

  - Supplements are not understood by Debian/Ubuntu

++++ python-kiwi:

  - Supplements are not understood by Debian/Ubuntu

++++ python-kiwi:

  - Supplements are not understood by Debian/Ubuntu

++++ kernel-default:

  - net/dcb: check for detached device before executing callbacks
    (bsc#1215587).
  - commit c563440
  - Update patches.suse/atm-Fix-Use-After-Free-in-do_vcc_ioctl.patch
    (git-fixes bsc#1218730 CVE-2023-51780).
  - commit 93588a3
  - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
    (bsc#1223570 ltc#205770).
  - commit d4edfeb
  - crypto/ecdsa: make ecdsa_ecc_ctx_deinit() to zeroize the public
    key (bsc#1222768).
  - commit 817f8be
  - crypto/ecdh: make ecdh_compute_value() to zeroize the public
    key (bsc#1222768).
  - commit 3f5391b
  - PCI: Do not wait for disconnected devices when resuming
    (git-fixes).
  - commit f7f9960
  - powerpc/rtas: Prevent Spectre v1 gadget construction in
    sys_rtas() (bsc#1227487).
  - commit 42da489
  - Enable CONFIG_SCHED_CLUSTER=y on arm64 (jsc#PED-8701).
  - commit 9157a3d
  - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
    (git-fixes).
  - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents (git-fixes).
  - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
    (git-fixes).
  - commit 1a2b239
  - nfs: drop the incorrect assertion in nfs_swap_rw() (git-fixes).
  - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
    (git-fixes).
  - SUNRPC: return proper error from gss_wrap_req_priv (git-fixes).
  - NFSv4.1 enforce rootpath check in fs_location query (git-fixes).
  - SUNRPC: Fix loop termination condition in
    gss_free_in_token_pages() (git-fixes).
  - nfs: fix undefined behavior in nfs_block_bits() (git-fixes).
  - pNFS/filelayout: fixup pNfs allocation modes (git-fixes).
  - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
    (git-fixes).
  - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
    (git-fixes).
  - sunrpc: fix NFSACL RPC retry on soft mount (git-fixes).
  - nfs: keep server info for remounts (git-fixes).
  - NFSv4: Fixup smatch warning for ambiguous return (git-fixes).
  - SUNRPC: Fix gss_free_in_token_pages() (git-fixes).
  - knfsd: LOOKUP can return an illegal error value (git-fixes).
  - nfs: Handle error of rpc_proc_register() in nfs_net_init()
    (git-fixes).
  - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
    (git-fixes).
  - NFSD: Fix checksum mismatches in the duplicate reply cache
    (git-fixes).
  - commit e019385
  - Update
    patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
    (git-fixes CVE-2024-36955 bsc#1225810).
  - Update
    patches.suse/ASoC-SOF-ipc4-topology-Fix-input-format-query-of-pro.patch
    (git-fixes CVE-2024-39473 bsc#1227433).
  - Update
    patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
    (git-fixes CVE-2024-36942 bsc#1225843).
  - Update
    patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
    (stable-fixes CVE-2024-36944 bsc#1225847).
  - Update
    patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
    (stable-fixes CVE-2024-36949 bsc#1225894).
  - Update
    patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
    (stable-fixes CVE-2024-36951 bsc#1225896).
  - Update patches.suse/drm-i915-hwmon-Get-rid-of-devm.patch
    (stable-fixes CVE-2024-39479 bsc#1227443).
  - Update
    patches.suse/fbdev-savage-Handle-err-return-when-savagefb_check_v.patch
    (git-fixes CVE-2024-39475 bsc#1227435).
  - Update
    patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
    (stable-fixes CVE-2024-36950 bsc#1225895).
  - Update
    patches.suse/media-mc-Fix-graph-walk-in-media_pipeline_start.patch
    (git-fixes CVE-2024-39481 bsc#1227446).
  - Update
    patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
    (git-fixes CVE-2024-36940 bsc#1225840).
  - Update
    patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
    (git-fixes CVE-2024-36959 bsc#1225839).
  - Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
    CVE-2024-36947 bsc#1225856).
  - Update
    patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
    (git-fixes CVE-2024-36930 bsc#1225830).
  - Update
    patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
    (stable-fixes CVE-2024-36922 bsc#1225805).
  - Update
    patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
    (git-fixes CVE-2024-36941 bsc#1225835).
  - commit ffdc766
  - Update
    patches.suse/crypto-rsa-add-a-check-for-allocation-failure.patch
    (bsc#1222775 CVE-2023-52472 bsc#1220430 bsc#1220427).
  - commit 7754b95

++++ kernel-default:

  - net/dcb: check for detached device before executing callbacks
    (bsc#1215587).
  - commit c563440
  - Update patches.suse/atm-Fix-Use-After-Free-in-do_vcc_ioctl.patch
    (git-fixes bsc#1218730 CVE-2023-51780).
  - commit 93588a3
  - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
    (bsc#1223570 ltc#205770).
  - commit d4edfeb
  - crypto/ecdsa: make ecdsa_ecc_ctx_deinit() to zeroize the public
    key (bsc#1222768).
  - commit 817f8be
  - crypto/ecdh: make ecdh_compute_value() to zeroize the public
    key (bsc#1222768).
  - commit 3f5391b
  - PCI: Do not wait for disconnected devices when resuming
    (git-fixes).
  - commit f7f9960
  - powerpc/rtas: Prevent Spectre v1 gadget construction in
    sys_rtas() (bsc#1227487).
  - commit 42da489
  - Enable CONFIG_SCHED_CLUSTER=y on arm64 (jsc#PED-8701).
  - commit 9157a3d
  - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
    (git-fixes).
  - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents (git-fixes).
  - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
    (git-fixes).
  - commit 1a2b239
  - nfs: drop the incorrect assertion in nfs_swap_rw() (git-fixes).
  - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
    (git-fixes).
  - SUNRPC: return proper error from gss_wrap_req_priv (git-fixes).
  - NFSv4.1 enforce rootpath check in fs_location query (git-fixes).
  - SUNRPC: Fix loop termination condition in
    gss_free_in_token_pages() (git-fixes).
  - nfs: fix undefined behavior in nfs_block_bits() (git-fixes).
  - pNFS/filelayout: fixup pNfs allocation modes (git-fixes).
  - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
    (git-fixes).
  - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
    (git-fixes).
  - sunrpc: fix NFSACL RPC retry on soft mount (git-fixes).
  - nfs: keep server info for remounts (git-fixes).
  - NFSv4: Fixup smatch warning for ambiguous return (git-fixes).
  - SUNRPC: Fix gss_free_in_token_pages() (git-fixes).
  - knfsd: LOOKUP can return an illegal error value (git-fixes).
  - nfs: Handle error of rpc_proc_register() in nfs_net_init()
    (git-fixes).
  - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
    (git-fixes).
  - NFSD: Fix checksum mismatches in the duplicate reply cache
    (git-fixes).
  - commit e019385
  - Update
    patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
    (git-fixes CVE-2024-36955 bsc#1225810).
  - Update
    patches.suse/ASoC-SOF-ipc4-topology-Fix-input-format-query-of-pro.patch
    (git-fixes CVE-2024-39473 bsc#1227433).
  - Update
    patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
    (git-fixes CVE-2024-36942 bsc#1225843).
  - Update
    patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
    (stable-fixes CVE-2024-36944 bsc#1225847).
  - Update
    patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
    (stable-fixes CVE-2024-36949 bsc#1225894).
  - Update
    patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
    (stable-fixes CVE-2024-36951 bsc#1225896).
  - Update patches.suse/drm-i915-hwmon-Get-rid-of-devm.patch
    (stable-fixes CVE-2024-39479 bsc#1227443).
  - Update
    patches.suse/fbdev-savage-Handle-err-return-when-savagefb_check_v.patch
    (git-fixes CVE-2024-39475 bsc#1227435).
  - Update
    patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
    (stable-fixes CVE-2024-36950 bsc#1225895).
  - Update
    patches.suse/media-mc-Fix-graph-walk-in-media_pipeline_start.patch
    (git-fixes CVE-2024-39481 bsc#1227446).
  - Update
    patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
    (git-fixes CVE-2024-36940 bsc#1225840).
  - Update
    patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
    (git-fixes CVE-2024-36959 bsc#1225839).
  - Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
    CVE-2024-36947 bsc#1225856).
  - Update
    patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
    (git-fixes CVE-2024-36930 bsc#1225830).
  - Update
    patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
    (stable-fixes CVE-2024-36922 bsc#1225805).
  - Update
    patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
    (git-fixes CVE-2024-36941 bsc#1225835).
  - commit ffdc766
  - Update
    patches.suse/crypto-rsa-add-a-check-for-allocation-failure.patch
    (bsc#1222775 CVE-2023-52472 bsc#1220430 bsc#1220427).
  - commit 7754b95

++++ kernel-default:

  - net/dcb: check for detached device before executing callbacks
    (bsc#1215587).
  - commit c563440
  - Update patches.suse/atm-Fix-Use-After-Free-in-do_vcc_ioctl.patch
    (git-fixes bsc#1218730 CVE-2023-51780).
  - commit 93588a3
  - powerpc/64s/radix/kfence: map __kfence_pool at page granularity
    (bsc#1223570 ltc#205770).
  - commit d4edfeb
  - crypto/ecdsa: make ecdsa_ecc_ctx_deinit() to zeroize the public
    key (bsc#1222768).
  - commit 817f8be
  - crypto/ecdh: make ecdh_compute_value() to zeroize the public
    key (bsc#1222768).
  - commit 3f5391b
  - PCI: Do not wait for disconnected devices when resuming
    (git-fixes).
  - commit f7f9960
  - powerpc/rtas: Prevent Spectre v1 gadget construction in
    sys_rtas() (bsc#1227487).
  - commit 42da489
  - Enable CONFIG_SCHED_CLUSTER=y on arm64 (jsc#PED-8701).
  - commit 9157a3d
  - clk: qcom: clk-alpha-pll: set ALPHA_EN bit for Stromer Plus PLLs
    (git-fixes).
  - clk: qcom: gcc-sm6350: Fix gpll6* & gpll7 parents (git-fixes).
  - clk: mediatek: mt8183: Only enable runtime PM on mt8183-mfgcfg
    (git-fixes).
  - commit 1a2b239
  - nfs: drop the incorrect assertion in nfs_swap_rw() (git-fixes).
  - NFS: add barriers when testing for NFS_FSDATA_BLOCKED
    (git-fixes).
  - SUNRPC: return proper error from gss_wrap_req_priv (git-fixes).
  - NFSv4.1 enforce rootpath check in fs_location query (git-fixes).
  - SUNRPC: Fix loop termination condition in
    gss_free_in_token_pages() (git-fixes).
  - nfs: fix undefined behavior in nfs_block_bits() (git-fixes).
  - pNFS/filelayout: fixup pNfs allocation modes (git-fixes).
  - rpcrdma: fix handling for RDMA_CM_EVENT_DEVICE_REMOVAL
    (git-fixes).
  - NFS: Fix READ_PLUS when server doesn't support OP_READ_PLUS
    (git-fixes).
  - sunrpc: fix NFSACL RPC retry on soft mount (git-fixes).
  - nfs: keep server info for remounts (git-fixes).
  - NFSv4: Fixup smatch warning for ambiguous return (git-fixes).
  - SUNRPC: Fix gss_free_in_token_pages() (git-fixes).
  - knfsd: LOOKUP can return an illegal error value (git-fixes).
  - nfs: Handle error of rpc_proc_register() in nfs_net_init()
    (git-fixes).
  - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY
    (git-fixes).
  - NFSD: Fix checksum mismatches in the duplicate reply cache
    (git-fixes).
  - commit e019385
  - Update
    patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
    (git-fixes CVE-2024-36955 bsc#1225810).
  - Update
    patches.suse/ASoC-SOF-ipc4-topology-Fix-input-format-query-of-pro.patch
    (git-fixes CVE-2024-39473 bsc#1227433).
  - Update
    patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
    (git-fixes CVE-2024-36942 bsc#1225843).
  - Update
    patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
    (stable-fixes CVE-2024-36944 bsc#1225847).
  - Update
    patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
    (stable-fixes CVE-2024-36949 bsc#1225894).
  - Update
    patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
    (stable-fixes CVE-2024-36951 bsc#1225896).
  - Update patches.suse/drm-i915-hwmon-Get-rid-of-devm.patch
    (stable-fixes CVE-2024-39479 bsc#1227443).
  - Update
    patches.suse/fbdev-savage-Handle-err-return-when-savagefb_check_v.patch
    (git-fixes CVE-2024-39475 bsc#1227435).
  - Update
    patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
    (stable-fixes CVE-2024-36950 bsc#1225895).
  - Update
    patches.suse/media-mc-Fix-graph-walk-in-media_pipeline_start.patch
    (git-fixes CVE-2024-39481 bsc#1227446).
  - Update
    patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
    (git-fixes CVE-2024-36940 bsc#1225840).
  - Update
    patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
    (git-fixes CVE-2024-36959 bsc#1225839).
  - Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
    CVE-2024-36947 bsc#1225856).
  - Update
    patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
    (git-fixes CVE-2024-36930 bsc#1225830).
  - Update
    patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
    (stable-fixes CVE-2024-36922 bsc#1225805).
  - Update
    patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
    (git-fixes CVE-2024-36941 bsc#1225835).
  - commit ffdc766
  - Update
    patches.suse/crypto-rsa-add-a-check-for-allocation-failure.patch
    (bsc#1222775 CVE-2023-52472 bsc#1220430 bsc#1220427).
  - commit 7754b95

++++ nvidia-open-driver-G06-signed:

  - Use macro which is set during build but not when running
    `osc service run download_files` to make sure both source versions
    are visible for download. This way, only the correct source
    tarball will be included in the source package of its respective
    flavor but both can be downloaded (updated) simultaniously.

------------------------------------------------------------------
------------------  2024-7-6  -  Jul 6 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - drm/fbdev-generic: Fix framebuffer on big endian devices
    (git-fixes).
  - drm/nouveau: fix null pointer dereference in
    nouveau_connector_get_modes (git-fixes).
  - usb: dwc3: core: Workaround for CSR read timeout (stable-fixes).
  - usb: gadget: printer: SS+ support (stable-fixes).
  - drm/amdgpu: avoid using null object of framebuffer
    (stable-fixes).
  - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if
    LTTPR is present (stable-fixes).
  - drm/amdgpu/atomfirmware: fix parsing of vram_info
    (stable-fixes).
  - drm/nouveau/dispnv04: fix null pointer dereference in
    nv17_tv_get_ld_modes (stable-fixes).
  - drm/nouveau/dispnv04: fix null pointer dereference in
    nv17_tv_get_hd_modes (stable-fixes).
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for
    EliteBook 645/665 G11 (stable-fixes).
  - usb: typec: ucsi: Ack also failed Get Error commands
    (git-fixes).
  - iio: pressure: bmp280: Fix BMP580 temperature reading
    (stable-fixes).
  - usb: typec: ucsi: Never send a lone connector change ack
    (stable-fixes).
  - mtd: partitions: redboot: Added conversion of operands to a
    larger type (stable-fixes).
  - media: dvbdev: Initialize sbuf (stable-fixes).
  - ALSA: emux: improve patch ioctl data validation (stable-fixes).
  - drm/radeon/radeon_display: Decrease the size of allocated memory
    (stable-fixes).
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers
    that sleep (stable-fixes).
  - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
    (stable-fixes).
  - crypto: ecdh - explicitly zeroize private_key (stable-fixes).
  - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of
    pointer message (stable-fixes).
  - usb: dwc3: core: Add DWC31 version 2.00a controller
    (stable-fixes).
  - iio: pressure: fix some word spelling errors (stable-fixes).
  - commit 42cf83f
  - Drop amd-pstate patch that caused a regression on 6.6.x stable
  - commit d3672a6
  - RDMA/restrack: Fix potential invalid address access (git-fixes)
  - commit 91e323d

++++ kernel-default:

  - drm/fbdev-generic: Fix framebuffer on big endian devices
    (git-fixes).
  - drm/nouveau: fix null pointer dereference in
    nouveau_connector_get_modes (git-fixes).
  - usb: dwc3: core: Workaround for CSR read timeout (stable-fixes).
  - usb: gadget: printer: SS+ support (stable-fixes).
  - drm/amdgpu: avoid using null object of framebuffer
    (stable-fixes).
  - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if
    LTTPR is present (stable-fixes).
  - drm/amdgpu/atomfirmware: fix parsing of vram_info
    (stable-fixes).
  - drm/nouveau/dispnv04: fix null pointer dereference in
    nv17_tv_get_ld_modes (stable-fixes).
  - drm/nouveau/dispnv04: fix null pointer dereference in
    nv17_tv_get_hd_modes (stable-fixes).
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for
    EliteBook 645/665 G11 (stable-fixes).
  - usb: typec: ucsi: Ack also failed Get Error commands
    (git-fixes).
  - iio: pressure: bmp280: Fix BMP580 temperature reading
    (stable-fixes).
  - usb: typec: ucsi: Never send a lone connector change ack
    (stable-fixes).
  - mtd: partitions: redboot: Added conversion of operands to a
    larger type (stable-fixes).
  - media: dvbdev: Initialize sbuf (stable-fixes).
  - ALSA: emux: improve patch ioctl data validation (stable-fixes).
  - drm/radeon/radeon_display: Decrease the size of allocated memory
    (stable-fixes).
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers
    that sleep (stable-fixes).
  - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
    (stable-fixes).
  - crypto: ecdh - explicitly zeroize private_key (stable-fixes).
  - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of
    pointer message (stable-fixes).
  - usb: dwc3: core: Add DWC31 version 2.00a controller
    (stable-fixes).
  - iio: pressure: fix some word spelling errors (stable-fixes).
  - commit 42cf83f
  - Drop amd-pstate patch that caused a regression on 6.6.x stable
  - commit d3672a6
  - RDMA/restrack: Fix potential invalid address access (git-fixes)
  - commit 91e323d

++++ kernel-default:

  - drm/fbdev-generic: Fix framebuffer on big endian devices
    (git-fixes).
  - drm/nouveau: fix null pointer dereference in
    nouveau_connector_get_modes (git-fixes).
  - usb: dwc3: core: Workaround for CSR read timeout (stable-fixes).
  - usb: gadget: printer: SS+ support (stable-fixes).
  - drm/amdgpu: avoid using null object of framebuffer
    (stable-fixes).
  - drm/amd/display: Send DP_TOTAL_LTTPR_CNT during detection if
    LTTPR is present (stable-fixes).
  - drm/amdgpu/atomfirmware: fix parsing of vram_info
    (stable-fixes).
  - drm/nouveau/dispnv04: fix null pointer dereference in
    nv17_tv_get_ld_modes (stable-fixes).
  - drm/nouveau/dispnv04: fix null pointer dereference in
    nv17_tv_get_hd_modes (stable-fixes).
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for
    EliteBook 645/665 G11 (stable-fixes).
  - usb: typec: ucsi: Ack also failed Get Error commands
    (git-fixes).
  - iio: pressure: bmp280: Fix BMP580 temperature reading
    (stable-fixes).
  - usb: typec: ucsi: Never send a lone connector change ack
    (stable-fixes).
  - mtd: partitions: redboot: Added conversion of operands to a
    larger type (stable-fixes).
  - media: dvbdev: Initialize sbuf (stable-fixes).
  - ALSA: emux: improve patch ioctl data validation (stable-fixes).
  - drm/radeon/radeon_display: Decrease the size of allocated memory
    (stable-fixes).
  - drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers
    that sleep (stable-fixes).
  - wifi: ieee80211: check for NULL in ieee80211_mle_size_ok()
    (stable-fixes).
  - crypto: ecdh - explicitly zeroize private_key (stable-fixes).
  - soc: ti: wkup_m3_ipc: Send NULL dummy message instead of
    pointer message (stable-fixes).
  - usb: dwc3: core: Add DWC31 version 2.00a controller
    (stable-fixes).
  - iio: pressure: fix some word spelling errors (stable-fixes).
  - commit 42cf83f
  - Drop amd-pstate patch that caused a regression on 6.6.x stable
  - commit d3672a6
  - RDMA/restrack: Fix potential invalid address access (git-fixes)
  - commit 91e323d

------------------------------------------------------------------
------------------  2024-7-5  -  Jul 5 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add new builder for enclaves
    Add new EnclaveBuilder class which allows to build initrd-only
    image types. The first enclave implementation covers aws-nitro
    images produced via the eif_build tooling.

++++ python-kiwi:

  - Add new builder for enclaves
    Add new EnclaveBuilder class which allows to build initrd-only
    image types. The first enclave implementation covers aws-nitro
    images produced via the eif_build tooling.

++++ python-kiwi:

  - Add new builder for enclaves
    Add new EnclaveBuilder class which allows to build initrd-only
    image types. The first enclave implementation covers aws-nitro
    images produced via the eif_build tooling.

++++ kernel-default:

  - smb: client: fix use-after-free in smb2_query_info_compound()
    (bsc#1225489, CVE-2023-52751).
  - Refresh
    patches.suse/smb-client-fix-potential-OOBs-in-smb2_parse_contexts-.patch.
  - commit fed05d1
  - smb: client: prevent new fids from being removed by laundromat
    (git-fixes, bsc#1225172).
  - commit b3d54ea
  - smb: client: make laundromat a delayed worker (git-fixes,
    bsc#1225172).
  - commit 97932f6
  - smb3: allow controlling length of time directory entries are
    cached with dir leases (git-fixes, bsc#1225172).
  - commit c39c365
  - smb: client: do not start laundromat thread on nohandlecache
    (git-fixes, bsc#1225172).
  - commit b320db3
  - smb3: allow controlling maximum number of cached directories
    (git-fixes, bsc#1225172).
  - commit e5e6d01
  - smb3: do not start laundromat thread when dir leases disabled
    (git-fixes, bsc#1225172).
  - commit b758cab
  - cifs: Add a laundromat thread for cached directories (git-fixes,
    bsc#1225172).
  - commit b1876e3
  - bcache: fix variable length array abuse in btree_iter
    (CVE-2024-39482 bsc#1227447).
  - commit 3d0cfa1
  - mm/vmalloc: fix vmalloc which may return null if called with
    __GFP_NOFAIL (CVE-2024-39474 bsc#1227434).
  - commit 13add8a
  - selftests: make order checking verbose in msg_zerocopy selftest
    (git-fixes).
  - selftests: fix OOM in msg_zerocopy selftest (git-fixes).
  - can: kvaser_usb: Explicitly initialize family in leafimx
    driver_info struct (git-fixes).
  - bluetooth/hci: disallow setting handle bigger than
    HCI_CONN_HANDLE_MAX (git-fixes).
  - Bluetooth: ISO: Check socket flag instead of hcon (git-fixes).
  - Bluetooth: Ignore too large handle values in BIG (git-fixes).
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after
    warm reboot (git-fixes).
  - Bluetooth: hci_event: Fix setting of unicast qos interval
    (git-fixes).
  - Bluetooth: hci_bcm4377: Fix msgid release (git-fixes).
  - mac802154: fix time calculation in
    ieee802154_configure_durations() (git-fixes).
  - net: phy: phy_device: Fix PHY LED blinking code comment
    (git-fixes).
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
    (git-fixes).
  - platform/x86: toshiba_acpi: Fix quickstart quirk handling
    (git-fixes).
  - commit 3db85da

++++ kernel-default:

  - smb: client: fix use-after-free in smb2_query_info_compound()
    (bsc#1225489, CVE-2023-52751).
  - Refresh
    patches.suse/smb-client-fix-potential-OOBs-in-smb2_parse_contexts-.patch.
  - commit fed05d1
  - smb: client: prevent new fids from being removed by laundromat
    (git-fixes, bsc#1225172).
  - commit b3d54ea
  - smb: client: make laundromat a delayed worker (git-fixes,
    bsc#1225172).
  - commit 97932f6
  - smb3: allow controlling length of time directory entries are
    cached with dir leases (git-fixes, bsc#1225172).
  - commit c39c365
  - smb: client: do not start laundromat thread on nohandlecache
    (git-fixes, bsc#1225172).
  - commit b320db3
  - smb3: allow controlling maximum number of cached directories
    (git-fixes, bsc#1225172).
  - commit e5e6d01
  - smb3: do not start laundromat thread when dir leases disabled
    (git-fixes, bsc#1225172).
  - commit b758cab
  - cifs: Add a laundromat thread for cached directories (git-fixes,
    bsc#1225172).
  - commit b1876e3
  - bcache: fix variable length array abuse in btree_iter
    (CVE-2024-39482 bsc#1227447).
  - commit 3d0cfa1
  - mm/vmalloc: fix vmalloc which may return null if called with
    __GFP_NOFAIL (CVE-2024-39474 bsc#1227434).
  - commit 13add8a
  - selftests: make order checking verbose in msg_zerocopy selftest
    (git-fixes).
  - selftests: fix OOM in msg_zerocopy selftest (git-fixes).
  - can: kvaser_usb: Explicitly initialize family in leafimx
    driver_info struct (git-fixes).
  - bluetooth/hci: disallow setting handle bigger than
    HCI_CONN_HANDLE_MAX (git-fixes).
  - Bluetooth: ISO: Check socket flag instead of hcon (git-fixes).
  - Bluetooth: Ignore too large handle values in BIG (git-fixes).
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after
    warm reboot (git-fixes).
  - Bluetooth: hci_event: Fix setting of unicast qos interval
    (git-fixes).
  - Bluetooth: hci_bcm4377: Fix msgid release (git-fixes).
  - mac802154: fix time calculation in
    ieee802154_configure_durations() (git-fixes).
  - net: phy: phy_device: Fix PHY LED blinking code comment
    (git-fixes).
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
    (git-fixes).
  - platform/x86: toshiba_acpi: Fix quickstart quirk handling
    (git-fixes).
  - commit 3db85da

++++ kernel-default:

  - smb: client: fix use-after-free in smb2_query_info_compound()
    (bsc#1225489, CVE-2023-52751).
  - Refresh
    patches.suse/smb-client-fix-potential-OOBs-in-smb2_parse_contexts-.patch.
  - commit fed05d1
  - smb: client: prevent new fids from being removed by laundromat
    (git-fixes, bsc#1225172).
  - commit b3d54ea
  - smb: client: make laundromat a delayed worker (git-fixes,
    bsc#1225172).
  - commit 97932f6
  - smb3: allow controlling length of time directory entries are
    cached with dir leases (git-fixes, bsc#1225172).
  - commit c39c365
  - smb: client: do not start laundromat thread on nohandlecache
    (git-fixes, bsc#1225172).
  - commit b320db3
  - smb3: allow controlling maximum number of cached directories
    (git-fixes, bsc#1225172).
  - commit e5e6d01
  - smb3: do not start laundromat thread when dir leases disabled
    (git-fixes, bsc#1225172).
  - commit b758cab
  - cifs: Add a laundromat thread for cached directories (git-fixes,
    bsc#1225172).
  - commit b1876e3
  - bcache: fix variable length array abuse in btree_iter
    (CVE-2024-39482 bsc#1227447).
  - commit 3d0cfa1
  - mm/vmalloc: fix vmalloc which may return null if called with
    __GFP_NOFAIL (CVE-2024-39474 bsc#1227434).
  - commit 13add8a
  - selftests: make order checking verbose in msg_zerocopy selftest
    (git-fixes).
  - selftests: fix OOM in msg_zerocopy selftest (git-fixes).
  - can: kvaser_usb: Explicitly initialize family in leafimx
    driver_info struct (git-fixes).
  - bluetooth/hci: disallow setting handle bigger than
    HCI_CONN_HANDLE_MAX (git-fixes).
  - Bluetooth: ISO: Check socket flag instead of hcon (git-fixes).
  - Bluetooth: Ignore too large handle values in BIG (git-fixes).
  - Bluetooth: qca: Fix BT enable failure again for QCA6390 after
    warm reboot (git-fixes).
  - Bluetooth: hci_event: Fix setting of unicast qos interval
    (git-fixes).
  - Bluetooth: hci_bcm4377: Fix msgid release (git-fixes).
  - mac802154: fix time calculation in
    ieee802154_configure_durations() (git-fixes).
  - net: phy: phy_device: Fix PHY LED blinking code comment
    (git-fixes).
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
    (git-fixes).
  - platform/x86: toshiba_acpi: Fix quickstart quirk handling
    (git-fixes).
  - commit 3db85da

++++ nvidia-open-driver-G06-signed:

  - make buildservice happy; all sources need to be mentioned as such
    in specfile

++++ openssh:

  - Add patch from upstream to fix proxy multiplexing mode:
    * 0001-upstream-fix-proxy-multiplexing-mode_-broken-when-keystroke.patch
  - Add patch from upstream to restore correctly sigprocmask
    * 0001-upstream-correctly-restore-sigprocmask-around-ppoll.patch
  - Add patch from upstream to fix a logic error in
    ObscureKeystrokeTiming that rendered this feature ineffective,
    allowing a passive observer to detect which network packets
    contained real keystrokes (bsc#1227318, CVE-2024-39894):
    * 0001-upstream-when-sending-ObscureKeystrokeTiming-chaff-packets_.patch

++++ openssh:

  - Add patch from upstream to fix proxy multiplexing mode:
    * 0001-upstream-fix-proxy-multiplexing-mode_-broken-when-keystroke.patch
  - Add patch from upstream to restore correctly sigprocmask
    * 0001-upstream-correctly-restore-sigprocmask-around-ppoll.patch
  - Add patch from upstream to fix a logic error in
    ObscureKeystrokeTiming that rendered this feature ineffective,
    allowing a passive observer to detect which network packets
    contained real keystrokes (bsc#1227318, CVE-2024-39894):
    * 0001-upstream-when-sending-ObscureKeystrokeTiming-chaff-packets_.patch

++++ openssh:

  - Add patch from upstream to fix proxy multiplexing mode:
    * 0001-upstream-fix-proxy-multiplexing-mode_-broken-when-keystroke.patch
  - Add patch from upstream to restore correctly sigprocmask
    * 0001-upstream-correctly-restore-sigprocmask-around-ppoll.patch
  - Add patch from upstream to fix a logic error in
    ObscureKeystrokeTiming that rendered this feature ineffective,
    allowing a passive observer to detect which network packets
    contained real keystrokes (bsc#1227318, CVE-2024-39894):
    * 0001-upstream-when-sending-ObscureKeystrokeTiming-chaff-packets_.patch

------------------------------------------------------------------
------------------  2024-7-4  -  Jul 4 2024  -------------------
------------------------------------------------------------------

++++ cockpit:

  - suse_docs.patch: update documentation to point at new links (bsc#1226050)
  - remove_rh_links.patch: remove additional hardcoded RH refs (bsc#1221336)
  - disable cockpit-pcp support since it's not supported here
  - hide-pcp.patch: don't display info about cockpit-pcp - uninstallable
  - suse-microos-branding.patch: use suse ID as branding instead of sle-micro
    (bsc#1227441)

++++ cockpit:

  - suse_docs.patch: update documentation to point at new links (bsc#1226050)
  - remove_rh_links.patch: remove additional hardcoded RH refs (bsc#1221336)
  - disable cockpit-pcp support since it's not supported here
  - hide-pcp.patch: don't display info about cockpit-pcp - uninstallable
  - suse-microos-branding.patch: use suse ID as branding instead of sle-micro
    (bsc#1227441)

++++ cockpit:

  - suse_docs.patch: update documentation to point at new links (bsc#1226050)
  - remove_rh_links.patch: remove additional hardcoded RH refs (bsc#1221336)
  - disable cockpit-pcp support since it's not supported here
  - hide-pcp.patch: don't display info about cockpit-pcp - uninstallable
  - suse-microos-branding.patch: use suse ID as branding instead of sle-micro
    (bsc#1227441)

++++ cockpit:

  - suse_docs.patch: update documentation to point at new links (bsc#1226050)
  - remove_rh_links.patch: remove additional hardcoded RH refs (bsc#1221336)
  - disable cockpit-pcp support since it's not supported here
  - hide-pcp.patch: don't display info about cockpit-pcp - uninstallable
  - suse-microos-branding.patch: use suse ID as branding instead of sle-micro
    (bsc#1227441)

++++ cockpit:

  - suse_docs.patch: update documentation to point at new links (bsc#1226050)
  - remove_rh_links.patch: remove additional hardcoded RH refs (bsc#1221336)
  - disable cockpit-pcp support since it's not supported here
  - hide-pcp.patch: don't display info about cockpit-pcp - uninstallable
  - suse-microos-branding.patch: use suse ID as branding instead of sle-micro
    (bsc#1227441)

++++ python-kiwi:

  - Split out bash completion into a sub-package
    Per review of the SUSE packaging team we should split out
    the bash completion into its own sub-package to give users
    better control over the completion feature.
  - Bump version: 10.0.22 → 10.0.23
  - package: Add fully qualified provides for python3-kiwi in spec
    On SUSE distributions, currently the expectation is that packages
    built against the Python interpreter should have fully qualified
    names in the form of pythonXY-<modulename>. Additionally, all other
    Linux distributions prefer something similar in the form of
    pythonX.Y-<modulename>.
    This ensures we have those names so that distribution dependency
    generation works as expected.
  - Add support for arch selector on volumes
    The optional <volume ... arch=""/> attribute allows to create
    the volume only if it matches the specified host architecture.
    Multiple architecture names can be specified as comma separated
    list.

++++ python-kiwi:

  - Split out bash completion into a sub-package
    Per review of the SUSE packaging team we should split out
    the bash completion into its own sub-package to give users
    better control over the completion feature.
  - Bump version: 10.0.22 → 10.0.23
  - package: Add fully qualified provides for python3-kiwi in spec
    On SUSE distributions, currently the expectation is that packages
    built against the Python interpreter should have fully qualified
    names in the form of pythonXY-<modulename>. Additionally, all other
    Linux distributions prefer something similar in the form of
    pythonX.Y-<modulename>.
    This ensures we have those names so that distribution dependency
    generation works as expected.
  - Add support for arch selector on volumes
    The optional <volume ... arch=""/> attribute allows to create
    the volume only if it matches the specified host architecture.
    Multiple architecture names can be specified as comma separated
    list.

++++ python-kiwi:

  - Split out bash completion into a sub-package
    Per review of the SUSE packaging team we should split out
    the bash completion into its own sub-package to give users
    better control over the completion feature.
  - Bump version: 10.0.22 → 10.0.23
  - package: Add fully qualified provides for python3-kiwi in spec
    On SUSE distributions, currently the expectation is that packages
    built against the Python interpreter should have fully qualified
    names in the form of pythonXY-<modulename>. Additionally, all other
    Linux distributions prefer something similar in the form of
    pythonX.Y-<modulename>.
    This ensures we have those names so that distribution dependency
    generation works as expected.
  - Add support for arch selector on volumes
    The optional <volume ... arch=""/> attribute allows to create
    the volume only if it matches the specified host architecture.
    Multiple architecture names can be specified as comma separated
    list.

++++ transactional-update:

  - Version 4.7.0
  - Add plugin mechanism
    It's now possible to hook into API functions with custom
    plugins; see doc/tukit-plugins.md for details.
    [gh#openSUSE/transactional-update#122]
  - Fix missing libdir replacement for status command

++++ transactional-update:

  - Version 4.7.0
  - Add plugin mechanism
    It's now possible to hook into API functions with custom
    plugins; see doc/tukit-plugins.md for details.
    [gh#openSUSE/transactional-update#122]
  - Fix missing libdir replacement for status command

++++ kernel-default:

  - jfs: xattr: fix buffer overflow for invalid xattr
    (bsc#1227383).
  - commit ae2a0d9
  - iommu/arm-smmu-v3: Free MSIs in case of ENOMEM (git-fixes).
  - commit 2fb4aa0
  - blacklist.conf: Add d988d9a9b9d1 panic: Flush kernel log buffer at the end
  - commit 0ce2686
  - Update
    patches.suse/arm64-mm-Batch-dsb-and-isb-when-populating-pgtables.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/arm64-mm-Don-t-remap-pgtables-for-allocate-vs-populate.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/arm64-mm-Don-t-remap-pgtables-per-cont-pte-pmd-block.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch
    (jsc#PED-8688 bsc#1226202).
  - commit 584efba
  - Update
    patches.suse/usb-gadget-printer-fix-races-against-disable.patch
    (CVE-2024-25741 bsc#1219832).
  - commit 4a6f084
  - llc: make llc_ui_sendmsg() more robust against bonding changes
    (CVE-2024-26636 bsc#1221659).
  - commit 1bb1c76
  - llc: Drop support for ETH_P_TR_802_2 (CVE-2024-26635
    bsc#1221656).
  - commit 6a42a8d
  - PCI: vmd: Create domain symlink before pci_bus_add_devices()
    (bsc#1227363).
  - commit 3666715
  - md: fix resync softlockup when bitmap size is less than array
    size (CVE-2024-38598, bsc#1226757).
  - commit 43087c7

++++ kernel-default:

  - jfs: xattr: fix buffer overflow for invalid xattr
    (bsc#1227383).
  - commit ae2a0d9
  - iommu/arm-smmu-v3: Free MSIs in case of ENOMEM (git-fixes).
  - commit 2fb4aa0
  - blacklist.conf: Add d988d9a9b9d1 panic: Flush kernel log buffer at the end
  - commit 0ce2686
  - Update
    patches.suse/arm64-mm-Batch-dsb-and-isb-when-populating-pgtables.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/arm64-mm-Don-t-remap-pgtables-for-allocate-vs-populate.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/arm64-mm-Don-t-remap-pgtables-per-cont-pte-pmd-block.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch
    (jsc#PED-8688 bsc#1226202).
  - commit 584efba
  - Update
    patches.suse/usb-gadget-printer-fix-races-against-disable.patch
    (CVE-2024-25741 bsc#1219832).
  - commit 4a6f084
  - llc: make llc_ui_sendmsg() more robust against bonding changes
    (CVE-2024-26636 bsc#1221659).
  - commit 1bb1c76
  - llc: Drop support for ETH_P_TR_802_2 (CVE-2024-26635
    bsc#1221656).
  - commit 6a42a8d
  - PCI: vmd: Create domain symlink before pci_bus_add_devices()
    (bsc#1227363).
  - commit 3666715
  - md: fix resync softlockup when bitmap size is less than array
    size (CVE-2024-38598, bsc#1226757).
  - commit 43087c7

++++ kernel-default:

  - jfs: xattr: fix buffer overflow for invalid xattr
    (bsc#1227383).
  - commit ae2a0d9
  - iommu/arm-smmu-v3: Free MSIs in case of ENOMEM (git-fixes).
  - commit 2fb4aa0
  - blacklist.conf: Add d988d9a9b9d1 panic: Flush kernel log buffer at the end
  - commit 0ce2686
  - Update
    patches.suse/arm64-mm-Batch-dsb-and-isb-when-populating-pgtables.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/arm64-mm-Don-t-remap-pgtables-for-allocate-vs-populate.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/arm64-mm-Don-t-remap-pgtables-per-cont-pte-pmd-block.patch
    (jsc#PED-8688 bsc#1226202).
  - Update
    patches.suse/net-ena-Fix-redundant-device-NUMA-node-override.patch
    (jsc#PED-8688 bsc#1226202).
  - commit 584efba
  - Update
    patches.suse/usb-gadget-printer-fix-races-against-disable.patch
    (CVE-2024-25741 bsc#1219832).
  - commit 4a6f084
  - llc: make llc_ui_sendmsg() more robust against bonding changes
    (CVE-2024-26636 bsc#1221659).
  - commit 1bb1c76
  - llc: Drop support for ETH_P_TR_802_2 (CVE-2024-26635
    bsc#1221656).
  - commit 6a42a8d
  - PCI: vmd: Create domain symlink before pci_bus_add_devices()
    (bsc#1227363).
  - commit 3666715
  - md: fix resync softlockup when bitmap size is less than array
    size (CVE-2024-38598, bsc#1226757).
  - commit 43087c7

++++ nvidia-open-driver-G06-signed:

  - To avoid issues with missing dependencies when no CUDA repo
    is present make the dependecy to nvidia-compute-G06 conditional.
  - CUDA is not available for Tumbleweed, exclude the build of the
    cuda flavor.
  - preamble: let the -cuda flavor KMP require the -cuda flavor
    firmware

------------------------------------------------------------------
------------------  2024-7-3  -  Jul 3 2024  -------------------
------------------------------------------------------------------

++++ cockpit:

  - add CVE-2024-6126.patch to resolve CVE-2024-6126

++++ cockpit:

  - CVE-2024-6126.patch: Fix insecure killing of session ssh-agent
    (CVE-2024-6126, bsc#1226040)

++++ cockpit:

  - CVE-2024-6126.patch: Fix insecure killing of session ssh-agent
    (CVE-2024-6126, bsc#1226040)

++++ cockpit:

  - CVE-2024-6126.patch: Fix insecure killing of session ssh-agent
    (CVE-2024-6126, bsc#1226040)

++++ cockpit:

  - CVE-2024-6126.patch: Fix insecure killing of session ssh-agent
    (CVE-2024-6126, bsc#1226040)

++++ cockpit:

  - CVE-2024-6126.patch: Fix insecure killing of session ssh-agent
    (CVE-2024-6126, bsc#1226040)

++++ kernel-default:

  - ice: fix LAG and VF lock dependency in ice_reset_vf()
    (CVE-2024-36003 bsc#1224544).
  - commit 0af15ab
  - Refresh
    patches.suse/nvme-tcp-strict-pdu-pacing-to-avoid-send-stalls-on-T.patch.
  - commit a27eef2
  - block: refine the EOF check in blkdev_iomap_begin (bsc#1226866
    CVE-2024-38604).
  - commit 9e332c1
  - blacklist.conf: 9cb46b31f3d0 drm/xe/xe_migrate: Cast to output precision before multiplying operands
  - commit d95545e
  - kabi/severities: ignore amd pds internal symbols
  - commit 3a9ca76
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
    (CVE-2024-26641 bsc#1221654).
  - commit 5bd1138
  - hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021
    CVE-2024-26863).
  - commit 21d04a8
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in
    ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633 bsc#1221647).
  - commit 78e628d
  - pds_core: Prevent race issues involving the adminq (bsc#1221057
    CVE-2024-26623).
  - commit 94351ab
  - iommufd: Fix protection fault in iommufd_test_syz_conv_iova
    (bsc#1222779 CVE-2024-26785).
  - commit 5644693
  - devlink: fix possible use-after-free and memory leaks in
    devlink_init() (bsc#1222438 CVE-2024-26734).
  - commit d3a3753
  - dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743,
    CVE-2024-35805).
  - commit ba12566

++++ kernel-default:

  - ice: fix LAG and VF lock dependency in ice_reset_vf()
    (CVE-2024-36003 bsc#1224544).
  - commit 0af15ab
  - Refresh
    patches.suse/nvme-tcp-strict-pdu-pacing-to-avoid-send-stalls-on-T.patch.
  - commit a27eef2
  - block: refine the EOF check in blkdev_iomap_begin (bsc#1226866
    CVE-2024-38604).
  - commit 9e332c1
  - blacklist.conf: 9cb46b31f3d0 drm/xe/xe_migrate: Cast to output precision before multiplying operands
  - commit d95545e
  - kabi/severities: ignore amd pds internal symbols
  - commit 3a9ca76
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
    (CVE-2024-26641 bsc#1221654).
  - commit 5bd1138
  - hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021
    CVE-2024-26863).
  - commit 21d04a8
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in
    ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633 bsc#1221647).
  - commit 78e628d
  - pds_core: Prevent race issues involving the adminq (bsc#1221057
    CVE-2024-26623).
  - commit 94351ab
  - iommufd: Fix protection fault in iommufd_test_syz_conv_iova
    (bsc#1222779 CVE-2024-26785).
  - commit 5644693
  - devlink: fix possible use-after-free and memory leaks in
    devlink_init() (bsc#1222438 CVE-2024-26734).
  - commit d3a3753
  - dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743,
    CVE-2024-35805).
  - commit ba12566

++++ kernel-default:

  - ice: fix LAG and VF lock dependency in ice_reset_vf()
    (CVE-2024-36003 bsc#1224544).
  - commit 0af15ab
  - Refresh
    patches.suse/nvme-tcp-strict-pdu-pacing-to-avoid-send-stalls-on-T.patch.
  - commit a27eef2
  - block: refine the EOF check in blkdev_iomap_begin (bsc#1226866
    CVE-2024-38604).
  - commit 9e332c1
  - blacklist.conf: 9cb46b31f3d0 drm/xe/xe_migrate: Cast to output precision before multiplying operands
  - commit d95545e
  - kabi/severities: ignore amd pds internal symbols
  - commit 3a9ca76
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
    (CVE-2024-26641 bsc#1221654).
  - commit 5bd1138
  - hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021
    CVE-2024-26863).
  - commit 21d04a8
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in
    ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633 bsc#1221647).
  - commit 78e628d
  - pds_core: Prevent race issues involving the adminq (bsc#1221057
    CVE-2024-26623).
  - commit 94351ab
  - iommufd: Fix protection fault in iommufd_test_syz_conv_iova
    (bsc#1222779 CVE-2024-26785).
  - commit 5644693
  - devlink: fix possible use-after-free and memory leaks in
    devlink_init() (bsc#1222438 CVE-2024-26734).
  - commit d3a3753
  - dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743,
    CVE-2024-35805).
  - commit ba12566

++++ nvidia-open-driver-G06-signed:

  - Add a second flavor for building the kernel module versions
    used by CUDA. The kmp targetting CUDA contains '-cuda' in
    its name to track its versions separately from the graphics
    kmp. (bsc#1227417)
  - Provide the meta package nv-prefer-signed-open-driver to
    make sure the latest available SUSE-build open driver is
    installed - independent of the latest available open driver
    version in he CUDA repository.
    Rationale:
    The package cuda-runtime provides the link between CUDA and
    the kernel driver version through a
    Requires: cuda-drivers >= %version
    This implies that a CUDA version will run withany kernel driver
    version equal or higher than a base version.
    nvidia-compute-G06 provides the glue layer between CUDA and
    a specific version of he kernel driver both by providing
    a set of base libraries and by requiring a specific kernel
    version. 'cuda-drivers' (provided by nvidia-compute-utils-G06)
    requires an unversioned nvidia-compute-G06. With this, the
    resolver will install the latest available and applicable
    nvidia-compute-G06.
    nv-prefer-signed-open-driver then represents the latest available
    open driver version and restricts the nvidia-compute-G06 version
    to it. (bsc#1227419)

------------------------------------------------------------------
------------------  2024-7-2  -  Jul 2 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to version 10.3.0 (bsc#1227308, bsc#1222985)
    + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
    + Add running command as root through sudoers file

++++ cloud-regionsrv-client:

  - Update to version 10.3.0 (bsc#1227308, bsc#1222985)
    + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
    + Add running command as root through sudoers file

++++ cloud-regionsrv-client:

  - Update to version 10.3.0 (bsc#1227308, bsc#1222985)
    + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
    + Add running command as root through sudoers file

++++ cloud-regionsrv-client:

  - Update to version 10.3.0 (bsc#1227308, bsc#1222985)
    + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
    + Add running command as root through sudoers file

++++ cloud-regionsrv-client:

  - Update to version 10.3.0 (bsc#1227308, bsc#1222985)
    + Add support for sidecar registry
    Podman and rootless Docker support to set up the necessary
    configuration for the container engines to run as defined
    + Add running command as root through sudoers file

++++ cups:

  - Version upgrade to 2.4.10:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.10 brings two fixes:
    * Fixed error handling when reading a mixed 1setOf attribute.
    * Fixed scheduler start if there is only domain socket
    to listen on (Issue #985) which is fix for regression
    after fix for CVE-2024-35235 in scenarios where is
    no other listeners in cupsd.conf than domain socket
    created on demand by systemd, launchd or upstart.
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Version upgrade to 2.4.9:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.9 brings security fix for CVE-2024-35235 and
    several bug fixes regarding CUPS Web User Interface,
    PPD generation and HTTP protocol implementation.
    Detailed list (from CHANGES.md):
    * Fixed domain socket handling (CVE-2024-35235)
    * Fixed creating of `cupsUrfSupported` PPD keyword
    (Issue #952)
    * Fixed searching for destinations in web ui (Issue #954)
    * Fixed TLS negotiation using OpenSSL with servers
    that require the TLS SNI extension.
    * Really raised `cups_enum_dests()` timeout for listing
    available IPP printers (Issue #751)...
    * Fixed `Host` header regression (Issue #967)
    * Fixed DNS-SD lookups of local services with Avahi
    (Issue #970)
    * Fixed listing jobs in destinations in web ui.
    (Apple issue #6204)
    * Fixed showing search query in web ui help page.
    (Issue #977)
    Issues are those at https://github.com/OpenPrinting/cups/issues
    Apple issues are those at https://github.com/apple/cups/issues
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.10
  - Removed cups-2.4.8-CVE-2024-35235.patch : fixed upstream
    see the above CUPS 2.4.9 changes
  - avoid_C99_mode_for_loop_initial_declarations.patch avoids error
    "'for' loop initial declarations are only allowed in C99 mode"
    that happens when building for SLE12
    in scheduler/client.c at "for (char *start = ..." since
    https://github.com/OpenPrinting/cups/commit/a7eda84da73126e40400e05dd27d57f8c92d5b0d
    see https://github.com/OpenPrinting/cups/issues/1000

++++ cups:

  - Version upgrade to 2.4.10:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.10 brings two fixes:
    * Fixed error handling when reading a mixed 1setOf attribute.
    * Fixed scheduler start if there is only domain socket
    to listen on (Issue #985) which is fix for regression
    after fix for CVE-2024-35235 in scenarios where is
    no other listeners in cupsd.conf than domain socket
    created on demand by systemd, launchd or upstart.
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Version upgrade to 2.4.9:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.9 brings security fix for CVE-2024-35235 and
    several bug fixes regarding CUPS Web User Interface,
    PPD generation and HTTP protocol implementation.
    Detailed list (from CHANGES.md):
    * Fixed domain socket handling (CVE-2024-35235)
    * Fixed creating of `cupsUrfSupported` PPD keyword
    (Issue #952)
    * Fixed searching for destinations in web ui (Issue #954)
    * Fixed TLS negotiation using OpenSSL with servers
    that require the TLS SNI extension.
    * Really raised `cups_enum_dests()` timeout for listing
    available IPP printers (Issue #751)...
    * Fixed `Host` header regression (Issue #967)
    * Fixed DNS-SD lookups of local services with Avahi
    (Issue #970)
    * Fixed listing jobs in destinations in web ui.
    (Apple issue #6204)
    * Fixed showing search query in web ui help page.
    (Issue #977)
    Issues are those at https://github.com/OpenPrinting/cups/issues
    Apple issues are those at https://github.com/apple/cups/issues
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.10
  - Removed cups-2.4.8-CVE-2024-35235.patch : fixed upstream
    see the above CUPS 2.4.9 changes
  - avoid_C99_mode_for_loop_initial_declarations.patch avoids error
    "'for' loop initial declarations are only allowed in C99 mode"
    that happens when building for SLE12
    in scheduler/client.c at "for (char *start = ..." since
    https://github.com/OpenPrinting/cups/commit/a7eda84da73126e40400e05dd27d57f8c92d5b0d
    see https://github.com/OpenPrinting/cups/issues/1000

++++ kernel-default:

  - io_uring/rsrc: fix incorrect assignment of iter->nr_segs in
    io_import_fixed (git-fixes).
  - io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
  - io_uring/io-wq: avoid garbage value of 'match' in
    io_wq_enqueue() (git-fixes).
  - commit 7d3e252
  - io_uring: check for non-NULL file pointer in io_file_can_poll()
    (bsc#1226990 CVE-2024-39371).
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
    (git-fixes).
  - io_uring/sqpoll: work around a potential audit memory leak
    (git-fixes).
  - commit 24603fc
  - io_uring: Fix io_cqring_wait() not restoring sigmask on
    get_timespec64() failure (git-fixes).
  - commit e640a65
  - hsr: Prevent use after free in prp_create_tagged_frame()
    (CVE-2023-52846 bsc#1225098).
  - commit cf63988
  - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
    (CVE-2024-38610 bsc#1226758).
  - commit 7069ac2
  - virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
  - commit c2ea51b
  - btrfs: fix crash on racing fsync and size-extending write into
    prealloc (bsc#1227101 CVE-2024-37354).
  - commit 1d355af
  - kernel-doc: fix struct_group_tagged() parsing (git-fixes).
  - commit e3a2a2e
  - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
    (git-fixes).
  - mtd: rawnand: Bypass a couple of sanity checks during NAND
    identification (git-fixes).
  - mtd: rawnand: Fix the nand_read_data_op() early check
    (git-fixes).
  - mtd: rawnand: Ensure ECC configuration is propagated to upper
    layers (git-fixes).
  - commit e545951
  - Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
  - commit e8ea587
  - gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
    CVE-2024-38570).
  - gfs2: Rename sd_{ glock => kill }_wait (bsc#1226775
    CVE-2024-38570).
  - commit f3adbca

++++ kernel-default:

  - io_uring/rsrc: fix incorrect assignment of iter->nr_segs in
    io_import_fixed (git-fixes).
  - io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
  - io_uring/io-wq: avoid garbage value of 'match' in
    io_wq_enqueue() (git-fixes).
  - commit 7d3e252
  - io_uring: check for non-NULL file pointer in io_file_can_poll()
    (bsc#1226990 CVE-2024-39371).
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
    (git-fixes).
  - io_uring/sqpoll: work around a potential audit memory leak
    (git-fixes).
  - commit 24603fc
  - io_uring: Fix io_cqring_wait() not restoring sigmask on
    get_timespec64() failure (git-fixes).
  - commit e640a65
  - hsr: Prevent use after free in prp_create_tagged_frame()
    (CVE-2023-52846 bsc#1225098).
  - commit cf63988
  - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
    (CVE-2024-38610 bsc#1226758).
  - commit 7069ac2
  - virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
  - commit c2ea51b
  - btrfs: fix crash on racing fsync and size-extending write into
    prealloc (bsc#1227101 CVE-2024-37354).
  - commit 1d355af
  - kernel-doc: fix struct_group_tagged() parsing (git-fixes).
  - commit e3a2a2e
  - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
    (git-fixes).
  - mtd: rawnand: Bypass a couple of sanity checks during NAND
    identification (git-fixes).
  - mtd: rawnand: Fix the nand_read_data_op() early check
    (git-fixes).
  - mtd: rawnand: Ensure ECC configuration is propagated to upper
    layers (git-fixes).
  - commit e545951
  - Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
  - commit e8ea587
  - gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
    CVE-2024-38570).
  - gfs2: Rename sd_{ glock => kill }_wait (bsc#1226775
    CVE-2024-38570).
  - commit f3adbca

++++ kernel-default:

  - io_uring/rsrc: fix incorrect assignment of iter->nr_segs in
    io_import_fixed (git-fixes).
  - io_uring/rsrc: don't lock while !TASK_RUNNING (git-fixes).
  - io_uring/io-wq: avoid garbage value of 'match' in
    io_wq_enqueue() (git-fixes).
  - commit 7d3e252
  - io_uring: check for non-NULL file pointer in io_file_can_poll()
    (bsc#1226990 CVE-2024-39371).
  - io_uring/io-wq: Use set_bit() and test_bit() at worker->flags
    (git-fixes).
  - io_uring/sqpoll: work around a potential audit memory leak
    (git-fixes).
  - commit 24603fc
  - io_uring: Fix io_cqring_wait() not restoring sigmask on
    get_timespec64() failure (git-fixes).
  - commit e640a65
  - hsr: Prevent use after free in prp_create_tagged_frame()
    (CVE-2023-52846 bsc#1225098).
  - commit cf63988
  - drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
    (CVE-2024-38610 bsc#1226758).
  - commit 7069ac2
  - virt: acrn: stop using follow_pfn (CVE-2024-38610 bsc#1226758).
  - commit c2ea51b
  - btrfs: fix crash on racing fsync and size-extending write into
    prealloc (bsc#1227101 CVE-2024-37354).
  - commit 1d355af
  - blk-mq: add helper for checking if one CPU is mapped to
    specified hctx (bsc#1223600).
  - blk-mq: don't schedule block kworker on isolated CPUs
    (bsc#1223600).
  - commit 2b67848
  - kernel-doc: fix struct_group_tagged() parsing (git-fixes).
  - commit e3a2a2e
  - mtd: rawnand: rockchip: ensure NVDDR timings are rejected
    (git-fixes).
  - mtd: rawnand: Bypass a couple of sanity checks during NAND
    identification (git-fixes).
  - mtd: rawnand: Fix the nand_read_data_op() early check
    (git-fixes).
  - mtd: rawnand: Ensure ECC configuration is propagated to upper
    layers (git-fixes).
  - commit e545951
  - Correct SCSI patch references (bsc#1225767 CVE-2024-36919 bsc#1226785 CVE-2024-38559)
  - commit e8ea587
  - gfs2: Fix potential glock use-after-free on unmount (bsc#1226775
    CVE-2024-38570).
  - gfs2: Rename sd_{ glock => kill }_wait (bsc#1226775
    CVE-2024-38570).
  - commit f3adbca

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ openssl-3:

  - FIPS: Deny SHA-1 signature verification in FIPS provider [bsc#1221365]
    * SHA-1 is not allowed anymore in FIPS 186-5 for signature
    verification operations. After 12/31/2030, NIST will disallow
    SHA-1 for all of its usages.
    * Add openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311-core:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ libzypp:

  - Install zypp/APIConfig.h legacy include (fixes #557)
  - version 17.35.1 (35)

++++ libzypp:

  - Install zypp/APIConfig.h legacy include (fixes #557)
  - version 17.35.1 (35)

++++ libzypp:

  - Install zypp/APIConfig.h legacy include (fixes #557)
  - version 17.35.1 (35)

++++ libzypp:

  - Install zypp/APIConfig.h legacy include (fixes #557)
  - version 17.35.1 (35)

++++ libzypp:

  - Install zypp/APIConfig.h legacy include (fixes #557)
  - version 17.35.1 (35)

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ python311:

  - Update F00251-change-user-install-location.patch to make pip and
    modern tools install directly in /usr/local when used by the user.
    bsc#1225660

++++ zypper:

  - Show rpm install size before installing (bsc#1224771)
    If filesystem snapshots are taken before the installation (e.g.
    by snapper) no disk space is freed by removing old packages. In
    this case the install size of all packages is a hint how much
    additional disk space is needed by the new packages static
    content.
  - version 1.14.76
  - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly
    (bsc#1227205)
  - version 1.14.75

++++ zypper:

  - Show rpm install size before installing (bsc#1224771)
    If filesystem snapshots are taken before the installation (e.g.
    by snapper) no disk space is freed by removing old packages. In
    this case the install size of all packages is a hint how much
    additional disk space is needed by the new packages static
    content.
  - version 1.14.76
  - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly
    (bsc#1227205)
  - version 1.14.75

++++ zypper:

  - Show rpm install size before installing (bsc#1224771)
    If filesystem snapshots are taken before the installation (e.g.
    by snapper) no disk space is freed by removing old packages. In
    this case the install size of all packages is a hint how much
    additional disk space is needed by the new packages static
    content.
  - version 1.14.76
  - Fix readline setup to handle Ctrl-C and Ctrl-D corrrectly
    (bsc#1227205)
  - version 1.14.75

------------------------------------------------------------------
------------------  2024-7-1  -  Jul 1 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - X.509: Fix the parser of extended key usage for length
    (bsc#1218820).
  - commit a9df6a7
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
    (CVE-2024-36904 bsc#1225732).
  - commit d578dcc
  - Update
    patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
    bsc#1226630).
  - Update
    patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
    (git-fixes CVE-2024-39463 bsc#1227090).
  - Update
    patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
    (stable-fixes CVE-2024-38600 bsc#1226864).
  - Update
    patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
    (git-fixes CVE-2024-38605 bsc#1226740).
  - Update
    patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
    (git-fixes CVE-2023-52806 bsc#1225554).
  - Update
    patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
    (git-fixes CVE-2024-38388 bsc#1226890).
  - Update
    patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
    (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
  - Update
    patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
    (git-fixes CVE-2024-38550 bsc#1226633).
  - Update
    patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
    (git-fixes CVE-2024-38551 bsc#1226761).
  - Update
    patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
    (git-fixes CVE-2023-52833 bsc#1225595).
  - Update
    patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
    (git-fixes CVE-2024-26889).
  - Update
    patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
    (git-fixes CVE-2023-52866 bsc#1225120).
  - Update
    patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
    (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
  - Update
    patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
    (git-fixes CVE-2023-52884 bsc#1226764).
  - Update
    patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
    (git-fixes CVE-2023-52840 bsc#1224928).
  - Update
    patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
    (git-fixes CVE-2024-36975 bsc#1226520).
  - Update
    patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
    (git-fixes CVE-2024-36967 bsc#1226131).
  - Update
    patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
    (git-fixes CVE-2024-38539 bsc#1226608).
  - Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
    (git-fixes CVE-2024-38545 bsc#1226595).
  - Update
    patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
    (git-fixes CVE-2024-38591 bsc#1226738).
  - Update
    patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
    (git-fixes CVE-2024-38590 bsc#1226839).
  - Update
    patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
    (git-fixes CVE-2024-38544 bsc#1226597).
  - Update
    patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
    (git-fixes CVE-2023-52803 bsc#1225008).
  - Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
  - Update
    patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
  - Update
    patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
  - Update
    patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
  - Update
    patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
    (git-fixes CVE-2023-52750 bsc#1225485).
  - Update
    patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
    (git-fixes CVE-2023-52834 bsc#1225599).
  - Update
    patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
    (git-fixes CVE-2024-38554 bsc#1226742).
  - Update
    patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
    (git-fixes CVE-2024-38602 bsc#1226613).
  - Update
    patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
    (bsc#1225605 CVE-2024-38384 bsc#1226938).
  - Update
    patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
    (bsc#1225605 CVE-2024-38663 bsc#1226939).
  - Update
    patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
    (git-fixes CVE-2024-38540 bsc#1226582).
  - Update
    patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
    (git-fixes CVE-2023-52784 bsc#1224946).
  - Update
    patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
    (git-fixes CVE-2023-52878 bsc#1225000).
  - Update
    patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52875 bsc#1225096).
  - Update
    patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52870 bsc#1224937).
  - Update
    patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52873 bsc#1225589).
  - Update
    patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52865 bsc#1225086).
  - Update
    patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52858 bsc#1225566).
  - Update
    patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
    (git-fixes CVE-2023-52876 bsc#1225036).
  - Update
    patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
    (git-fixes CVE-2024-38573 bsc#1226739).
  - Update patches.suse/cpufreq-exit-callback-is-optional.patch
    (git-fixes CVE-2024-38615 bsc#1226592).
  - Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
    (git-fixes CVE-2024-38579 bsc#1226637).
  - Update
    patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
    (git-fixes CVE-2023-52813 bsc#1225527).
  - Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
    CVE-2023-52849 bsc#1224949).
  - Update
    patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
    (git-fixes CVE-2023-52792 bsc#1225477).
  - Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
    (git-fixes CVE-2024-38391 bsc#1226894).
  - Update
    patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
    (git-fixes CVE-2024-38780 bsc#1226886).
  - Update
    patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
    (git-fixes CVE-2024-34777 bsc#1226796).
  - Update
    patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
    (git-fixes CVE-2024-39277 bsc#1226909).
  - Update
    patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
    (git-fixes CVE-2024-38629 bsc#1226905).
  - Update
    patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
    bsc#1225532).
  - Update
    patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
    bsc#1225530).
  - Update
    patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
    bsc#1225564).
  - Update
    patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
    bsc#1225478).
  - Update
    patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
    (stable-fixes CVE-2024-36969 bsc#1226155).
  - Update
    patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
    bsc#1225015).
  - Update
    patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
    (git-fixes CVE-2024-38552 bsc#1226767).
  - Update
    patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
    bsc#1225041).
  - Update
    patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
    (git-fixes CVE-2024-26767).
  - Update
    patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
    bsc#1225569).
  - Update
    patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
    (git-fixes CVE-2024-39291 bsc#1226934).
  - Update
    patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
    bsc#1225565).
  - Update
    patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
    (stable-fixes CVE-2024-39471 bsc#1227096).
  - Update
    patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
    (stable-fixes CVE-2024-38581 bsc#1226657).
  - Update
    patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
    bsc#1225568).
  - Update
    patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
    bsc#1225076).
  - Update
    patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
    bsc#1225529).
  - Update
    patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
    (git-fixes CVE-2024-38548).
  - Update
    patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
    bsc#1224941).
  - Update
    patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
    bsc#1224932).
  - Update
    patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
    (git-fixes CVE-2024-38549 bsc#1226735).
  - Update
    patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
    bsc#1225581).
  - Update
    patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
    (git-fixes CVE-2024-38592 bsc#1226844).
  - Update
    patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
    (git-fixes CVE-2024-38390 bsc#1226891).
  - Update
    patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
    (git-fixes CVE-2024-38622 bsc#1226856).
  - Update
    patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
    bsc#1225022).
  - Update
    patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
    bsc#1225077).
  - Update patches.suse/drm-radeon-possible-buffer-overflow.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
    bsc#1225009).
  - Update
    patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
    (git-fixes CVE-2024-38546 bsc#1226593).
  - Update
    patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
    (git-fixes CVE-2024-36960 bsc#1225872).
  - Update
    patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
    (git-fixes CVE-2024-38664 bsc#1226941).
  - Update
    patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
    (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
  - Update
    patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
    (git-fixes CVE-2024-38578 bsc#1226634).
  - Update
    patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
    (git-fixes CVE-2024-33619 bsc#1226768).
  - Update
    patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
    bsc#1225031).
  - Update
    patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
    (git-fixes CVE-2024-36964 bsc#1225866).
  - Update
    patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
    (git-fixes CVE-2023-52810 bsc#1225557).
  - Update
    patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
    (git-fixes CVE-2023-52804 bsc#1225550).
  - Update
    patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
    (git-fixes CVE-2024-38588 bsc#1226837).
  - Update
    patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
    (git-fixes CVE-2024-38385 bsc#1227085).
  - Update patches.suse/gfs2-ignore-negated-quota-changes.patch
    (git-fixes CVE-2023-52759 bsc#1225560).
  - Update
    patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
    (git-fixes CVE-2023-52853 bsc#1224988).
  - Update
    patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
    (git-fixes CVE-2023-52863 bsc#1225586).
  - Update
    patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
    (git-fixes CVE-2024-39362 bsc#1226995).
  - Update
    patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
    (git-fixes CVE-2023-52791 bsc#1225108).
  - Update
    patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
    (git-fixes CVE-2023-52763 bsc#1225570).
  - Update
    patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
    (git-fixes CVE-2023-52766).
  - Update
    patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
    bsc#1225106).
  - Update
    patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
    (git-fixes CVE-2024-36010 bsc#1225594).
  - Update
    patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
    (git-fixes CVE-2024-35957 bsc#1224673).
  - Update
    patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
    (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
  - Update
    patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
    (git-fixes CVE-2023-52796 bsc#1224930).
  - Update
    patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
    (git-fixes CVE-2024-38599 bsc#1226848).
  - Update
    patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
    (git-fixes CVE-2023-52799 bsc#1225472).
  - Update
    patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
    (git-fixes CVE-2023-52805 bsc#1225553).
  - Update
    patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
    (git-fixes CVE-2024-38617 bsc#1226859).
  - Update
    patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
    (git-fixes CVE-2021-47432 bsc#1225391).
  - Update
    patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
    (git-fixes CVE-2024-38543 bsc#1226594).
  - Update
    patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
    (bsc#1219953 CVE-2023-52836 bsc#1225609).
  - Update
    patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
    (bsc#1219596 CVE-2024-26758).
  - Update
    patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
    (git-fixes CVE-2024-38547 bsc#1226632).
  - Update
    patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
    (git-fixes CVE-2023-52847 bsc#1225588).
  - Update
    patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
    (git-fixes CVE-2023-52764 bsc#1225571).
  - Update
    patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
    (git-fixes CVE-2023-52850 bsc#1225014).
  - Update
    patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
    (git-fixes CVE-2024-38611 bsc#1226760).
  - Update
    patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
    (git-fixes CVE-2023-52754 bsc#1225490).
  - Update
    patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
    (stable-fixes CVE-2022-48772 bsc#1226976).
  - Update
    patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
    (git-fixes CVE-2024-38621 bsc#1226895).
  - Update
    patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
    (git-fixes CVE-2023-52841 bsc#1225592).
  - Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
    (git-fixes CVE-2023-52844 bsc#1225590).
  - Update
    patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
    (git-fixes CVE-2023-52765 bsc#1225029).
  - Update
    patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
    (git-fixes CVE-2024-36973 bsc#1226457).
  - Update
    patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
    (git-fixes CVE-2023-52807 bsc#1225097).
  - Update
    patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
    (git-fixes CVE-2024-36962 bsc#1225827).
  - Update
    patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
    (git-fixes CVE-2024-38595 bsc#1226741).
  - Update
    patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
    (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
  - Update
    patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
    (git-fixes CVE-2023-52780 bsc#1224933).
  - Update
    patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
    (git-fixes CVE-2023-52783 bsc#1225104).
  - Update
    patches.suse/netfilter-complete-validation-of-user-input.patch
    (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
    bsc#1224583).
  - Update
    patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
    (git-fixes CVE-2024-38381 bsc#1226878).
  - Update
    patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
    (git-fixes CVE-2024-39469 bsc#1226992).
  - Update
    patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
    (git-fixes CVE-2024-38582 bsc#1226658).
  - Update
    patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
    (git-fixes CVE-2024-38583 bsc#1226777).
  - Update
    patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
    (git-fixes CVE-2024-38541 bsc#1226587).
  - Update
    patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
    (git-fixes CVE-2023-52854 bsc#1225584).
  - Update
    patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
    (git-fixes CVE-2023-52835 bsc#1225602).
  - Update
    patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
    (git-fixes CVE-2023-52864 bsc#1225132).
  - Update
    patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
    (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
  - Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
    (git-fixes CVE-2023-52869 bsc#1225050).
  - Update
    patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
    (git-fixes CVE-2024-36965 bsc#1226149).
  - Update
    patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
    (git-fixes CVE-2024-38601 bsc#1226876).
  - Update
    patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
    (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
  - Update
    patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
    (git-fixes CVE-2023-52808 bsc#1225555).
  - Update
    patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
    (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
  - Update
    patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
    (git-fixes CVE-2023-52809 bsc#1225556).
  - Update
    patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
    (bsc#1221777 CVE-2024-36952 bsc#1225898).
  - Update
    patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
    (bsc#1221777 CVE-2024-36924 bsc#1225820).
  - Update
    patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
    (git-fixes CVE-2024-38634 bsc#1226868).
  - Update
    patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
    (git-fixes CVE-2024-38633 bsc#1226867).
  - Update
    patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
    (git-fixes CVE-2023-52871 bsc#1225534).
  - Update
    patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
    (stable-fixes CVE-2024-38635 bsc#1226863).
  - Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
    (git-fixes CVE-2024-38587 bsc#1226780).
  - Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
    (git-fixes CVE-2023-52749 bsc#1225476).
  - Update
    patches.suse/thermal-core-prevent-potential-string-overflow.patch
    (git-fixes CVE-2023-52868 bsc#1225044).
  - Update
    patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
    (git-fixes CVE-2024-39466 bsc#1227089).
  - Update
    patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
    (git-fixes CVE-2024-38571 bsc#1226737).
  - Update
    patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
    (git-fixes CVE-2023-52794 bsc#1225028).
  - Update
    patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
    (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
  - Update
    patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
    (git-fixes CVE-2024-36477 bsc#1226840).
  - Update
    patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
    (git-fixes CVE-2023-52879 bsc#1225101).
  - Update
    patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
    (git-fixes CVE-2024-26920).
  - Update
    patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
    (git-fixes CVE-2023-52872 bsc#1225591).
  - Update
    patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
    (bsc#1222619 CVE-2023-52880).
  - Update
    patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
    (git-fixes CVE-2023-52789 bsc#1225180).
  - Update
    patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
    (git-fixes CVE-2023-52781 bsc#1225092).
  - Update
    patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
    (git-fixes CVE-2024-36977 bsc#1226513).
  - Update
    patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
    (git-fixes CVE-2024-38628 bsc#1226911).
  - Update
    patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
    (git-fixes CVE-2024-38619 bsc#1226861).
  - Update
    patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
    (git-fixes CVE-2023-52877 bsc#1224944).
  - Update
    patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
    (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
  - Update
    patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
    (git-fixes CVE-2023-52762 bsc#1225573).
  - Update
    patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
    (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
  - Update
    patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
    (git-fixes CVE-2024-38630 bsc#1226908).
  - Update
    patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
    (git-fixes CVE-2024-38565 bsc#1226747).
  - Update
    patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
    (git-fixes CVE-2023-52798 bsc#1224947).
  - Update
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
    (git-fixes CVE-2023-52777 bsc#1224992).
  - Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
    (git-fixes CVE-2023-52800).
  - Update
    patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
    (git-fixes CVE-2023-52776 bsc#1225090).
  - Update
    patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
    (git-fixes CVE-2023-52769 bsc#1225001).
  - Update
    patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
    (git-fixes CVE-2024-38572 bsc#1226776).
  - Update
    patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
    (git-fixes CVE-2023-52827 bsc#1225078).
  - Update
    patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
    (git-fixes CVE-2023-52829 bsc#1225081).
  - Update
    patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
    (git-fixes CVE-2024-38575 bsc#1226612).
  - Update
    patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
    (git-fixes CVE-2024-38567 bsc#1226769).
  - Update
    patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
    (git-fixes CVE-2024-38616 bsc#1226852).
  - Update
    patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
    (git-fixes CVE-2023-52832 bsc#1225577).
  - Update
    patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
    (git-fixes CVE-2024-38562 bsc#1226788).
  - Update
    patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
    (git-fixes CVE-2023-52768 bsc#1225004).
  - Update
    patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
    (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
  - commit 33efdc4
  - tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
    bsc#1225611).
  - commit 16404a6
  - net: ena: Fix redundant device NUMA node override
    (jsc#PED-8688).
  - commit 6ad6684
  - ata: ahci: Clean up sysfs file on error (git-fixes).
  - ata: libata-core: Fix double free on error (git-fixes).
  - ata,scsi: libata-core: Do not leak memory for ata_port struct
    members (git-fixes).
  - ata: libata-core: Fix null pointer dereference on error
    (git-fixes).
  - kbuild: Fix build target deb-pkg: ln: failed to create hard link
    (git-fixes).
  - kbuild: doc: Update default INSTALL_MOD_DIR from extra to
    updates (git-fixes).
  - kbuild: Install dtb files as 0644 in Makefile.dtbinst
    (git-fixes).
  - counter: ti-eqep: enable clock at probe (git-fixes).
  - iio: chemical: bme680: Fix sensor data read operation
    (git-fixes).
  - iio: chemical: bme680: Fix overflows in compensate() functions
    (git-fixes).
  - iio: chemical: bme680: Fix calibration data variable
    (git-fixes).
  - iio: chemical: bme680: Fix pressure value output (git-fixes).
  - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
    (git-fixes).
  - iio: adc: ad7266: Fix variable checking bug (git-fixes).
  - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
    (git-fixes).
  - serial: bcm63xx-uart: fix tx after conversion to
    uart_port_tx_limited() (git-fixes).
  - serial: core: introduce uart_port_tx_limited_flags()
    (git-fixes).
  - Revert "serial: core: only stop transmit when HW fifo is empty"
    (git-fixes).
  - tty: mcf: MCF54418 has 10 UARTS (git-fixes).
  - usb: gadget: aspeed_udc: fix device address configuration
    (git-fixes).
  - usb: dwc3: core: remove lock of otg mode during gadget
    suspend/resume to avoid deadlock (git-fixes).
  - usb: typec: ucsi: glink: fix child node release in probe
    function (git-fixes).
  - usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    (git-fixes).
  - usb: gadget: printer: fix races against disable (git-fixes).
  - PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
  - commit a2ea5a9

++++ kernel-default:

  - X.509: Fix the parser of extended key usage for length
    (bsc#1218820).
  - commit a9df6a7
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
    (CVE-2024-36904 bsc#1225732).
  - commit d578dcc
  - Update
    patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
    bsc#1226630).
  - Update
    patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
    (git-fixes CVE-2024-39463 bsc#1227090).
  - Update
    patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
    (stable-fixes CVE-2024-38600 bsc#1226864).
  - Update
    patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
    (git-fixes CVE-2024-38605 bsc#1226740).
  - Update
    patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
    (git-fixes CVE-2023-52806 bsc#1225554).
  - Update
    patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
    (git-fixes CVE-2024-38388 bsc#1226890).
  - Update
    patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
    (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
  - Update
    patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
    (git-fixes CVE-2024-38550 bsc#1226633).
  - Update
    patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
    (git-fixes CVE-2024-38551 bsc#1226761).
  - Update
    patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
    (git-fixes CVE-2023-52833 bsc#1225595).
  - Update
    patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
    (git-fixes CVE-2024-26889).
  - Update
    patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
    (git-fixes CVE-2023-52866 bsc#1225120).
  - Update
    patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
    (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
  - Update
    patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
    (git-fixes CVE-2023-52884 bsc#1226764).
  - Update
    patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
    (git-fixes CVE-2023-52840 bsc#1224928).
  - Update
    patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
    (git-fixes CVE-2024-36975 bsc#1226520).
  - Update
    patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
    (git-fixes CVE-2024-36967 bsc#1226131).
  - Update
    patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
    (git-fixes CVE-2024-38539 bsc#1226608).
  - Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
    (git-fixes CVE-2024-38545 bsc#1226595).
  - Update
    patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
    (git-fixes CVE-2024-38591 bsc#1226738).
  - Update
    patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
    (git-fixes CVE-2024-38590 bsc#1226839).
  - Update
    patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
    (git-fixes CVE-2024-38544 bsc#1226597).
  - Update
    patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
    (git-fixes CVE-2023-52803 bsc#1225008).
  - Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
  - Update
    patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
  - Update
    patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
  - Update
    patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
  - Update
    patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
    (git-fixes CVE-2023-52750 bsc#1225485).
  - Update
    patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
    (git-fixes CVE-2023-52834 bsc#1225599).
  - Update
    patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
    (git-fixes CVE-2024-38554 bsc#1226742).
  - Update
    patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
    (git-fixes CVE-2024-38602 bsc#1226613).
  - Update
    patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
    (bsc#1225605 CVE-2024-38384 bsc#1226938).
  - Update
    patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
    (bsc#1225605 CVE-2024-38663 bsc#1226939).
  - Update
    patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
    (git-fixes CVE-2024-38540 bsc#1226582).
  - Update
    patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
    (git-fixes CVE-2023-52784 bsc#1224946).
  - Update
    patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
    (git-fixes CVE-2023-52878 bsc#1225000).
  - Update
    patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52875 bsc#1225096).
  - Update
    patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52870 bsc#1224937).
  - Update
    patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52873 bsc#1225589).
  - Update
    patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52865 bsc#1225086).
  - Update
    patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52858 bsc#1225566).
  - Update
    patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
    (git-fixes CVE-2023-52876 bsc#1225036).
  - Update
    patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
    (git-fixes CVE-2024-38573 bsc#1226739).
  - Update patches.suse/cpufreq-exit-callback-is-optional.patch
    (git-fixes CVE-2024-38615 bsc#1226592).
  - Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
    (git-fixes CVE-2024-38579 bsc#1226637).
  - Update
    patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
    (git-fixes CVE-2023-52813 bsc#1225527).
  - Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
    CVE-2023-52849 bsc#1224949).
  - Update
    patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
    (git-fixes CVE-2023-52792 bsc#1225477).
  - Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
    (git-fixes CVE-2024-38391 bsc#1226894).
  - Update
    patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
    (git-fixes CVE-2024-38780 bsc#1226886).
  - Update
    patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
    (git-fixes CVE-2024-34777 bsc#1226796).
  - Update
    patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
    (git-fixes CVE-2024-39277 bsc#1226909).
  - Update
    patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
    (git-fixes CVE-2024-38629 bsc#1226905).
  - Update
    patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
    bsc#1225532).
  - Update
    patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
    bsc#1225530).
  - Update
    patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
    bsc#1225564).
  - Update
    patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
    bsc#1225478).
  - Update
    patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
    (stable-fixes CVE-2024-36969 bsc#1226155).
  - Update
    patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
    bsc#1225015).
  - Update
    patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
    (git-fixes CVE-2024-38552 bsc#1226767).
  - Update
    patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
    bsc#1225041).
  - Update
    patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
    (git-fixes CVE-2024-26767).
  - Update
    patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
    bsc#1225569).
  - Update
    patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
    (git-fixes CVE-2024-39291 bsc#1226934).
  - Update
    patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
    bsc#1225565).
  - Update
    patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
    (stable-fixes CVE-2024-39471 bsc#1227096).
  - Update
    patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
    (stable-fixes CVE-2024-38581 bsc#1226657).
  - Update
    patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
    bsc#1225568).
  - Update
    patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
    bsc#1225076).
  - Update
    patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
    bsc#1225529).
  - Update
    patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
    (git-fixes CVE-2024-38548).
  - Update
    patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
    bsc#1224941).
  - Update
    patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
    bsc#1224932).
  - Update
    patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
    (git-fixes CVE-2024-38549 bsc#1226735).
  - Update
    patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
    bsc#1225581).
  - Update
    patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
    (git-fixes CVE-2024-38592 bsc#1226844).
  - Update
    patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
    (git-fixes CVE-2024-38390 bsc#1226891).
  - Update
    patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
    (git-fixes CVE-2024-38622 bsc#1226856).
  - Update
    patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
    bsc#1225022).
  - Update
    patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
    bsc#1225077).
  - Update patches.suse/drm-radeon-possible-buffer-overflow.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
    bsc#1225009).
  - Update
    patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
    (git-fixes CVE-2024-38546 bsc#1226593).
  - Update
    patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
    (git-fixes CVE-2024-36960 bsc#1225872).
  - Update
    patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
    (git-fixes CVE-2024-38664 bsc#1226941).
  - Update
    patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
    (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
  - Update
    patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
    (git-fixes CVE-2024-38578 bsc#1226634).
  - Update
    patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
    (git-fixes CVE-2024-33619 bsc#1226768).
  - Update
    patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
    bsc#1225031).
  - Update
    patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
    (git-fixes CVE-2024-36964 bsc#1225866).
  - Update
    patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
    (git-fixes CVE-2023-52810 bsc#1225557).
  - Update
    patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
    (git-fixes CVE-2023-52804 bsc#1225550).
  - Update
    patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
    (git-fixes CVE-2024-38588 bsc#1226837).
  - Update
    patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
    (git-fixes CVE-2024-38385 bsc#1227085).
  - Update patches.suse/gfs2-ignore-negated-quota-changes.patch
    (git-fixes CVE-2023-52759 bsc#1225560).
  - Update
    patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
    (git-fixes CVE-2023-52853 bsc#1224988).
  - Update
    patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
    (git-fixes CVE-2023-52863 bsc#1225586).
  - Update
    patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
    (git-fixes CVE-2024-39362 bsc#1226995).
  - Update
    patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
    (git-fixes CVE-2023-52791 bsc#1225108).
  - Update
    patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
    (git-fixes CVE-2023-52763 bsc#1225570).
  - Update
    patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
    (git-fixes CVE-2023-52766).
  - Update
    patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
    bsc#1225106).
  - Update
    patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
    (git-fixes CVE-2024-36010 bsc#1225594).
  - Update
    patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
    (git-fixes CVE-2024-35957 bsc#1224673).
  - Update
    patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
    (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
  - Update
    patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
    (git-fixes CVE-2023-52796 bsc#1224930).
  - Update
    patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
    (git-fixes CVE-2024-38599 bsc#1226848).
  - Update
    patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
    (git-fixes CVE-2023-52799 bsc#1225472).
  - Update
    patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
    (git-fixes CVE-2023-52805 bsc#1225553).
  - Update
    patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
    (git-fixes CVE-2024-38617 bsc#1226859).
  - Update
    patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
    (git-fixes CVE-2021-47432 bsc#1225391).
  - Update
    patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
    (git-fixes CVE-2024-38543 bsc#1226594).
  - Update
    patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
    (bsc#1219953 CVE-2023-52836 bsc#1225609).
  - Update
    patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
    (bsc#1219596 CVE-2024-26758).
  - Update
    patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
    (git-fixes CVE-2024-38547 bsc#1226632).
  - Update
    patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
    (git-fixes CVE-2023-52847 bsc#1225588).
  - Update
    patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
    (git-fixes CVE-2023-52764 bsc#1225571).
  - Update
    patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
    (git-fixes CVE-2023-52850 bsc#1225014).
  - Update
    patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
    (git-fixes CVE-2024-38611 bsc#1226760).
  - Update
    patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
    (git-fixes CVE-2023-52754 bsc#1225490).
  - Update
    patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
    (stable-fixes CVE-2022-48772 bsc#1226976).
  - Update
    patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
    (git-fixes CVE-2024-38621 bsc#1226895).
  - Update
    patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
    (git-fixes CVE-2023-52841 bsc#1225592).
  - Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
    (git-fixes CVE-2023-52844 bsc#1225590).
  - Update
    patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
    (git-fixes CVE-2023-52765 bsc#1225029).
  - Update
    patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
    (git-fixes CVE-2024-36973 bsc#1226457).
  - Update
    patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
    (git-fixes CVE-2023-52807 bsc#1225097).
  - Update
    patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
    (git-fixes CVE-2024-36962 bsc#1225827).
  - Update
    patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
    (git-fixes CVE-2024-38595 bsc#1226741).
  - Update
    patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
    (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
  - Update
    patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
    (git-fixes CVE-2023-52780 bsc#1224933).
  - Update
    patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
    (git-fixes CVE-2023-52783 bsc#1225104).
  - Update
    patches.suse/netfilter-complete-validation-of-user-input.patch
    (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
    bsc#1224583).
  - Update
    patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
    (git-fixes CVE-2024-38381 bsc#1226878).
  - Update
    patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
    (git-fixes CVE-2024-39469 bsc#1226992).
  - Update
    patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
    (git-fixes CVE-2024-38582 bsc#1226658).
  - Update
    patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
    (git-fixes CVE-2024-38583 bsc#1226777).
  - Update
    patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
    (git-fixes CVE-2024-38541 bsc#1226587).
  - Update
    patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
    (git-fixes CVE-2023-52854 bsc#1225584).
  - Update
    patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
    (git-fixes CVE-2023-52835 bsc#1225602).
  - Update
    patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
    (git-fixes CVE-2023-52864 bsc#1225132).
  - Update
    patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
    (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
  - Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
    (git-fixes CVE-2023-52869 bsc#1225050).
  - Update
    patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
    (git-fixes CVE-2024-36965 bsc#1226149).
  - Update
    patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
    (git-fixes CVE-2024-38601 bsc#1226876).
  - Update
    patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
    (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
  - Update
    patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
    (git-fixes CVE-2023-52808 bsc#1225555).
  - Update
    patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
    (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
  - Update
    patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
    (git-fixes CVE-2023-52809 bsc#1225556).
  - Update
    patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
    (bsc#1221777 CVE-2024-36952 bsc#1225898).
  - Update
    patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
    (bsc#1221777 CVE-2024-36924 bsc#1225820).
  - Update
    patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
    (git-fixes CVE-2024-38634 bsc#1226868).
  - Update
    patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
    (git-fixes CVE-2024-38633 bsc#1226867).
  - Update
    patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
    (git-fixes CVE-2023-52871 bsc#1225534).
  - Update
    patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
    (stable-fixes CVE-2024-38635 bsc#1226863).
  - Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
    (git-fixes CVE-2024-38587 bsc#1226780).
  - Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
    (git-fixes CVE-2023-52749 bsc#1225476).
  - Update
    patches.suse/thermal-core-prevent-potential-string-overflow.patch
    (git-fixes CVE-2023-52868 bsc#1225044).
  - Update
    patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
    (git-fixes CVE-2024-39466 bsc#1227089).
  - Update
    patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
    (git-fixes CVE-2024-38571 bsc#1226737).
  - Update
    patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
    (git-fixes CVE-2023-52794 bsc#1225028).
  - Update
    patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
    (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
  - Update
    patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
    (git-fixes CVE-2024-36477 bsc#1226840).
  - Update
    patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
    (git-fixes CVE-2023-52879 bsc#1225101).
  - Update
    patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
    (git-fixes CVE-2024-26920).
  - Update
    patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
    (git-fixes CVE-2023-52872 bsc#1225591).
  - Update
    patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
    (bsc#1222619 CVE-2023-52880).
  - Update
    patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
    (git-fixes CVE-2023-52789 bsc#1225180).
  - Update
    patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
    (git-fixes CVE-2023-52781 bsc#1225092).
  - Update
    patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
    (git-fixes CVE-2024-36977 bsc#1226513).
  - Update
    patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
    (git-fixes CVE-2024-38628 bsc#1226911).
  - Update
    patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
    (git-fixes CVE-2024-38619 bsc#1226861).
  - Update
    patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
    (git-fixes CVE-2023-52877 bsc#1224944).
  - Update
    patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
    (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
  - Update
    patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
    (git-fixes CVE-2023-52762 bsc#1225573).
  - Update
    patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
    (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
  - Update
    patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
    (git-fixes CVE-2024-38630 bsc#1226908).
  - Update
    patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
    (git-fixes CVE-2024-38565 bsc#1226747).
  - Update
    patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
    (git-fixes CVE-2023-52798 bsc#1224947).
  - Update
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
    (git-fixes CVE-2023-52777 bsc#1224992).
  - Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
    (git-fixes CVE-2023-52800).
  - Update
    patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
    (git-fixes CVE-2023-52776 bsc#1225090).
  - Update
    patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
    (git-fixes CVE-2023-52769 bsc#1225001).
  - Update
    patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
    (git-fixes CVE-2024-38572 bsc#1226776).
  - Update
    patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
    (git-fixes CVE-2023-52827 bsc#1225078).
  - Update
    patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
    (git-fixes CVE-2023-52829 bsc#1225081).
  - Update
    patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
    (git-fixes CVE-2024-38575 bsc#1226612).
  - Update
    patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
    (git-fixes CVE-2024-38567 bsc#1226769).
  - Update
    patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
    (git-fixes CVE-2024-38616 bsc#1226852).
  - Update
    patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
    (git-fixes CVE-2023-52832 bsc#1225577).
  - Update
    patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
    (git-fixes CVE-2024-38562 bsc#1226788).
  - Update
    patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
    (git-fixes CVE-2023-52768 bsc#1225004).
  - Update
    patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
    (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
  - commit 33efdc4
  - tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
    bsc#1225611).
  - commit 16404a6
  - net: ena: Fix redundant device NUMA node override
    (jsc#PED-8688).
  - commit 6ad6684
  - ata: ahci: Clean up sysfs file on error (git-fixes).
  - ata: libata-core: Fix double free on error (git-fixes).
  - ata,scsi: libata-core: Do not leak memory for ata_port struct
    members (git-fixes).
  - ata: libata-core: Fix null pointer dereference on error
    (git-fixes).
  - kbuild: Fix build target deb-pkg: ln: failed to create hard link
    (git-fixes).
  - kbuild: doc: Update default INSTALL_MOD_DIR from extra to
    updates (git-fixes).
  - kbuild: Install dtb files as 0644 in Makefile.dtbinst
    (git-fixes).
  - counter: ti-eqep: enable clock at probe (git-fixes).
  - iio: chemical: bme680: Fix sensor data read operation
    (git-fixes).
  - iio: chemical: bme680: Fix overflows in compensate() functions
    (git-fixes).
  - iio: chemical: bme680: Fix calibration data variable
    (git-fixes).
  - iio: chemical: bme680: Fix pressure value output (git-fixes).
  - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
    (git-fixes).
  - iio: adc: ad7266: Fix variable checking bug (git-fixes).
  - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
    (git-fixes).
  - serial: bcm63xx-uart: fix tx after conversion to
    uart_port_tx_limited() (git-fixes).
  - serial: core: introduce uart_port_tx_limited_flags()
    (git-fixes).
  - Revert "serial: core: only stop transmit when HW fifo is empty"
    (git-fixes).
  - tty: mcf: MCF54418 has 10 UARTS (git-fixes).
  - usb: gadget: aspeed_udc: fix device address configuration
    (git-fixes).
  - usb: dwc3: core: remove lock of otg mode during gadget
    suspend/resume to avoid deadlock (git-fixes).
  - usb: typec: ucsi: glink: fix child node release in probe
    function (git-fixes).
  - usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    (git-fixes).
  - usb: gadget: printer: fix races against disable (git-fixes).
  - PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
  - commit a2ea5a9

++++ kernel-default:

  - X.509: Fix the parser of extended key usage for length
    (bsc#1218820).
  - commit a9df6a7
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique()
    (CVE-2024-36904 bsc#1225732).
  - commit d578dcc
  - Update
    patches.suse/1352-drm-amdgpu-Fix-possible-null-pointer-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52883
    bsc#1226630).
  - Update
    patches.suse/9p-add-missing-locking-around-taking-dentry-fid-list.patch
    (git-fixes CVE-2024-39463 bsc#1227090).
  - Update
    patches.suse/ALSA-Fix-deadlocks-with-kctl-removals-at-disconnecti.patch
    (stable-fixes CVE-2024-38600 bsc#1226864).
  - Update
    patches.suse/ALSA-core-Fix-NULL-module-pointer-assignment-at-card.patch
    (git-fixes CVE-2024-38605 bsc#1226740).
  - Update
    patches.suse/ALSA-hda-Fix-possible-null-ptr-deref-when-assigning-.patch
    (git-fixes CVE-2023-52806 bsc#1225554).
  - Update
    patches.suse/ALSA-hda-cs_dsp_ctl-Use-private_free-for-control-cle.patch
    (git-fixes CVE-2024-38388 bsc#1226890).
  - Update
    patches.suse/ALSA-timer-Set-lower-bound-of-start-tick-time.patch
    (stable-fixes git-fixes CVE-2024-38618 bsc#1226754).
  - Update
    patches.suse/ASoC-kirkwood-Fix-potential-NULL-dereference.patch
    (git-fixes CVE-2024-38550 bsc#1226633).
  - Update
    patches.suse/ASoC-mediatek-Assign-dummy-when-codec-not-specified-.patch
    (git-fixes CVE-2024-38551 bsc#1226761).
  - Update
    patches.suse/Bluetooth-btusb-Add-date-evt_skb-is-NULL-check.patch
    (git-fixes CVE-2023-52833 bsc#1225595).
  - Update
    patches.suse/Bluetooth-hci_core-Fix-possible-buffer-overflow.patch
    (git-fixes CVE-2024-26889).
  - Update
    patches.suse/HID-uclogic-Fix-user-memory-access-bug-in-uclogic_pa.patch
    (git-fixes CVE-2023-52866 bsc#1225120).
  - Update
    patches.suse/IB-mlx5-Fix-init-stage-error-handling-to-avoid-doubl.patch
    (jsc#PED-6864 CVE-2023-52851 bsc#1225587).
  - Update
    patches.suse/Input-cyapa-add-missing-input-core-locking-to-suspen.patch
    (git-fixes CVE-2023-52884 bsc#1226764).
  - Update
    patches.suse/Input-synaptics-rmi4-fix-use-after-free-in-rmi_unreg.patch
    (git-fixes CVE-2023-52840 bsc#1224928).
  - Update
    patches.suse/KEYS-trusted-Do-not-use-WARN-when-encode-fails.patch
    (git-fixes CVE-2024-36975 bsc#1226520).
  - Update
    patches.suse/KEYS-trusted-Fix-memory-leak-in-tpm2_key_encode.patch
    (git-fixes CVE-2024-36967 bsc#1226131).
  - Update
    patches.suse/RDMA-cma-Fix-kmemleak-in-rdma_core-observed-during-b.patch
    (git-fixes CVE-2024-38539 bsc#1226608).
  - Update patches.suse/RDMA-hns-Fix-UAF-for-cq-async-event.patch
    (git-fixes CVE-2024-38545 bsc#1226595).
  - Update
    patches.suse/RDMA-hns-Fix-deadlock-on-SRQ-async-events.patch
    (git-fixes CVE-2024-38591 bsc#1226738).
  - Update
    patches.suse/RDMA-hns-Modify-the-print-level-of-CQE-error.patch
    (git-fixes CVE-2024-38590 bsc#1226839).
  - Update
    patches.suse/RDMA-rxe-Fix-seg-fault-in-rxe_comp_queue_pkt.patch
    (git-fixes CVE-2024-38544 bsc#1226597).
  - Update
    patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
    (git-fixes CVE-2023-52803 bsc#1225008).
  - Update patches.suse/af_unix-Clear-stale-u-oob_skb.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-35970 bsc#1224584).
  - Update
    patches.suse/af_unix-Drop-oob_skb-ref-before-purging-queue-in-GC.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-26750 bsc#1222617).
  - Update
    patches.suse/af_unix-Fix-task-hung-while-purging-oob_skb-in-GC.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-26780 bsc#1222588).
  - Update
    patches.suse/af_unix-Update-unix_sk-sk-oob_skb-under-sk_receive_queue-lock.patch
    (CVE-2024-26676 bsc#1222380 CVE-2024-36972 bsc#1226163).
  - Update
    patches.suse/arm64-Restrict-CPU_BIG_ENDIAN-to-GNU-as-or-LLVM-IAS-.patch
    (git-fixes CVE-2023-52750 bsc#1225485).
  - Update
    patches.suse/atl1c-Work-around-the-DMA-RX-overflow-issue.patch
    (git-fixes CVE-2023-52834 bsc#1225599).
  - Update
    patches.suse/ax25-Fix-reference-count-leak-issue-of-net_device.patch
    (git-fixes CVE-2024-38554 bsc#1226742).
  - Update
    patches.suse/ax25-Fix-reference-count-leak-issues-of-ax25_dev.patch
    (git-fixes CVE-2024-38602 bsc#1226613).
  - Update
    patches.suse/blk-cgroup-fix-list-corruption-from-reorder-of-WRITE-lqueued.patch
    (bsc#1225605 CVE-2024-38384 bsc#1226938).
  - Update
    patches.suse/blk-cgroup-fix-list-corruption-from-resetting-io-stat.patch
    (bsc#1225605 CVE-2024-38663 bsc#1226939).
  - Update
    patches.suse/bnxt_re-avoid-shift-undefined-behavior-in-bnxt_qplib.patch
    (git-fixes CVE-2024-38540 bsc#1226582).
  - Update
    patches.suse/bonding-stop-the-device-in-bond_setup_by_slave.patch
    (git-fixes CVE-2023-52784 bsc#1224946).
  - Update
    patches.suse/can-dev-can_put_echo_skb-don-t-crash-kernel-if-can_p.patch
    (git-fixes CVE-2023-52878 bsc#1225000).
  - Update
    patches.suse/clk-mediatek-clk-mt2701-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52875 bsc#1225096).
  - Update
    patches.suse/clk-mediatek-clk-mt6765-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52870 bsc#1224937).
  - Update
    patches.suse/clk-mediatek-clk-mt6779-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52873 bsc#1225589).
  - Update
    patches.suse/clk-mediatek-clk-mt6797-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52865 bsc#1225086).
  - Update
    patches.suse/clk-mediatek-clk-mt7629-Add-check-for-mtk_alloc_clk_.patch
    (git-fixes CVE-2023-52858 bsc#1225566).
  - Update
    patches.suse/clk-mediatek-clk-mt7629-eth-Add-check-for-mtk_alloc_.patch
    (git-fixes CVE-2023-52876 bsc#1225036).
  - Update
    patches.suse/cppc_cpufreq-Fix-possible-null-pointer-dereference.patch
    (git-fixes CVE-2024-38573 bsc#1226739).
  - Update patches.suse/cpufreq-exit-callback-is-optional.patch
    (git-fixes CVE-2024-38615 bsc#1226592).
  - Update patches.suse/crypto-bcm-Fix-pointer-arithmetic.patch
    (git-fixes CVE-2024-38579 bsc#1226637).
  - Update
    patches.suse/crypto-pcrypt-Fix-hungtask-for-PADATA_RESET.patch
    (git-fixes CVE-2023-52813 bsc#1225527).
  - Update patches.suse/cxl-mem-Fix-shutdown-order.patch (git-fixes
    CVE-2023-52849 bsc#1224949).
  - Update
    patches.suse/cxl-region-Do-not-try-to-cleanup-after-cxl_region_se.patch
    (git-fixes CVE-2023-52792 bsc#1225477).
  - Update patches.suse/cxl-region-Fix-cxlr_pmem-leaks.patch
    (git-fixes CVE-2024-38391 bsc#1226894).
  - Update
    patches.suse/dma-buf-sw-sync-don-t-enable-IRQ-from-sync_print_obj.patch
    (git-fixes CVE-2024-38780 bsc#1226886).
  - Update
    patches.suse/dma-mapping-benchmark-fix-node-id-validation.patch
    (git-fixes CVE-2024-34777 bsc#1226796).
  - Update
    patches.suse/dma-mapping-benchmark-handle-NUMA_NO_NODE-correctly.patch
    (git-fixes CVE-2024-39277 bsc#1226909).
  - Update
    patches.suse/dmaengine-idxd-Avoid-unnecessary-destruction-of-file.patch
    (git-fixes CVE-2024-38629 bsc#1226905).
  - Update
    patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52819
    bsc#1225532).
  - Update
    patches.suse/drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52818
    bsc#1225530).
  - Update
    patches.suse/drm-amd-check-num-of-link-levels-when-update-pcie-pa.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52812
    bsc#1225564).
  - Update
    patches.suse/drm-amd-display-Avoid-NULL-dereference-of-timing-gen.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52753
    bsc#1225478).
  - Update
    patches.suse/drm-amd-display-Fix-division-by-zero-in-setup_dsc_co.patch
    (stable-fixes CVE-2024-36969 bsc#1226155).
  - Update
    patches.suse/drm-amd-display-Fix-null-pointer-dereference-in-erro.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52862
    bsc#1225015).
  - Update
    patches.suse/drm-amd-display-Fix-potential-index-out-of-bounds-in.patch
    (git-fixes CVE-2024-38552 bsc#1226767).
  - Update
    patches.suse/drm-amd-display-fix-a-NULL-pointer-dereference-in-am.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52773
    bsc#1225041).
  - Update
    patches.suse/drm-amd-display-fixed-integer-types-and-null-check-l.patch
    (git-fixes CVE-2024-26767).
  - Update
    patches.suse/drm-amdgpu-Fix-a-null-pointer-access-when-the-smc_rr.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52817
    bsc#1225569).
  - Update
    patches.suse/drm-amdgpu-Fix-buffer-size-in-gfx_v9_4_3_init_-cp_co.patch
    (git-fixes CVE-2024-39291 bsc#1226934).
  - Update
    patches.suse/drm-amdgpu-Fix-potential-null-pointer-derefernce.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52814
    bsc#1225565).
  - Update
    patches.suse/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
    (stable-fixes CVE-2024-39471 bsc#1227096).
  - Update
    patches.suse/drm-amdgpu-mes-fix-use-after-free-issue.patch
    (stable-fixes CVE-2024-38581 bsc#1226657).
  - Update
    patches.suse/drm-amdgpu-vkms-fix-a-possible-null-pointer-derefere.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52815
    bsc#1225568).
  - Update
    patches.suse/drm-amdkfd-Fix-a-race-condition-of-vram-buffer-unref.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52825
    bsc#1225076).
  - Update
    patches.suse/drm-amdkfd-Fix-shift-out-of-bounds-issue.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52816
    bsc#1225529).
  - Update
    patches.suse/drm-bridge-cdns-mhdp8546-Fix-possible-null-pointer-d.patch
    (git-fixes CVE-2024-38548).
  - Update
    patches.suse/drm-bridge-it66121-Fix-invalid-connector-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52861
    bsc#1224941).
  - Update
    patches.suse/drm-bridge-lt8912b-Fix-crash-on-bridge-detach.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52856
    bsc#1224932).
  - Update
    patches.suse/drm-mediatek-Add-0-size-check-to-mtk_drm_gem_obj.patch
    (git-fixes CVE-2024-38549 bsc#1226735).
  - Update
    patches.suse/drm-mediatek-Fix-coverity-issue-with-unintentional-i.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52857
    bsc#1225581).
  - Update
    patches.suse/drm-mediatek-Init-ddp_comp-with-devm_kcalloc.patch
    (git-fixes CVE-2024-38592 bsc#1226844).
  - Update
    patches.suse/drm-msm-a6xx-Avoid-a-nullptr-dereference-when-speedb.patch
    (git-fixes CVE-2024-38390 bsc#1226891).
  - Update
    patches.suse/drm-msm-dpu-Add-callback-function-pointer-check-befo.patch
    (git-fixes CVE-2024-38622 bsc#1226856).
  - Update
    patches.suse/drm-panel-fix-a-possible-null-pointer-dereference.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52821
    bsc#1225022).
  - Update
    patches.suse/drm-panel-panel-tpo-tpg110-fix-a-possible-null-point.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52826
    bsc#1225077).
  - Update patches.suse/drm-radeon-possible-buffer-overflow.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52867
    bsc#1225009).
  - Update
    patches.suse/drm-vc4-Fix-possible-null-pointer-dereference.patch
    (git-fixes CVE-2024-38546 bsc#1226593).
  - Update
    patches.suse/drm-vmwgfx-Fix-invalid-reads-in-fence-signaled-event.patch
    (git-fixes CVE-2024-36960 bsc#1225872).
  - Update
    patches.suse/drm-zynqmp_dpsub-Always-register-bridge.patch
    (git-fixes CVE-2024-38664 bsc#1226941).
  - Update
    patches.suse/e1000e-change-usleep_range-to-udelay-in-PHY-mdic-acc.patch
    (CVE-2024-39296 bsc#1226989 CVE-2024-36887 bsc#1225731).
  - Update
    patches.suse/ecryptfs-Fix-buffer-size-for-tag-66-packet.patch
    (git-fixes CVE-2024-38578 bsc#1226634).
  - Update
    patches.suse/efi-libstub-only-free-priv.runtime_map-when-allocate.patch
    (git-fixes CVE-2024-33619 bsc#1226768).
  - Update
    patches.suse/fbdev-imsttfb-fix-a-resource-leak-in-probe.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52838
    bsc#1225031).
  - Update
    patches.suse/fs-9p-only-translate-RWX-permissions-for-plain-9P200.patch
    (git-fixes CVE-2024-36964 bsc#1225866).
  - Update
    patches.suse/fs-jfs-Add-check-for-negative-db_l2nbperpage.patch
    (git-fixes CVE-2023-52810 bsc#1225557).
  - Update
    patches.suse/fs-jfs-Add-validity-check-for-db_maxag-and-db_agpref.patch
    (git-fixes CVE-2023-52804 bsc#1225550).
  - Update
    patches.suse/ftrace-Fix-possible-use-after-free-issue-in-ftrace_location.patch
    (git-fixes CVE-2024-38588 bsc#1226837).
  - Update
    patches.suse/genirq-irqdesc-Prevent-use-after-free-in-irq_find_at.patch
    (git-fixes CVE-2024-38385 bsc#1227085).
  - Update patches.suse/gfs2-ignore-negated-quota-changes.patch
    (git-fixes CVE-2023-52759 bsc#1225560).
  - Update
    patches.suse/hid-cp2112-Fix-duplicate-workqueue-initialization.patch
    (git-fixes CVE-2023-52853 bsc#1224988).
  - Update
    patches.suse/hwmon-axi-fan-control-Fix-possible-NULL-pointer-dere.patch
    (git-fixes CVE-2023-52863 bsc#1225586).
  - Update
    patches.suse/i2c-acpi-Unbind-mux-adapters-before-delete.patch
    (git-fixes CVE-2024-39362 bsc#1226995).
  - Update
    patches.suse/i2c-core-Run-atomic-i2c-xfer-when-preemptible.patch
    (git-fixes CVE-2023-52791 bsc#1225108).
  - Update
    patches.suse/i3c-master-mipi-i3c-hci-Fix-a-kernel-panic-for-acces.patch
    (git-fixes CVE-2023-52763 bsc#1225570).
  - Update
    patches.suse/i3c-mipi-i3c-hci-Fix-out-of-bounds-access-in-hci_dma.patch
    (git-fixes CVE-2023-52766).
  - Update
    patches.suse/i915-perf-Fix-NULL-deref-bugs-with-drm_dbg-calls.patch
    (jsc#PED-3527 jsc#PED-5475 jsc#PED-6068 jsc#PED-6070
    jsc#PED-6116 jsc#PED-6120 jsc#PED-5065 jsc#PED-5477 jsc#PED-5511
    jsc#PED-6041 jsc#PED-6069 jsc#PED-6071 CVE-2023-52788
    bsc#1225106).
  - Update
    patches.suse/igb-Fix-string-truncation-warnings-in-igb_set_fw_ver.patch
    (git-fixes CVE-2024-36010 bsc#1225594).
  - Update
    patches.suse/iommu-vt-d-Fix-WARN_ON-in-iommu-probe-path.patch
    (git-fixes CVE-2024-35957 bsc#1224673).
  - Update
    patches.suse/iommufd-Fix-missing-update-of-domains_itree-after-splitting-iopt
    (jsc#PED-7779 jsc#PED-7780 CVE-2023-52801 bsc#1225006).
  - Update
    patches.suse/ipvlan-add-ipvlan_route_v6_outbound-helper.patch
    (git-fixes CVE-2023-52796 bsc#1224930).
  - Update
    patches.suse/jffs2-prevent-xattr-node-from-overflowing-the-eraseblock.patch
    (git-fixes CVE-2024-38599 bsc#1226848).
  - Update
    patches.suse/jfs-fix-array-index-out-of-bounds-in-dbFindLeaf.patch
    (git-fixes CVE-2023-52799 bsc#1225472).
  - Update
    patches.suse/jfs-fix-array-index-out-of-bounds-in-diAlloc.patch
    (git-fixes CVE-2023-52805 bsc#1225553).
  - Update
    patches.suse/kunit-fortify-Fix-mismatched-kvalloc-vfree-usage.patch
    (git-fixes CVE-2024-38617 bsc#1226859).
  - Update
    patches.suse/lib-generic-radix-tree.c-Don-t-overflow-in-peek.patch
    (git-fixes CVE-2021-47432 bsc#1225391).
  - Update
    patches.suse/lib-test_hmm.c-handle-src_pfns-and-dst_pfns-allocati.patch
    (git-fixes CVE-2024-38543 bsc#1226594).
  - Update
    patches.suse/locking-ww_mutex-test-Fix-potential-workqueue-corrup.patch
    (bsc#1219953 CVE-2023-52836 bsc#1225609).
  - Update
    patches.suse/md-Don-t-ignore-suspended-array-in-md_check_recovery-1baa.patch
    (bsc#1219596 CVE-2024-26758).
  - Update
    patches.suse/media-atomisp-ssh_css-Fix-a-null-pointer-dereference.patch
    (git-fixes CVE-2024-38547 bsc#1226632).
  - Update
    patches.suse/media-bttv-fix-use-after-free-error-due-to-btv-timeo.patch
    (git-fixes CVE-2023-52847 bsc#1225588).
  - Update
    patches.suse/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch
    (git-fixes CVE-2023-52764 bsc#1225571).
  - Update
    patches.suse/media-hantro-Check-whether-reset-op-is-defined-befor.patch
    (git-fixes CVE-2023-52850 bsc#1225014).
  - Update
    patches.suse/media-i2c-et8ek8-Don-t-strip-remove-function-when-dr.patch
    (git-fixes CVE-2024-38611 bsc#1226760).
  - Update
    patches.suse/media-imon-fix-access-to-invalid-resource-for-the-se.patch
    (git-fixes CVE-2023-52754 bsc#1225490).
  - Update
    patches.suse/media-lgdt3306a-Add-a-check-against-null-pointer-def.patch
    (stable-fixes CVE-2022-48772 bsc#1226976).
  - Update
    patches.suse/media-stk1160-fix-bounds-checking-in-stk1160_copy_vi.patch
    (git-fixes CVE-2024-38621 bsc#1226895).
  - Update
    patches.suse/media-vidtv-mux-Add-check-and-kfree-for-kstrdup.patch
    (git-fixes CVE-2023-52841 bsc#1225592).
  - Update patches.suse/media-vidtv-psi-Add-check-for-kstrdup.patch
    (git-fixes CVE-2023-52844 bsc#1225590).
  - Update
    patches.suse/mfd-qcom-spmi-pmic-Fix-revid-implementation.patch
    (git-fixes CVE-2023-52765 bsc#1225029).
  - Update
    patches.suse/misc-microchip-pci1xxxx-fix-double-free-in-the-error.patch
    (git-fixes CVE-2024-36973 bsc#1226457).
  - Update
    patches.suse/net-hns3-fix-out-of-bounds-access-may-occur-when-coa.patch
    (git-fixes CVE-2023-52807 bsc#1225097).
  - Update
    patches.suse/net-ks8851-Queue-RX-packets-in-IRQ-handler-instead-o.patch
    (git-fixes CVE-2024-36962 bsc#1225827).
  - Update
    patches.suse/net-mlx5-Fix-peer-devlink-set-for-SF-representor-dev.patch
    (git-fixes CVE-2024-38595 bsc#1226741).
  - Update
    patches.suse/net-mlx5e-Track-xmit-submission-to-PTP-WQ-after-popu.patch
    (jsc#PED-3311 CVE-2023-52782 bsc#1225103).
  - Update
    patches.suse/net-mvneta-fix-calls-to-page_pool_get_stats.patch
    (git-fixes CVE-2023-52780 bsc#1224933).
  - Update
    patches.suse/net-wangxun-fix-kernel-panic-due-to-null-pointer.patch
    (git-fixes CVE-2023-52783 bsc#1225104).
  - Update
    patches.suse/netfilter-complete-validation-of-user-input.patch
    (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
    bsc#1224583).
  - Update
    patches.suse/nfc-nci-Fix-uninit-value-in-nci_rx_work.patch
    (git-fixes CVE-2024-38381 bsc#1226878).
  - Update
    patches.suse/nilfs2-fix-nilfs_empty_dir-misjudgment-and-long-loop.patch
    (git-fixes CVE-2024-39469 bsc#1226992).
  - Update
    patches.suse/nilfs2-fix-potential-hang-in-nilfs_detach_log_writer.patch
    (git-fixes CVE-2024-38582 bsc#1226658).
  - Update
    patches.suse/nilfs2-fix-use-after-free-of-timer-for-log-writer-th.patch
    (git-fixes CVE-2024-38583 bsc#1226777).
  - Update
    patches.suse/of-module-add-buffer-overflow-check-in-of_modalias.patch
    (git-fixes CVE-2024-38541 bsc#1226587).
  - Update
    patches.suse/padata-Fix-refcnt-handling-in-padata_free_shell.patch
    (git-fixes CVE-2023-52854 bsc#1225584).
  - Update
    patches.suse/perf-core-Bail-out-early-if-the-request-AUX-area-is-out-of-bound.patch
    (git-fixes CVE-2023-52835 bsc#1225602).
  - Update
    patches.suse/platform-x86-wmi-Fix-opening-of-char-device.patch
    (git-fixes CVE-2023-52864 bsc#1225132).
  - Update
    patches.suse/powerpc-pseries-iommu-LPAR-panics-during-boot-up-wit.patch
    (bsc#1222011 ltc#205900 CVE-2024-36926 bsc#1225829).
  - Update patches.suse/pstore-platform-Add-check-for-kstrdup.patch
    (git-fixes CVE-2023-52869 bsc#1225050).
  - Update
    patches.suse/remoteproc-mediatek-Make-sure-IPI-buffer-fits-in-L2T.patch
    (git-fixes CVE-2024-36965 bsc#1226149).
  - Update
    patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
    (git-fixes CVE-2024-38601 bsc#1226876).
  - Update
    patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
    (git-fixes bsc#1217481 CVE-2023-52774 bsc#1225572).
  - Update
    patches.suse/scsi-hisi_sas-Set-debugfs_dir-pointer-to-NULL-after-removing-debugfs.patch
    (git-fixes CVE-2023-52808 bsc#1225555).
  - Update
    patches.suse/scsi-ibmvfc-Remove-BUG_ON-in-the-case-of-an-empty-ev.patch
    (bsc#1209834 ltc#202097 CVE-2023-52811 bsc#1225559).
  - Update
    patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
    (git-fixes CVE-2023-52809 bsc#1225556).
  - Update
    patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-af.patch
    (bsc#1221777 CVE-2024-36952 bsc#1225898).
  - Update
    patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker.patch
    (bsc#1221777 CVE-2024-36924 bsc#1225820).
  - Update
    patches.suse/serial-max3100-Lock-port-lock-when-calling-uart_hand.patch
    (git-fixes CVE-2024-38634 bsc#1226868).
  - Update
    patches.suse/serial-max3100-Update-uart_driver_registered-on-driv.patch
    (git-fixes CVE-2024-38633 bsc#1226867).
  - Update
    patches.suse/soc-qcom-llcc-Handle-a-second-device-without-data-co.patch
    (git-fixes CVE-2023-52871 bsc#1225534).
  - Update
    patches.suse/soundwire-cadence-fix-invalid-PDI-offset.patch
    (stable-fixes CVE-2024-38635 bsc#1226863).
  - Update patches.suse/speakup-Fix-sizeof-vs-ARRAY_SIZE-bug.patch
    (git-fixes CVE-2024-38587 bsc#1226780).
  - Update patches.suse/spi-Fix-null-dereference-on-suspend.patch
    (git-fixes CVE-2023-52749 bsc#1225476).
  - Update
    patches.suse/thermal-core-prevent-potential-string-overflow.patch
    (git-fixes CVE-2023-52868 bsc#1225044).
  - Update
    patches.suse/thermal-drivers-qcom-lmh-Check-for-SCM-availability-.patch
    (git-fixes CVE-2024-39466 bsc#1227089).
  - Update
    patches.suse/thermal-drivers-tsens-Fix-null-pointer-dereference.patch
    (git-fixes CVE-2024-38571 bsc#1226737).
  - Update
    patches.suse/thermal-intel-powerclamp-fix-mismatch-in-get-functio.patch
    (git-fixes CVE-2023-52794 bsc#1225028).
  - Update
    patches.suse/tls-fix-NULL-deref-on-tls_sw_splice_eof-with-empty-r.patch
    (jsc#PED-6831 CVE-2023-52767 bsc#1224998).
  - Update
    patches.suse/tpm_tis_spi-Account-for-SPI-header-when-allocating-T.patch
    (git-fixes CVE-2024-36477 bsc#1226840).
  - Update
    patches.suse/tracing-Have-trace_event_file-have-ref-counters.patch
    (git-fixes CVE-2023-52879 bsc#1225101).
  - Update
    patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
    (git-fixes CVE-2024-26920).
  - Update
    patches.suse/tty-n_gsm-fix-race-condition-in-status-line-change-o.patch
    (git-fixes CVE-2023-52872 bsc#1225591).
  - Update
    patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
    (bsc#1222619 CVE-2023-52880).
  - Update
    patches.suse/tty-vcc-Add-check-for-kstrdup-in-vcc_probe.patch
    (git-fixes CVE-2023-52789 bsc#1225180).
  - Update
    patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
    (git-fixes CVE-2023-52781 bsc#1225092).
  - Update
    patches.suse/usb-dwc3-Wait-unconditionally-after-issuing-EndXfer-.patch
    (git-fixes CVE-2024-36977 bsc#1226513).
  - Update
    patches.suse/usb-gadget-u_audio-Fix-race-condition-use-of-control.patch
    (git-fixes CVE-2024-38628 bsc#1226911).
  - Update
    patches.suse/usb-storage-alauda-Check-whether-the-media-is-initia.patch
    (git-fixes CVE-2024-38619 bsc#1226861).
  - Update
    patches.suse/usb-typec-tcpm-Fix-NULL-pointer-dereference-in-tcpm_.patch
    (git-fixes CVE-2023-52877 bsc#1224944).
  - Update
    patches.suse/vhost-vdpa-fix-use-after-free-in-vhost_vdpa_probe.patch
    (jsc#PED-3311 CVE-2023-52795 bsc#1225085).
  - Update
    patches.suse/virtio-blk-fix-implicit-overflow-on-virtio_max_dma_s.patch
    (git-fixes CVE-2023-52762 bsc#1225573).
  - Update
    patches.suse/virtio-vsock-Fix-uninit-value-in-virtio_transport_re.patch
    (jsc#PED-5505 CVE-2023-52842 bsc#1225025).
  - Update
    patches.suse/watchdog-cpu5wdt.c-Fix-use-after-free-bug-caused-by-.patch
    (git-fixes CVE-2024-38630 bsc#1226908).
  - Update
    patches.suse/wifi-ar5523-enable-proper-endpoint-verification.patch
    (git-fixes CVE-2024-38565 bsc#1226747).
  - Update
    patches.suse/wifi-ath11k-fix-dfs-radar-event-locking.patch
    (git-fixes CVE-2023-52798 bsc#1224947).
  - Update
    patches.suse/wifi-ath11k-fix-gtk-offload-status-event-locking.patch
    (git-fixes CVE-2023-52777 bsc#1224992).
  - Update patches.suse/wifi-ath11k-fix-htt-pktlog-locking.patch
    (git-fixes CVE-2023-52800).
  - Update
    patches.suse/wifi-ath12k-fix-dfs-radar-and-temperature-event-lock.patch
    (git-fixes CVE-2023-52776 bsc#1225090).
  - Update
    patches.suse/wifi-ath12k-fix-htt-mlo-offset-event-locking.patch
    (git-fixes CVE-2023-52769 bsc#1225001).
  - Update
    patches.suse/wifi-ath12k-fix-out-of-bound-access-of-qmi_invoke_ha.patch
    (git-fixes CVE-2024-38572 bsc#1226776).
  - Update
    patches.suse/wifi-ath12k-fix-possible-out-of-bound-read-in-ath12k.patch
    (git-fixes CVE-2023-52827 bsc#1225078).
  - Update
    patches.suse/wifi-ath12k-fix-possible-out-of-bound-write-in-ath12.patch
    (git-fixes CVE-2023-52829 bsc#1225081).
  - Update
    patches.suse/wifi-brcmfmac-pcie-handle-randbuf-allocation-failure.patch
    (git-fixes CVE-2024-38575 bsc#1226612).
  - Update
    patches.suse/wifi-carl9170-add-a-proper-sanity-check-for-endpoint.patch
    (git-fixes CVE-2024-38567 bsc#1226769).
  - Update
    patches.suse/wifi-carl9170-re-fix-fortified-memset-warning.patch
    (git-fixes CVE-2024-38616 bsc#1226852).
  - Update
    patches.suse/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch
    (git-fixes CVE-2023-52832 bsc#1225577).
  - Update
    patches.suse/wifi-nl80211-Avoid-address-calculations-via-out-of-b.patch
    (git-fixes CVE-2024-38562 bsc#1226788).
  - Update
    patches.suse/wifi-wilc1000-use-vmm_table-as-array-in-wilc-struct.patch
    (git-fixes CVE-2023-52768 bsc#1225004).
  - Update
    patches.suse/x86-tdx-Zero-out-the-missing-RSI-in-TDX_HYPERCALL-macro.patch
    (jsc#PED-5824 CVE-2023-52874 bsc#1225049).
  - commit 33efdc4
  - tcp: do not accept ACK of bytes we never sent (CVE-2023-52881
    bsc#1225611).
  - commit 16404a6
  - net: ena: Fix redundant device NUMA node override
    (jsc#PED-8688).
  - commit 6ad6684
  - ata: ahci: Clean up sysfs file on error (git-fixes).
  - ata: libata-core: Fix double free on error (git-fixes).
  - ata,scsi: libata-core: Do not leak memory for ata_port struct
    members (git-fixes).
  - ata: libata-core: Fix null pointer dereference on error
    (git-fixes).
  - kbuild: Fix build target deb-pkg: ln: failed to create hard link
    (git-fixes).
  - kbuild: doc: Update default INSTALL_MOD_DIR from extra to
    updates (git-fixes).
  - kbuild: Install dtb files as 0644 in Makefile.dtbinst
    (git-fixes).
  - counter: ti-eqep: enable clock at probe (git-fixes).
  - iio: chemical: bme680: Fix sensor data read operation
    (git-fixes).
  - iio: chemical: bme680: Fix overflows in compensate() functions
    (git-fixes).
  - iio: chemical: bme680: Fix calibration data variable
    (git-fixes).
  - iio: chemical: bme680: Fix pressure value output (git-fixes).
  - iio: accel: fxls8962af: select IIO_BUFFER & IIO_KFIFO_BUF
    (git-fixes).
  - iio: adc: ad7266: Fix variable checking bug (git-fixes).
  - iio: xilinx-ams: Don't include ams_ctrl_channels in scan_mask
    (git-fixes).
  - serial: bcm63xx-uart: fix tx after conversion to
    uart_port_tx_limited() (git-fixes).
  - serial: core: introduce uart_port_tx_limited_flags()
    (git-fixes).
  - Revert "serial: core: only stop transmit when HW fifo is empty"
    (git-fixes).
  - tty: mcf: MCF54418 has 10 UARTS (git-fixes).
  - usb: gadget: aspeed_udc: fix device address configuration
    (git-fixes).
  - usb: dwc3: core: remove lock of otg mode during gadget
    suspend/resume to avoid deadlock (git-fixes).
  - usb: typec: ucsi: glink: fix child node release in probe
    function (git-fixes).
  - usb: musb: da8xx: fix a resource leak in probe() (git-fixes).
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind()
    (git-fixes).
  - usb: gadget: printer: fix races against disable (git-fixes).
  - PCI/MSI: Fix UAF in msi_capability_init (git-fixes).
  - commit a2ea5a9

++++ krb5:

  - Fix vulnerabilities in GSS message token handling, add patch
    0011-Fix-vulnerabilities-in-GSS-message-token-handling.patch
    * CVE-2024-37370, bsc#1227186
    * CVE-2024-37371, bsc#1227187

++++ krb5:

  - Fix vulnerabilities in GSS message token handling, add patch
    0011-Fix-vulnerabilities-in-GSS-message-token-handling.patch
    * CVE-2024-37370, bsc#1227186
    * CVE-2024-37371, bsc#1227187

++++ krb5:

  - Fix vulnerabilities in GSS message token handling, add patch
    0011-Fix-vulnerabilities-in-GSS-message-token-handling.patch
    * CVE-2024-37370, bsc#1227186
    * CVE-2024-37371, bsc#1227187

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssl-3:

  - FIPS: RSA keygen PCT requirements.
    * Skip the rsa_keygen_pairwise_test() PCT in rsa_keygen() as the
    self-test requirements are covered by do_rsa_pct() for both
    RSA-OAEP and RSA signatures [bsc#1221760]
    * Enforce error state if rsa_keygen PCT is run and fails [bsc#1221753]
    * Add openssl-3-FIPS-PCT_rsa_keygen.patch

++++ openssh:

  - Add patch to fix a race condition in a signal handler by removing
    the async-signal-unsafe code (CVE-2024-6387, bsc#1226642):
    * fix-CVE-2024-6387.patch

++++ openssh:

  - Add patch to fix a race condition in a signal handler by removing
    the async-signal-unsafe code (CVE-2024-6387, bsc#1226642):
    * fix-CVE-2024-6387.patch

++++ openssh:

  - Add patch to fix a race condition in a signal handler by removing
    the async-signal-unsafe code (CVE-2024-6387, bsc#1226642):
    * fix-CVE-2024-6387.patch

------------------------------------------------------------------
------------------  2024-6-30  -  Jun 30 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - crypto: deflate - Add aliases to deflate (bsc#1227190).
  - commit 27ffd92
  - crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
  - commit cd600aa
  - i2c: testunit: discard write requests while old command is
    running (git-fixes).
  - i2c: testunit: don't erase registers after STOP (git-fixes).
  - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    (git-fixes).
  - mmc: sdhci: Do not invert write-protect twice (git-fixes).
  - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
    (git-fixes).
  - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - commit 448487d

++++ kernel-default:

  - crypto: deflate - Add aliases to deflate (bsc#1227190).
  - commit 27ffd92
  - crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
  - commit cd600aa
  - i2c: testunit: discard write requests while old command is
    running (git-fixes).
  - i2c: testunit: don't erase registers after STOP (git-fixes).
  - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    (git-fixes).
  - mmc: sdhci: Do not invert write-protect twice (git-fixes).
  - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
    (git-fixes).
  - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - commit 448487d

++++ kernel-default:

  - crypto: deflate - Add aliases to deflate (bsc#1227190).
  - commit 27ffd92
  - crypto: iaa - Account for cpu-less numa nodes (bsc#1227190).
  - commit cd600aa
  - i2c: testunit: discard write requests while old command is
    running (git-fixes).
  - i2c: testunit: don't erase registers after STOP (git-fixes).
  - mmc: sdhci: Do not lock spinlock around mmc_gpio_get_ro()
    (git-fixes).
  - mmc: sdhci: Do not invert write-protect twice (git-fixes).
  - mmc: sdhci-brcmstb: check R1_STATUS for erase/trim/discard
    (git-fixes).
  - mmc: sdhci-pci: Convert PCIBIOS_* return codes to errnos
    (git-fixes).
  - commit 448487d

------------------------------------------------------------------
------------------  2024-6-29  -  Jun 29 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - gpiolib: cdev: Disallow reconfiguration without direction
    (uAPI v1) (git-fixes).
  - gpio: davinci: Validate the obtained number of IRQs (git-fixes).
  - commit 919ebd1

++++ kernel-default:

  - gpiolib: cdev: Disallow reconfiguration without direction
    (uAPI v1) (git-fixes).
  - gpio: davinci: Validate the obtained number of IRQs (git-fixes).
  - commit 919ebd1

++++ kernel-default:

  - gpiolib: cdev: Disallow reconfiguration without direction
    (uAPI v1) (git-fixes).
  - gpio: davinci: Validate the obtained number of IRQs (git-fixes).
  - commit 919ebd1

------------------------------------------------------------------
------------------  2024-6-28  -  Jun 28 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - wifi: iwlwifi: mvm: fix the TXF mapping for BZ devices
    (bsc#1227149).
  - wifi: iwlwifi: clear link_id in time_event (bsc#1227149).
  - wifi: iwlwifi: mvm: fix a battery life regression (bsc#1227149).
  - wifi: iwlwifi: remove extra kernel-doc (bsc#1227149).
  - wifi: iwlwifi: mvm: skip adding debugfs symlink for reconfig
    (bsc#1227149).
  - wifi: iwlwifi: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: iwlwifi: mvm: use the new command to clear the internal
    buffer (bsc#1227149).
  - commit acd03db
  - wifi: iwlwifi: mvm: add US/Canada MCC to API (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit 70a9591
  - wifi: iwlwifi: mvm: disallow puncturing in US/Canada
    (bsc#1227149).
  - wifi: iwlwifi: Add rf_mapping of new wifi7 devices
    (bsc#1227149).
  - wifi: iwlwifi: cleanup BT Shared Single Antenna code
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Do not warn if valid link pair was not found
    (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: avoid intermediate/early mutex unlock
    (bsc#1227149).
  - wifi: iwlwifi: Don't mark DFS channels as NO-IR (bsc#1227149).
  - wifi: iwlwifi: mvm: Allow DFS concurrent operation
    (bsc#1227149).
  - wifi: iwlwifi: mvm: do not send STA_DISABLE_TX_CMD for newer
    firmware (bsc#1227149).
  - wifi: iwlwifi: remove async command callback (bsc#1227149).
  - commit 0205124
  - wifi: iwlwifi: fw: file: don't use [0] for variable arrays
    (bsc#1227149).
  - wifi: iwlwifi: pcie: get_crf_id() can be void (bsc#1227149).
  - wifi: iwlwifi: pcie: dump CSRs before removal (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up device removal work (bsc#1227149).
  - wifi: iwlwifi: mvm: add a debugfs hook to clear the monitor data
    (bsc#1227149).
  - wifi: iwlwifi: refactor RX tracing (bsc#1227149).
  - wifi: iwlwifi: mvm: Correctly report TSF data in scan complete
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Use the link ID provided in scan request
    (bsc#1227149).
  - wifi: iwlwifi: fw: replace deprecated strncpy with strscpy_pad
    (bsc#1227149).
  - wifi: iwlwifi: fix system commands group ordering (bsc#1227149).
  - commit 6cae420
  - wifi: iwlwifi: drop NULL pointer check in
    iwl_mvm_tzone_set_trip_temp() (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 86 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: read DSM func 2 for specific RF types
    (bsc#1227149).
  - wifi: iwlwifi: mvm: show dump even for pldr_sync (bsc#1227149).
  - wifi: iwlwifi: mvm: cycle FW link on chanctx removal
    (bsc#1227149).
  - wifi: iwlwifi: trace full frames with TX status request
    (bsc#1227149).
  - wifi: iwlwifi: fw: Add support for UATS table in UHB
    (bsc#1227149).
  - wifi: iwlwifi: mvm: add a print when sending RLC command
    (bsc#1227149).
  - wifi: iwlwifi: mvm: debugfs for fw system stats (bsc#1227149).
  - wifi: iwlwifi: mvm: implement new firmware API for statistics
    (bsc#1227149).
  - commit ed6b54f
  - wifi: iwlwifi: disable multi rx queue for 9000 (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-include-link-ID-when-releasing-fram.patch.
  - commit 9866ec0
  - wifi: iwlwifi: mvm: fix regdb initialization (bsc#1227149).
  - wifi: iwlwifi: mvm: simplify the reorder buffer (bsc#1227149).
  - wifi: iwlwifi: mvm: Return success if link could not be removed
    (bsc#1227149).
  - wifi: iwlwifi: add support for SNPS DPHYIP region type
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove set_tim callback for MLD ops
    (bsc#1227149).
  - wifi: iwlwifi: api: fix center_freq label in PHY diagram
    (bsc#1227149).
  - wifi: iwlwifi: support link id in SESSION_PROTECTION_NOTIF
    (bsc#1227149).
  - wifi: iwlwifi: support link_id in SESSION_PROTECTION cmd
    (bsc#1227149).
  - wifi: iwlwifi: make time_events MLO aware (bsc#1227149).
  - commit 1ea0f35
  - wifi: iwlwifi: add support for activating UNII-1 in WW via BIOS
    (bsc#1227149).
  - wifi: iwlwifi: mvm: extend alive timeout to 2 seconds
    (bsc#1227149).
  - wifi: iwlwifi: mvm: fix the PHY context resolution for p2p
    device (bsc#1227149).
  - wifi: iwlwifi: mvm: fold the ref++ into iwl_mvm_phy_ctxt_add
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't add dummy phy context (bsc#1227149).
  - wifi: iwlwifi: mvm: cleanup MLO and non-MLO unification code
    (bsc#1227149).
  - wifi: iwlwifi: mvm: implement ROC version 3 (bsc#1227149).
  - wifi: iwlwifi: send EDT table to FW (bsc#1227149).
  - wifi: iwlmvm: fw: Add new OEM vendor to tas approved list
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Fix unreachable code path (bsc#1227149).
  - commit 50ebcaa
  - wifi: iwlwifi: mvm: advertise support for SCS traffic
    description (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-do-not-announce-EPCS-support.patch.
  - commit 7208326
  - wifi: iwlwifi: add new RF support for wifi7 (bsc#1227149).
  - wifi: iwlwifi: fw: increase fw_version string size
    (bsc#1227149).
  - wifi: iwlwifi: check for kmemdup() return value in
    iwl_parse_tlv_firmware() (bsc#1227149).
  - wifi: iwlwifi: fix the rf step and flavor bits range
    (bsc#1227149).
  - wifi: iwlwifi: fw: Fix debugfs command sending (bsc#1227149).
  - wifi: iwlwifi: mvm: add start mac ctdp sum calculation debugfs
    handler (bsc#1227149).
  - wifi: iwlwifi: abort scan when rfkill on but device enabled
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Add basic link selection logic
    (bsc#1227149).
  - wifi: iwlwifi: mei: return error from register when not built
    (bsc#1227149).
  - commit fddf9eb
  - wifi: iwlwifi: mvm: fix SB CFG check (bsc#1227149).
  - wifi: iwlwifi: mvm: add a per-link debugfs (bsc#1227149).
  - wifi: iwlwifi: mvm: rework debugfs handling (bsc#1227149).
  - wifi: iwlwifi: add support for new ini region types
    (bsc#1227149).
  - wifi: iwlwifi: Extract common prph mac/phy regions data dump
    logic (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 84 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: offload IGTK in AP if BIGTK is supported
    (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up WFPM control bits (bsc#1227149).
  - wifi: iwlwifi: fix opmode start/stop race (bsc#1227149).
  - wifi: iwlwifi: skip opmode start retries on dead transport
    (bsc#1227149).
  - commit 36551d1
  - wifi: iwlwifi: mvm: add support for new wowlan_info_notif
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-d3-fix-IPN-byte-order.patch.
  - commit 0b379ae
  - wifi: iwlwifi: pcie: propagate iwl_pcie_gen2_apm_init() error
    (bsc#1227149).
  - wifi: iwlwifi: add mapping of a periphery register crf for WH RF
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check for iwl_mvm_mld_update_sta() errors
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support injection antenna control
    (bsc#1227149).
  - wifi: iwlwifi: mvm: refactor TX rate handling (bsc#1227149).
  - wifi: iwlwifi: mvm: make pldr_sync AX210 specific (bsc#1227149).
  - wifi: iwlwifi: fail NIC access fast on dead NIC (bsc#1227149).
  - wifi: iwlwifi: pcie: (re-)assign BAR0 on driver bind
    (bsc#1227149).
  - commit 0882d6d
  - wifi: iwlwifi: implement enable/disable for China 2022
    regulatory (bsc#1227149).
  - wifi: iwlwifi: mvm: handle link-STA allocation in restart
    (bsc#1227149).
  - wifi: iwlwifi: mvm: iterate active links for STA queues
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support set_antenna() (bsc#1227149).
  - wifi: iwlwifi: mvm: add a debug print when we get a BAR
    (bsc#1227149).
  - wifi: iwlwifi: mvm: move listen interval to constants
    (bsc#1227149).
  - wifi: iwlwifi: no power save during transition to D3
    (bsc#1227149).
  - wifi: iwlwifi: update context info structure definitions
    (bsc#1227149).
  - wifi: iwlwifi: mvm: fix recovery flow in CSA (bsc#1227149).
  - wifi: iwlwifi: mvm: enable FILS DF Tx on non-PSC channel
    (bsc#1227149).
  - commit 5c7efaf
  - wifi: iwlwifi: mvm: make "pldr_sync" mode effective
    (bsc#1227149).
  - wifi: iwlwifi: mvm: log dropped frames (bsc#1227149).
  - wifi: iwlwifi: fw: disable firmware debug asserts (bsc#1227149).
  - wifi: iwlwifi: remove dead-code (bsc#1227149).
  - wifi: iwlwifi: pcie: enable TOP fatal error interrupt
    (bsc#1227149).
  - wifi: iwlwifi: pcie: give up mem read if HW is dead
    (bsc#1227149).
  - wifi: iwlwifi: pcie: rescan bus if no parent (bsc#1227149).
  - wifi: iwlwifi: mvm: reduce maximum RX A-MPDU size (bsc#1227149).
  - wifi: iwlwifi: mvm: check link more carefully (bsc#1227149).
  - wifi: iwlwifi: mvm: move RU alloc B2 placement (bsc#1227149).
  - commit 8aa4ff8
  - virtio: delete vq in vp_find_vqs_msix() when request_irq()
    fails (CVE-2024-37353 bsc#1226875).
  - commit 4591439
  - wifi: iwlwifi: mvm: fix kernel-doc (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-ensure-offloading-TID-queue-exists.patch.
  - commit 68376c9
  - wifi: iwlwifi: pcie: fix kernel-doc issues (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-pcie-fix-RB-status-reading.patch.
  - commit f106797
  - wifi: iwlwifi: fw: reconstruct the API/CAPA enum number
    (bsc#1227149).
  - wifi: iwlwifi: dvm: remove kernel-doc warnings (bsc#1227149).
  - wifi: iwlwifi: queue: fix kernel-doc (bsc#1227149).
  - wifi: iwlwifi: fix some kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: mvm: disconnect long CSA only w/o alternative
    (bsc#1227149).
  - wifi: iwlwifi: mvm: increase session protection after CSA
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support CSA with MLD (bsc#1227149).
  - wifi: iwlmei: don't send nic info with invalid mac address
    (bsc#1227149).
  - commit 85cbe83
  - wifi: iwlwifi: mvm: support flush on AP interfaces
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-change-iwl_mvm_flush_sta-API.patch.
  - commit 908ff7c
  - wifi: iwlmei: send driver down SAP message only if wiamt is
    enabled (bsc#1227149).
  - wifi: iwlmei: send HOST_GOES_DOWN message even if wiamt is
    disabled (bsc#1227149).
  - wifi: iwlmei: don't send SAP messages if AMT is disabled
    (bsc#1227149).
  - wifi: iwlwifi: remove memory check for LMAC error address
    (bsc#1227149).
  - wifi: iwlwifi: mvm: enable HE TX/RX <242 tone RU on new RFs
    (bsc#1227149).
  - wifi: iwlwifi: add Razer to ppag approved list (bsc#1227149).
  - wifi: iwlwifi: pcie: point invalid TFDs to invalid data
    (bsc#1227149).
  - wifi: iwlwifi: queue: move iwl_txq_gen2_set_tb() up
    (bsc#1227149).
  - wifi: iwlwifi: pcie: move gen1 TB handling to header
    (bsc#1227149).
  - commit 92ab309
  - wifi: iwlwifi: remove 'def_rx_queue' struct member
    (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up gen1/gen2 TFD unmap (bsc#1227149).
  - wifi: iwlwifi: remove WARN from read_mem32() (bsc#1227149).
  - wifi: iwlwifi: api: fix a small upper/lower-case typo
    (bsc#1227149).
  - wifi: iwlwifi: mvm: advertise MLO only if EHT is enabled
    (bsc#1227149).
  - commit aa9a391
  - Add alt-commit to iwlwifi patches
  - commit 865aa7a
  - wifi: mac80211: fix unsolicited broadcast probe config
    (bsc#1227149).
  - wifi: mac80211: initialize SMPS mode correctly (bsc#1227149).
  - wifi: mac80211: fix driver debugfs for vif type change
    (bsc#1227149).
  - wifi: mac80211: improve CSA/ECSA connection refusal
    (bsc#1227149).
  - wifi: cfg80211: detect stuck ECSA element in probe resp
    (bsc#1227149).
  - wifi: mac80211: add/remove driver debugfs entries as appropriate
    (bsc#1227149).
  - wifi: mac80211: do not re-add debugfs entries during resume
    (bsc#1227149).
  - commit 769161a
  - wifi: mac80211: remove redundant ML element check (bsc#1227149).
  - wifi: cfg80211: Update the default DSCP-to-UP mapping
    (bsc#1227149).
  - wifi: mac80211: fix spelling typo in comment (bsc#1227149).
  - wifi: mac80211: add a driver callback to check active_links
    (bsc#1227149).
  - wifi: mac80211: fix advertised TTLM scheduling (bsc#1227149).
  - wifi: cfg80211: avoid double free if updating BSS fails
    (bsc#1227149).
  - commit e8bab13
  - wifi: cfg80211: handle UHB AP and STA power type (bsc#1227149).
  - commit 6021aa4
  - wifi: cfg80211: ensure cfg80211_bss_update frees IEs on error
    (bsc#1227149).
  - wifi: mac80211: allow 64-bit radiotap timestamps (bsc#1227149).
  - wifi: mac80211: rework RX timestamp flags (bsc#1227149).
  - wifi: mac80211: Schedule regulatory channels check on bandwith
    change (bsc#1227149).
  - wifi: cfg80211: Schedule regulatory check on BSS STA channel
    change (bsc#1227149).
  - wifi: cfg80211: reg: Support P2P operation on DFS channels
    (bsc#1227149).
  - wifi: mac80211: Skip association timeout update after comeback
    rejection (bsc#1227149).
  - wifi: mac80211: address some kerneldoc warnings (bsc#1227149).
  - wifi: cfg80211: address several kerneldoc warnings
    (bsc#1227149).
  - commit bc44e06
  - wifi: cfg80211: generate an ML element for per-STA profiles
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-parse-all-ML-elements-in-an-ML-probe-r.patch.
  - commit d924102
  - wifi: cfg80211: introduce cfg80211_ssid_eq() (bsc#1227149).
  - wifi: mac80211: sta_info.c: fix sentence grammar (bsc#1227149).
  - wifi: mac80211: rx.c: fix sentence grammar (bsc#1227149).
  - wifi: cfg80211: fix spelling & punctutation (bsc#1227149).
  - wifi: cfg80211: sort certificates in build (bsc#1227149).
  - wifi: mac80211: drop spurious WARN_ON() in
    ieee80211_ibss_csa_beacon() (bsc#1227149).
  - wifi: mac80211: don't set ESS capab bit in assoc request
    (bsc#1227149).
  - wifi: cfg80211: consume both probe response and beacon IEs
    (bsc#1227149).
  - wifi: cfg80211: Replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - commit 5e5ecdb
  - wifi: cfg80211: OWE DH IE handling offload (bsc#1227149).
  - commit 58c8e33
  - wifi: cfg80211: add BSS usage reporting (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-parse-all-ML-elements-in-an-ML-probe-r.patch.
  - commit 5b2693d
  - wifi: mac80211: Replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: mac80211: add a flag to disallow puncturing (bsc#1227149).
  - wifi: cfg80211: Add support for setting TID to link mapping
    (bsc#1227149).
  - wifi: mac80211: update some locking documentation (bsc#1227149).
  - wifi: nl80211: Extend del pmksa support for SAE and OWE security
    (bsc#1227149).
  - wifi: mac80211: cleanup airtime arithmetic with
    ieee80211_sta_keep_active() (bsc#1227149).
  - wifi: cfg80211: expose nl80211_chan_width_to_mhz for wide
    sharing (bsc#1227149).
  - wifi: cfg80211: make RX assoc data const (bsc#1227149).
  - commit e4b61c4
  - wifi: cfg80211: Extend support for scanning while MLO connected
    (bsc#1227149).
  - commit b4c9412
  - wifi: cfg80211: hold wiphy mutex for send_interface
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch.
  - commit 2123690
  - wifi: cfg80211: fix CQM for non-range use (bsc#1227149).
  - commit 3c8ba48
  - wifi: nl80211: refactor nl80211_send_mlme_event() arguments
    (bsc#1227149).
  - wifi: mac80211: Extend support for scanning while MLO connected
    (bsc#1227149).
  - wifi: mac80211: use wiphy locked debugfs for sdata/link
    (bsc#1227149).
  - wifi: mac80211: use wiphy locked debugfs helpers for agg_status
    (bsc#1227149).
  - wifi: cfg80211: add locked debugfs wrappers (bsc#1227149).
  - wifi: mac80211: drop robust action frames before assoc
    (bsc#1227149).
  - wifi: cfg80211: Allow AP/P2PGO to indicate port authorization
    to peer STA/P2PClient (bsc#1227149).
  - commit 03e12a0
  - blacklist: drop the wifi entries to be backported
  - commit 891934b
  - wifi: mac80211: fix another key installation error path
    (bsc#1227149).
  - wifi: mac80211: rename struct cfg80211_rx_assoc_resp to
    cfg80211_rx_assoc_resp_data (bsc#1227149).
  - wifi: mac80211: rename ieee80211_tx_status() to
    ieee80211_tx_status_skb() (bsc#1227149).
  - wifi: mac80211: fix change_address deadlock during unregister
    (bsc#1227149).
  - wifi: mac80211: Add __counted_by for struct ieee802_11_elems
    and use struct_size() (bsc#1227149).
  - wifi: remove unused argument of ieee80211_get_tdls_action()
    (bsc#1227149).
  - wifi: mac80211: fix header kernel-doc typos (bsc#1227149).
  - wifi: cfg80211: fix header kernel-doc typos (bsc#1227149).
  - wifi: mac80211: add link id to mgd_prepare_tx() (bsc#1227149).
  - wifi: mac80211: Check if we had first beacon with relevant links
    (bsc#1227149).
  - commit fa14599
  - kABI fix of KVM: x86/pmu: Prioritize VMX interception over
  - commit 1f1d114
  - wifi: mac80211: flush STA queues on unauthorization
    (bsc#1227149).
  - wifi: mac80211: purge TX queues in flush_queues flow
    (bsc#1227149).
  - wifi: cfg80211: wext: convert return value to kernel-doc
    (bsc#1227149).
  - wifi: mac80211: fix a expired vs. cancel race in roc
    (bsc#1227149).
  - wifi: mac80211: make mgd_protect_tdls_discover MLO-aware
    (bsc#1227149).
  - wifi: cfg80211: Fix typo in documentation (bsc#1227149).
  - wifi: cfg80211: Handle specific BSSID in 6GHz scanning
    (bsc#1227149).
  - wifi: mac80211: mesh: fix some kdoc warnings (bsc#1227149).
  - wifi: cfg80211: Include operating class 137 in 6GHz band
    (bsc#1227149).
  - wifi: mac80211: Rename and update
    IEEE80211_VIF_DISABLE_SMPS_OVERRIDE (bsc#1227149).
  - commit 585676b
  - wifi: mac80211: split ieee80211_drop_unencrypted_mgmt() return
    value (bsc#1227149).
  - commit 3835ef2
  - wifi: mac80211: fix error path key leak (bsc#1227149).
  - Refresh patches.suse/wifi-mac80211-remove-key_mtx.patch.
  - commit 3b93fe9
  - wifi: mac80211: fix potential key leak (bsc#1227149).
  - Refresh patches.suse/wifi-mac80211-remove-key_mtx.patch.
  - commit 9fa5ec3
  - wifi: mac80211: handle debugfs when switching to/from MLO
    (bsc#1227149).
  - wifi: mac80211: add a driver callback to add vif debugfs
    (bsc#1227149).
  - wifi: mac80211: cleanup auth_data only if association continues
    (bsc#1227149).
  - wifi: mac80211: add back SPDX identifier (bsc#1227149).
  - wifi: mac80211: fix ieee80211_drop_unencrypted_mgmt return
    type/value (bsc#1227149).
  - wifi: mac80211: expand __ieee80211_data_to_8023() status
    (bsc#1227149).
  - wifi: mac80211: remove RX_DROP_UNUSABLE (bsc#1227149).
  - commit e0a6a5e
  - wifi: cfg80211: add local_state_change to deauth trace
    (bsc#1227149).
  - wifi: mac80211: reject MLO channel configuration if not
    supported (bsc#1227149).
  - wifi: mac80211: report per-link error during association
    (bsc#1227149).
  - wifi: cfg80211: report per-link errors during association
    (bsc#1227149).
  - wifi: mac80211: support antenna control in injection
    (bsc#1227149).
  - wifi: mac80211: support handling of advertised TID-to-link
    mapping (bsc#1227149).
  - wifi: mac80211: add support for parsing TID to Link mapping
    element (bsc#1227149).
  - wifi: mac80211: Notify the low level driver on change in MLO
    valid links (bsc#1227149).
  - wifi: mac80211: describe return values in kernel-doc
    (bsc#1227149).
  - wifi: cfg80211: reg: describe return values in kernel-doc
    (bsc#1227149).
  - commit df6c84a
  - wifi: mac80211: allow for_each_sta_active_link() under RCU
    (bsc#1227149).
  - wifi: mac80211: relax RCU check in for_each_vif_active_link()
    (bsc#1227149).
  - wifi: mac80211: don't connect to an AP while it's in a CSA
    process (bsc#1227149).
  - wifi: mac80211: update the rx_chains after set_antenna()
    (bsc#1227149).
  - wifi: mac80211: use bandwidth indication element for CSA
    (bsc#1227149).
  - wifi: cfg80211: split struct cfg80211_ap_settings (bsc#1227149).
  - wifi: mac80211: ethtool: always hold wiphy mutex (bsc#1227149).
  - wifi: cfg80211: make read-only array centers_80mhz static const
    (bsc#1227149).
  - wifi: cfg80211: save power spectral density(psd) of regulatory
    rule (bsc#1227149).
  - wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush()
    (bsc#1227149).
  - commit 7f3b9af
  - wifi: mac80211: Sanity check tx bitrate if not provided by
    driver (bsc#1227149).
  - wifi: cfg80211: export DFS CAC time and usable state helper
    functions (bsc#1227149).
  - wifi: cfg80211: call reg_call_notifier on beacon hints
    (bsc#1227149).
  - wifi: cfg80211: allow reg update by driver even if wiphy->regd
    is set (bsc#1227149).
  - wifi: mac80211: additions to change_beacon() (bsc#1227149).
  - wifi: nl80211: additions to NL80211_CMD_SET_BEACON
    (bsc#1227149).
  - wifi: cfg80211: modify prototype for change_beacon
    (bsc#1227149).
  - wifi: mac80211: fixes in FILS discovery updates (bsc#1227149).
  - wifi: nl80211: fixes to FILS discovery updates (bsc#1227149).
  - wifi: lib80211: remove unused variables iv32 and iv16
    (bsc#1227149).
  - commit 67ccb18
  - wifi: mac80211: fix various kernel-doc issues (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-track-capability-opmode-NSS-separately.patch.
  - commit b1c042f
  - wifi: mac80211: remove shifted rate support (bsc#1227149).
  - wifi: cfg80211: remove scan_width support (bsc#1227149).
  - wifi: wext: avoid extra calls to strlen() in ieee80211_bss()
    (bsc#1227149).
  - wifi: mac80211: fix channel switch link data (bsc#1227149).
  - wifi: mac80211: Do not force off-channel for management Tx
    with MLO (bsc#1227149).
  - wifi: mac80211: take MBSSID/EHT data also from probe resp
    (bsc#1227149).
  - wifi: mac80211: Print local link address during authentication
    (bsc#1227149).
  - wifi: cfg80211: reg: fix various kernel-doc issues
    (bsc#1227149).
  - wifi: mac80211: remove unnecessary struct forward declaration
    (bsc#1227149).
  - commit 5936128
  - wifi: cfg80211: annotate iftype_data pointer with sparse
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch.
  - commit 031b8a7
  - wifi: mac80211: add more warnings about inserting sta info
    (bsc#1227149).
  - wifi: mac80211: add support for mld in ieee80211_chswitch_done
    (bsc#1227149).
  - wifi: mac80211: fix BA session teardown race (bsc#1227149).
  - wifi: mac80211: fix TXQ error path and cleanup (bsc#1227149).
  - commit 8e5b425
  - wifi: cfg80211: remove wdev mutex (bsc#1227149).
  - commit 4d7cf99
  - wifi: mac80211: set wiphy for virtual monitors (bsc#1227149).
  - commit 6022030
  - iommu/amd: Fix sysfs leak in iommu init (git-fixes).
  - commit 5b11e2a
  - wifi: mac80211: remove key_mtx (bsc#1227149).
  - commit 36d4ad3
  - iommu: Return right value in iommu_sva_bind_device()
    (git-fixes).
  - commit 769b149
  - wifi: mac80211: remove sta_mtx (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-check-if-the-existing-link-config-rema.patch.
  - Refresh
    patches.suse/wifi-mac80211-don-t-re-add-debugfs-during-reconfig.patch.
  - commit 5b967e8
  - wifi: mac80211: reduce iflist_mtx (bsc#1227149).
  - wifi: mac80211: remove local->mtx (bsc#1227149).
  - wifi: mac80211: remove ampdu_mlme.mtx (bsc#1227149).
  - wifi: mac80211: remove chanctx_mtx (bsc#1227149).
  - wifi: mac80211: take wiphy lock for MAC addr change
    (bsc#1227149).
  - wifi: mac80211: extend wiphy lock in interface removal
    (bsc#1227149).
  - wifi: mac80211: hold wiphy_lock around concurrency checks
    (bsc#1227149).
  - wifi: mac80211: ethtool: hold wiphy mutex (bsc#1227149).
  - commit b3dacec
  - wifi: mac80211: check wiphy mutex in ops (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-do-not-pass-AP_VLAN-vif-pointer-to-dri.patch.
  - commit 3b00636
  - wifi: cfg80211: check wiphy mutex is held for wdev mutex
    (bsc#1227149).
  - wifi: cfg80211: hold wiphy lock in
    cfg80211_any_wiphy_oper_chan() (bsc#1227149).
  - wifi: cfg80211: sme: hold wiphy lock for wdev iteration
    (bsc#1227149).
  - wifi: cfg80211: reg: hold wiphy mutex for wdev iteration
    (bsc#1227149).
  - wifi: mac80211: move color change finalize to wiphy work
    (bsc#1227149).
  - wifi: mac80211: move CSA finalize to wiphy work (bsc#1227149).
  - wifi: mac80211: move filter reconfig to wiphy work
    (bsc#1227149).
  - wifi: mac80211: move tspec work to wiphy work (bsc#1227149).
  - wifi: mac80211: move key tailroom work to wiphy work
    (bsc#1227149).
  - commit d930910
  - wifi: mac80211: move dynamic PS to wiphy work (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-sched-scan-stop-work-to-wiphy-wor.patch.
  - commit 6350819
  - wifi: mac80211: move DFS CAC work to wiphy work (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-radar-detect-work-to-wiphy-work.patch.
  - commit 46fc728
  - wifi: mac80211: move TDLS work to wiphy work (bsc#1227149).
  - wifi: mac80211: move link activation work to wiphy work
    (bsc#1227149).
  - wifi: mac80211: lock wiphy in IP address notifier (bsc#1227149).
  - wifi: mac80211: move monitor work to wiphy work (bsc#1227149).
  - wifi: mac80211: add more ops assertions (bsc#1227149).
  - wifi: mac80211: convert A-MPDU work to wiphy work (bsc#1227149).
  - wifi: mac80211: flush wiphy work where appropriate
    (bsc#1227149).
  - wifi: cfg80211: check RTNL when iterating devices (bsc#1227149).
  - commit 425f8ad
  - wifi: mac80211: lock wiphy for aggregation debugfs
    (bsc#1227149).
  - wifi: mac80211: hold wiphy lock in netdev/link debugfs
    (bsc#1227149).
  - wifi: mac80211: debugfs: lock wiphy instead of RTNL
    (bsc#1227149).
  - wifi: mac80211: fix SMPS status handling (bsc#1227149).
  - wifi: mac80211: Fix SMPS handling in the context of MLO
    (bsc#1227149).
  - wifi: mac80211: rework ack_frame_id handling a bit
    (bsc#1227149).
  - wifi: mac80211: tx: clarify conditions in if statement
    (bsc#1227149).
  - wifi: mac80211: Do not include crypto/algapi.h (bsc#1227149).
  - wifi: cfg80211: improve documentation for flag fields
    (bsc#1227149).
  - wifi: nl80211: Remove unused declaration
    nl80211_pmsr_dump_results() (bsc#1227149).
  - commit 75d4c97
  - wifi: mac80211: mesh: Remove unused function declaration
    mesh_ids_set_default() (bsc#1227149).
  - commit b3033c6
  - wifi: mac80211: Remove unused function declarations
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-radar-detect-work-to-wiphy-work.patch.
  - commit 343f020
  - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
    (bsc#1222015 bsc#1226962).
  - commit ba98363
  - KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC
    due to bad index (bsc#1226158).
  - commit fdb5ce1
  - net/9p: fix uninit-value in p9_client_rpc() (CVE-2024-39301
    bsc#1226994).
  - commit d8af728
  - arm64/io: add constant-argument check (bsc#1226502 git-fixes)
  - commit 45e8b78
  - struct acpi_ec kABI workaround (git-fixes).
  - commit 3605f74
  - wifi: mt76: mt7921s: fix potential hung tasks during chip
    recovery (stable-fixes).
  - commit d9504b4
  - drm/drm_file: Fix pid refcounting race (git-fixes).
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
    (git-fixes).
  - drm/amdgpu: Fix pci state save during mode-1 reset (git-fixes).
  - drm/panel: simple: Add missing display timing flags for KOE
    TX26D202VM0BWA (git-fixes).
  - drm/fbdev-dma: Only set smem_start is enable per module option
    (git-fixes).
  - net: usb: ax88179_178a: improve link status logs (git-fixes).
  - net: phy: micrel: add Microchip KSZ 9477 to the device table
    (git-fixes).
  - batman-adv: Don't accept TT entries for out-of-spec VIDs
    (git-fixes).
  - can: mcp251xfd: fix infinite loop when xmit fails (git-fixes).
  - net: can: j1939: recover socket queue on CAN bus error during
    BAM transmission (git-fixes).
  - net: can: j1939: Initialize unused data in j1939_send_one()
    (git-fixes).
  - net: can: j1939: enhanced error handling for tightly received
    RTS messages in xtp_rx_rts_session_new (git-fixes).
  - ASoC: fsl-asoc-card: set priv->pdev before using it (git-fixes).
  - ASoC: amd: acp: remove i2s configuration check in
    acp_i2s_probe() (git-fixes).
  - ASoC: amd: acp: add a null check for chip_pdev structure
    (git-fixes).
  - ASoC: q6apm-lpass-dai: close graph on prepare errors
    (git-fixes).
  - ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on
    right mclk (git-fixes).
  - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion (git-fixes).
  - ALSA: hda/realtek: Fix conflicting quirk for PCI SSID 17aa:3820
    (git-fixes).
  - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2
    messages (git-fixes).
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c (stable-fixes).
  - drm/radeon: fix UBSAN warning in kv_dpm.c (stable-fixes).
  - ACPI: EC: Evaluate orphan _REG under EC device (git-fixes).
  - serial: exar: adding missing CTI and Exar PCI ids
    (stable-fixes).
  - serial: imx: Introduce timeout when waiting on transmitter empty
    (stable-fixes).
  - usb: gadget: function: Remove usage of the deprecated
    ida_simple_xx() API (stable-fixes).
  - usb: typec: ucsi_glink: drop special handling for CCI_BUSY
    (stable-fixes).
  - usb: dwc3: pci: Don't set "linux,phy_charger_detect" property
    on Lenovo Yoga Tab2 1380 (stable-fixes).
  - usb: misc: uss720: check for incompatible versions of the
    Belkin F5U002 (stable-fixes).
  - usb: gadget: uvc: configfs: ensure guid to be valid before set
    (stable-fixes).
  - cpufreq: amd-pstate: fix memory leak on CPU EPP exit
    (stable-fixes).
  - ACPI: EC: Install address space handler at the namespace root
    (stable-fixes).
  - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
    (stable-fixes).
  - power: supply: cros_usbpd: provide ID table for avoiding
    fallback match (stable-fixes).
  - platform/x86: toshiba_acpi: Add quirk for buttons on Z830
    (stable-fixes).
  - ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
    (git-fixes).
  - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
    (stable-fixes).
  - ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
    (stable-fixes).
  - drm/lima: mask irqs in timeout path before hard reset
    (stable-fixes).
  - drm/lima: add mask irq callback to gp and pp (stable-fixes).
  - drm/amd/display: revert Exit idle optimizations before HDCP
    execution (stable-fixes).
  - drm/amd/display: Exit idle optimizations before HDCP execution
    (stable-fixes).
  - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
    (stable-fixes).
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    (stable-fixes).
  - ssb: Fix potential NULL pointer dereference in
    ssb_device_uevent() (stable-fixes).
  - HID: Add quirk for Logitech Casa touchpad (stable-fixes).
  - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
    (stable-fixes).
  - crypto: hisilicon/qm - Add the err memory release process to
    qm uninit (stable-fixes).
  - crypto: hisilicon/sec - Fix memory leak for sec resource release
    (stable-fixes).
  - commit bbedf42

++++ kernel-default:

  - wifi: iwlwifi: mvm: fix the TXF mapping for BZ devices
    (bsc#1227149).
  - wifi: iwlwifi: clear link_id in time_event (bsc#1227149).
  - wifi: iwlwifi: mvm: fix a battery life regression (bsc#1227149).
  - wifi: iwlwifi: remove extra kernel-doc (bsc#1227149).
  - wifi: iwlwifi: mvm: skip adding debugfs symlink for reconfig
    (bsc#1227149).
  - wifi: iwlwifi: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: iwlwifi: mvm: use the new command to clear the internal
    buffer (bsc#1227149).
  - commit acd03db
  - wifi: iwlwifi: mvm: add US/Canada MCC to API (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit 70a9591
  - wifi: iwlwifi: mvm: disallow puncturing in US/Canada
    (bsc#1227149).
  - wifi: iwlwifi: Add rf_mapping of new wifi7 devices
    (bsc#1227149).
  - wifi: iwlwifi: cleanup BT Shared Single Antenna code
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Do not warn if valid link pair was not found
    (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: avoid intermediate/early mutex unlock
    (bsc#1227149).
  - wifi: iwlwifi: Don't mark DFS channels as NO-IR (bsc#1227149).
  - wifi: iwlwifi: mvm: Allow DFS concurrent operation
    (bsc#1227149).
  - wifi: iwlwifi: mvm: do not send STA_DISABLE_TX_CMD for newer
    firmware (bsc#1227149).
  - wifi: iwlwifi: remove async command callback (bsc#1227149).
  - commit 0205124
  - wifi: iwlwifi: fw: file: don't use [0] for variable arrays
    (bsc#1227149).
  - wifi: iwlwifi: pcie: get_crf_id() can be void (bsc#1227149).
  - wifi: iwlwifi: pcie: dump CSRs before removal (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up device removal work (bsc#1227149).
  - wifi: iwlwifi: mvm: add a debugfs hook to clear the monitor data
    (bsc#1227149).
  - wifi: iwlwifi: refactor RX tracing (bsc#1227149).
  - wifi: iwlwifi: mvm: Correctly report TSF data in scan complete
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Use the link ID provided in scan request
    (bsc#1227149).
  - wifi: iwlwifi: fw: replace deprecated strncpy with strscpy_pad
    (bsc#1227149).
  - wifi: iwlwifi: fix system commands group ordering (bsc#1227149).
  - commit 6cae420
  - wifi: iwlwifi: drop NULL pointer check in
    iwl_mvm_tzone_set_trip_temp() (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 86 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: read DSM func 2 for specific RF types
    (bsc#1227149).
  - wifi: iwlwifi: mvm: show dump even for pldr_sync (bsc#1227149).
  - wifi: iwlwifi: mvm: cycle FW link on chanctx removal
    (bsc#1227149).
  - wifi: iwlwifi: trace full frames with TX status request
    (bsc#1227149).
  - wifi: iwlwifi: fw: Add support for UATS table in UHB
    (bsc#1227149).
  - wifi: iwlwifi: mvm: add a print when sending RLC command
    (bsc#1227149).
  - wifi: iwlwifi: mvm: debugfs for fw system stats (bsc#1227149).
  - wifi: iwlwifi: mvm: implement new firmware API for statistics
    (bsc#1227149).
  - commit ed6b54f
  - wifi: iwlwifi: disable multi rx queue for 9000 (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-include-link-ID-when-releasing-fram.patch.
  - commit 9866ec0
  - wifi: iwlwifi: mvm: fix regdb initialization (bsc#1227149).
  - wifi: iwlwifi: mvm: simplify the reorder buffer (bsc#1227149).
  - wifi: iwlwifi: mvm: Return success if link could not be removed
    (bsc#1227149).
  - wifi: iwlwifi: add support for SNPS DPHYIP region type
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove set_tim callback for MLD ops
    (bsc#1227149).
  - wifi: iwlwifi: api: fix center_freq label in PHY diagram
    (bsc#1227149).
  - wifi: iwlwifi: support link id in SESSION_PROTECTION_NOTIF
    (bsc#1227149).
  - wifi: iwlwifi: support link_id in SESSION_PROTECTION cmd
    (bsc#1227149).
  - wifi: iwlwifi: make time_events MLO aware (bsc#1227149).
  - commit 1ea0f35
  - wifi: iwlwifi: add support for activating UNII-1 in WW via BIOS
    (bsc#1227149).
  - wifi: iwlwifi: mvm: extend alive timeout to 2 seconds
    (bsc#1227149).
  - wifi: iwlwifi: mvm: fix the PHY context resolution for p2p
    device (bsc#1227149).
  - wifi: iwlwifi: mvm: fold the ref++ into iwl_mvm_phy_ctxt_add
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't add dummy phy context (bsc#1227149).
  - wifi: iwlwifi: mvm: cleanup MLO and non-MLO unification code
    (bsc#1227149).
  - wifi: iwlwifi: mvm: implement ROC version 3 (bsc#1227149).
  - wifi: iwlwifi: send EDT table to FW (bsc#1227149).
  - wifi: iwlmvm: fw: Add new OEM vendor to tas approved list
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Fix unreachable code path (bsc#1227149).
  - commit 50ebcaa
  - wifi: iwlwifi: mvm: advertise support for SCS traffic
    description (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-do-not-announce-EPCS-support.patch.
  - commit 7208326
  - wifi: iwlwifi: add new RF support for wifi7 (bsc#1227149).
  - wifi: iwlwifi: fw: increase fw_version string size
    (bsc#1227149).
  - wifi: iwlwifi: check for kmemdup() return value in
    iwl_parse_tlv_firmware() (bsc#1227149).
  - wifi: iwlwifi: fix the rf step and flavor bits range
    (bsc#1227149).
  - wifi: iwlwifi: fw: Fix debugfs command sending (bsc#1227149).
  - wifi: iwlwifi: mvm: add start mac ctdp sum calculation debugfs
    handler (bsc#1227149).
  - wifi: iwlwifi: abort scan when rfkill on but device enabled
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Add basic link selection logic
    (bsc#1227149).
  - wifi: iwlwifi: mei: return error from register when not built
    (bsc#1227149).
  - commit fddf9eb
  - wifi: iwlwifi: mvm: fix SB CFG check (bsc#1227149).
  - wifi: iwlwifi: mvm: add a per-link debugfs (bsc#1227149).
  - wifi: iwlwifi: mvm: rework debugfs handling (bsc#1227149).
  - wifi: iwlwifi: add support for new ini region types
    (bsc#1227149).
  - wifi: iwlwifi: Extract common prph mac/phy regions data dump
    logic (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 84 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: offload IGTK in AP if BIGTK is supported
    (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up WFPM control bits (bsc#1227149).
  - wifi: iwlwifi: fix opmode start/stop race (bsc#1227149).
  - wifi: iwlwifi: skip opmode start retries on dead transport
    (bsc#1227149).
  - commit 36551d1
  - wifi: iwlwifi: mvm: add support for new wowlan_info_notif
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-d3-fix-IPN-byte-order.patch.
  - commit 0b379ae
  - wifi: iwlwifi: pcie: propagate iwl_pcie_gen2_apm_init() error
    (bsc#1227149).
  - wifi: iwlwifi: add mapping of a periphery register crf for WH RF
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check for iwl_mvm_mld_update_sta() errors
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support injection antenna control
    (bsc#1227149).
  - wifi: iwlwifi: mvm: refactor TX rate handling (bsc#1227149).
  - wifi: iwlwifi: mvm: make pldr_sync AX210 specific (bsc#1227149).
  - wifi: iwlwifi: fail NIC access fast on dead NIC (bsc#1227149).
  - wifi: iwlwifi: pcie: (re-)assign BAR0 on driver bind
    (bsc#1227149).
  - commit 0882d6d
  - wifi: iwlwifi: implement enable/disable for China 2022
    regulatory (bsc#1227149).
  - wifi: iwlwifi: mvm: handle link-STA allocation in restart
    (bsc#1227149).
  - wifi: iwlwifi: mvm: iterate active links for STA queues
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support set_antenna() (bsc#1227149).
  - wifi: iwlwifi: mvm: add a debug print when we get a BAR
    (bsc#1227149).
  - wifi: iwlwifi: mvm: move listen interval to constants
    (bsc#1227149).
  - wifi: iwlwifi: no power save during transition to D3
    (bsc#1227149).
  - wifi: iwlwifi: update context info structure definitions
    (bsc#1227149).
  - wifi: iwlwifi: mvm: fix recovery flow in CSA (bsc#1227149).
  - wifi: iwlwifi: mvm: enable FILS DF Tx on non-PSC channel
    (bsc#1227149).
  - commit 5c7efaf
  - wifi: iwlwifi: mvm: make "pldr_sync" mode effective
    (bsc#1227149).
  - wifi: iwlwifi: mvm: log dropped frames (bsc#1227149).
  - wifi: iwlwifi: fw: disable firmware debug asserts (bsc#1227149).
  - wifi: iwlwifi: remove dead-code (bsc#1227149).
  - wifi: iwlwifi: pcie: enable TOP fatal error interrupt
    (bsc#1227149).
  - wifi: iwlwifi: pcie: give up mem read if HW is dead
    (bsc#1227149).
  - wifi: iwlwifi: pcie: rescan bus if no parent (bsc#1227149).
  - wifi: iwlwifi: mvm: reduce maximum RX A-MPDU size (bsc#1227149).
  - wifi: iwlwifi: mvm: check link more carefully (bsc#1227149).
  - wifi: iwlwifi: mvm: move RU alloc B2 placement (bsc#1227149).
  - commit 8aa4ff8
  - virtio: delete vq in vp_find_vqs_msix() when request_irq()
    fails (CVE-2024-37353 bsc#1226875).
  - commit 4591439
  - wifi: iwlwifi: mvm: fix kernel-doc (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-ensure-offloading-TID-queue-exists.patch.
  - commit 68376c9
  - wifi: iwlwifi: pcie: fix kernel-doc issues (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-pcie-fix-RB-status-reading.patch.
  - commit f106797
  - wifi: iwlwifi: fw: reconstruct the API/CAPA enum number
    (bsc#1227149).
  - wifi: iwlwifi: dvm: remove kernel-doc warnings (bsc#1227149).
  - wifi: iwlwifi: queue: fix kernel-doc (bsc#1227149).
  - wifi: iwlwifi: fix some kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: mvm: disconnect long CSA only w/o alternative
    (bsc#1227149).
  - wifi: iwlwifi: mvm: increase session protection after CSA
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support CSA with MLD (bsc#1227149).
  - wifi: iwlmei: don't send nic info with invalid mac address
    (bsc#1227149).
  - commit 85cbe83
  - wifi: iwlwifi: mvm: support flush on AP interfaces
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-change-iwl_mvm_flush_sta-API.patch.
  - commit 908ff7c
  - wifi: iwlmei: send driver down SAP message only if wiamt is
    enabled (bsc#1227149).
  - wifi: iwlmei: send HOST_GOES_DOWN message even if wiamt is
    disabled (bsc#1227149).
  - wifi: iwlmei: don't send SAP messages if AMT is disabled
    (bsc#1227149).
  - wifi: iwlwifi: remove memory check for LMAC error address
    (bsc#1227149).
  - wifi: iwlwifi: mvm: enable HE TX/RX <242 tone RU on new RFs
    (bsc#1227149).
  - wifi: iwlwifi: add Razer to ppag approved list (bsc#1227149).
  - wifi: iwlwifi: pcie: point invalid TFDs to invalid data
    (bsc#1227149).
  - wifi: iwlwifi: queue: move iwl_txq_gen2_set_tb() up
    (bsc#1227149).
  - wifi: iwlwifi: pcie: move gen1 TB handling to header
    (bsc#1227149).
  - commit 92ab309
  - wifi: iwlwifi: remove 'def_rx_queue' struct member
    (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up gen1/gen2 TFD unmap (bsc#1227149).
  - wifi: iwlwifi: remove WARN from read_mem32() (bsc#1227149).
  - wifi: iwlwifi: api: fix a small upper/lower-case typo
    (bsc#1227149).
  - wifi: iwlwifi: mvm: advertise MLO only if EHT is enabled
    (bsc#1227149).
  - commit aa9a391
  - Add alt-commit to iwlwifi patches
  - commit 865aa7a
  - wifi: mac80211: fix unsolicited broadcast probe config
    (bsc#1227149).
  - wifi: mac80211: initialize SMPS mode correctly (bsc#1227149).
  - wifi: mac80211: fix driver debugfs for vif type change
    (bsc#1227149).
  - wifi: mac80211: improve CSA/ECSA connection refusal
    (bsc#1227149).
  - wifi: cfg80211: detect stuck ECSA element in probe resp
    (bsc#1227149).
  - wifi: mac80211: add/remove driver debugfs entries as appropriate
    (bsc#1227149).
  - wifi: mac80211: do not re-add debugfs entries during resume
    (bsc#1227149).
  - commit 769161a
  - wifi: mac80211: remove redundant ML element check (bsc#1227149).
  - wifi: cfg80211: Update the default DSCP-to-UP mapping
    (bsc#1227149).
  - wifi: mac80211: fix spelling typo in comment (bsc#1227149).
  - wifi: mac80211: add a driver callback to check active_links
    (bsc#1227149).
  - wifi: mac80211: fix advertised TTLM scheduling (bsc#1227149).
  - wifi: cfg80211: avoid double free if updating BSS fails
    (bsc#1227149).
  - commit e8bab13
  - wifi: cfg80211: handle UHB AP and STA power type (bsc#1227149).
  - commit 6021aa4
  - wifi: cfg80211: ensure cfg80211_bss_update frees IEs on error
    (bsc#1227149).
  - wifi: mac80211: allow 64-bit radiotap timestamps (bsc#1227149).
  - wifi: mac80211: rework RX timestamp flags (bsc#1227149).
  - wifi: mac80211: Schedule regulatory channels check on bandwith
    change (bsc#1227149).
  - wifi: cfg80211: Schedule regulatory check on BSS STA channel
    change (bsc#1227149).
  - wifi: cfg80211: reg: Support P2P operation on DFS channels
    (bsc#1227149).
  - wifi: mac80211: Skip association timeout update after comeback
    rejection (bsc#1227149).
  - wifi: mac80211: address some kerneldoc warnings (bsc#1227149).
  - wifi: cfg80211: address several kerneldoc warnings
    (bsc#1227149).
  - commit bc44e06
  - wifi: cfg80211: generate an ML element for per-STA profiles
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-parse-all-ML-elements-in-an-ML-probe-r.patch.
  - commit d924102
  - wifi: cfg80211: introduce cfg80211_ssid_eq() (bsc#1227149).
  - wifi: mac80211: sta_info.c: fix sentence grammar (bsc#1227149).
  - wifi: mac80211: rx.c: fix sentence grammar (bsc#1227149).
  - wifi: cfg80211: fix spelling & punctutation (bsc#1227149).
  - wifi: cfg80211: sort certificates in build (bsc#1227149).
  - wifi: mac80211: drop spurious WARN_ON() in
    ieee80211_ibss_csa_beacon() (bsc#1227149).
  - wifi: mac80211: don't set ESS capab bit in assoc request
    (bsc#1227149).
  - wifi: cfg80211: consume both probe response and beacon IEs
    (bsc#1227149).
  - wifi: cfg80211: Replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - commit 5e5ecdb
  - wifi: cfg80211: OWE DH IE handling offload (bsc#1227149).
  - commit 58c8e33
  - wifi: cfg80211: add BSS usage reporting (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-parse-all-ML-elements-in-an-ML-probe-r.patch.
  - commit 5b2693d
  - wifi: mac80211: Replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: mac80211: add a flag to disallow puncturing (bsc#1227149).
  - wifi: cfg80211: Add support for setting TID to link mapping
    (bsc#1227149).
  - wifi: mac80211: update some locking documentation (bsc#1227149).
  - wifi: nl80211: Extend del pmksa support for SAE and OWE security
    (bsc#1227149).
  - wifi: mac80211: cleanup airtime arithmetic with
    ieee80211_sta_keep_active() (bsc#1227149).
  - wifi: cfg80211: expose nl80211_chan_width_to_mhz for wide
    sharing (bsc#1227149).
  - wifi: cfg80211: make RX assoc data const (bsc#1227149).
  - commit e4b61c4
  - wifi: cfg80211: Extend support for scanning while MLO connected
    (bsc#1227149).
  - commit b4c9412
  - wifi: cfg80211: hold wiphy mutex for send_interface
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch.
  - commit 2123690
  - wifi: cfg80211: fix CQM for non-range use (bsc#1227149).
  - commit 3c8ba48
  - wifi: nl80211: refactor nl80211_send_mlme_event() arguments
    (bsc#1227149).
  - wifi: mac80211: Extend support for scanning while MLO connected
    (bsc#1227149).
  - wifi: mac80211: use wiphy locked debugfs for sdata/link
    (bsc#1227149).
  - wifi: mac80211: use wiphy locked debugfs helpers for agg_status
    (bsc#1227149).
  - wifi: cfg80211: add locked debugfs wrappers (bsc#1227149).
  - wifi: mac80211: drop robust action frames before assoc
    (bsc#1227149).
  - wifi: cfg80211: Allow AP/P2PGO to indicate port authorization
    to peer STA/P2PClient (bsc#1227149).
  - commit 03e12a0
  - blacklist: drop the wifi entries to be backported
  - commit 891934b
  - wifi: mac80211: fix another key installation error path
    (bsc#1227149).
  - wifi: mac80211: rename struct cfg80211_rx_assoc_resp to
    cfg80211_rx_assoc_resp_data (bsc#1227149).
  - wifi: mac80211: rename ieee80211_tx_status() to
    ieee80211_tx_status_skb() (bsc#1227149).
  - wifi: mac80211: fix change_address deadlock during unregister
    (bsc#1227149).
  - wifi: mac80211: Add __counted_by for struct ieee802_11_elems
    and use struct_size() (bsc#1227149).
  - wifi: remove unused argument of ieee80211_get_tdls_action()
    (bsc#1227149).
  - wifi: mac80211: fix header kernel-doc typos (bsc#1227149).
  - wifi: cfg80211: fix header kernel-doc typos (bsc#1227149).
  - wifi: mac80211: add link id to mgd_prepare_tx() (bsc#1227149).
  - wifi: mac80211: Check if we had first beacon with relevant links
    (bsc#1227149).
  - commit fa14599
  - kABI fix of KVM: x86/pmu: Prioritize VMX interception over
  - commit 1f1d114
  - wifi: mac80211: flush STA queues on unauthorization
    (bsc#1227149).
  - wifi: mac80211: purge TX queues in flush_queues flow
    (bsc#1227149).
  - wifi: cfg80211: wext: convert return value to kernel-doc
    (bsc#1227149).
  - wifi: mac80211: fix a expired vs. cancel race in roc
    (bsc#1227149).
  - wifi: mac80211: make mgd_protect_tdls_discover MLO-aware
    (bsc#1227149).
  - wifi: cfg80211: Fix typo in documentation (bsc#1227149).
  - wifi: cfg80211: Handle specific BSSID in 6GHz scanning
    (bsc#1227149).
  - wifi: mac80211: mesh: fix some kdoc warnings (bsc#1227149).
  - wifi: cfg80211: Include operating class 137 in 6GHz band
    (bsc#1227149).
  - wifi: mac80211: Rename and update
    IEEE80211_VIF_DISABLE_SMPS_OVERRIDE (bsc#1227149).
  - commit 585676b
  - wifi: mac80211: split ieee80211_drop_unencrypted_mgmt() return
    value (bsc#1227149).
  - commit 3835ef2
  - wifi: mac80211: fix error path key leak (bsc#1227149).
  - Refresh patches.suse/wifi-mac80211-remove-key_mtx.patch.
  - commit 3b93fe9
  - wifi: mac80211: fix potential key leak (bsc#1227149).
  - Refresh patches.suse/wifi-mac80211-remove-key_mtx.patch.
  - commit 9fa5ec3
  - wifi: mac80211: handle debugfs when switching to/from MLO
    (bsc#1227149).
  - wifi: mac80211: add a driver callback to add vif debugfs
    (bsc#1227149).
  - wifi: mac80211: cleanup auth_data only if association continues
    (bsc#1227149).
  - wifi: mac80211: add back SPDX identifier (bsc#1227149).
  - wifi: mac80211: fix ieee80211_drop_unencrypted_mgmt return
    type/value (bsc#1227149).
  - wifi: mac80211: expand __ieee80211_data_to_8023() status
    (bsc#1227149).
  - wifi: mac80211: remove RX_DROP_UNUSABLE (bsc#1227149).
  - commit e0a6a5e
  - wifi: cfg80211: add local_state_change to deauth trace
    (bsc#1227149).
  - wifi: mac80211: reject MLO channel configuration if not
    supported (bsc#1227149).
  - wifi: mac80211: report per-link error during association
    (bsc#1227149).
  - wifi: cfg80211: report per-link errors during association
    (bsc#1227149).
  - wifi: mac80211: support antenna control in injection
    (bsc#1227149).
  - wifi: mac80211: support handling of advertised TID-to-link
    mapping (bsc#1227149).
  - wifi: mac80211: add support for parsing TID to Link mapping
    element (bsc#1227149).
  - wifi: mac80211: Notify the low level driver on change in MLO
    valid links (bsc#1227149).
  - wifi: mac80211: describe return values in kernel-doc
    (bsc#1227149).
  - wifi: cfg80211: reg: describe return values in kernel-doc
    (bsc#1227149).
  - commit df6c84a
  - wifi: mac80211: allow for_each_sta_active_link() under RCU
    (bsc#1227149).
  - wifi: mac80211: relax RCU check in for_each_vif_active_link()
    (bsc#1227149).
  - wifi: mac80211: don't connect to an AP while it's in a CSA
    process (bsc#1227149).
  - wifi: mac80211: update the rx_chains after set_antenna()
    (bsc#1227149).
  - wifi: mac80211: use bandwidth indication element for CSA
    (bsc#1227149).
  - wifi: cfg80211: split struct cfg80211_ap_settings (bsc#1227149).
  - wifi: mac80211: ethtool: always hold wiphy mutex (bsc#1227149).
  - wifi: cfg80211: make read-only array centers_80mhz static const
    (bsc#1227149).
  - wifi: cfg80211: save power spectral density(psd) of regulatory
    rule (bsc#1227149).
  - wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush()
    (bsc#1227149).
  - commit 7f3b9af
  - wifi: mac80211: Sanity check tx bitrate if not provided by
    driver (bsc#1227149).
  - wifi: cfg80211: export DFS CAC time and usable state helper
    functions (bsc#1227149).
  - wifi: cfg80211: call reg_call_notifier on beacon hints
    (bsc#1227149).
  - wifi: cfg80211: allow reg update by driver even if wiphy->regd
    is set (bsc#1227149).
  - wifi: mac80211: additions to change_beacon() (bsc#1227149).
  - wifi: nl80211: additions to NL80211_CMD_SET_BEACON
    (bsc#1227149).
  - wifi: cfg80211: modify prototype for change_beacon
    (bsc#1227149).
  - wifi: mac80211: fixes in FILS discovery updates (bsc#1227149).
  - wifi: nl80211: fixes to FILS discovery updates (bsc#1227149).
  - wifi: lib80211: remove unused variables iv32 and iv16
    (bsc#1227149).
  - commit 67ccb18
  - wifi: mac80211: fix various kernel-doc issues (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-track-capability-opmode-NSS-separately.patch.
  - commit b1c042f
  - wifi: mac80211: remove shifted rate support (bsc#1227149).
  - wifi: cfg80211: remove scan_width support (bsc#1227149).
  - wifi: wext: avoid extra calls to strlen() in ieee80211_bss()
    (bsc#1227149).
  - wifi: mac80211: fix channel switch link data (bsc#1227149).
  - wifi: mac80211: Do not force off-channel for management Tx
    with MLO (bsc#1227149).
  - wifi: mac80211: take MBSSID/EHT data also from probe resp
    (bsc#1227149).
  - wifi: mac80211: Print local link address during authentication
    (bsc#1227149).
  - wifi: cfg80211: reg: fix various kernel-doc issues
    (bsc#1227149).
  - wifi: mac80211: remove unnecessary struct forward declaration
    (bsc#1227149).
  - commit 5936128
  - wifi: cfg80211: annotate iftype_data pointer with sparse
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch.
  - commit 031b8a7
  - wifi: mac80211: add more warnings about inserting sta info
    (bsc#1227149).
  - wifi: mac80211: add support for mld in ieee80211_chswitch_done
    (bsc#1227149).
  - wifi: mac80211: fix BA session teardown race (bsc#1227149).
  - wifi: mac80211: fix TXQ error path and cleanup (bsc#1227149).
  - commit 8e5b425
  - wifi: cfg80211: remove wdev mutex (bsc#1227149).
  - commit 4d7cf99
  - wifi: mac80211: set wiphy for virtual monitors (bsc#1227149).
  - commit 6022030
  - iommu/amd: Fix sysfs leak in iommu init (git-fixes).
  - commit 5b11e2a
  - wifi: mac80211: remove key_mtx (bsc#1227149).
  - commit 36d4ad3
  - iommu: Return right value in iommu_sva_bind_device()
    (git-fixes).
  - commit 769b149
  - wifi: mac80211: remove sta_mtx (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-check-if-the-existing-link-config-rema.patch.
  - Refresh
    patches.suse/wifi-mac80211-don-t-re-add-debugfs-during-reconfig.patch.
  - commit 5b967e8
  - wifi: mac80211: reduce iflist_mtx (bsc#1227149).
  - wifi: mac80211: remove local->mtx (bsc#1227149).
  - wifi: mac80211: remove ampdu_mlme.mtx (bsc#1227149).
  - wifi: mac80211: remove chanctx_mtx (bsc#1227149).
  - wifi: mac80211: take wiphy lock for MAC addr change
    (bsc#1227149).
  - wifi: mac80211: extend wiphy lock in interface removal
    (bsc#1227149).
  - wifi: mac80211: hold wiphy_lock around concurrency checks
    (bsc#1227149).
  - wifi: mac80211: ethtool: hold wiphy mutex (bsc#1227149).
  - commit b3dacec
  - wifi: mac80211: check wiphy mutex in ops (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-do-not-pass-AP_VLAN-vif-pointer-to-dri.patch.
  - commit 3b00636
  - wifi: cfg80211: check wiphy mutex is held for wdev mutex
    (bsc#1227149).
  - wifi: cfg80211: hold wiphy lock in
    cfg80211_any_wiphy_oper_chan() (bsc#1227149).
  - wifi: cfg80211: sme: hold wiphy lock for wdev iteration
    (bsc#1227149).
  - wifi: cfg80211: reg: hold wiphy mutex for wdev iteration
    (bsc#1227149).
  - wifi: mac80211: move color change finalize to wiphy work
    (bsc#1227149).
  - wifi: mac80211: move CSA finalize to wiphy work (bsc#1227149).
  - wifi: mac80211: move filter reconfig to wiphy work
    (bsc#1227149).
  - wifi: mac80211: move tspec work to wiphy work (bsc#1227149).
  - wifi: mac80211: move key tailroom work to wiphy work
    (bsc#1227149).
  - commit d930910
  - wifi: mac80211: move dynamic PS to wiphy work (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-sched-scan-stop-work-to-wiphy-wor.patch.
  - commit 6350819
  - wifi: mac80211: move DFS CAC work to wiphy work (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-radar-detect-work-to-wiphy-work.patch.
  - commit 46fc728
  - wifi: mac80211: move TDLS work to wiphy work (bsc#1227149).
  - wifi: mac80211: move link activation work to wiphy work
    (bsc#1227149).
  - wifi: mac80211: lock wiphy in IP address notifier (bsc#1227149).
  - wifi: mac80211: move monitor work to wiphy work (bsc#1227149).
  - wifi: mac80211: add more ops assertions (bsc#1227149).
  - wifi: mac80211: convert A-MPDU work to wiphy work (bsc#1227149).
  - wifi: mac80211: flush wiphy work where appropriate
    (bsc#1227149).
  - wifi: cfg80211: check RTNL when iterating devices (bsc#1227149).
  - commit 425f8ad
  - wifi: mac80211: lock wiphy for aggregation debugfs
    (bsc#1227149).
  - wifi: mac80211: hold wiphy lock in netdev/link debugfs
    (bsc#1227149).
  - wifi: mac80211: debugfs: lock wiphy instead of RTNL
    (bsc#1227149).
  - wifi: mac80211: fix SMPS status handling (bsc#1227149).
  - wifi: mac80211: Fix SMPS handling in the context of MLO
    (bsc#1227149).
  - wifi: mac80211: rework ack_frame_id handling a bit
    (bsc#1227149).
  - wifi: mac80211: tx: clarify conditions in if statement
    (bsc#1227149).
  - wifi: mac80211: Do not include crypto/algapi.h (bsc#1227149).
  - wifi: cfg80211: improve documentation for flag fields
    (bsc#1227149).
  - wifi: nl80211: Remove unused declaration
    nl80211_pmsr_dump_results() (bsc#1227149).
  - commit 75d4c97
  - wifi: mac80211: mesh: Remove unused function declaration
    mesh_ids_set_default() (bsc#1227149).
  - commit b3033c6
  - wifi: mac80211: Remove unused function declarations
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-radar-detect-work-to-wiphy-work.patch.
  - commit 343f020
  - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
    (bsc#1222015 bsc#1226962).
  - commit ba98363
  - KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC
    due to bad index (bsc#1226158).
  - commit fdb5ce1
  - net/9p: fix uninit-value in p9_client_rpc() (CVE-2024-39301
    bsc#1226994).
  - commit d8af728
  - arm64/io: add constant-argument check (bsc#1226502 git-fixes)
  - commit 45e8b78
  - struct acpi_ec kABI workaround (git-fixes).
  - commit 3605f74
  - wifi: mt76: mt7921s: fix potential hung tasks during chip
    recovery (stable-fixes).
  - commit d9504b4
  - drm/drm_file: Fix pid refcounting race (git-fixes).
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
    (git-fixes).
  - drm/amdgpu: Fix pci state save during mode-1 reset (git-fixes).
  - drm/panel: simple: Add missing display timing flags for KOE
    TX26D202VM0BWA (git-fixes).
  - drm/fbdev-dma: Only set smem_start is enable per module option
    (git-fixes).
  - net: usb: ax88179_178a: improve link status logs (git-fixes).
  - net: phy: micrel: add Microchip KSZ 9477 to the device table
    (git-fixes).
  - batman-adv: Don't accept TT entries for out-of-spec VIDs
    (git-fixes).
  - can: mcp251xfd: fix infinite loop when xmit fails (git-fixes).
  - net: can: j1939: recover socket queue on CAN bus error during
    BAM transmission (git-fixes).
  - net: can: j1939: Initialize unused data in j1939_send_one()
    (git-fixes).
  - net: can: j1939: enhanced error handling for tightly received
    RTS messages in xtp_rx_rts_session_new (git-fixes).
  - ASoC: fsl-asoc-card: set priv->pdev before using it (git-fixes).
  - ASoC: amd: acp: remove i2s configuration check in
    acp_i2s_probe() (git-fixes).
  - ASoC: amd: acp: add a null check for chip_pdev structure
    (git-fixes).
  - ASoC: q6apm-lpass-dai: close graph on prepare errors
    (git-fixes).
  - ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on
    right mclk (git-fixes).
  - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion (git-fixes).
  - ALSA: hda/realtek: Fix conflicting quirk for PCI SSID 17aa:3820
    (git-fixes).
  - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2
    messages (git-fixes).
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c (stable-fixes).
  - drm/radeon: fix UBSAN warning in kv_dpm.c (stable-fixes).
  - ACPI: EC: Evaluate orphan _REG under EC device (git-fixes).
  - serial: exar: adding missing CTI and Exar PCI ids
    (stable-fixes).
  - serial: imx: Introduce timeout when waiting on transmitter empty
    (stable-fixes).
  - usb: gadget: function: Remove usage of the deprecated
    ida_simple_xx() API (stable-fixes).
  - usb: typec: ucsi_glink: drop special handling for CCI_BUSY
    (stable-fixes).
  - usb: dwc3: pci: Don't set "linux,phy_charger_detect" property
    on Lenovo Yoga Tab2 1380 (stable-fixes).
  - usb: misc: uss720: check for incompatible versions of the
    Belkin F5U002 (stable-fixes).
  - usb: gadget: uvc: configfs: ensure guid to be valid before set
    (stable-fixes).
  - cpufreq: amd-pstate: fix memory leak on CPU EPP exit
    (stable-fixes).
  - ACPI: EC: Install address space handler at the namespace root
    (stable-fixes).
  - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
    (stable-fixes).
  - power: supply: cros_usbpd: provide ID table for avoiding
    fallback match (stable-fixes).
  - platform/x86: toshiba_acpi: Add quirk for buttons on Z830
    (stable-fixes).
  - ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
    (git-fixes).
  - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
    (stable-fixes).
  - ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
    (stable-fixes).
  - drm/lima: mask irqs in timeout path before hard reset
    (stable-fixes).
  - drm/lima: add mask irq callback to gp and pp (stable-fixes).
  - drm/amd/display: revert Exit idle optimizations before HDCP
    execution (stable-fixes).
  - drm/amd/display: Exit idle optimizations before HDCP execution
    (stable-fixes).
  - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
    (stable-fixes).
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    (stable-fixes).
  - ssb: Fix potential NULL pointer dereference in
    ssb_device_uevent() (stable-fixes).
  - HID: Add quirk for Logitech Casa touchpad (stable-fixes).
  - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
    (stable-fixes).
  - crypto: hisilicon/qm - Add the err memory release process to
    qm uninit (stable-fixes).
  - crypto: hisilicon/sec - Fix memory leak for sec resource release
    (stable-fixes).
  - commit bbedf42

++++ kernel-default:

  - wifi: iwlwifi: mvm: fix the TXF mapping for BZ devices
    (bsc#1227149).
  - wifi: iwlwifi: clear link_id in time_event (bsc#1227149).
  - wifi: iwlwifi: mvm: fix a battery life regression (bsc#1227149).
  - wifi: iwlwifi: remove extra kernel-doc (bsc#1227149).
  - wifi: iwlwifi: mvm: skip adding debugfs symlink for reconfig
    (bsc#1227149).
  - wifi: iwlwifi: replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: iwlwifi: mvm: use the new command to clear the internal
    buffer (bsc#1227149).
  - commit acd03db
  - wifi: iwlwifi: mvm: add US/Canada MCC to API (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-fix-warnings-from-dmi_get_system_in.patch.
  - commit 70a9591
  - wifi: iwlwifi: mvm: disallow puncturing in US/Canada
    (bsc#1227149).
  - wifi: iwlwifi: Add rf_mapping of new wifi7 devices
    (bsc#1227149).
  - wifi: iwlwifi: cleanup BT Shared Single Antenna code
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Do not warn if valid link pair was not found
    (bsc#1227149).
  - wifi: iwlwifi: mvm: d3: avoid intermediate/early mutex unlock
    (bsc#1227149).
  - wifi: iwlwifi: Don't mark DFS channels as NO-IR (bsc#1227149).
  - wifi: iwlwifi: mvm: Allow DFS concurrent operation
    (bsc#1227149).
  - wifi: iwlwifi: mvm: do not send STA_DISABLE_TX_CMD for newer
    firmware (bsc#1227149).
  - wifi: iwlwifi: remove async command callback (bsc#1227149).
  - commit 0205124
  - wifi: iwlwifi: fw: file: don't use [0] for variable arrays
    (bsc#1227149).
  - wifi: iwlwifi: pcie: get_crf_id() can be void (bsc#1227149).
  - wifi: iwlwifi: pcie: dump CSRs before removal (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up device removal work (bsc#1227149).
  - wifi: iwlwifi: mvm: add a debugfs hook to clear the monitor data
    (bsc#1227149).
  - wifi: iwlwifi: refactor RX tracing (bsc#1227149).
  - wifi: iwlwifi: mvm: Correctly report TSF data in scan complete
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Use the link ID provided in scan request
    (bsc#1227149).
  - wifi: iwlwifi: fw: replace deprecated strncpy with strscpy_pad
    (bsc#1227149).
  - wifi: iwlwifi: fix system commands group ordering (bsc#1227149).
  - commit 6cae420
  - wifi: iwlwifi: drop NULL pointer check in
    iwl_mvm_tzone_set_trip_temp() (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 86 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: read DSM func 2 for specific RF types
    (bsc#1227149).
  - wifi: iwlwifi: mvm: show dump even for pldr_sync (bsc#1227149).
  - wifi: iwlwifi: mvm: cycle FW link on chanctx removal
    (bsc#1227149).
  - wifi: iwlwifi: trace full frames with TX status request
    (bsc#1227149).
  - wifi: iwlwifi: fw: Add support for UATS table in UHB
    (bsc#1227149).
  - wifi: iwlwifi: mvm: add a print when sending RLC command
    (bsc#1227149).
  - wifi: iwlwifi: mvm: debugfs for fw system stats (bsc#1227149).
  - wifi: iwlwifi: mvm: implement new firmware API for statistics
    (bsc#1227149).
  - commit ed6b54f
  - wifi: iwlwifi: disable multi rx queue for 9000 (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-include-link-ID-when-releasing-fram.patch.
  - commit 9866ec0
  - wifi: iwlwifi: mvm: fix regdb initialization (bsc#1227149).
  - wifi: iwlwifi: mvm: simplify the reorder buffer (bsc#1227149).
  - wifi: iwlwifi: mvm: Return success if link could not be removed
    (bsc#1227149).
  - wifi: iwlwifi: add support for SNPS DPHYIP region type
    (bsc#1227149).
  - wifi: iwlwifi: mvm: remove set_tim callback for MLD ops
    (bsc#1227149).
  - wifi: iwlwifi: api: fix center_freq label in PHY diagram
    (bsc#1227149).
  - wifi: iwlwifi: support link id in SESSION_PROTECTION_NOTIF
    (bsc#1227149).
  - wifi: iwlwifi: support link_id in SESSION_PROTECTION cmd
    (bsc#1227149).
  - wifi: iwlwifi: make time_events MLO aware (bsc#1227149).
  - commit 1ea0f35
  - wifi: iwlwifi: add support for activating UNII-1 in WW via BIOS
    (bsc#1227149).
  - wifi: iwlwifi: mvm: extend alive timeout to 2 seconds
    (bsc#1227149).
  - wifi: iwlwifi: mvm: fix the PHY context resolution for p2p
    device (bsc#1227149).
  - wifi: iwlwifi: mvm: fold the ref++ into iwl_mvm_phy_ctxt_add
    (bsc#1227149).
  - wifi: iwlwifi: mvm: don't add dummy phy context (bsc#1227149).
  - wifi: iwlwifi: mvm: cleanup MLO and non-MLO unification code
    (bsc#1227149).
  - wifi: iwlwifi: mvm: implement ROC version 3 (bsc#1227149).
  - wifi: iwlwifi: send EDT table to FW (bsc#1227149).
  - wifi: iwlmvm: fw: Add new OEM vendor to tas approved list
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Fix unreachable code path (bsc#1227149).
  - commit 50ebcaa
  - wifi: iwlwifi: mvm: advertise support for SCS traffic
    description (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-do-not-announce-EPCS-support.patch.
  - commit 7208326
  - wifi: iwlwifi: add new RF support for wifi7 (bsc#1227149).
  - wifi: iwlwifi: fw: increase fw_version string size
    (bsc#1227149).
  - wifi: iwlwifi: check for kmemdup() return value in
    iwl_parse_tlv_firmware() (bsc#1227149).
  - wifi: iwlwifi: fix the rf step and flavor bits range
    (bsc#1227149).
  - wifi: iwlwifi: fw: Fix debugfs command sending (bsc#1227149).
  - wifi: iwlwifi: mvm: add start mac ctdp sum calculation debugfs
    handler (bsc#1227149).
  - wifi: iwlwifi: abort scan when rfkill on but device enabled
    (bsc#1227149).
  - wifi: iwlwifi: mvm: Add basic link selection logic
    (bsc#1227149).
  - wifi: iwlwifi: mei: return error from register when not built
    (bsc#1227149).
  - commit fddf9eb
  - wifi: iwlwifi: mvm: fix SB CFG check (bsc#1227149).
  - wifi: iwlwifi: mvm: add a per-link debugfs (bsc#1227149).
  - wifi: iwlwifi: mvm: rework debugfs handling (bsc#1227149).
  - wifi: iwlwifi: add support for new ini region types
    (bsc#1227149).
  - wifi: iwlwifi: Extract common prph mac/phy regions data dump
    logic (bsc#1227149).
  - wifi: iwlwifi: bump FW API to 84 for AX/BZ/SC devices
    (bsc#1227149).
  - wifi: iwlwifi: mvm: offload IGTK in AP if BIGTK is supported
    (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up WFPM control bits (bsc#1227149).
  - wifi: iwlwifi: fix opmode start/stop race (bsc#1227149).
  - wifi: iwlwifi: skip opmode start retries on dead transport
    (bsc#1227149).
  - commit 36551d1
  - wifi: iwlwifi: mvm: add support for new wowlan_info_notif
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-d3-fix-IPN-byte-order.patch.
  - commit 0b379ae
  - wifi: iwlwifi: pcie: propagate iwl_pcie_gen2_apm_init() error
    (bsc#1227149).
  - wifi: iwlwifi: add mapping of a periphery register crf for WH RF
    (bsc#1227149).
  - wifi: iwlwifi: mvm: check for iwl_mvm_mld_update_sta() errors
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support injection antenna control
    (bsc#1227149).
  - wifi: iwlwifi: mvm: refactor TX rate handling (bsc#1227149).
  - wifi: iwlwifi: mvm: make pldr_sync AX210 specific (bsc#1227149).
  - wifi: iwlwifi: fail NIC access fast on dead NIC (bsc#1227149).
  - wifi: iwlwifi: pcie: (re-)assign BAR0 on driver bind
    (bsc#1227149).
  - commit 0882d6d
  - wifi: iwlwifi: implement enable/disable for China 2022
    regulatory (bsc#1227149).
  - wifi: iwlwifi: mvm: handle link-STA allocation in restart
    (bsc#1227149).
  - wifi: iwlwifi: mvm: iterate active links for STA queues
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support set_antenna() (bsc#1227149).
  - wifi: iwlwifi: mvm: add a debug print when we get a BAR
    (bsc#1227149).
  - wifi: iwlwifi: mvm: move listen interval to constants
    (bsc#1227149).
  - wifi: iwlwifi: no power save during transition to D3
    (bsc#1227149).
  - wifi: iwlwifi: update context info structure definitions
    (bsc#1227149).
  - wifi: iwlwifi: mvm: fix recovery flow in CSA (bsc#1227149).
  - wifi: iwlwifi: mvm: enable FILS DF Tx on non-PSC channel
    (bsc#1227149).
  - commit 5c7efaf
  - wifi: iwlwifi: mvm: make "pldr_sync" mode effective
    (bsc#1227149).
  - wifi: iwlwifi: mvm: log dropped frames (bsc#1227149).
  - wifi: iwlwifi: fw: disable firmware debug asserts (bsc#1227149).
  - wifi: iwlwifi: remove dead-code (bsc#1227149).
  - wifi: iwlwifi: pcie: enable TOP fatal error interrupt
    (bsc#1227149).
  - wifi: iwlwifi: pcie: give up mem read if HW is dead
    (bsc#1227149).
  - wifi: iwlwifi: pcie: rescan bus if no parent (bsc#1227149).
  - wifi: iwlwifi: mvm: reduce maximum RX A-MPDU size (bsc#1227149).
  - wifi: iwlwifi: mvm: check link more carefully (bsc#1227149).
  - wifi: iwlwifi: mvm: move RU alloc B2 placement (bsc#1227149).
  - commit 8aa4ff8
  - virtio: delete vq in vp_find_vqs_msix() when request_irq()
    fails (CVE-2024-37353 bsc#1226875).
  - commit 4591439
  - wifi: iwlwifi: mvm: fix kernel-doc (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-ensure-offloading-TID-queue-exists.patch.
  - commit 68376c9
  - wifi: iwlwifi: pcie: fix kernel-doc issues (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-pcie-fix-RB-status-reading.patch.
  - commit f106797
  - wifi: iwlwifi: fw: reconstruct the API/CAPA enum number
    (bsc#1227149).
  - wifi: iwlwifi: dvm: remove kernel-doc warnings (bsc#1227149).
  - wifi: iwlwifi: queue: fix kernel-doc (bsc#1227149).
  - wifi: iwlwifi: fix some kernel-doc issues (bsc#1227149).
  - wifi: iwlwifi: mvm: disconnect long CSA only w/o alternative
    (bsc#1227149).
  - wifi: iwlwifi: mvm: increase session protection after CSA
    (bsc#1227149).
  - wifi: iwlwifi: mvm: support CSA with MLD (bsc#1227149).
  - wifi: iwlmei: don't send nic info with invalid mac address
    (bsc#1227149).
  - commit 85cbe83
  - wifi: iwlwifi: mvm: support flush on AP interfaces
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-iwlwifi-mvm-change-iwl_mvm_flush_sta-API.patch.
  - commit 908ff7c
  - wifi: iwlmei: send driver down SAP message only if wiamt is
    enabled (bsc#1227149).
  - wifi: iwlmei: send HOST_GOES_DOWN message even if wiamt is
    disabled (bsc#1227149).
  - wifi: iwlmei: don't send SAP messages if AMT is disabled
    (bsc#1227149).
  - wifi: iwlwifi: remove memory check for LMAC error address
    (bsc#1227149).
  - wifi: iwlwifi: mvm: enable HE TX/RX <242 tone RU on new RFs
    (bsc#1227149).
  - wifi: iwlwifi: add Razer to ppag approved list (bsc#1227149).
  - wifi: iwlwifi: pcie: point invalid TFDs to invalid data
    (bsc#1227149).
  - wifi: iwlwifi: queue: move iwl_txq_gen2_set_tb() up
    (bsc#1227149).
  - wifi: iwlwifi: pcie: move gen1 TB handling to header
    (bsc#1227149).
  - commit 92ab309
  - wifi: iwlwifi: remove 'def_rx_queue' struct member
    (bsc#1227149).
  - wifi: iwlwifi: pcie: clean up gen1/gen2 TFD unmap (bsc#1227149).
  - wifi: iwlwifi: remove WARN from read_mem32() (bsc#1227149).
  - wifi: iwlwifi: api: fix a small upper/lower-case typo
    (bsc#1227149).
  - wifi: iwlwifi: mvm: advertise MLO only if EHT is enabled
    (bsc#1227149).
  - commit aa9a391
  - Add alt-commit to iwlwifi patches
  - commit 865aa7a
  - wifi: mac80211: fix unsolicited broadcast probe config
    (bsc#1227149).
  - wifi: mac80211: initialize SMPS mode correctly (bsc#1227149).
  - wifi: mac80211: fix driver debugfs for vif type change
    (bsc#1227149).
  - wifi: mac80211: improve CSA/ECSA connection refusal
    (bsc#1227149).
  - wifi: cfg80211: detect stuck ECSA element in probe resp
    (bsc#1227149).
  - wifi: mac80211: add/remove driver debugfs entries as appropriate
    (bsc#1227149).
  - wifi: mac80211: do not re-add debugfs entries during resume
    (bsc#1227149).
  - commit 769161a
  - wifi: mac80211: remove redundant ML element check (bsc#1227149).
  - wifi: cfg80211: Update the default DSCP-to-UP mapping
    (bsc#1227149).
  - wifi: mac80211: fix spelling typo in comment (bsc#1227149).
  - wifi: mac80211: add a driver callback to check active_links
    (bsc#1227149).
  - wifi: mac80211: fix advertised TTLM scheduling (bsc#1227149).
  - wifi: cfg80211: avoid double free if updating BSS fails
    (bsc#1227149).
  - commit e8bab13
  - wifi: cfg80211: handle UHB AP and STA power type (bsc#1227149).
  - commit 6021aa4
  - wifi: cfg80211: ensure cfg80211_bss_update frees IEs on error
    (bsc#1227149).
  - wifi: mac80211: allow 64-bit radiotap timestamps (bsc#1227149).
  - wifi: mac80211: rework RX timestamp flags (bsc#1227149).
  - wifi: mac80211: Schedule regulatory channels check on bandwith
    change (bsc#1227149).
  - wifi: cfg80211: Schedule regulatory check on BSS STA channel
    change (bsc#1227149).
  - wifi: cfg80211: reg: Support P2P operation on DFS channels
    (bsc#1227149).
  - wifi: mac80211: Skip association timeout update after comeback
    rejection (bsc#1227149).
  - wifi: mac80211: address some kerneldoc warnings (bsc#1227149).
  - wifi: cfg80211: address several kerneldoc warnings
    (bsc#1227149).
  - commit bc44e06
  - wifi: cfg80211: generate an ML element for per-STA profiles
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-parse-all-ML-elements-in-an-ML-probe-r.patch.
  - commit d924102
  - wifi: cfg80211: introduce cfg80211_ssid_eq() (bsc#1227149).
  - wifi: mac80211: sta_info.c: fix sentence grammar (bsc#1227149).
  - wifi: mac80211: rx.c: fix sentence grammar (bsc#1227149).
  - wifi: cfg80211: fix spelling & punctutation (bsc#1227149).
  - wifi: cfg80211: sort certificates in build (bsc#1227149).
  - wifi: mac80211: drop spurious WARN_ON() in
    ieee80211_ibss_csa_beacon() (bsc#1227149).
  - wifi: mac80211: don't set ESS capab bit in assoc request
    (bsc#1227149).
  - wifi: cfg80211: consume both probe response and beacon IEs
    (bsc#1227149).
  - wifi: cfg80211: Replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - commit 5e5ecdb
  - wifi: cfg80211: OWE DH IE handling offload (bsc#1227149).
  - commit 58c8e33
  - wifi: cfg80211: add BSS usage reporting (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-parse-all-ML-elements-in-an-ML-probe-r.patch.
  - commit 5b2693d
  - wifi: mac80211: Replace ENOTSUPP with EOPNOTSUPP (bsc#1227149).
  - wifi: mac80211: add a flag to disallow puncturing (bsc#1227149).
  - wifi: cfg80211: Add support for setting TID to link mapping
    (bsc#1227149).
  - wifi: mac80211: update some locking documentation (bsc#1227149).
  - wifi: nl80211: Extend del pmksa support for SAE and OWE security
    (bsc#1227149).
  - wifi: mac80211: cleanup airtime arithmetic with
    ieee80211_sta_keep_active() (bsc#1227149).
  - wifi: cfg80211: expose nl80211_chan_width_to_mhz for wide
    sharing (bsc#1227149).
  - wifi: cfg80211: make RX assoc data const (bsc#1227149).
  - commit e4b61c4
  - wifi: cfg80211: Extend support for scanning while MLO connected
    (bsc#1227149).
  - commit b4c9412
  - wifi: cfg80211: hold wiphy mutex for send_interface
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-fix-missing-interfaces-when-dumping.patch.
  - commit 2123690
  - wifi: cfg80211: fix CQM for non-range use (bsc#1227149).
  - commit 3c8ba48
  - wifi: nl80211: refactor nl80211_send_mlme_event() arguments
    (bsc#1227149).
  - wifi: mac80211: Extend support for scanning while MLO connected
    (bsc#1227149).
  - wifi: mac80211: use wiphy locked debugfs for sdata/link
    (bsc#1227149).
  - wifi: mac80211: use wiphy locked debugfs helpers for agg_status
    (bsc#1227149).
  - wifi: cfg80211: add locked debugfs wrappers (bsc#1227149).
  - wifi: mac80211: drop robust action frames before assoc
    (bsc#1227149).
  - wifi: cfg80211: Allow AP/P2PGO to indicate port authorization
    to peer STA/P2PClient (bsc#1227149).
  - commit 03e12a0
  - blacklist: drop the wifi entries to be backported
  - commit 891934b
  - wifi: mac80211: fix another key installation error path
    (bsc#1227149).
  - wifi: mac80211: rename struct cfg80211_rx_assoc_resp to
    cfg80211_rx_assoc_resp_data (bsc#1227149).
  - wifi: mac80211: rename ieee80211_tx_status() to
    ieee80211_tx_status_skb() (bsc#1227149).
  - wifi: mac80211: fix change_address deadlock during unregister
    (bsc#1227149).
  - wifi: mac80211: Add __counted_by for struct ieee802_11_elems
    and use struct_size() (bsc#1227149).
  - wifi: remove unused argument of ieee80211_get_tdls_action()
    (bsc#1227149).
  - wifi: mac80211: fix header kernel-doc typos (bsc#1227149).
  - wifi: cfg80211: fix header kernel-doc typos (bsc#1227149).
  - wifi: mac80211: add link id to mgd_prepare_tx() (bsc#1227149).
  - wifi: mac80211: Check if we had first beacon with relevant links
    (bsc#1227149).
  - commit fa14599
  - kABI fix of KVM: x86/pmu: Prioritize VMX interception over
  - commit 1f1d114
  - wifi: mac80211: flush STA queues on unauthorization
    (bsc#1227149).
  - wifi: mac80211: purge TX queues in flush_queues flow
    (bsc#1227149).
  - wifi: cfg80211: wext: convert return value to kernel-doc
    (bsc#1227149).
  - wifi: mac80211: fix a expired vs. cancel race in roc
    (bsc#1227149).
  - wifi: mac80211: make mgd_protect_tdls_discover MLO-aware
    (bsc#1227149).
  - wifi: cfg80211: Fix typo in documentation (bsc#1227149).
  - wifi: cfg80211: Handle specific BSSID in 6GHz scanning
    (bsc#1227149).
  - wifi: mac80211: mesh: fix some kdoc warnings (bsc#1227149).
  - wifi: cfg80211: Include operating class 137 in 6GHz band
    (bsc#1227149).
  - wifi: mac80211: Rename and update
    IEEE80211_VIF_DISABLE_SMPS_OVERRIDE (bsc#1227149).
  - commit 585676b
  - wifi: mac80211: split ieee80211_drop_unencrypted_mgmt() return
    value (bsc#1227149).
  - commit 3835ef2
  - wifi: mac80211: fix error path key leak (bsc#1227149).
  - Refresh patches.suse/wifi-mac80211-remove-key_mtx.patch.
  - commit 3b93fe9
  - wifi: mac80211: fix potential key leak (bsc#1227149).
  - Refresh patches.suse/wifi-mac80211-remove-key_mtx.patch.
  - commit 9fa5ec3
  - wifi: mac80211: handle debugfs when switching to/from MLO
    (bsc#1227149).
  - wifi: mac80211: add a driver callback to add vif debugfs
    (bsc#1227149).
  - wifi: mac80211: cleanup auth_data only if association continues
    (bsc#1227149).
  - wifi: mac80211: add back SPDX identifier (bsc#1227149).
  - wifi: mac80211: fix ieee80211_drop_unencrypted_mgmt return
    type/value (bsc#1227149).
  - wifi: mac80211: expand __ieee80211_data_to_8023() status
    (bsc#1227149).
  - wifi: mac80211: remove RX_DROP_UNUSABLE (bsc#1227149).
  - commit e0a6a5e
  - wifi: cfg80211: add local_state_change to deauth trace
    (bsc#1227149).
  - wifi: mac80211: reject MLO channel configuration if not
    supported (bsc#1227149).
  - wifi: mac80211: report per-link error during association
    (bsc#1227149).
  - wifi: cfg80211: report per-link errors during association
    (bsc#1227149).
  - wifi: mac80211: support antenna control in injection
    (bsc#1227149).
  - wifi: mac80211: support handling of advertised TID-to-link
    mapping (bsc#1227149).
  - wifi: mac80211: add support for parsing TID to Link mapping
    element (bsc#1227149).
  - wifi: mac80211: Notify the low level driver on change in MLO
    valid links (bsc#1227149).
  - wifi: mac80211: describe return values in kernel-doc
    (bsc#1227149).
  - wifi: cfg80211: reg: describe return values in kernel-doc
    (bsc#1227149).
  - commit df6c84a
  - wifi: mac80211: allow for_each_sta_active_link() under RCU
    (bsc#1227149).
  - wifi: mac80211: relax RCU check in for_each_vif_active_link()
    (bsc#1227149).
  - wifi: mac80211: don't connect to an AP while it's in a CSA
    process (bsc#1227149).
  - wifi: mac80211: update the rx_chains after set_antenna()
    (bsc#1227149).
  - wifi: mac80211: use bandwidth indication element for CSA
    (bsc#1227149).
  - wifi: cfg80211: split struct cfg80211_ap_settings (bsc#1227149).
  - wifi: mac80211: ethtool: always hold wiphy mutex (bsc#1227149).
  - wifi: cfg80211: make read-only array centers_80mhz static const
    (bsc#1227149).
  - wifi: cfg80211: save power spectral density(psd) of regulatory
    rule (bsc#1227149).
  - wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush()
    (bsc#1227149).
  - commit 7f3b9af
  - wifi: mac80211: Sanity check tx bitrate if not provided by
    driver (bsc#1227149).
  - wifi: cfg80211: export DFS CAC time and usable state helper
    functions (bsc#1227149).
  - wifi: cfg80211: call reg_call_notifier on beacon hints
    (bsc#1227149).
  - wifi: cfg80211: allow reg update by driver even if wiphy->regd
    is set (bsc#1227149).
  - wifi: mac80211: additions to change_beacon() (bsc#1227149).
  - wifi: nl80211: additions to NL80211_CMD_SET_BEACON
    (bsc#1227149).
  - wifi: cfg80211: modify prototype for change_beacon
    (bsc#1227149).
  - wifi: mac80211: fixes in FILS discovery updates (bsc#1227149).
  - wifi: nl80211: fixes to FILS discovery updates (bsc#1227149).
  - wifi: lib80211: remove unused variables iv32 and iv16
    (bsc#1227149).
  - commit 67ccb18
  - wifi: mac80211: fix various kernel-doc issues (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-track-capability-opmode-NSS-separately.patch.
  - commit b1c042f
  - wifi: mac80211: remove shifted rate support (bsc#1227149).
  - wifi: cfg80211: remove scan_width support (bsc#1227149).
  - wifi: wext: avoid extra calls to strlen() in ieee80211_bss()
    (bsc#1227149).
  - wifi: mac80211: fix channel switch link data (bsc#1227149).
  - wifi: mac80211: Do not force off-channel for management Tx
    with MLO (bsc#1227149).
  - wifi: mac80211: take MBSSID/EHT data also from probe resp
    (bsc#1227149).
  - wifi: mac80211: Print local link address during authentication
    (bsc#1227149).
  - wifi: cfg80211: reg: fix various kernel-doc issues
    (bsc#1227149).
  - wifi: mac80211: remove unnecessary struct forward declaration
    (bsc#1227149).
  - commit 5936128
  - wifi: cfg80211: annotate iftype_data pointer with sparse
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-cfg80211-fix-wiphy-delayed-work-queueing.patch.
  - commit 031b8a7
  - wifi: mac80211: add more warnings about inserting sta info
    (bsc#1227149).
  - wifi: mac80211: add support for mld in ieee80211_chswitch_done
    (bsc#1227149).
  - wifi: mac80211: fix BA session teardown race (bsc#1227149).
  - wifi: mac80211: fix TXQ error path and cleanup (bsc#1227149).
  - commit 8e5b425
  - wifi: cfg80211: remove wdev mutex (bsc#1227149).
  - commit 4d7cf99
  - wifi: mac80211: set wiphy for virtual monitors (bsc#1227149).
  - commit 6022030
  - iommu/amd: Fix sysfs leak in iommu init (git-fixes).
  - commit 5b11e2a
  - wifi: mac80211: remove key_mtx (bsc#1227149).
  - commit 36d4ad3
  - iommu: Return right value in iommu_sva_bind_device()
    (git-fixes).
  - commit 769b149
  - wifi: mac80211: remove sta_mtx (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-check-if-the-existing-link-config-rema.patch.
  - Refresh
    patches.suse/wifi-mac80211-don-t-re-add-debugfs-during-reconfig.patch.
  - commit 5b967e8
  - wifi: mac80211: reduce iflist_mtx (bsc#1227149).
  - wifi: mac80211: remove local->mtx (bsc#1227149).
  - wifi: mac80211: remove ampdu_mlme.mtx (bsc#1227149).
  - wifi: mac80211: remove chanctx_mtx (bsc#1227149).
  - wifi: mac80211: take wiphy lock for MAC addr change
    (bsc#1227149).
  - wifi: mac80211: extend wiphy lock in interface removal
    (bsc#1227149).
  - wifi: mac80211: hold wiphy_lock around concurrency checks
    (bsc#1227149).
  - wifi: mac80211: ethtool: hold wiphy mutex (bsc#1227149).
  - commit b3dacec
  - wifi: mac80211: check wiphy mutex in ops (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-do-not-pass-AP_VLAN-vif-pointer-to-dri.patch.
  - commit 3b00636
  - wifi: cfg80211: check wiphy mutex is held for wdev mutex
    (bsc#1227149).
  - wifi: cfg80211: hold wiphy lock in
    cfg80211_any_wiphy_oper_chan() (bsc#1227149).
  - wifi: cfg80211: sme: hold wiphy lock for wdev iteration
    (bsc#1227149).
  - wifi: cfg80211: reg: hold wiphy mutex for wdev iteration
    (bsc#1227149).
  - wifi: mac80211: move color change finalize to wiphy work
    (bsc#1227149).
  - wifi: mac80211: move CSA finalize to wiphy work (bsc#1227149).
  - wifi: mac80211: move filter reconfig to wiphy work
    (bsc#1227149).
  - wifi: mac80211: move tspec work to wiphy work (bsc#1227149).
  - wifi: mac80211: move key tailroom work to wiphy work
    (bsc#1227149).
  - commit d930910
  - wifi: mac80211: move dynamic PS to wiphy work (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-sched-scan-stop-work-to-wiphy-wor.patch.
  - commit 6350819
  - wifi: mac80211: move DFS CAC work to wiphy work (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-radar-detect-work-to-wiphy-work.patch.
  - commit 46fc728
  - wifi: mac80211: move TDLS work to wiphy work (bsc#1227149).
  - wifi: mac80211: move link activation work to wiphy work
    (bsc#1227149).
  - wifi: mac80211: lock wiphy in IP address notifier (bsc#1227149).
  - wifi: mac80211: move monitor work to wiphy work (bsc#1227149).
  - wifi: mac80211: add more ops assertions (bsc#1227149).
  - wifi: mac80211: convert A-MPDU work to wiphy work (bsc#1227149).
  - wifi: mac80211: flush wiphy work where appropriate
    (bsc#1227149).
  - wifi: cfg80211: check RTNL when iterating devices (bsc#1227149).
  - commit 425f8ad
  - wifi: mac80211: lock wiphy for aggregation debugfs
    (bsc#1227149).
  - wifi: mac80211: hold wiphy lock in netdev/link debugfs
    (bsc#1227149).
  - wifi: mac80211: debugfs: lock wiphy instead of RTNL
    (bsc#1227149).
  - wifi: mac80211: fix SMPS status handling (bsc#1227149).
  - wifi: mac80211: Fix SMPS handling in the context of MLO
    (bsc#1227149).
  - wifi: mac80211: rework ack_frame_id handling a bit
    (bsc#1227149).
  - wifi: mac80211: tx: clarify conditions in if statement
    (bsc#1227149).
  - wifi: mac80211: Do not include crypto/algapi.h (bsc#1227149).
  - wifi: cfg80211: improve documentation for flag fields
    (bsc#1227149).
  - wifi: nl80211: Remove unused declaration
    nl80211_pmsr_dump_results() (bsc#1227149).
  - commit 75d4c97
  - wifi: mac80211: mesh: Remove unused function declaration
    mesh_ids_set_default() (bsc#1227149).
  - commit b3033c6
  - wifi: mac80211: Remove unused function declarations
    (bsc#1227149).
  - Refresh
    patches.suse/wifi-mac80211-move-radar-detect-work-to-wiphy-work.patch.
  - commit 343f020
  - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
    (bsc#1222015 bsc#1226962).
  - commit ba98363
  - KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC
    due to bad index (bsc#1226158).
  - commit fdb5ce1
  - net/9p: fix uninit-value in p9_client_rpc() (CVE-2024-39301
    bsc#1226994).
  - commit d8af728
  - arm64/io: add constant-argument check (bsc#1226502 git-fixes)
  - commit 45e8b78
  - struct acpi_ec kABI workaround (git-fixes).
  - commit 3605f74
  - wifi: mt76: mt7921s: fix potential hung tasks during chip
    recovery (stable-fixes).
  - commit d9504b4
  - drm/drm_file: Fix pid refcounting race (git-fixes).
  - drm/i915/gt: Fix potential UAF by revoke of fence registers
    (git-fixes).
  - drm/amdgpu: Fix pci state save during mode-1 reset (git-fixes).
  - drm/panel: simple: Add missing display timing flags for KOE
    TX26D202VM0BWA (git-fixes).
  - drm/fbdev-dma: Only set smem_start is enable per module option
    (git-fixes).
  - net: usb: ax88179_178a: improve link status logs (git-fixes).
  - net: phy: micrel: add Microchip KSZ 9477 to the device table
    (git-fixes).
  - batman-adv: Don't accept TT entries for out-of-spec VIDs
    (git-fixes).
  - can: mcp251xfd: fix infinite loop when xmit fails (git-fixes).
  - net: can: j1939: recover socket queue on CAN bus error during
    BAM transmission (git-fixes).
  - net: can: j1939: Initialize unused data in j1939_send_one()
    (git-fixes).
  - net: can: j1939: enhanced error handling for tightly received
    RTS messages in xtp_rx_rts_session_new (git-fixes).
  - ASoC: fsl-asoc-card: set priv->pdev before using it (git-fixes).
  - ASoC: amd: acp: remove i2s configuration check in
    acp_i2s_probe() (git-fixes).
  - ASoC: amd: acp: add a null check for chip_pdev structure
    (git-fixes).
  - ASoC: q6apm-lpass-dai: close graph on prepare errors
    (git-fixes).
  - ASoC: rockchip: i2s-tdm: Fix trcm mode by setting clock on
    right mclk (git-fixes).
  - ALSA: seq: Fix missing MSB in MIDI2 SPP conversion (git-fixes).
  - ALSA: hda/realtek: Fix conflicting quirk for PCI SSID 17aa:3820
    (git-fixes).
  - ALSA: seq: Fix missing channel at encoding RPN/NRPN MIDI2
    messages (git-fixes).
  - drm/amdgpu: fix UBSAN warning in kv_dpm.c (stable-fixes).
  - drm/radeon: fix UBSAN warning in kv_dpm.c (stable-fixes).
  - ACPI: EC: Evaluate orphan _REG under EC device (git-fixes).
  - serial: exar: adding missing CTI and Exar PCI ids
    (stable-fixes).
  - serial: imx: Introduce timeout when waiting on transmitter empty
    (stable-fixes).
  - usb: gadget: function: Remove usage of the deprecated
    ida_simple_xx() API (stable-fixes).
  - usb: typec: ucsi_glink: drop special handling for CCI_BUSY
    (stable-fixes).
  - usb: dwc3: pci: Don't set "linux,phy_charger_detect" property
    on Lenovo Yoga Tab2 1380 (stable-fixes).
  - usb: misc: uss720: check for incompatible versions of the
    Belkin F5U002 (stable-fixes).
  - usb: gadget: uvc: configfs: ensure guid to be valid before set
    (stable-fixes).
  - cpufreq: amd-pstate: fix memory leak on CPU EPP exit
    (stable-fixes).
  - ACPI: EC: Install address space handler at the namespace root
    (stable-fixes).
  - PCI/PM: Avoid D3cold for HP Pavilion 17 PC/1972 PCIe Ports
    (stable-fixes).
  - power: supply: cros_usbpd: provide ID table for avoiding
    fallback match (stable-fixes).
  - platform/x86: toshiba_acpi: Add quirk for buttons on Z830
    (stable-fixes).
  - ASoC: Intel: sof-sdw: really remove FOUR_SPEAKER quirk
    (git-fixes).
  - ASoC: Intel: sof_sdw: add quirk for Dell SKU 0C0F
    (stable-fixes).
  - ASoC: Intel: sof_sdw: add JD2 quirk for HP Omen 14
    (stable-fixes).
  - drm/lima: mask irqs in timeout path before hard reset
    (stable-fixes).
  - drm/lima: add mask irq callback to gp and pp (stable-fixes).
  - drm/amd/display: revert Exit idle optimizations before HDCP
    execution (stable-fixes).
  - drm/amd/display: Exit idle optimizations before HDCP execution
    (stable-fixes).
  - Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl
    (stable-fixes).
  - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    (stable-fixes).
  - ssb: Fix potential NULL pointer dereference in
    ssb_device_uevent() (stable-fixes).
  - HID: Add quirk for Logitech Casa touchpad (stable-fixes).
  - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
    (stable-fixes).
  - crypto: hisilicon/qm - Add the err memory release process to
    qm uninit (stable-fixes).
  - crypto: hisilicon/sec - Fix memory leak for sec resource release
    (stable-fixes).
  - commit bbedf42

++++ liburing:

  - Update to 2.6:
    * Add getsockopt and setsockopt socket commands
    * Add test cases to test/hardlink
    * Man page fixes
    * Add futex support, and test cases
    * Add waitid support, and test cases
    * Add read multishot, and test cases
    * Add support for IORING_SETUP_NO_SQARRAY
    * Use IORING_SETUP_NO_SQARRAY as the default
    * Add support for IORING_OP_FIXED_FD_INSTALL
    * Add io_uring_prep_fixed_fd_install() helper
    * Support for napi busy polling
    * Improve/add test cases
    * Man page fixes
    * Add sample 'proxy' example
  - Remove (they are upstream)
    * test-no-mmap-inval-0-return-is-fine-too.patch
    * test-recv-multishot-wait-for-the-right-amount-of-CQE.patch
  - exclude buf-ring-nommap.t test (crashes)

++++ libzypp:

  - Update soname due to RepoManager refactoring and cleanup.
  - version 17.35.0 (35)

++++ libzypp:

  - Update soname due to RepoManager refactoring and cleanup.
  - version 17.35.0 (35)

++++ libzypp:

  - Update soname due to RepoManager refactoring and cleanup.
  - version 17.35.0 (35)

++++ libzypp:

  - Update soname due to RepoManager refactoring and cleanup.
  - version 17.35.0 (35)

++++ libzypp:

  - Update soname due to RepoManager refactoring and cleanup.
  - version 17.35.0 (35)

++++ qemu:

  - Update to version 8.2.5:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1718081047.648425.1238605.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/loongarch: fix a wrong print in cpu dump
    ui/sdl2: Allow host to power down screen
    target/i386: fix SSE and SSE2 feature check
    target/i386: fix xsave.flat from kvm-unit-tests
    disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
    target/riscv/kvm.c: Fix the hart bit setting of AIA
    target/riscv: rvzicbo: Fixup CBO extension register calculation
    target/riscv: do not set mtval2 for non guest-page faults
    target/riscv: prioritize pmp errors in raise_mmu_exception()
    target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
    target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
    target/riscv: rvv: Check single width operator for vector fp widen instructions
    target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
    target/riscv/cpu.c: fix Zvkb extension config
    target/riscv: Fix the element agnostic function problem
    target/riscv/kvm: tolerate KVM disable ext errors
    hw/intc/riscv_aplic: APLICs should add child earlier than realize
    iotests: test NBD+TLS+iothread
    qio: Inherit follow_coroutine_ctx across TLS
    target/arm: Disable SVE extensions when SVE is disabled
    hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
    hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
    gitlab: use 'setarch -R' to workaround tsan bug
    gitlab: use $MAKE instead of 'make'
    dockerfiles: add 'MAKE' env variable to remaining containers
    gitlab: Update msys2-64bit runner tags
    target/i386: no single-step exception after MOV or POP SS
    ...

++++ qemu:

  - Update to version 8.2.5:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1718081047.648425.1238605.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/loongarch: fix a wrong print in cpu dump
    ui/sdl2: Allow host to power down screen
    target/i386: fix SSE and SSE2 feature check
    target/i386: fix xsave.flat from kvm-unit-tests
    disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
    target/riscv/kvm.c: Fix the hart bit setting of AIA
    target/riscv: rvzicbo: Fixup CBO extension register calculation
    target/riscv: do not set mtval2 for non guest-page faults
    target/riscv: prioritize pmp errors in raise_mmu_exception()
    target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
    target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
    target/riscv: rvv: Check single width operator for vector fp widen instructions
    target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
    target/riscv/cpu.c: fix Zvkb extension config
    target/riscv: Fix the element agnostic function problem
    target/riscv/kvm: tolerate KVM disable ext errors
    hw/intc/riscv_aplic: APLICs should add child earlier than realize
    iotests: test NBD+TLS+iothread
    qio: Inherit follow_coroutine_ctx across TLS
    target/arm: Disable SVE extensions when SVE is disabled
    hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
    hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
    gitlab: use 'setarch -R' to workaround tsan bug
    gitlab: use $MAKE instead of 'make'
    dockerfiles: add 'MAKE' env variable to remaining containers
    gitlab: Update msys2-64bit runner tags
    target/i386: no single-step exception after MOV or POP SS
    ...

++++ qemu:

  - Update to version 8.2.5:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1718081047.648425.1238605.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/loongarch: fix a wrong print in cpu dump
    ui/sdl2: Allow host to power down screen
    target/i386: fix SSE and SSE2 feature check
    target/i386: fix xsave.flat from kvm-unit-tests
    disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
    target/riscv/kvm.c: Fix the hart bit setting of AIA
    target/riscv: rvzicbo: Fixup CBO extension register calculation
    target/riscv: do not set mtval2 for non guest-page faults
    target/riscv: prioritize pmp errors in raise_mmu_exception()
    target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
    target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
    target/riscv: rvv: Check single width operator for vector fp widen instructions
    target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
    target/riscv/cpu.c: fix Zvkb extension config
    target/riscv: Fix the element agnostic function problem
    target/riscv/kvm: tolerate KVM disable ext errors
    hw/intc/riscv_aplic: APLICs should add child earlier than realize
    iotests: test NBD+TLS+iothread
    qio: Inherit follow_coroutine_ctx across TLS
    target/arm: Disable SVE extensions when SVE is disabled
    hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
    hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
    gitlab: use 'setarch -R' to workaround tsan bug
    gitlab: use $MAKE instead of 'make'
    dockerfiles: add 'MAKE' env variable to remaining containers
    gitlab: Update msys2-64bit runner tags
    target/i386: no single-step exception after MOV or POP SS
    ...

++++ qemu:

  - Update to version 8.2.5:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1718081047.648425.1238605.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/loongarch: fix a wrong print in cpu dump
    ui/sdl2: Allow host to power down screen
    target/i386: fix SSE and SSE2 feature check
    target/i386: fix xsave.flat from kvm-unit-tests
    disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
    target/riscv/kvm.c: Fix the hart bit setting of AIA
    target/riscv: rvzicbo: Fixup CBO extension register calculation
    target/riscv: do not set mtval2 for non guest-page faults
    target/riscv: prioritize pmp errors in raise_mmu_exception()
    target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
    target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
    target/riscv: rvv: Check single width operator for vector fp widen instructions
    target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
    target/riscv/cpu.c: fix Zvkb extension config
    target/riscv: Fix the element agnostic function problem
    target/riscv/kvm: tolerate KVM disable ext errors
    hw/intc/riscv_aplic: APLICs should add child earlier than realize
    iotests: test NBD+TLS+iothread
    qio: Inherit follow_coroutine_ctx across TLS
    target/arm: Disable SVE extensions when SVE is disabled
    hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
    hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
    gitlab: use 'setarch -R' to workaround tsan bug
    gitlab: use $MAKE instead of 'make'
    dockerfiles: add 'MAKE' env variable to remaining containers
    gitlab: Update msys2-64bit runner tags
    target/i386: no single-step exception after MOV or POP SS
    ...

++++ qemu:

  - Update to version 8.2.5:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1718081047.648425.1238605.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/loongarch: fix a wrong print in cpu dump
    ui/sdl2: Allow host to power down screen
    target/i386: fix SSE and SSE2 feature check
    target/i386: fix xsave.flat from kvm-unit-tests
    disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
    target/riscv/kvm.c: Fix the hart bit setting of AIA
    target/riscv: rvzicbo: Fixup CBO extension register calculation
    target/riscv: do not set mtval2 for non guest-page faults
    target/riscv: prioritize pmp errors in raise_mmu_exception()
    target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
    target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
    target/riscv: rvv: Check single width operator for vector fp widen instructions
    target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
    target/riscv/cpu.c: fix Zvkb extension config
    target/riscv: Fix the element agnostic function problem
    target/riscv/kvm: tolerate KVM disable ext errors
    hw/intc/riscv_aplic: APLICs should add child earlier than realize
    iotests: test NBD+TLS+iothread
    qio: Inherit follow_coroutine_ctx across TLS
    target/arm: Disable SVE extensions when SVE is disabled
    hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
    hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
    gitlab: use 'setarch -R' to workaround tsan bug
    gitlab: use $MAKE instead of 'make'
    dockerfiles: add 'MAKE' env variable to remaining containers
    gitlab: Update msys2-64bit runner tags
    target/i386: no single-step exception after MOV or POP SS
    ...

++++ qemu:

  - Update to version 8.2.5:
    Full backport lists (from the various releases) here:
    https://lore.kernel.org/qemu-devel/1718081047.648425.1238605.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/loongarch: fix a wrong print in cpu dump
    ui/sdl2: Allow host to power down screen
    target/i386: fix SSE and SSE2 feature check
    target/i386: fix xsave.flat from kvm-unit-tests
    disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
    target/riscv/kvm.c: Fix the hart bit setting of AIA
    target/riscv: rvzicbo: Fixup CBO extension register calculation
    target/riscv: do not set mtval2 for non guest-page faults
    target/riscv: prioritize pmp errors in raise_mmu_exception()
    target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
    target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
    target/riscv: rvv: Check single width operator for vector fp widen instructions
    target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
    target/riscv/cpu.c: fix Zvkb extension config
    target/riscv: Fix the element agnostic function problem
    target/riscv/kvm: tolerate KVM disable ext errors
    hw/intc/riscv_aplic: APLICs should add child earlier than realize
    iotests: test NBD+TLS+iothread
    qio: Inherit follow_coroutine_ctx across TLS
    target/arm: Disable SVE extensions when SVE is disabled
    hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
    hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
    gitlab: use 'setarch -R' to workaround tsan bug
    gitlab: use $MAKE instead of 'make'
    dockerfiles: add 'MAKE' env variable to remaining containers
    gitlab: Update msys2-64bit runner tags
    target/i386: no single-step exception after MOV or POP SS
    ...

------------------------------------------------------------------
------------------  2024-6-27  -  Jun 27 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - net/mlx5: Fix MTMP register capability offset in MCAM register
    (git-fixes).
  - bonding: fix oops during rmmod (CVE-2024-39296 bsc#1226989).
  - e1000e: change usleep_range to udelay in PHY mdic access
    (CVE-2024-39296 bsc#1226989).
  - dpll: spec: use proper enum for pin capabilities attribute
    (git-fixes).
  - tools: ynl: fix handling of multiple mcast groups (git-fixes).
  - tools: ynl: don't leak mcast_groups on init error (git-fixes).
  - tools: ynl: make sure we always pass yarg to mnl_cb_run
    (git-fixes).
  - commit 164182f
  - iommu/vt-d: Fix WARN_ON in iommu probe path (git-fixes).
  - iommu/vt-d: Use device rbtree in iopf reporting path
    (bsc#1224751 CVE-2024-35843).
  - iommu/vt-d: Use rbtree to track iommu probed devices
    (git-fixes).
  - commit 5f366a7
  - nilfs2: fix potential kernel bug due to lack of writeback flag
    waiting (bsc#1227066 CVE-2024-37078).
  - commit bd6df7f
  - kABI workaround for FPGA changes (CVE-2024-35247 bsc#1226948
    CVE-2024-36479 bsc#1226949 CVE-2024-37021 bsc#1226950).
  - commit 4b32e86
  - fpga: region: add owner module and take its refcount
    (CVE-2024-35247 bsc#1226948).
  - Refresh patches.suse/fpga-add-kABI-padding.patch.
  - commit 670051c
  - fpga: manager: add owner module and take its refcount
    (CVE-2024-37021 bsc#1226950).
  - Refresh patches.suse/fpga-add-kABI-padding.patch.
  - commit 34a2533
  - fpga: bridge: add owner module and take its refcount
    (CVE-2024-36479 bsc#1226949).
  - commit 545627b
  - Fix build failure on powerpc
    Refresh
    patches.suse/powerpc-uaccess-Use-YZ-asm-constraint-for-ld.patch.
  - commit 4cafc95
  - kabi: Use __iowriteXX_copy_inlined for in-kernel modules (bsc#1226502)
  - commit 54c3656
  - net: hns3: Remove io_stop_wc() calls after __iowrite64_copy() (bsc#1226502)
  - commit 5ea0ed2
  - arm64/io: Provide a WC friendly __iowriteXX_copy() (bsc#1226502)
  - commit a39a193
  - s390: Stop using weak symbols for __iowrite64_copy() (bsc#1226502)
  - commit 4a798a5
  - s390: Implement __iowrite32_copy() (bsc#1226502)
  - commit 80e689b
  - x86: Stop using weak symbols for __iowrite32_copy() (bsc#1226502)
  - commit 894aede
  - net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete
    status rules (CVE-2024-36281 bsc#1226799).
  - commit a7197fd

++++ kernel-default:

  - net/mlx5: Fix MTMP register capability offset in MCAM register
    (git-fixes).
  - bonding: fix oops during rmmod (CVE-2024-39296 bsc#1226989).
  - e1000e: change usleep_range to udelay in PHY mdic access
    (CVE-2024-39296 bsc#1226989).
  - dpll: spec: use proper enum for pin capabilities attribute
    (git-fixes).
  - tools: ynl: fix handling of multiple mcast groups (git-fixes).
  - tools: ynl: don't leak mcast_groups on init error (git-fixes).
  - tools: ynl: make sure we always pass yarg to mnl_cb_run
    (git-fixes).
  - commit 164182f
  - iommu/vt-d: Fix WARN_ON in iommu probe path (git-fixes).
  - iommu/vt-d: Use device rbtree in iopf reporting path
    (bsc#1224751 CVE-2024-35843).
  - iommu/vt-d: Use rbtree to track iommu probed devices
    (git-fixes).
  - commit 5f366a7
  - nilfs2: fix potential kernel bug due to lack of writeback flag
    waiting (bsc#1227066 CVE-2024-37078).
  - commit bd6df7f
  - kABI workaround for FPGA changes (CVE-2024-35247 bsc#1226948
    CVE-2024-36479 bsc#1226949 CVE-2024-37021 bsc#1226950).
  - commit 4b32e86
  - fpga: region: add owner module and take its refcount
    (CVE-2024-35247 bsc#1226948).
  - Refresh patches.suse/fpga-add-kABI-padding.patch.
  - commit 670051c
  - fpga: manager: add owner module and take its refcount
    (CVE-2024-37021 bsc#1226950).
  - Refresh patches.suse/fpga-add-kABI-padding.patch.
  - commit 34a2533
  - fpga: bridge: add owner module and take its refcount
    (CVE-2024-36479 bsc#1226949).
  - commit 545627b
  - Fix build failure on powerpc
    Refresh
    patches.suse/powerpc-uaccess-Use-YZ-asm-constraint-for-ld.patch.
  - commit 4cafc95
  - kabi: Use __iowriteXX_copy_inlined for in-kernel modules (bsc#1226502)
  - commit 54c3656
  - net: hns3: Remove io_stop_wc() calls after __iowrite64_copy() (bsc#1226502)
  - commit 5ea0ed2
  - arm64/io: Provide a WC friendly __iowriteXX_copy() (bsc#1226502)
  - commit a39a193
  - s390: Stop using weak symbols for __iowrite64_copy() (bsc#1226502)
  - commit 4a798a5
  - s390: Implement __iowrite32_copy() (bsc#1226502)
  - commit 80e689b
  - x86: Stop using weak symbols for __iowrite32_copy() (bsc#1226502)
  - commit 894aede
  - net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete
    status rules (CVE-2024-36281 bsc#1226799).
  - commit a7197fd

++++ kernel-default:

  - net/mlx5: Fix MTMP register capability offset in MCAM register
    (git-fixes).
  - bonding: fix oops during rmmod (CVE-2024-39296 bsc#1226989).
  - e1000e: change usleep_range to udelay in PHY mdic access
    (CVE-2024-39296 bsc#1226989).
  - dpll: spec: use proper enum for pin capabilities attribute
    (git-fixes).
  - tools: ynl: fix handling of multiple mcast groups (git-fixes).
  - tools: ynl: don't leak mcast_groups on init error (git-fixes).
  - tools: ynl: make sure we always pass yarg to mnl_cb_run
    (git-fixes).
  - commit 164182f
  - iommu/vt-d: Fix WARN_ON in iommu probe path (git-fixes).
  - iommu/vt-d: Use device rbtree in iopf reporting path
    (bsc#1224751 CVE-2024-35843).
  - iommu/vt-d: Use rbtree to track iommu probed devices
    (git-fixes).
  - commit 5f366a7
  - nilfs2: fix potential kernel bug due to lack of writeback flag
    waiting (bsc#1227066 CVE-2024-37078).
  - commit bd6df7f
  - kABI workaround for FPGA changes (CVE-2024-35247 bsc#1226948
    CVE-2024-36479 bsc#1226949 CVE-2024-37021 bsc#1226950).
  - commit 4b32e86
  - fpga: region: add owner module and take its refcount
    (CVE-2024-35247 bsc#1226948).
  - Refresh patches.suse/fpga-add-kABI-padding.patch.
  - commit 670051c
  - fpga: manager: add owner module and take its refcount
    (CVE-2024-37021 bsc#1226950).
  - Refresh patches.suse/fpga-add-kABI-padding.patch.
  - commit 34a2533
  - fpga: bridge: add owner module and take its refcount
    (CVE-2024-36479 bsc#1226949).
  - commit 545627b
  - Fix build failure on powerpc
    Refresh
    patches.suse/powerpc-uaccess-Use-YZ-asm-constraint-for-ld.patch.
  - commit 4cafc95
  - kabi: Use __iowriteXX_copy_inlined for in-kernel modules (bsc#1226502)
  - commit 54c3656
  - net: hns3: Remove io_stop_wc() calls after __iowrite64_copy() (bsc#1226502)
  - commit 5ea0ed2
  - arm64/io: Provide a WC friendly __iowriteXX_copy() (bsc#1226502)
  - commit a39a193
  - s390: Stop using weak symbols for __iowrite64_copy() (bsc#1226502)
  - commit 4a798a5
  - s390: Implement __iowrite32_copy() (bsc#1226502)
  - commit 80e689b
  - x86: Stop using weak symbols for __iowrite32_copy() (bsc#1226502)
  - commit 894aede
  - net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete
    status rules (CVE-2024-36281 bsc#1226799).
  - commit a7197fd

++++ libndp:

  - Add libndp-CVE-2024-5564.patch: add a check on the route
    information option length field (bsc#1225771 CVE-2024-5564).

------------------------------------------------------------------
------------------  2024-6-26  -  Jun 26 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add rd.kiwi.oem.force_resize boot option
    Forces the disk resize process on an OEM disk image.
    If set, no sanity check for unpartitioned/free space
    is performed and also an eventually configured
    <oem-resize-once> configuration from the image description
    will not be taken into account. This Fixes bsc#1224389

++++ python-kiwi:

  - Add rd.kiwi.oem.force_resize boot option
    Forces the disk resize process on an OEM disk image.
    If set, no sanity check for unpartitioned/free space
    is performed and also an eventually configured
    <oem-resize-once> configuration from the image description
    will not be taken into account. This Fixes bsc#1224389

++++ python-kiwi:

  - Add rd.kiwi.oem.force_resize boot option
    Forces the disk resize process on an OEM disk image.
    If set, no sanity check for unpartitioned/free space
    is performed and also an eventually configured
    <oem-resize-once> configuration from the image description
    will not be taken into account. This Fixes bsc#1224389

++++ kernel-default:

  - ceph: switch to use cap_delay_lock for the unlink delay list
    (bsc#1226022).
  - ceph: break the check delayed cap loop every 5s (bsc#1226022).
  - ceph: add ceph_cap_unlink_work to fire check_caps() immediately
    (bsc#1226022).
  - ceph: always queue a writeback when revoking the Fb caps
    (bsc#1226022).
  - ceph: always check dir caps asynchronously (bsc#1226022).
  - commit 7eb372a
  - arm64: mm: Don't remap pgtables for allocate vs populate
    (jsc#PED-8688).
  - arm64: mm: Batch dsb and isb when populating pgtables
    (jsc#PED-8688).
  - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block
    (jsc#PED-8688).
  - commit fdec960
  - epoll: be better about file lifetimes (bsc#1226610
    CVE-2024-38580).
  - commit 4ff3c13
  - null_blk: Fix return value of nullb_device_power_store()
    (bsc#1226841 CVE-2024-36478).
  - commit f213a2a
  - f2fs: multidev: fix to recognize valid zero block address (bsc#1226879, CVE-2024-38636).
  - commit ec1ded3
  - s390/cpacf: Make use of invalid opcode produce a link error
    (git-fixes bsc#1227072).
  - commit 24c76d1
  - s390/ap: Fix crash in AP internal function modify_bitmap()
    (CVE-2024-38661 bsc#1226996 git-fixes).
  - commit 456a41d
  - selftests/bpf: Add sockopt case to verify prog_type (bsc#1226789
    CVE-2024-38564).
  - selftests/bpf: Extend sockopt tests to use BPF_LINK_CREATE
    (bsc#1226789 CVE-2024-38564).
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in
    BPF_LINK_CREATE (bsc#1226789 CVE-2024-38564).
  - commit 2f12314
  - bpf: Fix verifier assumptions about socket->sk (bsc#1226790
    CVE-2024-38566).
  - commit dc586b3

++++ kernel-default:

  - ceph: switch to use cap_delay_lock for the unlink delay list
    (bsc#1226022).
  - ceph: break the check delayed cap loop every 5s (bsc#1226022).
  - ceph: add ceph_cap_unlink_work to fire check_caps() immediately
    (bsc#1226022).
  - ceph: always queue a writeback when revoking the Fb caps
    (bsc#1226022).
  - ceph: always check dir caps asynchronously (bsc#1226022).
  - commit 7eb372a
  - arm64: mm: Don't remap pgtables for allocate vs populate
    (jsc#PED-8688).
  - arm64: mm: Batch dsb and isb when populating pgtables
    (jsc#PED-8688).
  - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block
    (jsc#PED-8688).
  - commit fdec960
  - epoll: be better about file lifetimes (bsc#1226610
    CVE-2024-38580).
  - commit 4ff3c13
  - null_blk: Fix return value of nullb_device_power_store()
    (bsc#1226841 CVE-2024-36478).
  - commit f213a2a
  - f2fs: multidev: fix to recognize valid zero block address (bsc#1226879, CVE-2024-38636).
  - commit ec1ded3
  - s390/cpacf: Make use of invalid opcode produce a link error
    (git-fixes bsc#1227072).
  - commit 24c76d1
  - s390/ap: Fix crash in AP internal function modify_bitmap()
    (CVE-2024-38661 bsc#1226996 git-fixes).
  - commit 456a41d
  - selftests/bpf: Add sockopt case to verify prog_type (bsc#1226789
    CVE-2024-38564).
  - selftests/bpf: Extend sockopt tests to use BPF_LINK_CREATE
    (bsc#1226789 CVE-2024-38564).
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in
    BPF_LINK_CREATE (bsc#1226789 CVE-2024-38564).
  - commit 2f12314
  - bpf: Fix verifier assumptions about socket->sk (bsc#1226790
    CVE-2024-38566).
  - commit dc586b3

++++ kernel-default:

  - ceph: switch to use cap_delay_lock for the unlink delay list
    (bsc#1226022).
  - ceph: break the check delayed cap loop every 5s (bsc#1226022).
  - ceph: add ceph_cap_unlink_work to fire check_caps() immediately
    (bsc#1226022).
  - ceph: always queue a writeback when revoking the Fb caps
    (bsc#1226022).
  - ceph: always check dir caps asynchronously (bsc#1226022).
  - commit 7eb372a
  - arm64: mm: Don't remap pgtables for allocate vs populate
    (jsc#PED-8688).
  - arm64: mm: Batch dsb and isb when populating pgtables
    (jsc#PED-8688).
  - arm64: mm: Don't remap pgtables per-cont(pte|pmd) block
    (jsc#PED-8688).
  - commit fdec960
  - epoll: be better about file lifetimes (bsc#1226610
    CVE-2024-38580).
  - commit 4ff3c13
  - null_blk: Fix return value of nullb_device_power_store()
    (bsc#1226841 CVE-2024-36478).
  - commit f213a2a
  - f2fs: multidev: fix to recognize valid zero block address (bsc#1226879, CVE-2024-38636).
  - commit ec1ded3
  - s390/cpacf: Make use of invalid opcode produce a link error
    (git-fixes bsc#1227072).
  - commit 24c76d1
  - s390/ap: Fix crash in AP internal function modify_bitmap()
    (CVE-2024-38661 bsc#1226996 git-fixes).
  - commit 456a41d
  - selftests/bpf: Add sockopt case to verify prog_type (bsc#1226789
    CVE-2024-38564).
  - selftests/bpf: Extend sockopt tests to use BPF_LINK_CREATE
    (bsc#1226789 CVE-2024-38564).
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in
    BPF_LINK_CREATE (bsc#1226789 CVE-2024-38564).
  - commit 2f12314
  - bpf: Fix verifier assumptions about socket->sk (bsc#1226790
    CVE-2024-38566).
  - commit dc586b3

++++ kernel-firmware:

  - Update to version 20240622 (git commit 7d931f8afa51):
    * linux-firmware: mediatek: Update MT8173 VPU firmware to v1.2.0
    * qcom: Add AIC100 firmware files

++++ kernel-firmware:

  - Update to version 20240622 (git commit 7d931f8afa51):
    * linux-firmware: mediatek: Update MT8173 VPU firmware to v1.2.0
    * qcom: Add AIC100 firmware files

++++ kernel-firmware:

  - Update to version 20240622 (git commit 7d931f8afa51):
    * linux-firmware: mediatek: Update MT8173 VPU firmware to v1.2.0
    * qcom: Add AIC100 firmware files

++++ libvirt:

  - qemu: Fix migration with custom XML
    bsc#1226492

++++ libvirt:

  - qemu: Fix migration with custom XML
    bsc#1226492

++++ libxml2:

  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch

++++ libxml2:

  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch

++++ libxml2:

  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch
  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch

++++ libxml2:

  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch

++++ libxml2:

  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch

++++ libxml2:

  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch

++++ libxml2-python:

  - Security fix (CVE-2024-34459, bsc#1224282) buffer over-read in
    xmlHTMLPrintFileContext in xmllint.c
    * Added libxml2-CVE-2024-34459.patch

++++ zypper:

  - Let_readline_abort_on_Ctrl-C (bsc#1226493)
  - packages: add '--system' to show @System packages (bsc#222971)
  - version 1.14.74

++++ zypper:

  - Let_readline_abort_on_Ctrl-C (bsc#1226493)
  - packages: add '--system' to show @System packages (bsc#222971)
  - version 1.14.74

++++ zypper:

  - Let_readline_abort_on_Ctrl-C (bsc#1226493)
  - packages: add '--system' to show @System packages (bsc#222971)
  - version 1.14.74

------------------------------------------------------------------
------------------  2024-6-25  -  Jun 25 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed leap integration tests
    For whatever reason procps is not longer pulled in by the
    core dependencies. Thus we have to explicitly request it

++++ python-kiwi:

  - Fixed leap integration tests
    For whatever reason procps is not longer pulled in by the
    core dependencies. Thus we have to explicitly request it

++++ python-kiwi:

  - Fixed leap integration tests
    For whatever reason procps is not longer pulled in by the
    core dependencies. Thus we have to explicitly request it

++++ kernel-default:

  - scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758
    CVE-2024-38559).
  - scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786
    CVE-2024-38560).
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources
    after upload (bsc#1224767 CVE-2024-36919).
  - commit 3cabc93
  - nvme: do not retry authentication failures (bsc#1186716).
  - nvme-fabrics: short-circuit reconnect retries (bsc#1186716).
  - nvme: return kernel error codes for admin queue connect
    (bsc#1186716).
  - nvmet: return DHCHAP status codes from nvmet_setup_auth()
    (bsc#1186716).
  - nvmet: lock config semaphore when accessing DH-HMAC-CHAP key
    (bsc#1186716).
  - commit ac2b954
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
    (CVE-2024-36978 bsc#1226514).
  - commit 3b6fd26
  - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
    (git-fixes).
  - commit 556ea4a
  - null_blk: fix null-ptr-dereference while configuring 'power'
    and 'submit_queues' (bsc#1226841 CVE-2024-36478).
  - commit d0b4b2a
  - block: fix overflow in blk_ioctl_discard() (bsc#1225770
    CVE-2024-36917).
  - commit bbdd816
  - mm: Avoid overflows in dirty throttling logic (bsc#1222364
    CVE-2024-26720).
  - commit 77e301c
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
    (CVE-2024-36974 bsc#1226519).
  - commit f911add
  - PCI: Clear Secondary Status errors after enumeration (bsc#1226928)
  - commit 606f4e7
  - nvmet-passthru: propagate status from id override functions
    (git-fixes).
  - nvme: fix nvme_pr_* status code parsing (git-fixes).
  - nvmet: fix nvme status code when namespace is disabled
    (git-fixes).
  - nvmet-tcp: fix possible memory leak when tearing down a
    controller (git-fixes).
  - nvmet-auth: replace pr_debug() with pr_err() to report an error
    (git-fixes).
  - nvmet-auth: return the error code to the nvmet_auth_host_hash()
    callers (git-fixes).
  - nvme: find numa distance only if controller has valid numa id
    (git-fixes).
  - commit 3709ef4
  - nvme: cancel pending I/O if nvme controller is in terminal state
    (bsc#1226503).
    Refresh:
  - patches.suse/nvme-multipath-fix-io-accounting-on-failover.patch
  - commit 7dbf1d4
  - stm class: Fix a double free in stm_register_device()
    (CVE-2024-38627 bsc#1226857).
  - commit ef5c589
  - Input: ili210x - fix ili251x_read_touch_data() return value
    (git-fixes).
  - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    (git-fixes).
  - pinctrl: rockchip: use dedicated pinctrl type for RK3328
    (git-fixes).
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    (git-fixes).
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    (git-fixes).
  - pinctrl: fix deadlock in create_pinctrl() when handling
  - EPROBE_DEFER (git-fixes).
  - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
    (git-fixes).
  - commit a1b46e3
  - drivers/perf: hisi: hns3: Actually use
    devm_add_action_or_reset() (CVE-2024-38603 bsc#1226842).
  - commit 4db6ba6
  - NFSv4.x: by default serialize open/close operations (bsc#1223863 bsc#1227362).
  - commit 6ed2498

++++ kernel-default:

  - scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758
    CVE-2024-38559).
  - scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786
    CVE-2024-38560).
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources
    after upload (bsc#1224767 CVE-2024-36919).
  - commit 3cabc93
  - nvme: do not retry authentication failures (bsc#1186716).
  - nvme-fabrics: short-circuit reconnect retries (bsc#1186716).
  - nvme: return kernel error codes for admin queue connect
    (bsc#1186716).
  - nvmet: return DHCHAP status codes from nvmet_setup_auth()
    (bsc#1186716).
  - nvmet: lock config semaphore when accessing DH-HMAC-CHAP key
    (bsc#1186716).
  - commit ac2b954
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
    (CVE-2024-36978 bsc#1226514).
  - commit 3b6fd26
  - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
    (git-fixes).
  - commit 556ea4a
  - null_blk: fix null-ptr-dereference while configuring 'power'
    and 'submit_queues' (bsc#1226841 CVE-2024-36478).
  - commit d0b4b2a
  - block: fix overflow in blk_ioctl_discard() (bsc#1225770
    CVE-2024-36917).
  - commit bbdd816
  - mm: Avoid overflows in dirty throttling logic (bsc#1222364
    CVE-2024-26720).
  - commit 77e301c
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
    (CVE-2024-36974 bsc#1226519).
  - commit f911add
  - PCI: Clear Secondary Status errors after enumeration (bsc#1226928)
  - commit 606f4e7
  - nvmet-passthru: propagate status from id override functions
    (git-fixes).
  - nvme: fix nvme_pr_* status code parsing (git-fixes).
  - nvmet: fix nvme status code when namespace is disabled
    (git-fixes).
  - nvmet-tcp: fix possible memory leak when tearing down a
    controller (git-fixes).
  - nvmet-auth: replace pr_debug() with pr_err() to report an error
    (git-fixes).
  - nvmet-auth: return the error code to the nvmet_auth_host_hash()
    callers (git-fixes).
  - nvme: find numa distance only if controller has valid numa id
    (git-fixes).
  - commit 3709ef4
  - nvme: cancel pending I/O if nvme controller is in terminal state
    (bsc#1226503).
    Refresh:
  - patches.suse/nvme-multipath-fix-io-accounting-on-failover.patch
  - commit 7dbf1d4
  - stm class: Fix a double free in stm_register_device()
    (CVE-2024-38627 bsc#1226857).
  - commit ef5c589
  - Input: ili210x - fix ili251x_read_touch_data() return value
    (git-fixes).
  - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    (git-fixes).
  - pinctrl: rockchip: use dedicated pinctrl type for RK3328
    (git-fixes).
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    (git-fixes).
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    (git-fixes).
  - pinctrl: fix deadlock in create_pinctrl() when handling
  - EPROBE_DEFER (git-fixes).
  - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
    (git-fixes).
  - commit a1b46e3
  - drivers/perf: hisi: hns3: Actually use
    devm_add_action_or_reset() (CVE-2024-38603 bsc#1226842).
  - commit 4db6ba6
  - NFSv4.x: by default serialize open/close operations (bsc#1223863 bsc#1227362).
  - commit 6ed2498

++++ kernel-default:

  - scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226758
    CVE-2024-38559).
  - scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786
    CVE-2024-38560).
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources
    after upload (bsc#1224767 CVE-2024-36919).
  - commit 3cabc93
  - nvme: do not retry authentication failures (bsc#1186716).
  - nvme-fabrics: short-circuit reconnect retries (bsc#1186716).
  - nvme: return kernel error codes for admin queue connect
    (bsc#1186716).
  - nvmet: return DHCHAP status codes from nvmet_setup_auth()
    (bsc#1186716).
  - nvmet: lock config semaphore when accessing DH-HMAC-CHAP key
    (bsc#1186716).
  - commit ac2b954
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
    (CVE-2024-36978 bsc#1226514).
  - commit 3b6fd26
  - nvmet: prevent sprintf() overflow in nvmet_subsys_nsid_exists()
    (git-fixes).
  - commit 556ea4a
  - null_blk: fix null-ptr-dereference while configuring 'power'
    and 'submit_queues' (bsc#1226841 CVE-2024-36478).
  - commit d0b4b2a
  - block: fix overflow in blk_ioctl_discard() (bsc#1225770
    CVE-2024-36917).
  - commit bbdd816
  - mm: Avoid overflows in dirty throttling logic (bsc#1222364
    CVE-2024-26720).
  - commit 77e301c
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP
    (CVE-2024-36974 bsc#1226519).
  - commit f911add
  - PCI: Clear Secondary Status errors after enumeration (bsc#1226928)
  - commit 606f4e7
  - nvmet-passthru: propagate status from id override functions
    (git-fixes).
  - nvme: fix nvme_pr_* status code parsing (git-fixes).
  - nvmet: fix nvme status code when namespace is disabled
    (git-fixes).
  - nvmet-tcp: fix possible memory leak when tearing down a
    controller (git-fixes).
  - nvmet-auth: replace pr_debug() with pr_err() to report an error
    (git-fixes).
  - nvmet-auth: return the error code to the nvmet_auth_host_hash()
    callers (git-fixes).
  - nvme: find numa distance only if controller has valid numa id
    (git-fixes).
  - commit 3709ef4
  - nvme: cancel pending I/O if nvme controller is in terminal state
    (bsc#1226503).
    Refresh:
  - patches.suse/nvme-multipath-fix-io-accounting-on-failover.patch
  - commit 7dbf1d4
  - stm class: Fix a double free in stm_register_device()
    (CVE-2024-38627 bsc#1226857).
  - commit ef5c589
  - Input: ili210x - fix ili251x_read_touch_data() return value
    (git-fixes).
  - pinctrl: rockchip: fix pinmux reset in rockchip_pmx_set
    (git-fixes).
  - pinctrl: rockchip: use dedicated pinctrl type for RK3328
    (git-fixes).
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO3-B pins
    (git-fixes).
  - pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins
    (git-fixes).
  - pinctrl: fix deadlock in create_pinctrl() when handling
  - EPROBE_DEFER (git-fixes).
  - pinctrl: qcom: spmi-gpio: drop broken pm8008 support
    (git-fixes).
  - commit a1b46e3
  - drivers/perf: hisi: hns3: Actually use
    devm_add_action_or_reset() (CVE-2024-38603 bsc#1226842).
  - commit 4db6ba6
  - NFSv4.x: by default serialize open/close operations (bsc#1223863 bsc#1227362).
  - commit 6ed2498

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311-core:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

++++ python311:

  - Add CVE-2024-4032-private-IP-addrs.patch to fix bsc#1226448
    (CVE-2024-4032) rearranging definition of private v global IP
    addresses.

------------------------------------------------------------------
------------------  2024-6-24  -  Jun 24 2024  -------------------
------------------------------------------------------------------

++++ Leap-Micro-release:

  - automatically generated by openSUSE-release-tools/pkglistgen

++++ containerd:

  - Revert noarch for devel subpackage for SLE 15
    Switching to noarch causes issues on SLES maintenance updates, reverting it
    fixes our image builds

++++ containerd:

  - Revert noarch for devel subpackage for SLE 15
    Switching to noarch causes issues on SLES maintenance updates, reverting it
    fixes our image builds

++++ containerd:

  - Revert noarch for devel subpackage for SLE 15
    Switching to noarch causes issues on SLES maintenance updates, reverting it
    fixes our image builds

++++ containerd:

  - Revert noarch for devel subpackage for SLE 15
    Switching to noarch causes issues on SLES maintenance updates, reverting it
    fixes our image builds

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker:

  - Rebase patches:
    * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
    * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
    * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
    * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
    * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - Fix BuildKit's symlink resolution logic to correctly handle non-lexical
    symlinks. Backport of <https://github.com/moby/buildkit/pull/4896> and
    <https://github.com/moby/buildkit/pull/5060>. bsc#1221916
    + 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch
  - Write volume options atomically so sudden system crashes won't result in
    future Docker starts failing due to empty files. Backport of
    <https://github.com/moby/moby/pull/48034>. bsc#1214855
    + 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch

++++ docker-compose:

  - Update to version 2.28.1:
    * Remove `console.Terminal` check and use `IsTerminal` from
    `streams.Out`

++++ docker-compose:

  - Update to version 2.28.1:
    * Remove `console.Terminal` check and use `IsTerminal` from
    `streams.Out`

++++ docker-compose:

  - Update to version 2.28.1:
    * Remove `console.Terminal` check and use `IsTerminal` from
    `streams.Out`

++++ kernel-default:

  - work around gcc bugs with 'asm goto' with outputs (git-fixes).
  - Refresh
    patches.suse/powerpc-uaccess-Fix-build-errors-seen-with-GCC-13-14.patch.
  - Refresh
    patches.suse/powerpc-uaccess-Use-YZ-asm-constraint-for-ld.patch.
  - commit eac0f3f
  - x86/asm: Remove the __iomem annotation of movdir64b()'s dst argument (git-fixes).
  - commit 8a8a749
  - x86/tdx: Preserve shared bit on mprotect() (git-fixes).
  - commit ea4a8f6
  - x86/sev: Fix position dependent variable references in startup code (git-fixes).
  - Refresh
    patches.suse/x86-coco-Require-seeding-RNG-with-RDRAND-on-CoCo-systems.patch.
  - commit 2efccd0
  - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump  kernel (git-fixes).
  - Refresh
    patches.suse/x86-mce-Differentiate-real-hardware-MCs-from-TDX-erratum-o.patch.
  - commit d75f0fd
  - x86/kexec: Fix bug with call depth tracking (git-fixes).
  - commit 926155d
  - x86/nmi: Drop unused declaration of proc_nmi_enabled() (git-fixes).
  - commit 3441c2e
  - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map (git-fixes).
  - commit 820085a
  - x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking (git-fixes).
  - commit 1c4403a
  - blacklist.conf: Blacklist invalid commit (git-fixes)
    We don't support CPU_MITIGATIONS hence to need for this logic
  - commit 6899966
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38553 bsc#1226744).
  - net/mlx5: Discard command completions in internal error
    (CVE-2024-38555 bsc#1226607).
  - net/mlx5: Add a timeout to acquire the command queue semaphore
    (CVE-2024-38556 bsc#1226774).
  - net/mlx5: Reload only IB representors upon lag disable/enable
    (CVE-2024-38557 bsc#1226781).
  - net/mlx5e: Fix netif state handling (CVE-2024-38608
    bsc#1226746).
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38597 bsc#1226749).
  - net: stmmac: move the EST lock to struct stmmac_priv
    (CVE-2024-38594 bsc#1226734).
  - commit d6f20aa
  - i2c: ocores: set IACK bit after core is enabled (git-fixes).
  - commit dc04936

++++ kernel-default:

  - work around gcc bugs with 'asm goto' with outputs (git-fixes).
  - Refresh
    patches.suse/powerpc-uaccess-Fix-build-errors-seen-with-GCC-13-14.patch.
  - Refresh
    patches.suse/powerpc-uaccess-Use-YZ-asm-constraint-for-ld.patch.
  - commit eac0f3f
  - x86/asm: Remove the __iomem annotation of movdir64b()'s dst argument (git-fixes).
  - commit 8a8a749
  - x86/tdx: Preserve shared bit on mprotect() (git-fixes).
  - commit ea4a8f6
  - x86/sev: Fix position dependent variable references in startup code (git-fixes).
  - Refresh
    patches.suse/x86-coco-Require-seeding-RNG-with-RDRAND-on-CoCo-systems.patch.
  - commit 2efccd0
  - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump  kernel (git-fixes).
  - Refresh
    patches.suse/x86-mce-Differentiate-real-hardware-MCs-from-TDX-erratum-o.patch.
  - commit d75f0fd
  - x86/kexec: Fix bug with call depth tracking (git-fixes).
  - commit 926155d
  - x86/nmi: Drop unused declaration of proc_nmi_enabled() (git-fixes).
  - commit 3441c2e
  - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map (git-fixes).
  - commit 820085a
  - x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking (git-fixes).
  - commit 1c4403a
  - blacklist.conf: Blacklist invalid commit (git-fixes)
    We don't support CPU_MITIGATIONS hence to need for this logic
  - commit 6899966
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38553 bsc#1226744).
  - net/mlx5: Discard command completions in internal error
    (CVE-2024-38555 bsc#1226607).
  - net/mlx5: Add a timeout to acquire the command queue semaphore
    (CVE-2024-38556 bsc#1226774).
  - net/mlx5: Reload only IB representors upon lag disable/enable
    (CVE-2024-38557 bsc#1226781).
  - net/mlx5e: Fix netif state handling (CVE-2024-38608
    bsc#1226746).
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38597 bsc#1226749).
  - net: stmmac: move the EST lock to struct stmmac_priv
    (CVE-2024-38594 bsc#1226734).
  - commit d6f20aa
  - i2c: ocores: set IACK bit after core is enabled (git-fixes).
  - commit dc04936

++++ kernel-default:

  - work around gcc bugs with 'asm goto' with outputs (git-fixes).
  - Refresh
    patches.suse/powerpc-uaccess-Fix-build-errors-seen-with-GCC-13-14.patch.
  - Refresh
    patches.suse/powerpc-uaccess-Use-YZ-asm-constraint-for-ld.patch.
  - commit eac0f3f
  - x86/asm: Remove the __iomem annotation of movdir64b()'s dst argument (git-fixes).
  - commit 8a8a749
  - x86/tdx: Preserve shared bit on mprotect() (git-fixes).
  - commit ea4a8f6
  - x86/sev: Fix position dependent variable references in startup code (git-fixes).
  - Refresh
    patches.suse/x86-coco-Require-seeding-RNG-with-RDRAND-on-CoCo-systems.patch.
  - commit 2efccd0
  - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump  kernel (git-fixes).
  - Refresh
    patches.suse/x86-mce-Differentiate-real-hardware-MCs-from-TDX-erratum-o.patch.
  - commit d75f0fd
  - x86/kexec: Fix bug with call depth tracking (git-fixes).
  - commit 926155d
  - x86/nmi: Drop unused declaration of proc_nmi_enabled() (git-fixes).
  - commit 3441c2e
  - x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map (git-fixes).
  - commit 820085a
  - x86/uaccess: Fix missed zeroing of ia32 u64 get_user() range checking (git-fixes).
  - commit 1c4403a
  - blacklist.conf: Blacklist invalid commit (git-fixes)
    We don't support CPU_MITIGATIONS hence to need for this logic
  - commit 6899966
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38553 bsc#1226744).
  - net/mlx5: Discard command completions in internal error
    (CVE-2024-38555 bsc#1226607).
  - net/mlx5: Add a timeout to acquire the command queue semaphore
    (CVE-2024-38556 bsc#1226774).
  - net/mlx5: Reload only IB representors upon lag disable/enable
    (CVE-2024-38557 bsc#1226781).
  - net/mlx5e: Fix netif state handling (CVE-2024-38608
    bsc#1226746).
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38597 bsc#1226749).
  - net: stmmac: move the EST lock to struct stmmac_priv
    (CVE-2024-38594 bsc#1226734).
  - commit d6f20aa
  - i2c: ocores: set IACK bit after core is enabled (git-fixes).
  - commit dc04936

++++ libzypp:

  - Workaround broken libsolv-tools-base requirements (fixes
    openSUSE/zypper#551)
  - Strip ssl_clientkey from repo urls (bsc#1226030)
  - Remove protobuf build dependency.
  - Lazily attach medium during refresh workflows (bsc#1223094)
  - Refactor RepoManager and add Service workflows.
  - version 17.34.2 (34)

++++ libzypp:

  - Workaround broken libsolv-tools-base requirements (fixes
    openSUSE/zypper#551)
  - Strip ssl_clientkey from repo urls (bsc#1226030)
  - Remove protobuf build dependency.
  - Lazily attach medium during refresh workflows (bsc#1223094)
  - Refactor RepoManager and add Service workflows.
  - version 17.34.2 (34)

++++ libzypp:

  - Workaround broken libsolv-tools-base requirements (fixes
    openSUSE/zypper#551)
  - Strip ssl_clientkey from repo urls (bsc#1226030)
  - Remove protobuf build dependency.
  - Lazily attach medium during refresh workflows (bsc#1223094)
  - Refactor RepoManager and add Service workflows.
  - version 17.34.2 (34)

++++ libzypp:

  - Workaround broken libsolv-tools-base requirements (fixes
    openSUSE/zypper#551)
  - Strip ssl_clientkey from repo urls (bsc#1226030)
  - Remove protobuf build dependency.
  - Lazily attach medium during refresh workflows (bsc#1223094)
  - Refactor RepoManager and add Service workflows.
  - version 17.34.2 (34)

++++ libzypp:

  - Workaround broken libsolv-tools-base requirements (fixes
    openSUSE/zypper#551)
  - Strip ssl_clientkey from repo urls (bsc#1226030)
  - Remove protobuf build dependency.
  - Lazily attach medium during refresh workflows (bsc#1223094)
  - Refactor RepoManager and add Service workflows.
  - version 17.34.2 (34)

++++ openSUSE-repos-LeapMicro:

  - Ensure that refresh-services / refs is called after addservice
  - Update to version 20240621.6fd1ef2:
    * Update README.md
    * use osc service mr for update
    * Disable source and debug repos by default for Tumbleweed ports
    * Use cdn.opensuse.org for Tumbleweed ports

------------------------------------------------------------------
------------------  2024-6-23  -  Jun 23 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - regulator: bd71815: fix ramp values (git-fixes).
  - regulator: core: Fix modpost error "regulator_get_regmap"
    undefined (git-fixes).
  - spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to
    CCR_BUSWIDTH_4 (git-fixes).
  - spi: stm32: qspi: Fix dual flash mode sanity test in
    stm32_qspi_setup() (git-fixes).
  - firmware: psci: Fix return value from psci_system_suspend()
    (git-fixes).
  - commit 5c1d1d7

++++ kernel-default:

  - regulator: bd71815: fix ramp values (git-fixes).
  - regulator: core: Fix modpost error "regulator_get_regmap"
    undefined (git-fixes).
  - spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to
    CCR_BUSWIDTH_4 (git-fixes).
  - spi: stm32: qspi: Fix dual flash mode sanity test in
    stm32_qspi_setup() (git-fixes).
  - firmware: psci: Fix return value from psci_system_suspend()
    (git-fixes).
  - commit 5c1d1d7

++++ kernel-default:

  - regulator: bd71815: fix ramp values (git-fixes).
  - regulator: core: Fix modpost error "regulator_get_regmap"
    undefined (git-fixes).
  - spi: stm32: qspi: Clamp stm32_qspi_get_mode() output to
    CCR_BUSWIDTH_4 (git-fixes).
  - spi: stm32: qspi: Fix dual flash mode sanity test in
    stm32_qspi_setup() (git-fixes).
  - firmware: psci: Fix return value from psci_system_suspend()
    (git-fixes).
  - commit 5c1d1d7

------------------------------------------------------------------
------------------  2024-6-22  -  Jun 22 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - RDMA/mlx5: Add check for srq max_sge attribute (git-fixes)
  - commit 5a7a44c
  - RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init (git-fixes)
  - commit a73b3cb
  - RDMA/mlx5: Ensure created mkeys always have a populated rb_key (git-fixes)
  - commit 194920a
  - RDMA/mlx5: Follow rb_key.ats when creating new mkeys (git-fixes)
  - commit 93d4abb
  - RDMA/mlx5: Remove extra unlock on error path (git-fixes)
  - commit 662ecd8
  - RDMA/rxe: Fix responder length checking for UD request packets (git-fixes)
  - commit 77ecb50
  - RDMA/rxe: Fix data copy for IB_SEND_INLINE (git-fixes)
  - commit 9ec1cd9
  - RDMA/bnxt_re: Fix the max msix vectors macro (git-fixes)
  - commit 19f32fe
  - drm/i915/mso: using joiner is not possible with eDP MSO
    (git-fixes).
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
    (stable-fixes).
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your
    kernel is fine." (git-fixes).
  - thermal/drivers/mediatek/lvts_thermal: Return error in case
    of invalid efuse data (git-fixes).
  - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
    (git-fixes).
  - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
    (git-fixes).
  - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
    (git-fixes).
  - dmaengine: ioatdma: Fix leaking on version mismatch (git-fixes).
  - dmaengine: idxd: Fix possible Use-After-Free in
    irq_process_work_list (git-fixes).
  - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
    (stable-fixes).
  - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
    (stable-fixes).
  - xhci: Set correct transferred length for cancelled bulk
    transfers (stable-fixes).
  - drm/exynos/vidi: fix memory leak in .get_modes() (stable-fixes).
  - ACPI: x86: Force StorageD3Enable on more products
    (stable-fixes).
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on
    I/O errors (git-fixes).
  - kheaders: explicitly define file modes for archived headers
    (stable-fixes).
  - intel_th: pci: Add Lunar Lake support (stable-fixes).
  - intel_th: pci: Add Meteor Lake-S support (stable-fixes).
  - intel_th: pci: Add Sapphire Rapids SOC support (stable-fixes).
  - intel_th: pci: Add Granite Rapids SOC support (stable-fixes).
  - intel_th: pci: Add Granite Rapids support (stable-fixes).
  - clkdev: Update clkdev id usage to allow for longer names
    (stable-fixes).
  - nilfs2: return the mapped address from nilfs_get_page()
    (stable-fixes).
  - commit 8bec8e0

++++ kernel-default:

  - RDMA/mlx5: Add check for srq max_sge attribute (git-fixes)
  - commit 5a7a44c
  - RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init (git-fixes)
  - commit a73b3cb
  - RDMA/mlx5: Ensure created mkeys always have a populated rb_key (git-fixes)
  - commit 194920a
  - RDMA/mlx5: Follow rb_key.ats when creating new mkeys (git-fixes)
  - commit 93d4abb
  - RDMA/mlx5: Remove extra unlock on error path (git-fixes)
  - commit 662ecd8
  - RDMA/rxe: Fix responder length checking for UD request packets (git-fixes)
  - commit 77ecb50
  - RDMA/rxe: Fix data copy for IB_SEND_INLINE (git-fixes)
  - commit 9ec1cd9
  - RDMA/bnxt_re: Fix the max msix vectors macro (git-fixes)
  - commit 19f32fe
  - drm/i915/mso: using joiner is not possible with eDP MSO
    (git-fixes).
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
    (stable-fixes).
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your
    kernel is fine." (git-fixes).
  - thermal/drivers/mediatek/lvts_thermal: Return error in case
    of invalid efuse data (git-fixes).
  - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
    (git-fixes).
  - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
    (git-fixes).
  - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
    (git-fixes).
  - dmaengine: ioatdma: Fix leaking on version mismatch (git-fixes).
  - dmaengine: idxd: Fix possible Use-After-Free in
    irq_process_work_list (git-fixes).
  - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
    (stable-fixes).
  - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
    (stable-fixes).
  - xhci: Set correct transferred length for cancelled bulk
    transfers (stable-fixes).
  - drm/exynos/vidi: fix memory leak in .get_modes() (stable-fixes).
  - ACPI: x86: Force StorageD3Enable on more products
    (stable-fixes).
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on
    I/O errors (git-fixes).
  - kheaders: explicitly define file modes for archived headers
    (stable-fixes).
  - intel_th: pci: Add Lunar Lake support (stable-fixes).
  - intel_th: pci: Add Meteor Lake-S support (stable-fixes).
  - intel_th: pci: Add Sapphire Rapids SOC support (stable-fixes).
  - intel_th: pci: Add Granite Rapids SOC support (stable-fixes).
  - intel_th: pci: Add Granite Rapids support (stable-fixes).
  - clkdev: Update clkdev id usage to allow for longer names
    (stable-fixes).
  - nilfs2: return the mapped address from nilfs_get_page()
    (stable-fixes).
  - commit 8bec8e0

++++ kernel-default:

  - RDMA/mlx5: Add check for srq max_sge attribute (git-fixes)
  - commit 5a7a44c
  - RDMA/mlx5: Fix unwind flow as part of mlx5_ib_stage_init_init (git-fixes)
  - commit a73b3cb
  - RDMA/mlx5: Ensure created mkeys always have a populated rb_key (git-fixes)
  - commit 194920a
  - RDMA/mlx5: Follow rb_key.ats when creating new mkeys (git-fixes)
  - commit 93d4abb
  - RDMA/mlx5: Remove extra unlock on error path (git-fixes)
  - commit 662ecd8
  - RDMA/rxe: Fix responder length checking for UD request packets (git-fixes)
  - commit 77ecb50
  - RDMA/rxe: Fix data copy for IB_SEND_INLINE (git-fixes)
  - commit 9ec1cd9
  - RDMA/bnxt_re: Fix the max msix vectors macro (git-fixes)
  - commit 19f32fe
  - drm/i915/mso: using joiner is not possible with eDP MSO
    (git-fixes).
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14AHP9
    (stable-fixes).
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your
    kernel is fine." (git-fixes).
  - thermal/drivers/mediatek/lvts_thermal: Return error in case
    of invalid efuse data (git-fixes).
  - dmaengine: ioatdma: Fix missing kmem_cache_destroy()
    (git-fixes).
  - dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe()
    (git-fixes).
  - dmaengine: ioatdma: Fix error path in ioat3_dma_probe()
    (git-fixes).
  - dmaengine: ioatdma: Fix leaking on version mismatch (git-fixes).
  - dmaengine: idxd: Fix possible Use-After-Free in
    irq_process_work_list (git-fixes).
  - xhci: Apply broken streams quirk to Etron EJ188 xHCI host
    (stable-fixes).
  - xhci: Apply reset resume quirk to Etron EJ188 xHCI host
    (stable-fixes).
  - xhci: Set correct transferred length for cancelled bulk
    transfers (stable-fixes).
  - drm/exynos/vidi: fix memory leak in .get_modes() (stable-fixes).
  - ACPI: x86: Force StorageD3Enable on more products
    (stable-fixes).
  - nilfs2: fix nilfs_empty_dir() misjudgment and long loop on
    I/O errors (git-fixes).
  - kheaders: explicitly define file modes for archived headers
    (stable-fixes).
  - intel_th: pci: Add Lunar Lake support (stable-fixes).
  - intel_th: pci: Add Meteor Lake-S support (stable-fixes).
  - intel_th: pci: Add Sapphire Rapids SOC support (stable-fixes).
  - intel_th: pci: Add Granite Rapids SOC support (stable-fixes).
  - intel_th: pci: Add Granite Rapids support (stable-fixes).
  - clkdev: Update clkdev id usage to allow for longer names
    (stable-fixes).
  - nilfs2: return the mapped address from nilfs_get_page()
    (stable-fixes).
  - commit 8bec8e0

------------------------------------------------------------------
------------------  2024-6-21  -  Jun 21 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240620.57ee9e1:
    * Remove legacy-actions support [jsc#PED-264]

++++ docker-compose:

  - Update to version 2.28.0:
    * go.mod: github.com/compose-spec/compose-go v2.1.3
    * go.mod: docker/docker and docker/cli v27.0.1-rc.1
  - Update to version 2.27.3:
    * build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1
    * build(deps): bump github.com/docker/buildx from 0.15.0 to
    0.15.1
  - Update to version 2.27.2:
    * using as flag of the up command, watch was blocking process
    shutdown This happened when sunsetting the application from
    docker compose down command
    * Add open watch docs in up menu
    * bump buildkit to v0.14.0 and buildx to v0.15.0
    * stop watch process when associated up process is stopped
    * build(deps): bump github.com/docker/docker
    * build(deps): bump github.com/containerd/containerd from 1.7.17
    to 1.7.18
    * build(deps): bump golang.org/x/sys from 0.20.0 to 0.21.0
    * build(deps): bump github.com/hashicorp/go-version from 1.6.0 to
    1.7.0
    * build: replace uses of archive.CanonicalTarNameForPath
    * update gh actions versions, update engine matrix, bump golang
    to 1.21.11
    * enforce keyboard.Close is always executed to restore terminal
    * config --environment
    * Readd event
    * remove unreachable code
    * Fix dot env file to define COMPOSE_* variables
    * return an error when --detach and --watch are used together in
    up command
    * Correct 'cancellation' typo in comment
    * Fix: change append to use slice index in ps.go
    * COMPOSE_PROFILES can be set by .env file
    * prevent concurrent map write relying on project immutability

++++ docker-compose:

  - Update to version 2.28.0:
    * go.mod: github.com/compose-spec/compose-go v2.1.3
    * go.mod: docker/docker and docker/cli v27.0.1-rc.1
  - Update to version 2.27.3:
    * build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1
    * build(deps): bump github.com/docker/buildx from 0.15.0 to
    0.15.1
  - Update to version 2.27.2:
    * using as flag of the up command, watch was blocking process
    shutdown This happened when sunsetting the application from
    docker compose down command
    * Add open watch docs in up menu
    * bump buildkit to v0.14.0 and buildx to v0.15.0
    * stop watch process when associated up process is stopped
    * build(deps): bump github.com/docker/docker
    * build(deps): bump github.com/containerd/containerd from 1.7.17
    to 1.7.18
    * build(deps): bump golang.org/x/sys from 0.20.0 to 0.21.0
    * build(deps): bump github.com/hashicorp/go-version from 1.6.0 to
    1.7.0
    * build: replace uses of archive.CanonicalTarNameForPath
    * update gh actions versions, update engine matrix, bump golang
    to 1.21.11
    * enforce keyboard.Close is always executed to restore terminal
    * config --environment
    * Readd event
    * remove unreachable code
    * Fix dot env file to define COMPOSE_* variables
    * return an error when --detach and --watch are used together in
    up command
    * Correct 'cancellation' typo in comment
    * Fix: change append to use slice index in ps.go
    * COMPOSE_PROFILES can be set by .env file
    * prevent concurrent map write relying on project immutability

++++ docker-compose:

  - Update to version 2.28.0:
    * go.mod: github.com/compose-spec/compose-go v2.1.3
    * go.mod: docker/docker and docker/cli v27.0.1-rc.1
  - Update to version 2.27.3:
    * build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1
    * build(deps): bump github.com/docker/buildx from 0.15.0 to
    0.15.1
  - Update to version 2.27.2:
    * using as flag of the up command, watch was blocking process
    shutdown This happened when sunsetting the application from
    docker compose down command
    * Add open watch docs in up menu
    * bump buildkit to v0.14.0 and buildx to v0.15.0
    * stop watch process when associated up process is stopped
    * build(deps): bump github.com/docker/docker
    * build(deps): bump github.com/containerd/containerd from 1.7.17
    to 1.7.18
    * build(deps): bump golang.org/x/sys from 0.20.0 to 0.21.0
    * build(deps): bump github.com/hashicorp/go-version from 1.6.0 to
    1.7.0
    * build: replace uses of archive.CanonicalTarNameForPath
    * update gh actions versions, update engine matrix, bump golang
    to 1.21.11
    * enforce keyboard.Close is always executed to restore terminal
    * config --environment
    * Readd event
    * remove unreachable code
    * Fix dot env file to define COMPOSE_* variables
    * return an error when --detach and --watch are used together in
    up command
    * Correct 'cancellation' typo in comment
    * Fix: change append to use slice index in ps.go
    * COMPOSE_PROFILES can be set by .env file
    * prevent concurrent map write relying on project immutability

++++ kernel-default:

  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid
    event group (CVE-2024-38569 bsc#1226772).
  - commit 6715b52
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid
    event group (CVE-2024-38568 bsc#1226771).
  - commit 33d69e0
  - sched/core: Fix incorrect initialization of the 'burst'
    parameter in cpu_max_write() (bsc#1226791).
  - commit 6b67975
  - blacklist.conf: Add 6fb454606153 sched: Simplify tg_set_cfs_bandwidth()
  - commit 4e56705
  - virtio_net: checksum offloading handling fix (git-fixes).
  - commit d283709
  - virtio_net: avoid data-races on dev->stats fields (git-fixes).
  - commit 50373fb
  - vfio/fsl-mc: Block calling interrupt handler without trigger
    (bsc#1222810 CVE-2024-26814).
  - commit b1aee55
  - vfio/platform: Create persistent IRQ handlers (bsc#1222809
    CVE-2024-26813).
  - commit 28ae90e
  - ALSA: hda/realtek: Add more codec ID to no shutup pins list
    (stable-fixes).
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ARP8
    (stable-fixes).
  - ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 4
    (stable-fixes).
  - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
    (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 4
    (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo Thinkbook 16P Gen 5
    (stable-fixes).
  - ALSA: hda/realtek: Limit mic boost on N14AP7 (stable-fixes).
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook
    445/465 G11 (stable-fixes).
  - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
    (stable-fixes).
  - commit 3c2cbdc
  - net: usb: rtl8150 fix unintiatilzed variables in
    rtl8150_get_link_ksettings (git-fixes).
  - net: usb: ax88179_178a: improve reset check (git-fixes).
  - net: phy: mxl-gpy: Remove interrupt mask clearing from
    config_init (git-fixes).
  - net: lan743x: Support WOL at both the PHY and MAC appropriately
    (git-fixes).
  - net: lan743x: disable WOL upon resume to restore full data
    path operation (git-fixes).
  - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
    (git-fixes).
  - ALSA: hda: tas2781: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA: hda: cs35l41: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA: hda: cs35l56: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
    (git-fixes).
  - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
    (git-fixes).
  - ALSA: seq: ump: Fix missing System Reset message handling
    (git-fixes).
  - ALSA: hda: cs35l41: Possible null pointer dereference in
    cs35l41_hda_unbind() (git-fixes).
  - commit 045593b
  - tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
  - commit ff006da

++++ kernel-default:

  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid
    event group (CVE-2024-38569 bsc#1226772).
  - commit 6715b52
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid
    event group (CVE-2024-38568 bsc#1226771).
  - commit 33d69e0
  - sched/core: Fix incorrect initialization of the 'burst'
    parameter in cpu_max_write() (bsc#1226791).
  - commit 6b67975
  - blacklist.conf: Add 6fb454606153 sched: Simplify tg_set_cfs_bandwidth()
  - commit 4e56705
  - virtio_net: checksum offloading handling fix (git-fixes).
  - commit d283709
  - virtio_net: avoid data-races on dev->stats fields (git-fixes).
  - commit 50373fb
  - vfio/fsl-mc: Block calling interrupt handler without trigger
    (bsc#1222810 CVE-2024-26814).
  - commit b1aee55
  - vfio/platform: Create persistent IRQ handlers (bsc#1222809
    CVE-2024-26813).
  - commit 28ae90e
  - ALSA: hda/realtek: Add more codec ID to no shutup pins list
    (stable-fixes).
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ARP8
    (stable-fixes).
  - ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 4
    (stable-fixes).
  - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
    (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 4
    (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo Thinkbook 16P Gen 5
    (stable-fixes).
  - ALSA: hda/realtek: Limit mic boost on N14AP7 (stable-fixes).
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook
    445/465 G11 (stable-fixes).
  - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
    (stable-fixes).
  - commit 3c2cbdc
  - net: usb: rtl8150 fix unintiatilzed variables in
    rtl8150_get_link_ksettings (git-fixes).
  - net: usb: ax88179_178a: improve reset check (git-fixes).
  - net: phy: mxl-gpy: Remove interrupt mask clearing from
    config_init (git-fixes).
  - net: lan743x: Support WOL at both the PHY and MAC appropriately
    (git-fixes).
  - net: lan743x: disable WOL upon resume to restore full data
    path operation (git-fixes).
  - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
    (git-fixes).
  - ALSA: hda: tas2781: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA: hda: cs35l41: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA: hda: cs35l56: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
    (git-fixes).
  - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
    (git-fixes).
  - ALSA: seq: ump: Fix missing System Reset message handling
    (git-fixes).
  - ALSA: hda: cs35l41: Possible null pointer dereference in
    cs35l41_hda_unbind() (git-fixes).
  - commit 045593b
  - tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
  - commit ff006da

++++ kernel-default:

  - drivers/perf: hisi_pcie: Fix out-of-bound access when valid
    event group (CVE-2024-38569 bsc#1226772).
  - commit 6715b52
  - drivers/perf: hisi: hns3: Fix out-of-bound access when valid
    event group (CVE-2024-38568 bsc#1226771).
  - commit 33d69e0
  - sched/core: Fix incorrect initialization of the 'burst'
    parameter in cpu_max_write() (bsc#1226791).
  - commit 6b67975
  - blacklist.conf: Add 6fb454606153 sched: Simplify tg_set_cfs_bandwidth()
  - commit 4e56705
  - virtio_net: checksum offloading handling fix (git-fixes).
  - commit d283709
  - virtio_net: avoid data-races on dev->stats fields (git-fixes).
  - commit 50373fb
  - vfio/fsl-mc: Block calling interrupt handler without trigger
    (bsc#1222810 CVE-2024-26814).
  - commit b1aee55
  - vfio/platform: Create persistent IRQ handlers (bsc#1222809
    CVE-2024-26813).
  - commit 28ae90e
  - ALSA: hda/realtek: Add more codec ID to no shutup pins list
    (stable-fixes).
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14ARP8
    (stable-fixes).
  - ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 4
    (stable-fixes).
  - ALSA: hda/realtek: Support Lenovo Thinkbook 16P Gen 5
    (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 4
    (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo Thinkbook 16P Gen 5
    (stable-fixes).
  - ALSA: hda/realtek: Limit mic boost on N14AP7 (stable-fixes).
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook
    445/465 G11 (stable-fixes).
  - ALSA: hda: cs35l56: Fix lifecycle of codec pointer
    (stable-fixes).
  - commit 3c2cbdc
  - net: usb: rtl8150 fix unintiatilzed variables in
    rtl8150_get_link_ksettings (git-fixes).
  - net: usb: ax88179_178a: improve reset check (git-fixes).
  - net: phy: mxl-gpy: Remove interrupt mask clearing from
    config_init (git-fixes).
  - net: lan743x: Support WOL at both the PHY and MAC appropriately
    (git-fixes).
  - net: lan743x: disable WOL upon resume to restore full data
    path operation (git-fixes).
  - ALSA: hda/realtek: Enable headset mic on IdeaPad 330-17IKB 81DM
    (git-fixes).
  - ALSA: hda: tas2781: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA: hda: cs35l41: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA: hda: cs35l56: Component should be unbound before
    deconstruction (git-fixes).
  - ALSA/hda: intel-dsp-config: Document AVS as dsp_driver option
    (git-fixes).
  - ALSA: hda/realtek: Remove Framework Laptop 16 from quirks
    (git-fixes).
  - ALSA: seq: ump: Fix missing System Reset message handling
    (git-fixes).
  - ALSA: hda: cs35l41: Possible null pointer dereference in
    cs35l41_hda_unbind() (git-fixes).
  - commit 045593b
  - tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
  - commit ff006da

++++ openSUSE-build-key:

  - Ensure that SLM 6.0 key is installed on Leap Micro and Leap 16
  - install SLFO / SLM 6.0 key and SLES 15 SP6+ key by default

++++ patterns-container:

  - Add obsoletes for libcontainers-sles-mounts to allow migration from 5.X
    boo#1226722

------------------------------------------------------------------
------------------  2024-6-20  -  Jun 20 2024  -------------------
------------------------------------------------------------------

++++ avahi:

  - Add avahi-filter-bogus-services.patch: no longer supply bogus
    services to callbacks (bsc#1226586).

++++ avahi:

  - Add avahi-filter-bogus-services.patch: no longer supply bogus
    services to callbacks (bsc#1226586).

++++ avahi:

  - Add avahi-filter-bogus-services.patch: no longer supply bogus
    services to callbacks (bsc#1226586).

++++ avahi:

  - Add avahi-filter-bogus-services.patch: no longer supply bogus
    services to callbacks (bsc#1226586).

++++ curl:

  - add multibuild for minimal libcurl flavored build (useful for
    container environments)
  - split zsh and fish completion into subpackages to have
    proper supplements

++++ curl:

  - add multibuild for minimal libcurl flavored build (useful for
    container environments)
  - split zsh and fish completion into subpackages to have
    proper supplements

++++ curl:

  - add multibuild for minimal libcurl flavored build (useful for
    container environments)
  - split zsh and fish completion into subpackages to have
    proper supplements

++++ curl:

  - add multibuild for minimal libcurl flavored build (useful for
    container environments)
  - split zsh and fish completion into subpackages to have
    proper supplements

++++ curl:

  - add multibuild for minimal libcurl flavored build (useful for
    container environments)
  - split zsh and fish completion into subpackages to have
    proper supplements

++++ curl:

  - add multibuild for minimal libcurl flavored build (useful for
    container environments)
  - split zsh and fish completion into subpackages to have
    proper supplements

++++ python-kiwi:

  - Fix potential race condition in loop detach
    The call to 'losetup -d' is in fact an async operation. Once
    the command returns the loop can still be associated with the
    former file because it gets lazy unbound and releases later.
    Prior re-use of the same loop device it is therefore required
    to wait until the kernel event queue is processed.

++++ python-kiwi:

  - Fix potential race condition in loop detach
    The call to 'losetup -d' is in fact an async operation. Once
    the command returns the loop can still be associated with the
    former file because it gets lazy unbound and releases later.
    Prior re-use of the same loop device it is therefore required
    to wait until the kernel event queue is processed.

++++ python-kiwi:

  - Fix potential race condition in loop detach
    The call to 'losetup -d' is in fact an async operation. Once
    the command returns the loop can still be associated with the
    former file because it gets lazy unbound and releases later.
    Prior re-use of the same loop device it is therefore required
    to wait until the kernel event queue is processed.

++++ kernel-default:

  - cachefiles: remove requests from xarray during flushing requests
    (bsc#1226588).
  - commit b238f81
  - blacklist.conf: add ppdev cleanup
  - commit 58ce126
  - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
    (git-fixes bsc#1225823 CVE-2024-36945 bsc#1226547).
  - commit d4aa573
  - selftests/bpf: test case for callback_depth states pruning logic
    (bsc#1225903).
  - bpf: check bpf_func_state->callback_depth when pruning states
    (bsc#1225903).
  - commit 6632e43

++++ kernel-default:

  - cachefiles: remove requests from xarray during flushing requests
    (bsc#1226588).
  - commit b238f81
  - blacklist.conf: add ppdev cleanup
  - commit 58ce126
  - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
    (git-fixes bsc#1225823 CVE-2024-36945 bsc#1226547).
  - commit d4aa573
  - selftests/bpf: test case for callback_depth states pruning logic
    (bsc#1225903).
  - bpf: check bpf_func_state->callback_depth when pruning states
    (bsc#1225903).
  - commit 6632e43

++++ kernel-default:

  - cachefiles: remove requests from xarray during flushing requests
    (bsc#1226588).
  - commit b238f81
  - blacklist.conf: add ppdev cleanup
  - commit 58ce126
  - net/smc: fix neighbour and rtable leak in smc_ib_find_route()
    (git-fixes bsc#1225823 CVE-2024-36945 bsc#1226547).
  - commit d4aa573
  - selftests/bpf: test case for callback_depth states pruning logic
    (bsc#1225903).
  - bpf: check bpf_func_state->callback_depth when pruning states
    (bsc#1225903).
  - commit 6632e43

++++ util-linux:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

++++ util-linux:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

++++ util-linux:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

++++ util-linux:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

++++ openSUSE-repos-LeapMicro:

  - Ensure package gets removed on migration to commmercial products
    Issue #62 on gh
  - Update _service file's set_version and obs_scm to manual
    spec will be now updated by running osc service mr

++++ util-linux-systemd:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

++++ util-linux-systemd:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

++++ util-linux-systemd:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

++++ util-linux-systemd:

  - Document unexpected side effects of lazy destruction
    (bsc#1159034, util-linux-umount-losetup-lazy-destruction.patch,
    util-linux-umount-losetup-lazy-destruction-generated.patch).
  - Don't delete binaries not common for all architectures. Create an
    util-linux-extra subpackage instead, so users of third party
    tools can use them. (bsc#1222285)

------------------------------------------------------------------
------------------  2024-6-19  -  Jun 19 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fixed repository include to image with dnf
    When specifying a repository element with imageinclude="true",
    kiwi permanently adds the repo file inside of the image.
    The distribution standard path is used to store the repo
    file in this case. With dnf a package manager exists that is
    primarily used on Fedora and RHEL systems. Thus the standard
    path for the repo files is set to "/etc/yum.repos.d".
    However, dnf can also be used for other rpm based distributions
    e.g SUSE. On such a system the default path does not exist
    or is different because another package manager is the
    default. This commit makes sure that the expected path is
    created prior adding any repo files.

++++ python-kiwi:

  - Fixed repository include to image with dnf
    When specifying a repository element with imageinclude="true",
    kiwi permanently adds the repo file inside of the image.
    The distribution standard path is used to store the repo
    file in this case. With dnf a package manager exists that is
    primarily used on Fedora and RHEL systems. Thus the standard
    path for the repo files is set to "/etc/yum.repos.d".
    However, dnf can also be used for other rpm based distributions
    e.g SUSE. On such a system the default path does not exist
    or is different because another package manager is the
    default. This commit makes sure that the expected path is
    created prior adding any repo files.

++++ python-kiwi:

  - Fixed repository include to image with dnf
    When specifying a repository element with imageinclude="true",
    kiwi permanently adds the repo file inside of the image.
    The distribution standard path is used to store the repo
    file in this case. With dnf a package manager exists that is
    primarily used on Fedora and RHEL systems. Thus the standard
    path for the repo files is set to "/etc/yum.repos.d".
    However, dnf can also be used for other rpm based distributions
    e.g SUSE. On such a system the default path does not exist
    or is different because another package manager is the
    default. This commit makes sure that the expected path is
    created prior adding any repo files.

++++ kernel-default:

  - supported.conf: Add APM X-Gene SoC hardware monitoring driver (jsc#PED-8649)
    Module is marked supported because of merge from SP6, but lets add
    reference to SLM6.0 maintenance task.
  - commit d270c07
  - gpio: tqmx86: introduce shadow register for GPIO output value
    (git-fixes).
  - Refresh
    patches.suse/gpio-tqmx86-store-IRQ-trigger-type-and-unmask-status.patch.
  - commit 559245f
  - efi/x86: Free EFI memory map only when installing a new one
    (git-fixes).
  - gpio: lpc32xx: fix module autoloading (stable-fixes).
  - commit d39df35
  - Move upstreamed NFS patch into sorted section
  - commit 19c3986
  - nfsd: optimise recalculate_deny_mode() for a common case
    (bsc#1217912).
  - commit 882d2ff
  - NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633
    bsc#1226226).
  - commit b98e69a
  - NFS: abort nfs_atomic_open_v23 if name is too long
    (bsc#1219847).
  - NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly
    (bsc#1219847).
  - commit 772961e

++++ kernel-default:

  - supported.conf: Add APM X-Gene SoC hardware monitoring driver (jsc#PED-8649)
    Module is marked supported because of merge from SP6, but lets add
    reference to SLM6.0 maintenance task.
  - commit d270c07
  - gpio: tqmx86: introduce shadow register for GPIO output value
    (git-fixes).
  - Refresh
    patches.suse/gpio-tqmx86-store-IRQ-trigger-type-and-unmask-status.patch.
  - commit 559245f
  - efi/x86: Free EFI memory map only when installing a new one
    (git-fixes).
  - gpio: lpc32xx: fix module autoloading (stable-fixes).
  - commit d39df35
  - Move upstreamed NFS patch into sorted section
  - commit 19c3986
  - nfsd: optimise recalculate_deny_mode() for a common case
    (bsc#1217912).
  - commit 882d2ff
  - NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633
    bsc#1226226).
  - commit b98e69a
  - NFS: abort nfs_atomic_open_v23 if name is too long
    (bsc#1219847).
  - NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly
    (bsc#1219847).
  - commit 772961e

++++ kernel-default:

  - supported.conf: Add APM X-Gene SoC hardware monitoring driver (jsc#PED-8649)
    Module is marked supported because of merge from SP6, but lets add
    reference to SLM6.0 maintenance task.
  - commit d270c07
  - gpio: tqmx86: introduce shadow register for GPIO output value
    (git-fixes).
  - Refresh
    patches.suse/gpio-tqmx86-store-IRQ-trigger-type-and-unmask-status.patch.
  - commit 559245f
  - efi/x86: Free EFI memory map only when installing a new one
    (git-fixes).
  - gpio: lpc32xx: fix module autoloading (stable-fixes).
  - commit d39df35
  - Move upstreamed NFS patch into sorted section
  - commit 19c3986
  - nfsd: optimise recalculate_deny_mode() for a common case
    (bsc#1217912).
  - commit 882d2ff
  - NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633
    bsc#1226226).
  - commit b98e69a
  - NFS: abort nfs_atomic_open_v23 if name is too long
    (bsc#1219847).
  - NFS: add atomic_open for NFSv3 to handle O_TRUNC correctly
    (bsc#1219847).
  - commit 772961e

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

++++ openssl-3:

  - FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode. [bsc#1220523]
    * Rebase openssl-Force-FIPS.patch

------------------------------------------------------------------
------------------  2024-6-18  -  Jun 18 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.0.21 → 10.0.22

++++ python-kiwi:

  - Bump version: 10.0.21 → 10.0.22

++++ python-kiwi:

  - Bump version: 10.0.21 → 10.0.22

++++ kernel-default:

  - fs/9p: fix uninitialized values during inode evict (bsc#1225815
    CVE-2024-36923).
  - commit b349473
  - x86/mce: Dynamically size space for machine check records
    (bsc#1222241).
  - commit 2d0d4b2
  - nvme-tcp: Export the nvme_tcp_wq to sysfs (bsc#1224049).
  - Refresh
    patches.suse/nvme-tcp-Add-wq_unbound-modparam-for-nvme_tcp_wq.patch.
  - commit 099b967
  - net: preserve kabi for struct dst_ops (CVE-2024-36971
    bsc#1226145).
  - commit 6d764b6
  - kcov: don't lose track of remote references during softirqs
    (git-fixes).
  - commit fc5abf0
  - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
    (CVE-2024-27414 bsc#1224439).
  - commit 6651625
  - netfilter: nf_tables: reject new basechain after table flag update
    (CVE-2024-35900 bsc#1224497).
  - commit ef2c4d5
  - net: fix __dst_negative_advice() race (CVE-2024-36971
    bsc#1226145).
  - commit 604ed28
  - ipv6: Fix infinite recursion in fib6_dump_done() (CVE-2024-35886
    bsc#1224670).
  - commit ba91bc1

++++ kernel-default:

  - fs/9p: fix uninitialized values during inode evict (bsc#1225815
    CVE-2024-36923).
  - commit b349473
  - x86/mce: Dynamically size space for machine check records
    (bsc#1222241).
  - commit 2d0d4b2
  - nvme-tcp: Export the nvme_tcp_wq to sysfs (bsc#1224049).
  - Refresh
    patches.suse/nvme-tcp-Add-wq_unbound-modparam-for-nvme_tcp_wq.patch.
  - commit 099b967
  - net: preserve kabi for struct dst_ops (CVE-2024-36971
    bsc#1226145).
  - commit 6d764b6
  - kcov: don't lose track of remote references during softirqs
    (git-fixes).
  - commit fc5abf0
  - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
    (CVE-2024-27414 bsc#1224439).
  - commit 6651625
  - netfilter: nf_tables: reject new basechain after table flag update
    (CVE-2024-35900 bsc#1224497).
  - commit ef2c4d5
  - net: fix __dst_negative_advice() race (CVE-2024-36971
    bsc#1226145).
  - commit 604ed28
  - ipv6: Fix infinite recursion in fib6_dump_done() (CVE-2024-35886
    bsc#1224670).
  - commit ba91bc1

++++ kernel-default:

  - fs/9p: fix uninitialized values during inode evict (bsc#1225815
    CVE-2024-36923).
  - commit b349473
  - x86/mce: Dynamically size space for machine check records
    (bsc#1222241).
  - commit 2d0d4b2
  - nvme-tcp: Export the nvme_tcp_wq to sysfs (bsc#1224049).
  - Refresh
    patches.suse/nvme-tcp-Add-wq_unbound-modparam-for-nvme_tcp_wq.patch.
  - commit 099b967
  - net: preserve kabi for struct dst_ops (CVE-2024-36971
    bsc#1226145).
  - commit 6d764b6
  - kcov: don't lose track of remote references during softirqs
    (git-fixes).
  - commit fc5abf0
  - rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
    (CVE-2024-27414 bsc#1224439).
  - commit 6651625
  - netfilter: nf_tables: reject new basechain after table flag update
    (CVE-2024-35900 bsc#1224497).
  - commit ef2c4d5
  - net: fix __dst_negative_advice() race (CVE-2024-36971
    bsc#1226145).
  - commit 604ed28
  - ipv6: Fix infinite recursion in fib6_dump_done() (CVE-2024-35886
    bsc#1224670).
  - commit ba91bc1

++++ kernel-firmware:

  - Update to version 20240618 (git commit 7d931f8afa51):
    * amlogic: Update bluetooth firmware binary
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * linux-firmware: Update firmware file for Intel Bluetooth Pulsar core
    * rtl_bt: Update RTL8822C BT UART firmware to 0xB5D6_6DCB
    * rtl_bt: Update RTL8822C BT USB firmware to 0xAED6_6DCB
    * amdgpu: update DMCUB to v0.0.222.0 for DCN314
    * iwlwifi: add ty/So/Ma firmwares for core88-87 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core88-87 release
    * linux-firmware: add new cc33xx firmware for cc33xx chips
    * cirrus: cs35l56: Update firmware for Cirrus CS35L56 for ASUS UM5606 laptop
    * cirrus: cs35l56: Update firmware for Cirrus CS35L56 for various ASUS laptops
    * linux-firmware: Add firmware for Lenovo Thinkbooks
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update SDMA 6.0.2 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update raven2 firmware
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update SDMA 6.0.3 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update VCN 3.1.2 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update psp 13.0.8 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update smu 13.0.0 firmware
    * amdgpu: update SDMA 6.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update PSP 13.0.11 firmware
    * amdgpu: update GC 11.0.4 firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update SDMA 6.0.1 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update SMU 13.0.6 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update aldebaran firmware
    * amdgpu: add support for PSP 14.0.1
    * amdgpu: add support for VPE 6.1.1
    * amdgpu: add support for VCN 4.0.6
    * amdgpu: add support for SDMA 6.1.1
    * amdgpu: add support for GC 11.5.1
    * amdgpu: Add support for DCN 3.5.1
    * QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00639
    * cnm: update chips&media wave521c firmware.
    * linux-firmware: Add ordinary firmware for RTL8821AU device

++++ kernel-firmware:

  - Update to version 20240618 (git commit 7d931f8afa51):
    * amlogic: Update bluetooth firmware binary
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * linux-firmware: Update firmware file for Intel Bluetooth Pulsar core
    * rtl_bt: Update RTL8822C BT UART firmware to 0xB5D6_6DCB
    * rtl_bt: Update RTL8822C BT USB firmware to 0xAED6_6DCB
    * amdgpu: update DMCUB to v0.0.222.0 for DCN314
    * iwlwifi: add ty/So/Ma firmwares for core88-87 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core88-87 release
    * linux-firmware: add new cc33xx firmware for cc33xx chips
    * cirrus: cs35l56: Update firmware for Cirrus CS35L56 for ASUS UM5606 laptop
    * cirrus: cs35l56: Update firmware for Cirrus CS35L56 for various ASUS laptops
    * linux-firmware: Add firmware for Lenovo Thinkbooks
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update SDMA 6.0.2 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update raven2 firmware
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update SDMA 6.0.3 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update VCN 3.1.2 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update psp 13.0.8 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update smu 13.0.0 firmware
    * amdgpu: update SDMA 6.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update PSP 13.0.11 firmware
    * amdgpu: update GC 11.0.4 firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update SDMA 6.0.1 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update SMU 13.0.6 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update aldebaran firmware
    * amdgpu: add support for PSP 14.0.1
    * amdgpu: add support for VPE 6.1.1
    * amdgpu: add support for VCN 4.0.6
    * amdgpu: add support for SDMA 6.1.1
    * amdgpu: add support for GC 11.5.1
    * amdgpu: Add support for DCN 3.5.1
    * QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00639
    * cnm: update chips&media wave521c firmware.
    * linux-firmware: Add ordinary firmware for RTL8821AU device

++++ kernel-firmware:

  - Update to version 20240618 (git commit 7d931f8afa51):
    * amlogic: Update bluetooth firmware binary
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * linux-firmware: Update firmware file for Intel Bluetooth Pulsar core
    * rtl_bt: Update RTL8822C BT UART firmware to 0xB5D6_6DCB
    * rtl_bt: Update RTL8822C BT USB firmware to 0xAED6_6DCB
    * amdgpu: update DMCUB to v0.0.222.0 for DCN314
    * iwlwifi: add ty/So/Ma firmwares for core88-87 release
    * iwlwifi: update cc/Qu/QuZ firmwares for core88-87 release
    * linux-firmware: add new cc33xx firmware for cc33xx chips
    * cirrus: cs35l56: Update firmware for Cirrus CS35L56 for ASUS UM5606 laptop
    * cirrus: cs35l56: Update firmware for Cirrus CS35L56 for various ASUS laptops
    * linux-firmware: Add firmware for Lenovo Thinkbooks
    * amdgpu: update yellow carp firmware
    * amdgpu: update VCN 4.0.4 firmware
    * amdgpu: update SDMA 6.0.2 firmware
    * amdgpu: update PSP 13.0.7 firmware
    * amdgpu: update GC 11.0.2 firmware
    * amdgpu: update navi10 firmware
    * amdgpu: update raven2 firmware
    * amdgpu: update raven firmware
    * amdgpu: update SMU 13.0.10 firmware
    * amdgpu: update SDMA 6.0.3 firmware
    * amdgpu: update PSP 13.0.10 firmware
    * amdgpu: update GC 11.0.3 firmware
    * amdgpu: update VCN 3.1.2 firmware
    * amdgpu: update PSP 13.0.5 firmware
    * amdgpu: update psp 13.0.8 firmware
    * amdgpu: update vega20 firmware
    * amdgpu: update vega12 firmware
    * amdgpu: update vega10 firmware
    * amdgpu: update VCN 4.0.0 firmware
    * amdgpu: update smu 13.0.0 firmware
    * amdgpu: update SDMA 6.0.0 firmware
    * amdgpu: update PSP 13.0.0 firmware
    * amdgpu: update GC 11.0.0 firmware
    * amdgpu: update picasso firmware
    * amdgpu: update beige goby firmware
    * amdgpu: update vangogh firmware
    * amdgpu: update dimgrey cavefish firmware
    * amdgpu: update green sardine firmware
    * amdgpu: update navy flounder firmware
    * amdgpu: update PSP 13.0.11 firmware
    * amdgpu: update GC 11.0.4 firmware
    * amdgpu: update VCN 4.0.2 firmware
    * amdgpu: update SDMA 6.0.1 firmware
    * amdgpu: update PSP 13.0.4 firmware
    * amdgpu: update GC 11.0.1 firmware
    * amdgpu: update sienna cichlid firmware
    * amdgpu: update VCN 4.0.5 firmware
    * amdgpu: update PSP 14.0.0 firmware
    * amdgpu: update GC 11.5.0 firmware
    * amdgpu: update navi14 firmware
    * amdgpu: update SMU 13.0.6 firmware
    * amdgpu: update PSP 13.0.6 firmware
    * amdgpu: update GC 9.4.3 firmware
    * amdgpu: update renoir firmware
    * amdgpu: update navi12 firmware
    * amdgpu: update aldebaran firmware
    * amdgpu: add support for PSP 14.0.1
    * amdgpu: add support for VPE 6.1.1
    * amdgpu: add support for VCN 4.0.6
    * amdgpu: add support for SDMA 6.1.1
    * amdgpu: add support for GC 11.5.1
    * amdgpu: Add support for DCN 3.5.1
    * QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00639
    * cnm: update chips&media wave521c firmware.
    * linux-firmware: Add ordinary firmware for RTL8821AU device

++++ openSUSE-repos-LeapMicro:

  - Add Leap Micro 6.X 5.X handling
    * no dedicated update repo for slem updates.
    * oss repo will now always include slem 6.X updates
  - Update to version 20240618.8c4e429:
    * keep micro5 in micro5 repoindex
  - Update to version 20240618.727f0a2:
    * Use new path names for micro 6.0
    * use 6.0 for leap-micro6 repoindex
    * Add repoindex for Micro 6
    * Update README.md with openqa reference
    * Update README.md with --gpg-auto-import-keys
    * Remove reference to undefined substitution

++++ python-urllib3:

  - Add CVE-2024-37891.patch (bsc#1226469)

++++ python-urllib3:

  - Add CVE-2024-37891.patch (bsc#1226469)

++++ python-urllib3:

  - Add CVE-2024-37891.patch (bsc#1226469)

++++ python-urllib3:

  - Add CVE-2024-37891.patch (bsc#1226469)

++++ wget:

  - Fix mishandled semicolons in the userinfo subcomponent could lead to an
    insecure behavior in which data that was supposed to be in the userinfo
    subcomponent is misinterpreted to be part of the host subcomponent.
    [bsc#1226419, CVE-2024-38428, properly-re-implement-userinfo-parsing.patch]

++++ wget:

  - Fix mishandled semicolons in the userinfo subcomponent could lead to an
    insecure behavior in which data that was supposed to be in the userinfo
    subcomponent is misinterpreted to be part of the host subcomponent.
    [bsc#1226419, CVE-2024-38428, properly-re-implement-userinfo-parsing.patch]

------------------------------------------------------------------
------------------  2024-6-17  -  Jun 17 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240617.f5ff27f:
    * add /usr/bin/nu to etc/shells for nushell

++++ curl:

  - remove mozilla-nss code (unsupported since 8.3.0)

++++ curl:

  - remove mozilla-nss code (unsupported since 8.3.0)

++++ curl:

  - remove mozilla-nss code (unsupported since 8.3.0)

++++ curl:

  - remove mozilla-nss code (unsupported since 8.3.0)

++++ curl:

  - remove mozilla-nss code (unsupported since 8.3.0)

++++ curl:

  - remove mozilla-nss code (unsupported since 8.3.0)

++++ python-kiwi:

  - Fixed selinux labels for boot files
    When kiwi calls the bootloader config and installation modules
    several files gets created as unlabeled_t because the labeling
    happened earlier. This commit ensures that setfiles gets called
    after BootLoaderConfig and/or BootLoaderInstall has done its
    job. This Fixes #2568
  - Add bash to package requirements
    If there are script evaluations that does not specify
    an interpreter, kiwi uses bash for it. The same applies
    for sub-process invocations using shell pipelines. Thus
    the bash shell is a required tool for kiwi under certain
    circumstances. Further details in Issue #2567

++++ python-kiwi:

  - Fixed selinux labels for boot files
    When kiwi calls the bootloader config and installation modules
    several files gets created as unlabeled_t because the labeling
    happened earlier. This commit ensures that setfiles gets called
    after BootLoaderConfig and/or BootLoaderInstall has done its
    job. This Fixes #2568
  - Add bash to package requirements
    If there are script evaluations that does not specify
    an interpreter, kiwi uses bash for it. The same applies
    for sub-process invocations using shell pipelines. Thus
    the bash shell is a required tool for kiwi under certain
    circumstances. Further details in Issue #2567

++++ python-kiwi:

  - Fixed selinux labels for boot files
    When kiwi calls the bootloader config and installation modules
    several files gets created as unlabeled_t because the labeling
    happened earlier. This commit ensures that setfiles gets called
    after BootLoaderConfig and/or BootLoaderInstall has done its
    job. This Fixes #2568
  - Add bash to package requirements
    If there are script evaluations that does not specify
    an interpreter, kiwi uses bash for it. The same applies
    for sub-process invocations using shell pipelines. Thus
    the bash shell is a required tool for kiwi under certain
    circumstances. Further details in Issue #2567

++++ kernel-default:

  - drm/amd/display: Disable idle reallow as part of command/gpint (bsc#1225702 CVE-2024-36024)
  - commit 6d53e8c
  - RAS/AMD/ATL: Use system settings for MI300 DRAM to normalized
    address translation (bsc#1225300).
  - RAS/AMD/ATL: Fix MI300 bank hash (bsc#1225300).
  - commit 82b08f9
  - i2c: designware: Fix the functionality flags of the slave-only
    interface (git-fixes).
  - i2c: at91: Fix the functionality flags of the slave-only
    interface (git-fixes).
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log
    messages (git-fixes).
  - xhci: Handle TD clearing for multiple streams case (git-fixes).
  - thunderbolt: debugfs: Fix margin debugfs node creation condition
    (git-fixes).
  - usb-storage: alauda: Check whether the media is initialized
    (git-fixes).
  - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
    (git-fixes).
  - usb: typec: tcpm: fix use-after-free case in
    tcpm_register_source_caps (git-fixes).
  - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
    (git-fixes).
  - tty: n_tty: Fix buffer offsets when lookahead is used
    (git-fixes).
  - drivers: core: synchronize really_probe() and dev_uevent()
    (git-fixes).
  - iio: imu: inv_icm42600: delete unneeded update watermark call
    (git-fixes).
  - iio: dac: ad5592r: fix temperature channel scaling value
    (git-fixes).
  - iio: adc: ad9467: fix scan type sign (git-fixes).
  - misc: microchip: pci1xxxx: Fix a memory leak in the error
    handling of gp_aux_bus_probe() (git-fixes).
  - misc: microchip: pci1xxxx: fix double free in the error handling
    of gp_aux_bus_probe() (git-fixes).
  - mei: me: release irq in mei_me_pci_resume error path
    (git-fixes).
  - ax25: Fix refcount imbalance on inbound connections (git-fixes).
  - tpm_tis: Do *not* flush uninitialized work (git-fixes).
  - selftests/mm: fix build warnings on ppc64 (stable-fixes).
  - selftests/mm: compaction_test: fix incorrect write of zero to
    nr_hugepages (git-fixes).
  - genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
    (git-fixes).
  - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
    (stable-fixes).
  - intel_th: pci: Add Meteor Lake-S CPU support (stable-fixes).
  - mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect
    GPIO on Asus T100TA (git-fixes).
  - mmc: sdhci-acpi: Disable write protect detection on Toshiba
    WT10-A (stable-fixes).
  - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot
    not working (stable-fixes).
  - mmc: sdhci-acpi: Sort DMI quirks alphabetically (stable-fixes).
  - mmc: sdhci: Add support for "Tuning Error" interrupts
    (stable-fixes).
  - mmc: core: Add mmc_gpiod_set_cd_config() function
    (stable-fixes).
  - media: mxl5xx: Move xpt structures off stack (stable-fixes).
  - media: lgdt3306a: Add a check against null-pointer-def
    (stable-fixes).
  - media: v4l2-core: hold videodev_lock until dev reg, finishes
    (stable-fixes).
  - drm/amdgpu: add error handle to avoid out-of-bounds
    (stable-fixes).
  - drm/i915/hwmon: Get rid of devm (stable-fixes).
  - wifi: rtw89: correct aSIFSTime for 6GHz band (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
    (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
    (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power (stable-fixes).
  - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
    (stable-fixes).
  - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
    (stable-fixes).
  - crypto: ecrdsa - Fix module auto-load on add_key (stable-fixes).
  - drm/sun4i: hdmi: Move mode_set into enable (stable-fixes).
  - drm/sun4i: hdmi: Convert encoder to atomic (stable-fixes).
  - mmc: core: Do not force a retune before RPMB switch
    (stable-fixes).
  - commit 8df97c4
  - nvme/tcp: Add wq_unbound modparam for nvme_tcp_wq (bsc#1224049).
  - commit 7af7bce

++++ kernel-default:

  - drm/amd/display: Disable idle reallow as part of command/gpint (bsc#1225702 CVE-2024-36024)
  - commit 6d53e8c
  - RAS/AMD/ATL: Use system settings for MI300 DRAM to normalized
    address translation (bsc#1225300).
  - RAS/AMD/ATL: Fix MI300 bank hash (bsc#1225300).
  - commit 82b08f9
  - i2c: designware: Fix the functionality flags of the slave-only
    interface (git-fixes).
  - i2c: at91: Fix the functionality flags of the slave-only
    interface (git-fixes).
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log
    messages (git-fixes).
  - xhci: Handle TD clearing for multiple streams case (git-fixes).
  - thunderbolt: debugfs: Fix margin debugfs node creation condition
    (git-fixes).
  - usb-storage: alauda: Check whether the media is initialized
    (git-fixes).
  - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
    (git-fixes).
  - usb: typec: tcpm: fix use-after-free case in
    tcpm_register_source_caps (git-fixes).
  - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
    (git-fixes).
  - tty: n_tty: Fix buffer offsets when lookahead is used
    (git-fixes).
  - drivers: core: synchronize really_probe() and dev_uevent()
    (git-fixes).
  - iio: imu: inv_icm42600: delete unneeded update watermark call
    (git-fixes).
  - iio: dac: ad5592r: fix temperature channel scaling value
    (git-fixes).
  - iio: adc: ad9467: fix scan type sign (git-fixes).
  - misc: microchip: pci1xxxx: Fix a memory leak in the error
    handling of gp_aux_bus_probe() (git-fixes).
  - misc: microchip: pci1xxxx: fix double free in the error handling
    of gp_aux_bus_probe() (git-fixes).
  - mei: me: release irq in mei_me_pci_resume error path
    (git-fixes).
  - ax25: Fix refcount imbalance on inbound connections (git-fixes).
  - tpm_tis: Do *not* flush uninitialized work (git-fixes).
  - selftests/mm: fix build warnings on ppc64 (stable-fixes).
  - selftests/mm: compaction_test: fix incorrect write of zero to
    nr_hugepages (git-fixes).
  - genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
    (git-fixes).
  - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
    (stable-fixes).
  - intel_th: pci: Add Meteor Lake-S CPU support (stable-fixes).
  - mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect
    GPIO on Asus T100TA (git-fixes).
  - mmc: sdhci-acpi: Disable write protect detection on Toshiba
    WT10-A (stable-fixes).
  - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot
    not working (stable-fixes).
  - mmc: sdhci-acpi: Sort DMI quirks alphabetically (stable-fixes).
  - mmc: sdhci: Add support for "Tuning Error" interrupts
    (stable-fixes).
  - mmc: core: Add mmc_gpiod_set_cd_config() function
    (stable-fixes).
  - media: mxl5xx: Move xpt structures off stack (stable-fixes).
  - media: lgdt3306a: Add a check against null-pointer-def
    (stable-fixes).
  - media: v4l2-core: hold videodev_lock until dev reg, finishes
    (stable-fixes).
  - drm/amdgpu: add error handle to avoid out-of-bounds
    (stable-fixes).
  - drm/i915/hwmon: Get rid of devm (stable-fixes).
  - wifi: rtw89: correct aSIFSTime for 6GHz band (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
    (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
    (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power (stable-fixes).
  - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
    (stable-fixes).
  - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
    (stable-fixes).
  - crypto: ecrdsa - Fix module auto-load on add_key (stable-fixes).
  - drm/sun4i: hdmi: Move mode_set into enable (stable-fixes).
  - drm/sun4i: hdmi: Convert encoder to atomic (stable-fixes).
  - mmc: core: Do not force a retune before RPMB switch
    (stable-fixes).
  - commit 8df97c4
  - nvme/tcp: Add wq_unbound modparam for nvme_tcp_wq (bsc#1224049).
  - commit 7af7bce

++++ kernel-default:

  - drm/amd/display: Disable idle reallow as part of command/gpint (bsc#1225702 CVE-2024-36024)
  - commit 6d53e8c
  - RAS/AMD/ATL: Use system settings for MI300 DRAM to normalized
    address translation (bsc#1225300).
  - RAS/AMD/ATL: Fix MI300 bank hash (bsc#1225300).
  - commit 82b08f9
  - i2c: designware: Fix the functionality flags of the slave-only
    interface (git-fixes).
  - i2c: at91: Fix the functionality flags of the slave-only
    interface (git-fixes).
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log
    messages (git-fixes).
  - xhci: Handle TD clearing for multiple streams case (git-fixes).
  - thunderbolt: debugfs: Fix margin debugfs node creation condition
    (git-fixes).
  - usb-storage: alauda: Check whether the media is initialized
    (git-fixes).
  - usb: typec: tcpm: Ignore received Hard Reset in TOGGLING state
    (git-fixes).
  - usb: typec: tcpm: fix use-after-free case in
    tcpm_register_source_caps (git-fixes).
  - USB: xen-hcd: Traverse host/ when CONFIG_USB_XEN_HCD is selected
    (git-fixes).
  - tty: n_tty: Fix buffer offsets when lookahead is used
    (git-fixes).
  - drivers: core: synchronize really_probe() and dev_uevent()
    (git-fixes).
  - iio: imu: inv_icm42600: delete unneeded update watermark call
    (git-fixes).
  - iio: dac: ad5592r: fix temperature channel scaling value
    (git-fixes).
  - iio: adc: ad9467: fix scan type sign (git-fixes).
  - misc: microchip: pci1xxxx: Fix a memory leak in the error
    handling of gp_aux_bus_probe() (git-fixes).
  - misc: microchip: pci1xxxx: fix double free in the error handling
    of gp_aux_bus_probe() (git-fixes).
  - mei: me: release irq in mei_me_pci_resume error path
    (git-fixes).
  - ax25: Fix refcount imbalance on inbound connections (git-fixes).
  - tpm_tis: Do *not* flush uninitialized work (git-fixes).
  - selftests/mm: fix build warnings on ppc64 (stable-fixes).
  - selftests/mm: compaction_test: fix incorrect write of zero to
    nr_hugepages (git-fixes).
  - genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()
    (git-fixes).
  - drm/amdgpu/atomfirmware: add intergrated info v2.3 table
    (stable-fixes).
  - intel_th: pci: Add Meteor Lake-S CPU support (stable-fixes).
  - mmc: sdhci-acpi: Add quirk to enable pull-up on the card-detect
    GPIO on Asus T100TA (git-fixes).
  - mmc: sdhci-acpi: Disable write protect detection on Toshiba
    WT10-A (stable-fixes).
  - mmc: sdhci-acpi: Fix Lenovo Yoga Tablet 2 Pro 1380 sdcard slot
    not working (stable-fixes).
  - mmc: sdhci-acpi: Sort DMI quirks alphabetically (stable-fixes).
  - mmc: sdhci: Add support for "Tuning Error" interrupts
    (stable-fixes).
  - mmc: core: Add mmc_gpiod_set_cd_config() function
    (stable-fixes).
  - media: mxl5xx: Move xpt structures off stack (stable-fixes).
  - media: lgdt3306a: Add a check against null-pointer-def
    (stable-fixes).
  - media: v4l2-core: hold videodev_lock until dev reg, finishes
    (stable-fixes).
  - drm/amdgpu: add error handle to avoid out-of-bounds
    (stable-fixes).
  - drm/i915/hwmon: Get rid of devm (stable-fixes).
  - wifi: rtw89: correct aSIFSTime for 6GHz band (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix endianness issue in RX path
    (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix low speed with WPA3-SAE
    (stable-fixes).
  - wifi: rtlwifi: rtl8192de: Fix 5 GHz TX power (stable-fixes).
  - wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU
    (stable-fixes).
  - ACPI: resource: Do IRQ override on TongFang GXxHRXx and GMxHGxx
    (stable-fixes).
  - crypto: ecrdsa - Fix module auto-load on add_key (stable-fixes).
  - drm/sun4i: hdmi: Move mode_set into enable (stable-fixes).
  - drm/sun4i: hdmi: Convert encoder to atomic (stable-fixes).
  - mmc: core: Do not force a retune before RPMB switch
    (stable-fixes).
  - commit 8df97c4
  - nvme/tcp: Add wq_unbound modparam for nvme_tcp_wq (bsc#1224049).
  - commit 7af7bce

------------------------------------------------------------------
------------------  2024-6-16  -  Jun 16 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - ocfs2: fix sparse warnings (bsc#1219224).
  - ocfs2: speed up chain-list searching (bsc#1219224).
  - ocfs2: adjust enabling place for la window (bsc#1219224).
  - ocfs2: improve write IO performance when fragmentation is high
    (bsc#1219224).
  - commit 98a3adb

++++ kernel-default:

  - ocfs2: fix sparse warnings (bsc#1219224).
  - ocfs2: speed up chain-list searching (bsc#1219224).
  - ocfs2: adjust enabling place for la window (bsc#1219224).
  - ocfs2: improve write IO performance when fragmentation is high
    (bsc#1219224).
  - commit 98a3adb

++++ kernel-default:

  - ocfs2: fix sparse warnings (bsc#1219224).
  - ocfs2: speed up chain-list searching (bsc#1219224).
  - ocfs2: adjust enabling place for la window (bsc#1219224).
  - ocfs2: improve write IO performance when fragmentation is high
    (bsc#1219224).
  - commit 98a3adb

------------------------------------------------------------------
------------------  2024-6-15  -  Jun 15 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - drm/exynos: hdmi: report safe 640x480 mode as a fallback when
    no EDID found (git-fixes).
  - drm/nouveau: don't attempt to schedule hpd_work on headless
    cards (git-fixes).
  - drm/bridge/panel: Fix runtime warning on panel bridge release
    (git-fixes).
  - drm/komeda: check for error-valued pointer (git-fixes).
  - commit b393dd7

++++ kernel-default:

  - drm/exynos: hdmi: report safe 640x480 mode as a fallback when
    no EDID found (git-fixes).
  - drm/nouveau: don't attempt to schedule hpd_work on headless
    cards (git-fixes).
  - drm/bridge/panel: Fix runtime warning on panel bridge release
    (git-fixes).
  - drm/komeda: check for error-valued pointer (git-fixes).
  - commit b393dd7

++++ kernel-default:

  - drm/exynos: hdmi: report safe 640x480 mode as a fallback when
    no EDID found (git-fixes).
  - drm/nouveau: don't attempt to schedule hpd_work on headless
    cards (git-fixes).
  - drm/bridge/panel: Fix runtime warning on panel bridge release
    (git-fixes).
  - drm/komeda: check for error-valued pointer (git-fixes).
  - commit b393dd7

------------------------------------------------------------------
------------------  2024-6-14  -  Jun 14 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240614.332933e:
    * Do not save/restore cursor for foot at status line
    * Add tmux and others to DIR_COLORS (Issue #116)
    * Remove kernel.pid_max limit (bsc#1219038)
    * Add subpackge to enable ptrace

++++ cloud-init:

  - remove dependency on /usr/bin/python3 via using the macros (bsc#1212476)

++++ cloud-init:

  - remove dependency on /usr/bin/python3 via using the macros (bsc#1212476)

++++ cloud-init:

  - remove dependency on /usr/bin/python3 via using the macros (bsc#1212476)

++++ transactional-update:

  - Enable soft-reboot by default again as announced in
    https://microos.opensuse.org/blog/2024-06-13-soft-reboot/

++++ transactional-update:

  - Enable soft-reboot by default again as announced in
    https://microos.opensuse.org/blog/2024-06-13-soft-reboot/

++++ kernel-default:

  - Temporarily drop KVM patch that caused a regression (bsc#1226158)
    Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
  - commit 33f31da
  - kABI: bpf: verifier kABI workaround
    (bsc#1225903).
  - commit 726091c
  - bpf: keep track of max number of bpf_loop callback iterations
    (bsc#1225903).
  - selftests/bpf: test widening for iterating callbacks
    (bsc#1225903).
  - bpf: widening for callback iterators (bsc#1225903).
  - selftests/bpf: tests for iterating callbacks (bsc#1225903).
  - bpf: verify callbacks as if they are called unknown number of
    times (bsc#1225903).
  - bpf: extract setup_func_entry() utility function (bsc#1225903).
  - bpf: extract __check_reg_arg() utility function (bsc#1225903).
  - selftests/bpf: track string payload offset as scalar in
    strobemeta (bsc#1225903).
  - selftests/bpf: track tcp payload offset as scalar in
    xdp_synproxy (bsc#1225903).
  - bpf: print full verifier states on infinite loop detection
    (bsc#1225903).
  - selftests/bpf: test if state loops are detected in a tricky case
    (bsc#1225903).
  - bpf: correct loop detection for iterators convergence
    (bsc#1225903).
  - selftests/bpf: tests with delayed read/precision makrs in loop
    body (bsc#1225903).
  - bpf: exact states comparison for iterator convergence checks
    (bsc#1225903).
  - bpf: extract same_callsites() as utility function (bsc#1225903).
  - bpf: move explored_state() closer to the beginning of verifier.c
    (bsc#1225903).
  - commit 63dfc45
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
    (CVE-2024-36903 bsc#1225741).
  - commit f510672
  - Update references
  - commit 36a2563
  - drm/amd/display: Skip on writeback when it's not applicable (CVE-2024-36914 bsc#1225757).
  - commit e1ad803
  - cpufreq: amd-pstate: Fix the inconsistency in max frequency
    units (git-fixes).
  - commit 9dd9a2b
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
    (bsc#1225737 CVE-2024-36899).
  - commit 24144db
  - nouveau: report byte usage in VRAM usage (git-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 5638f93
  - nouveau: add an ioctl to report vram usage (stable-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 7ea88ac
  - nouveau: add an ioctl to return vram bar size (stable-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 07ddfce
  - platform/x86: dell-smbios: Fix wrong token data in sysfs
    (git-fixes).
  - net: phy: Micrel KSZ8061: fix errata solution not taking effect
    problem (git-fixes).
  - wifi: ath10k: fix QCOM_RPROC_COMMON dependency (git-fixes).
  - wifi: mac80211: correctly parse Spatial Reuse Parameter Set
    element (git-fixes).
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    (git-fixes).
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    (git-fixes).
  - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of
    debugfs ifdef (git-fixes).
  - wifi: iwlwifi: mvm: set properly mac header (git-fixes).
  - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
    (git-fixes).
  - wifi: iwlwifi: mvm: don't initialize csa_work twice (git-fixes).
  - wifi: cfg80211: pmsr: use correct nla_get_uX functions
    (git-fixes).
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station (git-fixes).
  - wifi: cfg80211: fully move wiphy work to unbound workqueue
    (git-fixes).
  - wifi: mac80211: Fix deadlock in
    ieee80211_sta_ps_deliver_wakeup() (git-fixes).
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    (git-fixes).
  - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume
    (git-fixes).
  - module: don't ignore sysfs_create_link() failures (git-fixes).
  - soundwire: cadence: fix invalid PDI offset (stable-fixes).
  - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
    (stable-fixes).
  - platform/x86: thinkpad_acpi: Take hotkey_mutex during
    hotkey_exit() (git-fixes).
  - media: radio-shark2: Avoid led_names truncations (git-fixes).
  - wifi: nl80211: Avoid address calculations via out of bounds
    array indexing (git-fixes).
  - selftests: mptcp: add ms units for tc-netem delay
    (stable-fixes).
  - pwm: sti: Simplify probe function using devm functions
    (git-fixes).
  - regulator: vqmmc-ipq4019: fix module autoloading (stable-fixes).
  - regulator: irq_helpers: duplicate IRQ name (stable-fixes).
  - platform/x86: ISST: Add Grand Ridge to HPM CPU list
    (stable-fixes).
  - selftests: sud_test: return correct emulated syscall value on
    RISC-V (stable-fixes).
  - wifi: cfg80211: fix the order of arguments for trace events
    of the tx_rx_evt class (stable-fixes).
  - wifi: mac80211: ensure beacon is non-S1G prior to extracting
    the beacon timestamp field (stable-fixes).
  - wifi: mac80211: don't use rate mask for scanning (stable-fixes).
  - pwm: sti: Prepare removing pwm_chip from driver data
    (stable-fixes).
  - commit d252b95
  - HID: logitech-dj: Fix memory leak in
    logi_dj_recv_switch_to_dj_mode() (git-fixes).
  - HID: core: remove unnecessary WARN_ON() in implement()
    (git-fixes).
  - kconfig: doc: fix a typo in the note about 'imply' (git-fixes).
  - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
    (git-fixes).
  - gpio: tqmx86: store IRQ trigger type and unmask status
    separately (git-fixes).
  - gpio: tqmx86: fix typo in Kconfig label (git-fixes).
  - drm/vmwgfx: Don't memcmp equivalent pointers (git-fixes).
  - drm/vmwgfx: 3D disabled should not effect STDU memory limits
    (git-fixes).
  - drm/vmwgfx: Filter modes which exceed graphics memory
    (git-fixes).
  - drm/panel: sitronix-st7789v: Add check for
    of_drm_get_panel_orientation (git-fixes).
  - drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
    (git-fixes).
  - kconfig: fix comparison to constant symbols, 'm', 'n'
    (git-fixes).
  - drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_
    cp_compute_microcode() and rlc_microcode() (git-fixes).
  - drm/amdgpu: init microcode chip name from ip versions
    (stable-fixes).
  - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
    (stable-fixes).
  - iio: accel: mxc4005: Reset chip on probe() and resume()
    (stable-fixes).
  - drm/amdkfd: Flush the process wq before creating a kfd_process
    (stable-fixes).
  - drm/amd/display: Disable seamless boot on 128b/132b encoding
    (stable-fixes).
  - drm/amd/display: Fix DC mode screen flickering on DCN321
    (stable-fixes).
  - drm/amd/display: Add VCO speed parameter for DCN31 FPU
    (stable-fixes).
  - drm/amd/display: Allocate zero bw after bw alloc enable
    (stable-fixes).
  - drm/amd/display: Add dtbclk access to dcn315 (stable-fixes).
  - drm/amdgpu: Fix VRAM memory accounting (stable-fixes).
  - drm/etnaviv: fix tx clock gating on some GC7000 variants
    (stable-fixes).
  - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is
    enabled (stable-fixes).
  - iio: adc: ad9467: use chip_info variables instead of array
    (stable-fixes).
  - iio: adc: ad9467: use spi_get_device_match_data()
    (stable-fixes).
  - iio: accel: mxc4005: allow module autoloading via OF compatible
    (stable-fixes).
  - commit 4e48378
  - kABI workaround for sof_ipc_pcm_ops (git-fixes).
  - commit 070cfe5
  - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
    (git-fixes).
  - cxl/region: Fix memregion leaks in devm_cxl_add_region()
    (git-fixes).
  - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
    (git-fixes).
  - cxl/region: Fix cxlr_pmem leaks (git-fixes).
  - cxl/trace: Correct DPA field masks for general_media & dram
    events (git-fixes).
  - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
    (stable-fixes).
  - drm/amdgpu/mes: fix use-after-free issue (stable-fixes).
  - drm/amdgpu: Fix the ring buffer size for queue VM flush
    (stable-fixes).
  - drm/amdkfd: Add VRAM accounting for SVM migration
    (stable-fixes).
  - drm/amd/pm: Restore config space after reset (stable-fixes).
  - drm/amdgpu: Update BO eviction priorities (stable-fixes).
  - drm/amd/display: Set color_mgmt_changed to true on unsuspend
    (stable-fixes).
  - drm/amd/display: Revert Remove pixle rate limit for subvp
    (stable-fixes).
  - drm/amd/display: Remove pixle rate limit for subvp
    (stable-fixes).
  - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
    (stable-fixes).
  - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
    (stable-fixes).
  - ASoC: Intel: common: add ACPI matching tables for Arrow Lake
    (stable-fixes).
  - Bluetooth: ISO: Fix BIS cleanup (stable-fixes).
  - commit b6ffdb9
  - KVM: arm64: Use local TLBI on permission relaxation
    (bsc#1219478).
  - Refresh
    patches.suse/KVM-arm64-Always-invalidate-TLB-for-stage-2-permission-faults.
  - commit c414679

++++ kernel-default:

  - Temporarily drop KVM patch that caused a regression (bsc#1226158)
    Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
  - commit 33f31da
  - kABI: bpf: verifier kABI workaround
    (bsc#1225903).
  - commit 726091c
  - bpf: keep track of max number of bpf_loop callback iterations
    (bsc#1225903).
  - selftests/bpf: test widening for iterating callbacks
    (bsc#1225903).
  - bpf: widening for callback iterators (bsc#1225903).
  - selftests/bpf: tests for iterating callbacks (bsc#1225903).
  - bpf: verify callbacks as if they are called unknown number of
    times (bsc#1225903).
  - bpf: extract setup_func_entry() utility function (bsc#1225903).
  - bpf: extract __check_reg_arg() utility function (bsc#1225903).
  - selftests/bpf: track string payload offset as scalar in
    strobemeta (bsc#1225903).
  - selftests/bpf: track tcp payload offset as scalar in
    xdp_synproxy (bsc#1225903).
  - bpf: print full verifier states on infinite loop detection
    (bsc#1225903).
  - selftests/bpf: test if state loops are detected in a tricky case
    (bsc#1225903).
  - bpf: correct loop detection for iterators convergence
    (bsc#1225903).
  - selftests/bpf: tests with delayed read/precision makrs in loop
    body (bsc#1225903).
  - bpf: exact states comparison for iterator convergence checks
    (bsc#1225903).
  - bpf: extract same_callsites() as utility function (bsc#1225903).
  - bpf: move explored_state() closer to the beginning of verifier.c
    (bsc#1225903).
  - commit 63dfc45
  - blacklist.conf: Add a7fb0423c201 cgroup: Move rcu_head up near the top of cgroup_root
  - commit 3f951ce
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
    (CVE-2024-36903 bsc#1225741).
  - commit f510672
  - Update references
  - commit 36a2563
  - drm/amd/display: Skip on writeback when it's not applicable (CVE-2024-36914 bsc#1225757).
  - commit e1ad803
  - cpufreq: amd-pstate: Fix the inconsistency in max frequency
    units (git-fixes).
  - commit 9dd9a2b
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
    (bsc#1225737 CVE-2024-36899).
  - commit 24144db
  - nouveau: report byte usage in VRAM usage (git-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 5638f93
  - nouveau: add an ioctl to report vram usage (stable-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 7ea88ac
  - nouveau: add an ioctl to return vram bar size (stable-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 07ddfce
  - platform/x86: dell-smbios: Fix wrong token data in sysfs
    (git-fixes).
  - net: phy: Micrel KSZ8061: fix errata solution not taking effect
    problem (git-fixes).
  - wifi: ath10k: fix QCOM_RPROC_COMMON dependency (git-fixes).
  - wifi: mac80211: correctly parse Spatial Reuse Parameter Set
    element (git-fixes).
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    (git-fixes).
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    (git-fixes).
  - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of
    debugfs ifdef (git-fixes).
  - wifi: iwlwifi: mvm: set properly mac header (git-fixes).
  - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
    (git-fixes).
  - wifi: iwlwifi: mvm: don't initialize csa_work twice (git-fixes).
  - wifi: cfg80211: pmsr: use correct nla_get_uX functions
    (git-fixes).
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station (git-fixes).
  - wifi: cfg80211: fully move wiphy work to unbound workqueue
    (git-fixes).
  - wifi: mac80211: Fix deadlock in
    ieee80211_sta_ps_deliver_wakeup() (git-fixes).
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    (git-fixes).
  - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume
    (git-fixes).
  - module: don't ignore sysfs_create_link() failures (git-fixes).
  - soundwire: cadence: fix invalid PDI offset (stable-fixes).
  - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
    (stable-fixes).
  - platform/x86: thinkpad_acpi: Take hotkey_mutex during
    hotkey_exit() (git-fixes).
  - media: radio-shark2: Avoid led_names truncations (git-fixes).
  - wifi: nl80211: Avoid address calculations via out of bounds
    array indexing (git-fixes).
  - selftests: mptcp: add ms units for tc-netem delay
    (stable-fixes).
  - pwm: sti: Simplify probe function using devm functions
    (git-fixes).
  - regulator: vqmmc-ipq4019: fix module autoloading (stable-fixes).
  - regulator: irq_helpers: duplicate IRQ name (stable-fixes).
  - platform/x86: ISST: Add Grand Ridge to HPM CPU list
    (stable-fixes).
  - selftests: sud_test: return correct emulated syscall value on
    RISC-V (stable-fixes).
  - wifi: cfg80211: fix the order of arguments for trace events
    of the tx_rx_evt class (stable-fixes).
  - wifi: mac80211: ensure beacon is non-S1G prior to extracting
    the beacon timestamp field (stable-fixes).
  - wifi: mac80211: don't use rate mask for scanning (stable-fixes).
  - pwm: sti: Prepare removing pwm_chip from driver data
    (stable-fixes).
  - commit d252b95
  - HID: logitech-dj: Fix memory leak in
    logi_dj_recv_switch_to_dj_mode() (git-fixes).
  - HID: core: remove unnecessary WARN_ON() in implement()
    (git-fixes).
  - kconfig: doc: fix a typo in the note about 'imply' (git-fixes).
  - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
    (git-fixes).
  - gpio: tqmx86: store IRQ trigger type and unmask status
    separately (git-fixes).
  - gpio: tqmx86: fix typo in Kconfig label (git-fixes).
  - drm/vmwgfx: Don't memcmp equivalent pointers (git-fixes).
  - drm/vmwgfx: 3D disabled should not effect STDU memory limits
    (git-fixes).
  - drm/vmwgfx: Filter modes which exceed graphics memory
    (git-fixes).
  - drm/panel: sitronix-st7789v: Add check for
    of_drm_get_panel_orientation (git-fixes).
  - drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
    (git-fixes).
  - kconfig: fix comparison to constant symbols, 'm', 'n'
    (git-fixes).
  - drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_
    cp_compute_microcode() and rlc_microcode() (git-fixes).
  - drm/amdgpu: init microcode chip name from ip versions
    (stable-fixes).
  - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
    (stable-fixes).
  - iio: accel: mxc4005: Reset chip on probe() and resume()
    (stable-fixes).
  - drm/amdkfd: Flush the process wq before creating a kfd_process
    (stable-fixes).
  - drm/amd/display: Disable seamless boot on 128b/132b encoding
    (stable-fixes).
  - drm/amd/display: Fix DC mode screen flickering on DCN321
    (stable-fixes).
  - drm/amd/display: Add VCO speed parameter for DCN31 FPU
    (stable-fixes).
  - drm/amd/display: Allocate zero bw after bw alloc enable
    (stable-fixes).
  - drm/amd/display: Add dtbclk access to dcn315 (stable-fixes).
  - drm/amdgpu: Fix VRAM memory accounting (stable-fixes).
  - drm/etnaviv: fix tx clock gating on some GC7000 variants
    (stable-fixes).
  - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is
    enabled (stable-fixes).
  - iio: adc: ad9467: use chip_info variables instead of array
    (stable-fixes).
  - iio: adc: ad9467: use spi_get_device_match_data()
    (stable-fixes).
  - iio: accel: mxc4005: allow module autoloading via OF compatible
    (stable-fixes).
  - commit 4e48378
  - kABI workaround for sof_ipc_pcm_ops (git-fixes).
  - commit 070cfe5
  - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
    (git-fixes).
  - cxl/region: Fix memregion leaks in devm_cxl_add_region()
    (git-fixes).
  - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
    (git-fixes).
  - cxl/region: Fix cxlr_pmem leaks (git-fixes).
  - cxl/trace: Correct DPA field masks for general_media & dram
    events (git-fixes).
  - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
    (stable-fixes).
  - drm/amdgpu/mes: fix use-after-free issue (stable-fixes).
  - drm/amdgpu: Fix the ring buffer size for queue VM flush
    (stable-fixes).
  - drm/amdkfd: Add VRAM accounting for SVM migration
    (stable-fixes).
  - drm/amd/pm: Restore config space after reset (stable-fixes).
  - drm/amdgpu: Update BO eviction priorities (stable-fixes).
  - drm/amd/display: Set color_mgmt_changed to true on unsuspend
    (stable-fixes).
  - drm/amd/display: Revert Remove pixle rate limit for subvp
    (stable-fixes).
  - drm/amd/display: Remove pixle rate limit for subvp
    (stable-fixes).
  - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
    (stable-fixes).
  - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
    (stable-fixes).
  - ASoC: Intel: common: add ACPI matching tables for Arrow Lake
    (stable-fixes).
  - Bluetooth: ISO: Fix BIS cleanup (stable-fixes).
  - commit b6ffdb9
  - KVM: arm64: Use local TLBI on permission relaxation
    (bsc#1219478).
  - Refresh
    patches.suse/KVM-arm64-Always-invalidate-TLB-for-stage-2-permission-faults.
  - commit c414679

++++ kernel-default:

  - smb: client: fix use-after-free bug in
    cifs_debug_data_proc_show() (bsc#1225487, CVE-2023-52752).
  - commit c4e1b53
  - Temporarily drop KVM patch that caused a regression (bsc#1226158)
    Delete patches.suse/KVM-x86-pmu-Prioritize-VMX-interception-over-GP-on-R.patch
  - commit 33f31da
  - kABI: bpf: verifier kABI workaround
    (bsc#1225903).
  - commit 726091c
  - bpf: keep track of max number of bpf_loop callback iterations
    (bsc#1225903).
  - selftests/bpf: test widening for iterating callbacks
    (bsc#1225903).
  - bpf: widening for callback iterators (bsc#1225903).
  - selftests/bpf: tests for iterating callbacks (bsc#1225903).
  - bpf: verify callbacks as if they are called unknown number of
    times (bsc#1225903).
  - bpf: extract setup_func_entry() utility function (bsc#1225903).
  - bpf: extract __check_reg_arg() utility function (bsc#1225903).
  - selftests/bpf: track string payload offset as scalar in
    strobemeta (bsc#1225903).
  - selftests/bpf: track tcp payload offset as scalar in
    xdp_synproxy (bsc#1225903).
  - bpf: print full verifier states on infinite loop detection
    (bsc#1225903).
  - selftests/bpf: test if state loops are detected in a tricky case
    (bsc#1225903).
  - bpf: correct loop detection for iterators convergence
    (bsc#1225903).
  - selftests/bpf: tests with delayed read/precision makrs in loop
    body (bsc#1225903).
  - bpf: exact states comparison for iterator convergence checks
    (bsc#1225903).
  - bpf: extract same_callsites() as utility function (bsc#1225903).
  - bpf: move explored_state() closer to the beginning of verifier.c
    (bsc#1225903).
  - commit 63dfc45
  - blacklist.conf: Add a7fb0423c201 cgroup: Move rcu_head up near the top of cgroup_root
  - commit 3f951ce
  - ipv6: Fix potential uninit-value access in __ip6_make_skb()
    (CVE-2024-36903 bsc#1225741).
  - commit f510672
  - Update references
  - commit 36a2563
  - drm/amd/display: Skip on writeback when it's not applicable (CVE-2024-36914 bsc#1225757).
  - commit e1ad803
  - cpufreq: amd-pstate: Fix the inconsistency in max frequency
    units (git-fixes).
  - commit 9dd9a2b
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify
    (bsc#1225737 CVE-2024-36899).
  - commit 24144db
  - nouveau: report byte usage in VRAM usage (git-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 5638f93
  - nouveau: add an ioctl to report vram usage (stable-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 7ea88ac
  - nouveau: add an ioctl to return vram bar size (stable-fixes).
  - Refresh
    patches.suse/drm-nouveau-use-tile_mode-and-pte_kind-for-VM_BIND-b.patch.
  - commit 07ddfce
  - platform/x86: dell-smbios: Fix wrong token data in sysfs
    (git-fixes).
  - net: phy: Micrel KSZ8061: fix errata solution not taking effect
    problem (git-fixes).
  - wifi: ath10k: fix QCOM_RPROC_COMMON dependency (git-fixes).
  - wifi: mac80211: correctly parse Spatial Reuse Parameter Set
    element (git-fixes).
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    (git-fixes).
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    (git-fixes).
  - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of
    debugfs ifdef (git-fixes).
  - wifi: iwlwifi: mvm: set properly mac header (git-fixes).
  - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
    (git-fixes).
  - wifi: iwlwifi: mvm: don't initialize csa_work twice (git-fixes).
  - wifi: cfg80211: pmsr: use correct nla_get_uX functions
    (git-fixes).
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station (git-fixes).
  - wifi: cfg80211: fully move wiphy work to unbound workqueue
    (git-fixes).
  - wifi: mac80211: Fix deadlock in
    ieee80211_sta_ps_deliver_wakeup() (git-fixes).
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    (git-fixes).
  - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume
    (git-fixes).
  - module: don't ignore sysfs_create_link() failures (git-fixes).
  - soundwire: cadence: fix invalid PDI offset (stable-fixes).
  - platform/x86/intel/tpmi: Handle error from tpmi_process_info()
    (stable-fixes).
  - platform/x86: thinkpad_acpi: Take hotkey_mutex during
    hotkey_exit() (git-fixes).
  - media: radio-shark2: Avoid led_names truncations (git-fixes).
  - wifi: nl80211: Avoid address calculations via out of bounds
    array indexing (git-fixes).
  - selftests: mptcp: add ms units for tc-netem delay
    (stable-fixes).
  - pwm: sti: Simplify probe function using devm functions
    (git-fixes).
  - regulator: vqmmc-ipq4019: fix module autoloading (stable-fixes).
  - regulator: irq_helpers: duplicate IRQ name (stable-fixes).
  - platform/x86: ISST: Add Grand Ridge to HPM CPU list
    (stable-fixes).
  - selftests: sud_test: return correct emulated syscall value on
    RISC-V (stable-fixes).
  - wifi: cfg80211: fix the order of arguments for trace events
    of the tx_rx_evt class (stable-fixes).
  - wifi: mac80211: ensure beacon is non-S1G prior to extracting
    the beacon timestamp field (stable-fixes).
  - wifi: mac80211: don't use rate mask for scanning (stable-fixes).
  - pwm: sti: Prepare removing pwm_chip from driver data
    (stable-fixes).
  - commit d252b95
  - HID: logitech-dj: Fix memory leak in
    logi_dj_recv_switch_to_dj_mode() (git-fixes).
  - HID: core: remove unnecessary WARN_ON() in implement()
    (git-fixes).
  - kconfig: doc: fix a typo in the note about 'imply' (git-fixes).
  - gpio: tqmx86: fix broken IRQ_TYPE_EDGE_BOTH interrupt type
    (git-fixes).
  - gpio: tqmx86: store IRQ trigger type and unmask status
    separately (git-fixes).
  - gpio: tqmx86: fix typo in Kconfig label (git-fixes).
  - drm/vmwgfx: Don't memcmp equivalent pointers (git-fixes).
  - drm/vmwgfx: 3D disabled should not effect STDU memory limits
    (git-fixes).
  - drm/vmwgfx: Filter modes which exceed graphics memory
    (git-fixes).
  - drm/panel: sitronix-st7789v: Add check for
    of_drm_get_panel_orientation (git-fixes).
  - drm/amd: Fix shutdown (again) on some SMU v13.0.4/11 platforms
    (git-fixes).
  - kconfig: fix comparison to constant symbols, 'm', 'n'
    (git-fixes).
  - drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_
    cp_compute_microcode() and rlc_microcode() (git-fixes).
  - drm/amdgpu: init microcode chip name from ip versions
    (stable-fixes).
  - fpga: dfl-pci: add PCI subdevice ID for Intel D5005 card
    (stable-fixes).
  - iio: accel: mxc4005: Reset chip on probe() and resume()
    (stable-fixes).
  - drm/amdkfd: Flush the process wq before creating a kfd_process
    (stable-fixes).
  - drm/amd/display: Disable seamless boot on 128b/132b encoding
    (stable-fixes).
  - drm/amd/display: Fix DC mode screen flickering on DCN321
    (stable-fixes).
  - drm/amd/display: Add VCO speed parameter for DCN31 FPU
    (stable-fixes).
  - drm/amd/display: Allocate zero bw after bw alloc enable
    (stable-fixes).
  - drm/amd/display: Add dtbclk access to dcn315 (stable-fixes).
  - drm/amdgpu: Fix VRAM memory accounting (stable-fixes).
  - drm/etnaviv: fix tx clock gating on some GC7000 variants
    (stable-fixes).
  - HID: mcp-2221: cancel delayed_work only when CONFIG_IIO is
    enabled (stable-fixes).
  - iio: adc: ad9467: use chip_info variables instead of array
    (stable-fixes).
  - iio: adc: ad9467: use spi_get_device_match_data()
    (stable-fixes).
  - iio: accel: mxc4005: allow module autoloading via OF compatible
    (stable-fixes).
  - commit 4e48378
  - kABI workaround for sof_ipc_pcm_ops (git-fixes).
  - commit 070cfe5
  - Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
    (git-fixes).
  - cxl/region: Fix memregion leaks in devm_cxl_add_region()
    (git-fixes).
  - cxl/test: Add missing vmalloc.h for tools/testing/cxl/test/mem.c
    (git-fixes).
  - cxl/region: Fix cxlr_pmem leaks (git-fixes).
  - cxl/trace: Correct DPA field masks for general_media & dram
    events (git-fixes).
  - ASoC: SOF: pcm: Restrict DSP D0i3 during S0ix to IPC3
    (stable-fixes).
  - drm/amdgpu/mes: fix use-after-free issue (stable-fixes).
  - drm/amdgpu: Fix the ring buffer size for queue VM flush
    (stable-fixes).
  - drm/amdkfd: Add VRAM accounting for SVM migration
    (stable-fixes).
  - drm/amd/pm: Restore config space after reset (stable-fixes).
  - drm/amdgpu: Update BO eviction priorities (stable-fixes).
  - drm/amd/display: Set color_mgmt_changed to true on unsuspend
    (stable-fixes).
  - drm/amd/display: Revert Remove pixle rate limit for subvp
    (stable-fixes).
  - drm/amd/display: Remove pixle rate limit for subvp
    (stable-fixes).
  - Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS
    (stable-fixes).
  - Bluetooth: Remove usage of the deprecated ida_simple_xx() API
    (stable-fixes).
  - ASoC: Intel: common: add ACPI matching tables for Arrow Lake
    (stable-fixes).
  - Bluetooth: ISO: Fix BIS cleanup (stable-fixes).
  - commit b6ffdb9
  - KVM: arm64: Use local TLBI on permission relaxation
    (bsc#1219478).
  - Refresh
    patches.suse/KVM-arm64-Always-invalidate-TLB-for-stage-2-permission-faults.
  - commit c414679

++++ rust-keylime:

  - Update to version 0.2.6~0:
    * Bump version to 0.2.6
    * build(deps): bump libc from 0.2.153 to 0.2.155
    * build(deps): bump serde from 1.0.196 to 1.0.203
    * rpm/fedora: Update rust macro usage
    * config: Support hostnames in registrar_ip option
    * added use of persisted IAK and IDevID and authorisation values
    * config changes
    * Adding /agent/info API to agent
    * Fix leftover 'unnecessary qualification' warnings on tests

++++ rust-keylime:

  - Update to version 0.2.6~0:
    * Bump version to 0.2.6
    * build(deps): bump libc from 0.2.153 to 0.2.155
    * build(deps): bump serde from 1.0.196 to 1.0.203
    * rpm/fedora: Update rust macro usage
    * config: Support hostnames in registrar_ip option
    * added use of persisted IAK and IDevID and authorisation values
    * config changes
    * Adding /agent/info API to agent
    * Fix leftover 'unnecessary qualification' warnings on tests

++++ rust-keylime:

  - Update to version 0.2.6~0:
    * Bump version to 0.2.6
    * build(deps): bump libc from 0.2.153 to 0.2.155
    * build(deps): bump serde from 1.0.196 to 1.0.203
    * rpm/fedora: Update rust macro usage
    * config: Support hostnames in registrar_ip option
    * added use of persisted IAK and IDevID and authorisation values
    * config changes
    * Adding /agent/info API to agent
    * Fix leftover 'unnecessary qualification' warnings on tests

++++ rust-keylime:

  - Update to version 0.2.6~0:
    * Bump version to 0.2.6
    * build(deps): bump libc from 0.2.153 to 0.2.155
    * build(deps): bump serde from 1.0.196 to 1.0.203
    * rpm/fedora: Update rust macro usage
    * config: Support hostnames in registrar_ip option
    * added use of persisted IAK and IDevID and authorisation values
    * config changes
    * Adding /agent/info API to agent
    * Fix leftover 'unnecessary qualification' warnings on tests

++++ rust-keylime:

  - Update to version 0.2.6~0:
    * Bump version to 0.2.6
    * build(deps): bump libc from 0.2.153 to 0.2.155
    * build(deps): bump serde from 1.0.196 to 1.0.203
    * rpm/fedora: Update rust macro usage
    * config: Support hostnames in registrar_ip option
    * added use of persisted IAK and IDevID and authorisation values
    * config changes
    * Adding /agent/info API to agent
    * Fix leftover 'unnecessary qualification' warnings on tests

------------------------------------------------------------------
------------------  2024-6-13  -  Jun 13 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR
    in CPUID (git-fixes).
  - commit 001738e
  - net: usb: qmi_wwan: add Telit FN920C04 compositions (git-fixes).
  - commit 49f5909
  - Replace the inhouse patch with following upstream patch
    (bsc#1221097, bsc#1224572, CVE-2024-35979)
    patches.suse/raid1-fix-use-after-free-for-original-bio-in-raid1_-fcf3.patch.
  - commit 03ae28a
  - supported.conf: mark ufs as unsupported
    UFS is an unsupported filesystem, mark it as such. We still keep it
    around (not marking as optional), to accommodate any potential
    migrations from BSD systems.
  - commit 5192abd
  - supported.conf: mark orangefs as optional
    We don't support orangefs at all (and it is already marked as such), but
    since there are no SLE consumers of it, mark it as optional.
  - commit 264e3d2
  - blacklist.conf: add f2fs fixes 87161a2b0aed and 4e0197f9932f
    Both are f2fs-related fixes, f2fs is unsupported and not compiled at
    all.
  - commit e891815
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
    (git-fixes).
  - commit 181df2f
  - rpm/kernel-obs-build.spec.in: Add iso9660 (bsc#1226212)
    Some builds don't just create an iso9660 image, but also mount it during
    build.
  - commit aaee141
  - blacklist.conf: kABI
  - commit 70e89e6
  - Input: xpad - add support for ASUS ROG RAIKIRI (git-fixes).
  - commit 9d3a015

++++ kernel-default:

  - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR
    in CPUID (git-fixes).
  - commit 001738e
  - cgroup: preserve KABI of cgroup_root (bsc#1222254).
  - commit d652cd6
  - cgroup: Add annotation for holding namespace_sem in
    current_cgns_cgroup_from_root() (bsc#1222254).
  - cgroup: Eliminate the need for cgroup_mutex in
    proc_cgroup_show() (bsc#1222254).
  - cgroup: Make operations on the cgroup root_list RCU safe
    (bsc#1222254).
  - cgroup: Remove unnecessary list_empty() (bsc#1222254).
  - commit 8dc654b
  - net: usb: qmi_wwan: add Telit FN920C04 compositions (git-fixes).
  - commit 49f5909
  - Replace the inhouse patch with following upstream patch
    (bsc#1221097, bsc#1224572, CVE-2024-35979)
    patches.suse/raid1-fix-use-after-free-for-original-bio-in-raid1_-fcf3.patch.
  - commit 03ae28a
  - supported.conf: mark ufs as unsupported
    UFS is an unsupported filesystem, mark it as such. We still keep it
    around (not marking as optional), to accommodate any potential
    migrations from BSD systems.
  - commit 5192abd
  - supported.conf: mark orangefs as optional
    We don't support orangefs at all (and it is already marked as such), but
    since there are no SLE consumers of it, mark it as optional.
  - commit 264e3d2
  - blacklist.conf: add f2fs fixes 87161a2b0aed and 4e0197f9932f
    Both are f2fs-related fixes, f2fs is unsupported and not compiled at
    all.
  - commit e891815
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
    (git-fixes).
  - commit 181df2f
  - rpm/kernel-obs-build.spec.in: Add iso9660 (bsc#1226212)
    Some builds don't just create an iso9660 image, but also mount it during
    build.
  - commit aaee141
  - blacklist.conf: kABI
  - commit 70e89e6
  - Input: xpad - add support for ASUS ROG RAIKIRI (git-fixes).
  - commit 9d3a015

++++ kernel-default:

  - KVM: x86: Don't advertise guest.MAXPHYADDR as host.MAXPHYADDR
    in CPUID (git-fixes).
  - commit 001738e
  - cgroup: preserve KABI of cgroup_root (bsc#1222254).
  - commit d652cd6
  - cgroup: Add annotation for holding namespace_sem in
    current_cgns_cgroup_from_root() (bsc#1222254).
  - cgroup: Eliminate the need for cgroup_mutex in
    proc_cgroup_show() (bsc#1222254).
  - cgroup: Make operations on the cgroup root_list RCU safe
    (bsc#1222254).
  - cgroup: Remove unnecessary list_empty() (bsc#1222254).
  - commit 8dc654b
  - net: usb: qmi_wwan: add Telit FN920C04 compositions (git-fixes).
  - commit 49f5909
  - Replace the inhouse patch with following upstream patch
    (bsc#1221097, bsc#1224572, CVE-2024-35979)
    patches.suse/raid1-fix-use-after-free-for-original-bio-in-raid1_-fcf3.patch.
  - commit 03ae28a
  - supported.conf: mark ufs as unsupported
    UFS is an unsupported filesystem, mark it as such. We still keep it
    around (not marking as optional), to accommodate any potential
    migrations from BSD systems.
  - commit 5192abd
  - supported.conf: mark orangefs as optional
    We don't support orangefs at all (and it is already marked as such), but
    since there are no SLE consumers of it, mark it as optional.
  - commit 264e3d2
  - blacklist.conf: add f2fs fixes 87161a2b0aed and 4e0197f9932f
    Both are f2fs-related fixes, f2fs is unsupported and not compiled at
    all.
  - commit e891815
  - nilfs2: fix potential hang in nilfs_detach_log_writer()
    (git-fixes).
  - commit 181df2f
  - rpm/kernel-obs-build.spec.in: Add iso9660 (bsc#1226212)
    Some builds don't just create an iso9660 image, but also mount it during
    build.
  - commit aaee141
  - blacklist.conf: kABI
  - commit 70e89e6
  - Input: xpad - add support for ASUS ROG RAIKIRI (git-fixes).
  - commit 9d3a015

++++ libarchive:

  - Fix CVE-2024-20696, heap based out-of-bounds write
    (CVE-2024-20696, bsc#1225971)
    * CVE-2024-20696.patch
  - Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
    (CVE-2024-20697, bsc#1225972)
    * CVE-2024-20697.patch

++++ libarchive:

  - Fix CVE-2024-20696, heap based out-of-bounds write
    (CVE-2024-20696, bsc#1225971)
    * CVE-2024-20696.patch
  - Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
    (CVE-2024-20697, bsc#1225972)
    * CVE-2024-20697.patch

++++ libarchive:

  - Fix CVE-2024-20696, heap based out-of-bounds write
    (CVE-2024-20696, bsc#1225971)
    * CVE-2024-20696.patch
  - Fix CVE-2024-20697, Out of bounds Remote Code Execution Vulnerability
    (CVE-2024-20697, bsc#1225972)
    * CVE-2024-20697.patch

------------------------------------------------------------------
------------------  2024-6-12  -  Jun 12 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - test-image-live: add shadow package
    Fixes:
    KiwiCommandError: chroot: stderr: /usr/bin/chroot: failed to run command ‘usermod’: No such file or directory

++++ python-kiwi:

  - test-image-live: add shadow package
    Fixes:
    KiwiCommandError: chroot: stderr: /usr/bin/chroot: failed to run command ‘usermod’: No such file or directory

++++ python-kiwi:

  - test-image-live: add shadow package
    Fixes:
    KiwiCommandError: chroot: stderr: /usr/bin/chroot: failed to run command ‘usermod’: No such file or directory

++++ kernel-default:

  - ext4: correct offset of gdb backup in non meta_bg group to
    update_backups (bsc#1224735 CVE-2024-35807).
  - commit 68779d8
  - ext4: remove unnecessary check from alloc_flex_gd() (bsc#1222080
    CVE-2023-52622).
  - commit 2e6ec2e
  - llc: verify mac len before reading mac header
    (CVE-2023-52843 bsc#1224951).
  - commit ea955e6
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
    (CVE-2024-35898 bsc#1224498).
  - commit 47a49f0
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
    (CVE-2024-36915 bsc#1225758).
  - commit 0955416
  - net: add copy_safe_from_sockptr() helper
    (git-fixes prerequisite CVE-2024-36915 bsc#1225758).
  - commit e4ca26d
  - rpm/kernel-obs-build.spec.in: Add networking modules for docker
    (bsc#1226211)
    docker needs more networking modules, even legacy iptable_nat and _filter.
  - commit 415e132

++++ kernel-default:

  - ext4: correct offset of gdb backup in non meta_bg group to
    update_backups (bsc#1224735 CVE-2024-35807).
  - commit 68779d8
  - ext4: remove unnecessary check from alloc_flex_gd() (bsc#1222080
    CVE-2023-52622).
  - commit 2e6ec2e
  - llc: verify mac len before reading mac header
    (CVE-2023-52843 bsc#1224951).
  - commit ea955e6
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
    (CVE-2024-35898 bsc#1224498).
  - commit 47a49f0
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
    (CVE-2024-36915 bsc#1225758).
  - commit 0955416
  - net: add copy_safe_from_sockptr() helper
    (git-fixes prerequisite CVE-2024-36915 bsc#1225758).
  - commit e4ca26d
  - rpm/kernel-obs-build.spec.in: Add networking modules for docker
    (bsc#1226211)
    docker needs more networking modules, even legacy iptable_nat and _filter.
  - commit 415e132

++++ kernel-default:

  - ext4: correct offset of gdb backup in non meta_bg group to
    update_backups (bsc#1224735 CVE-2024-35807).
  - commit 68779d8
  - ext4: remove unnecessary check from alloc_flex_gd() (bsc#1222080
    CVE-2023-52622).
  - commit 2e6ec2e
  - llc: verify mac len before reading mac header
    (CVE-2023-52843 bsc#1224951).
  - commit ea955e6
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
    (CVE-2024-35898 bsc#1224498).
  - commit 47a49f0
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
    (CVE-2024-36915 bsc#1225758).
  - commit 0955416
  - net: add copy_safe_from_sockptr() helper
    (git-fixes prerequisite CVE-2024-36915 bsc#1225758).
  - commit e4ca26d
  - rpm/kernel-obs-build.spec.in: Add networking modules for docker
    (bsc#1226211)
    docker needs more networking modules, even legacy iptable_nat and _filter.
  - commit 415e132

------------------------------------------------------------------
------------------  2024-6-11  -  Jun 11 2024  -------------------
------------------------------------------------------------------

++++ cups:

  - cups-2.4.8-CVE-2024-35235.patch is derived
    from the upstream patch against master (CUPS 2.5)
    to apply to CUPS 2.4.8 in openSUSE Factory to fix CVE-2024-35235
    "cupsd Listen port arbitrary chmod 0140777"
    https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
    bsc#1225365

++++ cups:

  - cups-2.4.8-CVE-2024-35235.patch is derived
    from the upstream patch against master (CUPS 2.5)
    to apply to CUPS 2.4.8 in openSUSE Factory to fix CVE-2024-35235
    "cupsd Listen port arbitrary chmod 0140777"
    https://github.com/OpenPrinting/cups/security/advisories/GHSA-vvwp-mv6j-hw6f
    bsc#1225365

++++ python-kiwi:

  - Fix displaying the image verification failure dialog
    Kiwi must wait for the previous dialog to finish before showing another
    one as it's the same systemd service behind it.

++++ python-kiwi:

  - Fix displaying the image verification failure dialog
    Kiwi must wait for the previous dialog to finish before showing another
    one as it's the same systemd service behind it.

++++ python-kiwi:

  - Fix displaying the image verification failure dialog
    Kiwi must wait for the previous dialog to finish before showing another
    one as it's the same systemd service behind it.

++++ kernel-default:

  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    (CVE-2024-36017 bsc#1225681).
  - commit 349b81e
  - mm: use memalloc_nofs_save() in page_cache_ra_order()
    (bsc#1225723 CVE-2024-36882).
  - commit 858537f
  - blk-iocost: avoid out of bounds shift (bsc#1225759
    CVE-2024-36916).
  - commit 9e35e70
  - netfilter: complete validation of user input
    (git-fixes CVE-2024-35896 bsc#1224662).
  - commit a54ae57
  - net: hns3: fix kernel crash when devlink reload during
    initialization (CVE-2024-36900 bsc#1225726).
  - net: hns3: release PTP resources if pf initialization failed
    (CVE-2024-36900 bsc#1225726).
  - commit ad59124
  - blk-mq: make sure active queue usage is held for
    bio_integrity_prep() (bsc#1225105 CVE-2023-52787).
  - commit 6131890
  - block: prevent division by zero in blk_rq_stat_sum()
    (bsc#1224661 CVE-2024-35925).
  - commit 7339ca3
  - Update refs for patches.suse/nbd-fix-uaf-in-nbd_open.patch (bsc#1216436
    bsc#1224935 CVE-2023-52837).
  - commit 95ff8cb
  - netfilter: validate user input for expected length
    (CVE-2024-35896 bsc#1224662).
  - commit 6a29de4
  - ext4: fix corruption during on-line resize (bsc#1224735
    CVE-2024-35807).
  - commit 751677a
  - ext4: fix racy may inline data check in dio write (bsc#1224939
    CVE-2023-52786).
  - commit 742009f
  - ext4: avoid online resizing failures due to oversized flex bg
    (bsc#1222080 CVE-2023-52622).
  - commit 817510d
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
    (git-fixes).
  - commit d2efb00
  - net: mana: Enable MANA driver on ARM64 with 4K page size
    (jsc#PED-8491).
  - Update config files.
  - commit 5211306
  - bna: ensure the copied buf is NUL terminated (CVE-2024-36934
    bsc#1225760).
  - ice: ensure the copied buf is NUL terminated (CVE-2024-36935
    bsc#1225763).
  - commit ab36d7d
  - xdp: use flags field to disambiguate broadcast redirect
    (bsc#1225834 CVE-2024-36937).
  - commit de0720c
  - fs/pipe: move check to pipe_has_watch_queue() (bsc#1224614
    CVE-2023-52672).
  - commit 66a9a3f

++++ kernel-default:

  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    (CVE-2024-36017 bsc#1225681).
  - commit 349b81e
  - mm: use memalloc_nofs_save() in page_cache_ra_order()
    (bsc#1225723 CVE-2024-36882).
  - commit 858537f
  - blk-iocost: avoid out of bounds shift (bsc#1225759
    CVE-2024-36916).
  - commit 9e35e70
  - netfilter: complete validation of user input
    (git-fixes CVE-2024-35896 bsc#1224662).
  - commit a54ae57
  - net: hns3: fix kernel crash when devlink reload during
    initialization (CVE-2024-36900 bsc#1225726).
  - net: hns3: release PTP resources if pf initialization failed
    (CVE-2024-36900 bsc#1225726).
  - commit ad59124
  - blk-mq: make sure active queue usage is held for
    bio_integrity_prep() (bsc#1225105 CVE-2023-52787).
  - commit 6131890
  - block: prevent division by zero in blk_rq_stat_sum()
    (bsc#1224661 CVE-2024-35925).
  - commit 7339ca3
  - Update refs for patches.suse/nbd-fix-uaf-in-nbd_open.patch (bsc#1216436
    bsc#1224935 CVE-2023-52837).
  - commit 95ff8cb
  - netfilter: validate user input for expected length
    (CVE-2024-35896 bsc#1224662).
  - commit 6a29de4
  - ext4: fix corruption during on-line resize (bsc#1224735
    CVE-2024-35807).
  - commit 751677a
  - ext4: fix racy may inline data check in dio write (bsc#1224939
    CVE-2023-52786).
  - commit 742009f
  - ext4: avoid online resizing failures due to oversized flex bg
    (bsc#1222080 CVE-2023-52622).
  - commit 817510d
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
    (git-fixes).
  - commit d2efb00
  - net: mana: Enable MANA driver on ARM64 with 4K page size
    (jsc#PED-8491).
  - Update config files.
  - commit 5211306
  - bna: ensure the copied buf is NUL terminated (CVE-2024-36934
    bsc#1225760).
  - ice: ensure the copied buf is NUL terminated (CVE-2024-36935
    bsc#1225763).
  - commit ab36d7d
  - xdp: use flags field to disambiguate broadcast redirect
    (bsc#1225834 CVE-2024-36937).
  - commit de0720c
  - fs/pipe: move check to pipe_has_watch_queue() (bsc#1224614
    CVE-2023-52672).
  - commit 66a9a3f

++++ kernel-default:

  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    (CVE-2024-36017 bsc#1225681).
  - commit 349b81e
  - mm: use memalloc_nofs_save() in page_cache_ra_order()
    (bsc#1225723 CVE-2024-36882).
  - commit 858537f
  - blk-iocost: avoid out of bounds shift (bsc#1225759
    CVE-2024-36916).
  - commit 9e35e70
  - netfilter: complete validation of user input
    (git-fixes CVE-2024-35896 bsc#1224662).
  - commit a54ae57
  - net: hns3: fix kernel crash when devlink reload during
    initialization (CVE-2024-36900 bsc#1225726).
  - net: hns3: release PTP resources if pf initialization failed
    (CVE-2024-36900 bsc#1225726).
  - commit ad59124
  - blk-mq: make sure active queue usage is held for
    bio_integrity_prep() (bsc#1225105 CVE-2023-52787).
  - commit 6131890
  - block: prevent division by zero in blk_rq_stat_sum()
    (bsc#1224661 CVE-2024-35925).
  - commit 7339ca3
  - Update refs for patches.suse/nbd-fix-uaf-in-nbd_open.patch (bsc#1216436
    bsc#1224935 CVE-2023-52837).
  - commit 95ff8cb
  - netfilter: validate user input for expected length
    (CVE-2024-35896 bsc#1224662).
  - commit 6a29de4
  - ext4: fix corruption during on-line resize (bsc#1224735
    CVE-2024-35807).
  - commit 751677a
  - ext4: fix racy may inline data check in dio write (bsc#1224939
    CVE-2023-52786).
  - commit 742009f
  - ext4: avoid online resizing failures due to oversized flex bg
    (bsc#1222080 CVE-2023-52622).
  - commit 817510d
  - arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
    (git-fixes).
  - commit d2efb00
  - net: mana: Enable MANA driver on ARM64 with 4K page size
    (jsc#PED-8491).
  - Update config files.
  - commit 5211306
  - bna: ensure the copied buf is NUL terminated (CVE-2024-36934
    bsc#1225760).
  - ice: ensure the copied buf is NUL terminated (CVE-2024-36935
    bsc#1225763).
  - commit ab36d7d
  - xdp: use flags field to disambiguate broadcast redirect
    (bsc#1225834 CVE-2024-36937).
  - commit de0720c
  - fs/pipe: move check to pipe_has_watch_queue() (bsc#1224614
    CVE-2023-52672).
  - commit 66a9a3f

++++ less:

  - Fix CVE-2024-32487, mishandling of \n character in paths when
    LESSOPEN is set leads to OS command execution
    (CVE-2024-32487, bsc#1222849)
    * CVE-2024-32487.patch

------------------------------------------------------------------
------------------  2024-6-10  -  Jun 10 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Allow to customize the path of the isoscan cowfile
    Added rd.live.cowfile.path option to specify the cowfile at
    any path below the isoscan-loop-mount. This Fixes #2554
  - Better error handling on grub vendor dir lookup
    The strings command is used to lookup the in-efi binary encoded
    vendor path. However, if the strings or bash command is not availabe
    on the build host, the command silently failed and moved into the
    standard (non vendored) EFI boot path. This can lead to a broken
    boot for those distros and image targets which requires a vendor
    directory and should lead to an error message instead of a
    successful image build. This Fixes #2565
  - Fixed profile variable settings for preferences
    It's allowed to have multiple preferences sections. If those
    sections provides the same value multiple times, e.g keytable,
    the last one in the row will win. The setup of the variables
    in .profile environment file for the preferences elements is
    not following this rule and used the first section not the
    last. This commit fixes the profile variables to match the
    actual setup and Fixes #2560

++++ python-kiwi:

  - Allow to customize the path of the isoscan cowfile
    Added rd.live.cowfile.path option to specify the cowfile at
    any path below the isoscan-loop-mount. This Fixes #2554
  - Better error handling on grub vendor dir lookup
    The strings command is used to lookup the in-efi binary encoded
    vendor path. However, if the strings or bash command is not availabe
    on the build host, the command silently failed and moved into the
    standard (non vendored) EFI boot path. This can lead to a broken
    boot for those distros and image targets which requires a vendor
    directory and should lead to an error message instead of a
    successful image build. This Fixes #2565
  - Fixed profile variable settings for preferences
    It's allowed to have multiple preferences sections. If those
    sections provides the same value multiple times, e.g keytable,
    the last one in the row will win. The setup of the variables
    in .profile environment file for the preferences elements is
    not following this rule and used the first section not the
    last. This commit fixes the profile variables to match the
    actual setup and Fixes #2560

++++ python-kiwi:

  - Allow to customize the path of the isoscan cowfile
    Added rd.live.cowfile.path option to specify the cowfile at
    any path below the isoscan-loop-mount. This Fixes #2554
  - Better error handling on grub vendor dir lookup
    The strings command is used to lookup the in-efi binary encoded
    vendor path. However, if the strings or bash command is not availabe
    on the build host, the command silently failed and moved into the
    standard (non vendored) EFI boot path. This can lead to a broken
    boot for those distros and image targets which requires a vendor
    directory and should lead to an error message instead of a
    successful image build. This Fixes #2565
  - Fixed profile variable settings for preferences
    It's allowed to have multiple preferences sections. If those
    sections provides the same value multiple times, e.g keytable,
    the last one in the row will win. The setup of the variables
    in .profile environment file for the preferences elements is
    not following this rule and used the first section not the
    last. This commit fixes the profile variables to match the
    actual setup and Fixes #2560

++++ ignition:

  - Update to version 2.19.0:
    * Support LUKS encryption using IBM CEX secure keys on s390x
    * providers: add "akamai" provider
  - Adding %check section
  - Build scripts are executable by themselves now, remove explicit
    Bash call

++++ ignition:

  - Update to version 2.19.0:
    * Support LUKS encryption using IBM CEX secure keys on s390x
    * providers: add "akamai" provider
  - Adding %check section
  - Build scripts are executable by themselves now, remove explicit
    Bash call

++++ ignition:

  - Update to version 2.19.0:
    * Support LUKS encryption using IBM CEX secure keys on s390x
    * providers: add "akamai" provider
  - Adding %check section
  - Build scripts are executable by themselves now, remove explicit
    Bash call

++++ kernel-default:

  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    (CVE-2023-52845 bsc#1225585).
  - commit a73a0ca
  - pipe: wakeup wr_wait after setting max_usage (bsc#1224614
    CVE-2023-52672).
  - commit 333fe30
  - blacklist.conf: add bsc#1223013 CVE-2024-26482, does not apply
  - commit a7ff2c2
  - netfilter: nf_tables: honor table dormant flag from netdev release event path
    (CVE-2024-36005 bsc#1224539).
  - commit 5b08b61
  - blacklist.conf: irrelevant build fix
  - commit 226f27a

++++ kernel-default:

  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    (CVE-2023-52845 bsc#1225585).
  - commit a73a0ca
  - pipe: wakeup wr_wait after setting max_usage (bsc#1224614
    CVE-2023-52672).
  - commit 333fe30
  - blacklist.conf: add bsc#1223013 CVE-2024-26482, does not apply
  - commit a7ff2c2
  - netfilter: nf_tables: honor table dormant flag from netdev release event path
    (CVE-2024-36005 bsc#1224539).
  - commit 5b08b61
  - blacklist.conf: irrelevant build fix
  - commit 226f27a

++++ kernel-default:

  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    (CVE-2023-52845 bsc#1225585).
  - commit a73a0ca
  - pipe: wakeup wr_wait after setting max_usage (bsc#1224614
    CVE-2023-52672).
  - commit 333fe30
  - blacklist.conf: add bsc#1223013 CVE-2024-26482, does not apply
  - commit a7ff2c2
  - netfilter: nf_tables: honor table dormant flag from netdev release event path
    (CVE-2024-36005 bsc#1224539).
  - commit 5b08b61
  - blacklist.conf: irrelevant build fix
  - commit 226f27a

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

++++ openssl-3:

  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Set the module in error state if the jitter RNG fails either on
    initialization or entropy gathering because health tests failed.
    * Add jitterentropy as a seeding source output also in crypto/info.c
    * Move the jitter entropy collector and the associated lock out
    of the header file to avoid redefinitions.
    * Add the fips_local.cnf symlink to the spec file. This simlink
    points to the openssl_fips.config file that is provided by the
    crypto-policies package.
    * Rebase openssl-3-jitterentropy-3.4.0.patch
    * Rebase openssl-FIPS-enforce-EMS-support.patch

------------------------------------------------------------------
------------------  2024-6-9  -  Jun 9 2024  -------------------
------------------------------------------------------------------

++++ util-linux:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

++++ util-linux:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

++++ util-linux:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

++++ util-linux:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

++++ util-linux-systemd:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

++++ util-linux-systemd:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

++++ util-linux-systemd:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

++++ util-linux-systemd:

  - Fix hang of lscpu -e (bsc#1225598,
    util-linux-libsmartcols-fix-reduction-stages-use.patch).

------------------------------------------------------------------
------------------  2024-6-8  -  Jun 8 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - scsi: target: core: Add TMF to tmr_list handling (bsc#1223018
    CVE-2024-26845).
  - commit 6b81c05

++++ kernel-default:

  - scsi: target: core: Add TMF to tmr_list handling (bsc#1223018
    CVE-2024-26845).
  - commit 6b81c05

++++ kernel-default:

  - scsi: target: core: Add TMF to tmr_list handling (bsc#1223018
    CVE-2024-26845).
  - commit 6b81c05

------------------------------------------------------------------
------------------  2024-6-7  -  Jun 7 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - iommu: mtk: fix module autoloading (git-fixes).
  - commit 50334e4
  - iommu/amd: Enhance def_domain_type to handle untrusted device
    (git-fixes).
  - commit 9d0dd7f
  - iommu: Undo pasid attachment only for the devices that have
    succeeded (git-fixes).
  - commit 4de170c
  - net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
    (CVE-2024-35892 bsc#1224515).
  - commit e8fcaf3
  - eeprom: at24: fix memory corruption race condition (bsc#1224612
    CVE-2024-35848).
  - commit 269cd6c
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel
    (CVE-2024-35884 bsc#1224520).
  - commit 78d5dd0
  - Kabi workaround for icmp: prevent possible NULL dereferences from
    icmp_build_probe() (CVE-2024-35857 bsc#1224619).
  - icmp: prevent possible NULL dereferences from icmp_build_probe()
    (CVE-2024-35857 bsc#1224619).
  - commit fa789e3

++++ kernel-default:

  - iommu: mtk: fix module autoloading (git-fixes).
  - commit 50334e4
  - iommu/amd: Enhance def_domain_type to handle untrusted device
    (git-fixes).
  - commit 9d0dd7f
  - iommu: Undo pasid attachment only for the devices that have
    succeeded (git-fixes).
  - commit 4de170c
  - net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
    (CVE-2024-35892 bsc#1224515).
  - commit e8fcaf3
  - eeprom: at24: fix memory corruption race condition (bsc#1224612
    CVE-2024-35848).
  - commit 269cd6c
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel
    (CVE-2024-35884 bsc#1224520).
  - commit 78d5dd0
  - Kabi workaround for icmp: prevent possible NULL dereferences from
    icmp_build_probe() (CVE-2024-35857 bsc#1224619).
  - icmp: prevent possible NULL dereferences from icmp_build_probe()
    (CVE-2024-35857 bsc#1224619).
  - commit fa789e3

++++ kernel-default:

  - iommu: mtk: fix module autoloading (git-fixes).
  - commit 50334e4
  - iommu/amd: Enhance def_domain_type to handle untrusted device
    (git-fixes).
  - commit 9d0dd7f
  - iommu: Undo pasid attachment only for the devices that have
    succeeded (git-fixes).
  - commit 4de170c
  - net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()
    (CVE-2024-35892 bsc#1224515).
  - commit e8fcaf3
  - eeprom: at24: fix memory corruption race condition (bsc#1224612
    CVE-2024-35848).
  - commit 269cd6c
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel
    (CVE-2024-35884 bsc#1224520).
  - commit 78d5dd0
  - Kabi workaround for icmp: prevent possible NULL dereferences from
    icmp_build_probe() (CVE-2024-35857 bsc#1224619).
  - icmp: prevent possible NULL dereferences from icmp_build_probe()
    (CVE-2024-35857 bsc#1224619).
  - commit fa789e3

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ openssl-3:

  - FIPS: Block non-Approved Elliptic Curves [bsc#1221786]
    * Add patches
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-Remove-EC-curves.patch
  - openssl-Disable-explicit-ec.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-services-minimize.patch
  - FIPS: Service Level Indicator [bsc#1221365]
    * Add patches:
  - openssl-FIPS-Expose-a-FIPS-indicator.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-RSA-disable-shake.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-services-minimize.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch
  - openssl-FIPS-enforce-security-checks-during-initialization.patch
  - TODO: incomplete
  - FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module. [bsc#1221751]
    * Add openssl-FIPS-release_num_in_version_string.patch
  - FIPS: Add required selftests: [bsc#1221760]
    * Add patches
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-Use-FFDHE2048-in-self-test.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-140-3-keychecks.patch
  - FIPS: DH: Disable FIPS 186-4 Domain Parameters [bsc#1221821]
    Add openssl-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch
  - FIPS: Recommendation for Password-Based Key Derivation [bsc#1221827]
    * Add additional check required by FIPS 140-3. Minimum value for
    PBKDF2 password is 20 characters.
    * Add patches:
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-pbkdf2-Set-indicator-if-pkcs5-param-disabled-checks.patch
  - FIPS: Zeroization is required [bsc#1221752]
    * Add openssl-FIPS-140-3-zeroization.patch
  - FIPS: Reseed DRBG [bsc#1220690, bsc#1220693, bsc#1220696]
    * Enable prediction resistance for primary DRBG
    * Add oversampling of the noise source to comply with requirements of
    NIST SP 800-90C
    * Change CRNG buf size to align with output size of the Jitter RNG
    * Add openssl-FIPS-140-3-DRBG.patch
  - FIPS: NIST SP 800-56Brev2 [bsc#1221824]
    * Add patches:
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-RSA-encapsulate.patch
  - openssl-FIPS-Add-SP800-56Br2-6.4.1.2.1-3.c-check.patch
  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 [bsc#1221787]
    * Add patches:
  - openssl-FIPS-services-minimize.patch
  - openssl-Revert-Improve-FIPS-RSA-keygen-performance.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - FIPS: Port openssl to use jitterentropy [bsc#1220523]
    * Add openssl-3-jitterentropy-3.4.0.patch
    * Add build dependency on jitterentropy-devel >= 3.4.0 and
    libjitterentropy3 >= 3.4.0
  - FIPS: NIST SP 800-56Arev3 [bsc#1221822]
    * Add openssl-FIPS-140-3-keychecks.patch
  - FIPS: Error state has to be enforced [bsc#1221753]
    * Add patches:
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-Enforce-error-state.patch

++++ libsolv:

  - add a conflict to older libsolv-tools to libsolv-tools-base
  - report unsupported compression in solv_xfopen() with errno
  - fix return value of repodata.add_solv() in the bindings
  - fix SHA-224 oid in solv_pgpvrfy

++++ libsolv:

  - add a conflict to older libsolv-tools to libsolv-tools-base
  - report unsupported compression in solv_xfopen() with errno
  - fix return value of repodata.add_solv() in the bindings
  - fix SHA-224 oid in solv_pgpvrfy

++++ libsolv:

  - add a conflict to older libsolv-tools to libsolv-tools-base
  - report unsupported compression in solv_xfopen() with errno
  - fix return value of repodata.add_solv() in the bindings
  - fix SHA-224 oid in solv_pgpvrfy

++++ libsolv:

  - add a conflict to older libsolv-tools to libsolv-tools-base
  - report unsupported compression in solv_xfopen() with errno
  - fix return value of repodata.add_solv() in the bindings
  - fix SHA-224 oid in solv_pgpvrfy

------------------------------------------------------------------
------------------  2024-6-6  -  Jun 6 2024  -------------------
------------------------------------------------------------------

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ docker:

  - Update to Docker 26.1.4-ce. See upstream changelog online at
    <https://docs.docker.com/engine/release-notes/26.1/#2614>
  - Rebase patches:
    * cli-0001-docs-include-required-tools-in-source-tree.patch

++++ python-kiwi:

  - Revise users.rst
  - REvise systemdeps.rst
  - Revise shell_scripts.rst
  - Add initrd boot option rd.kiwi.allow_plymouth
    By default kiwi stops plymouth if present and active in the
    initrd. Setting rd.kiwi.allow_plymouth will keep plymouth
    active in the initrd including all effects that might have
    to the available consoles. This is related to bsc#1214824
  - Drop use of obsolete tool isconsole
    isconsole was provided with the dropped kiwi-tools package.
    It was a simple C application that checked the capabilities
    of the current console. In the context of fbiterm it was just
    used to provide proper error messages which fbiterm on its
    own did not show. As also fbiterm is on its way to become
    obsolete and isconsole is already no longer present, it's ok
    to just drop that extra check and therefore keep the fbiterm
    mode functional if one manages to include fbiterm and its
    fonts into the initrd

++++ python-kiwi:

  - Revise users.rst
  - REvise systemdeps.rst
  - Revise shell_scripts.rst
  - Add initrd boot option rd.kiwi.allow_plymouth
    By default kiwi stops plymouth if present and active in the
    initrd. Setting rd.kiwi.allow_plymouth will keep plymouth
    active in the initrd including all effects that might have
    to the available consoles. This is related to bsc#1214824
  - Drop use of obsolete tool isconsole
    isconsole was provided with the dropped kiwi-tools package.
    It was a simple C application that checked the capabilities
    of the current console. In the context of fbiterm it was just
    used to provide proper error messages which fbiterm on its
    own did not show. As also fbiterm is on its way to become
    obsolete and isconsole is already no longer present, it's ok
    to just drop that extra check and therefore keep the fbiterm
    mode functional if one manages to include fbiterm and its
    fonts into the initrd

++++ python-kiwi:

  - Revise users.rst
  - REvise systemdeps.rst
  - Revise shell_scripts.rst
  - Add initrd boot option rd.kiwi.allow_plymouth
    By default kiwi stops plymouth if present and active in the
    initrd. Setting rd.kiwi.allow_plymouth will keep plymouth
    active in the initrd including all effects that might have
    to the available consoles. This is related to bsc#1214824
  - Drop use of obsolete tool isconsole
    isconsole was provided with the dropped kiwi-tools package.
    It was a simple C application that checked the capabilities
    of the current console. In the context of fbiterm it was just
    used to provide proper error messages which fbiterm on its
    own did not show. As also fbiterm is on its way to become
    obsolete and isconsole is already no longer present, it's ok
    to just drop that extra check and therefore keep the fbiterm
    mode functional if one manages to include fbiterm and its
    fonts into the initrd

++++ kernel-default:

  - io_uring/net: correct the type of variable (git-fixes).
  - commit 91963e3
  - sock_map: avoid race between sock_map_close and sk_psock_put
    (bsc#1225475 CVE-2023-52735).
  - commit 71eeba4
  - Update
    patches.suse/usb-dwc2-fix-possible-NULL-pointer-dereference-cause.patch
    (CVE-2023-52855 bsc#1225583).
    Adding references
  - commit 4b5e987
  - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
  - commit 7bf5961
  - inet: inet_defrag: prevent sk release while still in use
    (CVE-2024-26921 bsc#1223138).
  - commit 2016faf
  - perf ui browser: Avoid SEGV on title (git fixes).
  - commit 1578c22

++++ kernel-default:

  - io_uring/net: correct the type of variable (git-fixes).
  - commit 91963e3
  - sock_map: avoid race between sock_map_close and sk_psock_put
    (bsc#1225475 CVE-2023-52735).
  - commit 71eeba4
  - Update
    patches.suse/usb-dwc2-fix-possible-NULL-pointer-dereference-cause.patch
    (CVE-2023-52855 bsc#1225583).
    Adding references
  - commit 4b5e987
  - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
  - commit 7bf5961
  - inet: inet_defrag: prevent sk release while still in use
    (CVE-2024-26921 bsc#1223138).
  - commit 2016faf
  - perf ui browser: Avoid SEGV on title (git fixes).
  - commit 1578c22

++++ kernel-default:

  - io_uring/net: correct the type of variable (git-fixes).
  - commit 91963e3
  - sock_map: avoid race between sock_map_close and sk_psock_put
    (bsc#1225475 CVE-2023-52735).
  - commit 71eeba4
  - Update
    patches.suse/usb-dwc2-fix-possible-NULL-pointer-dereference-cause.patch
    (CVE-2023-52855 bsc#1225583).
    Adding references
  - commit 4b5e987
  - net: preserve kabi for sk_buff (CVE-2024-26921 bsc#1223138).
  - commit 7bf5961
  - inet: inet_defrag: prevent sk release while still in use
    (CVE-2024-26921 bsc#1223138).
  - commit 2016faf
  - perf ui browser: Avoid SEGV on title (git fixes).
  - commit 1578c22

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ openssl-3:

  - Apply "openssl-CVE-2024-4741.patch" to fix a use-after-free
    security vulnerability. Calling the function SSL_free_buffers()
    potentially caused memory to be accessed that was previously
    freed in some situations and a malicious attacker could attempt
    to engineer a stituation where this occurs to facilitate a
    denial-of-service attack. [CVE-2024-4741, bsc#1225551]

++++ python-requests:

  - update to 2.32.3:
    * Fixed bug breaking the ability to specify custom SSLContexts
    in sub-classes of HTTPAdapter.
    * Fixed issue where Requests started failing to run on Python
    versions compiled without the `ssl` module.

++++ python-requests:

  - update to 2.32.3:
    * Fixed bug breaking the ability to specify custom SSLContexts
    in sub-classes of HTTPAdapter.
    * Fixed issue where Requests started failing to run on Python
    versions compiled without the `ssl` module.

++++ python-requests:

  - update to 2.32.3:
    * Fixed bug breaking the ability to specify custom SSLContexts
    in sub-classes of HTTPAdapter.
    * Fixed issue where Requests started failing to run on Python
    versions compiled without the `ssl` module.

------------------------------------------------------------------
------------------  2024-6-5  -  Jun 5 2024  -------------------
------------------------------------------------------------------

++++ cockpit:

  - add 0001-users-Support-for-watching-lastlog2-and-wutmp-on-ove.patch to fix bsc#1220551

++++ cockpit:

  - add 0001-users-Support-for-watching-lastlog2-and-wutmp-on-ove.patch to fix bsc#1220551

++++ cockpit:

  - add 0001-users-Support-for-watching-lastlog2-and-wutmp-on-ove.patch to fix bsc#1220551

++++ cockpit:

  - add 0001-users-Support-for-watching-lastlog2-and-wutmp-on-ove.patch to fix bsc#1220551

++++ cockpit:

  - add 0001-users-Support-for-watching-lastlog2-and-wutmp-on-ove.patch to fix bsc#1220551

++++ cockpit:

  - add 0001-users-Support-for-watching-lastlog2-and-wutmp-on-ove.patch to fix bsc#1220551

++++ kernel-default:

  - perf pmu: Count sys and cpuid JSON events separately (git
    fixes).
  - perf stat: Don't display metric header for non-leader uncore
    events (git-fixes).
  - perf daemon: Fix file leak in daemon_session__control
    (git-fixes).
  - perf symbols: Fix ownership of string in dso__load_vmlinux()
    (git-fixes).
  - perf thread: Fixes to thread__new() related to initializing comm
    (git-fixes).
  - perf report: Avoid SEGV in report__setup_sample_type()
    (git-fixes).
  - perf ui browser: Don't save pointer to stack memory (git-fixes).
  - perf bench internals inject-build-id: Fix trap divide when
    collecting just one DSO (git-fixes).
  - perf intel-pt: Fix unassigned instruction op (discovered by
    MemorySanitizer) (git-fixes).
  - perf test shell arm_coresight: Increase buffer size for
    Coresight basic tests (git-fixes).
  - perf docs: Document bpf event modifier (git-fixes).
  - perf bench uprobe: Remove lib64 from libc.so.6 binary path
    (git-fixes).
  - perf record: Fix debug message placement for test consumption
    (git-fixes).
  - perf tests: Apply attributes to all events in object code
    reading test (git-fixes).
  - perf tests: Make "test data symbol" more robust on Neoverse N1
    (git-fixes).
  - perf annotate: Fix annotation_calc_lines() to pass correct
    address to get_srcline() (git-fixes).
  - perf stat: Do not fail on metrics on s390 z/VM systems
    (git-fixes).
  - perf sched timehist: Fix -g/--call-graph option failure
    (git-fixes).
  - perf annotate: Get rid of duplicate --group option item
    (git-fixes).
  - perf probe: Add missing libgen.h header needed for using
    basename() (git-fixes).
  - perf record: Delete session after stopping sideband thread
    (git-fixes).
  - perf auxtrace: Fix multiple use of --itrace option (git-fixes).
  - perf script: Show also errors for --insn-trace option
    (git-fixes).
  - perf lock contention: Add a missing NULL check (git-fixes).
  - perf vendor events amd: Fix Zen 4 cache latency events
    (git-fixes).
  - libperf evlist: Avoid out-of-bounds access (git-fixes).
  - perf pmu: Fix a potential memory leak in perf_pmu__lookup()
    (git-fixes).
  - perf print-events: make is_event_supported() more robust
    (git-fixes).
  - perf list: fix short description for some cache events
    (git-fixes).
  - perf metric: Don't remove scale from counts (git-fixes).
  - perf stat: Avoid metric-only segv (git-fixes).
  - perf expr: Fix "has_event" function for metric style events
    (git-fixes).
  - perf srcline: Add missed addr2line closes (git-fixes).
  - perf thread_map: Free strlist on normal path in
    thread_map__new_by_tid_str() (git-fixes).
  - perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
  - perf jevents: Drop or simplify small integer values (git-fixes).
  - perf evsel: Fix duplicate initialization of data->id in
    evsel__parse_sample() (git-fixes).
  - perf pmu: Treat the msr pmu as software (git-fixes).
  - perf record: Check conflict between '--timestamp-filename'
    option and pipe mode before recording (git-fixes).
  - perf record: Fix possible incorrect free in
    record__switch_output() (git-fixes).
  - perf vendor events amd: Add Zen 4 memory controller events
    (git-fixes).
  - perf top: Uniform the event name for the hybrid machine
    (git-fixes).
  - perf top: Use evsel's cpus to replace user_requested_cpus
    (git-fixes).
  - commit a1f9340
  - nfs: Bump default write congestion size (bsc#1218442).
  - commit 563bd84
  - nfs: Avoid flushing many pages with NFS_FILE_SYNC (bsc#1218442).
  - commit 1092c12
  - blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
  - Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
    Quoting bsc#1225945#c11:
    "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
    transaction for every subvol create")
    ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
    unwritten extent buffer after snapshotting a new subvolume") was never
    backported."
  - commit d947258
  - crypto: iaa - Fix async_disable descriptor leak (CVE-2024-35926
    bsc#1224655).
  - commit c5d6a9b
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
    (bsc#1224575 CVE-2024-35976).
  - commit 794d5e8
  - bpf, skmsg: Fix NULL pointer dereference in
    sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938).
  - commit 2f2e817
  - ipv4: check for NULL idev in ip_route_use_hint()
    (CVE-2024-36008 bsc#1224540)
  - commit d751eb5

++++ kernel-default:

  - perf pmu: Count sys and cpuid JSON events separately (git
    fixes).
  - perf stat: Don't display metric header for non-leader uncore
    events (git-fixes).
  - perf daemon: Fix file leak in daemon_session__control
    (git-fixes).
  - perf symbols: Fix ownership of string in dso__load_vmlinux()
    (git-fixes).
  - perf thread: Fixes to thread__new() related to initializing comm
    (git-fixes).
  - perf report: Avoid SEGV in report__setup_sample_type()
    (git-fixes).
  - perf ui browser: Don't save pointer to stack memory (git-fixes).
  - perf bench internals inject-build-id: Fix trap divide when
    collecting just one DSO (git-fixes).
  - perf intel-pt: Fix unassigned instruction op (discovered by
    MemorySanitizer) (git-fixes).
  - perf test shell arm_coresight: Increase buffer size for
    Coresight basic tests (git-fixes).
  - perf docs: Document bpf event modifier (git-fixes).
  - perf bench uprobe: Remove lib64 from libc.so.6 binary path
    (git-fixes).
  - perf record: Fix debug message placement for test consumption
    (git-fixes).
  - perf tests: Apply attributes to all events in object code
    reading test (git-fixes).
  - perf tests: Make "test data symbol" more robust on Neoverse N1
    (git-fixes).
  - perf annotate: Fix annotation_calc_lines() to pass correct
    address to get_srcline() (git-fixes).
  - perf stat: Do not fail on metrics on s390 z/VM systems
    (git-fixes).
  - perf sched timehist: Fix -g/--call-graph option failure
    (git-fixes).
  - perf annotate: Get rid of duplicate --group option item
    (git-fixes).
  - perf probe: Add missing libgen.h header needed for using
    basename() (git-fixes).
  - perf record: Delete session after stopping sideband thread
    (git-fixes).
  - perf auxtrace: Fix multiple use of --itrace option (git-fixes).
  - perf script: Show also errors for --insn-trace option
    (git-fixes).
  - perf lock contention: Add a missing NULL check (git-fixes).
  - perf vendor events amd: Fix Zen 4 cache latency events
    (git-fixes).
  - libperf evlist: Avoid out-of-bounds access (git-fixes).
  - perf pmu: Fix a potential memory leak in perf_pmu__lookup()
    (git-fixes).
  - perf print-events: make is_event_supported() more robust
    (git-fixes).
  - perf list: fix short description for some cache events
    (git-fixes).
  - perf metric: Don't remove scale from counts (git-fixes).
  - perf stat: Avoid metric-only segv (git-fixes).
  - perf expr: Fix "has_event" function for metric style events
    (git-fixes).
  - perf srcline: Add missed addr2line closes (git-fixes).
  - perf thread_map: Free strlist on normal path in
    thread_map__new_by_tid_str() (git-fixes).
  - perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
  - perf jevents: Drop or simplify small integer values (git-fixes).
  - perf evsel: Fix duplicate initialization of data->id in
    evsel__parse_sample() (git-fixes).
  - perf pmu: Treat the msr pmu as software (git-fixes).
  - perf record: Check conflict between '--timestamp-filename'
    option and pipe mode before recording (git-fixes).
  - perf record: Fix possible incorrect free in
    record__switch_output() (git-fixes).
  - perf vendor events amd: Add Zen 4 memory controller events
    (git-fixes).
  - perf top: Uniform the event name for the hybrid machine
    (git-fixes).
  - perf top: Use evsel's cpus to replace user_requested_cpus
    (git-fixes).
  - commit a1f9340
  - nfs: Bump default write congestion size (bsc#1218442).
  - commit 563bd84
  - nfs: Avoid flushing many pages with NFS_FILE_SYNC (bsc#1218442).
  - commit 1092c12
  - blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
  - Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
    Quoting bsc#1225945#c11:
    "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
    transaction for every subvol create")
    ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
    unwritten extent buffer after snapshotting a new subvolume") was never
    backported."
  - commit d947258
  - crypto: iaa - Fix async_disable descriptor leak (CVE-2024-35926
    bsc#1224655).
  - commit c5d6a9b
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
    (bsc#1224575 CVE-2024-35976).
  - commit 794d5e8
  - bpf, skmsg: Fix NULL pointer dereference in
    sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938).
  - commit 2f2e817
  - ipv4: check for NULL idev in ip_route_use_hint()
    (CVE-2024-36008 bsc#1224540)
  - commit d751eb5

++++ kernel-default:

  - perf pmu: Count sys and cpuid JSON events separately (git
    fixes).
  - perf stat: Don't display metric header for non-leader uncore
    events (git-fixes).
  - perf daemon: Fix file leak in daemon_session__control
    (git-fixes).
  - perf symbols: Fix ownership of string in dso__load_vmlinux()
    (git-fixes).
  - perf thread: Fixes to thread__new() related to initializing comm
    (git-fixes).
  - perf report: Avoid SEGV in report__setup_sample_type()
    (git-fixes).
  - perf ui browser: Don't save pointer to stack memory (git-fixes).
  - perf bench internals inject-build-id: Fix trap divide when
    collecting just one DSO (git-fixes).
  - perf intel-pt: Fix unassigned instruction op (discovered by
    MemorySanitizer) (git-fixes).
  - perf test shell arm_coresight: Increase buffer size for
    Coresight basic tests (git-fixes).
  - perf docs: Document bpf event modifier (git-fixes).
  - perf bench uprobe: Remove lib64 from libc.so.6 binary path
    (git-fixes).
  - perf record: Fix debug message placement for test consumption
    (git-fixes).
  - perf tests: Apply attributes to all events in object code
    reading test (git-fixes).
  - perf tests: Make "test data symbol" more robust on Neoverse N1
    (git-fixes).
  - perf annotate: Fix annotation_calc_lines() to pass correct
    address to get_srcline() (git-fixes).
  - perf stat: Do not fail on metrics on s390 z/VM systems
    (git-fixes).
  - perf sched timehist: Fix -g/--call-graph option failure
    (git-fixes).
  - perf annotate: Get rid of duplicate --group option item
    (git-fixes).
  - perf probe: Add missing libgen.h header needed for using
    basename() (git-fixes).
  - perf record: Delete session after stopping sideband thread
    (git-fixes).
  - perf auxtrace: Fix multiple use of --itrace option (git-fixes).
  - perf script: Show also errors for --insn-trace option
    (git-fixes).
  - perf lock contention: Add a missing NULL check (git-fixes).
  - perf vendor events amd: Fix Zen 4 cache latency events
    (git-fixes).
  - libperf evlist: Avoid out-of-bounds access (git-fixes).
  - perf pmu: Fix a potential memory leak in perf_pmu__lookup()
    (git-fixes).
  - perf print-events: make is_event_supported() more robust
    (git-fixes).
  - perf list: fix short description for some cache events
    (git-fixes).
  - perf metric: Don't remove scale from counts (git-fixes).
  - perf stat: Avoid metric-only segv (git-fixes).
  - perf expr: Fix "has_event" function for metric style events
    (git-fixes).
  - perf srcline: Add missed addr2line closes (git-fixes).
  - perf thread_map: Free strlist on normal path in
    thread_map__new_by_tid_str() (git-fixes).
  - perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
  - perf jevents: Drop or simplify small integer values (git-fixes).
  - perf evsel: Fix duplicate initialization of data->id in
    evsel__parse_sample() (git-fixes).
  - perf pmu: Treat the msr pmu as software (git-fixes).
  - perf record: Check conflict between '--timestamp-filename'
    option and pipe mode before recording (git-fixes).
  - perf record: Fix possible incorrect free in
    record__switch_output() (git-fixes).
  - perf vendor events amd: Add Zen 4 memory controller events
    (git-fixes).
  - perf top: Uniform the event name for the hybrid machine
    (git-fixes).
  - perf top: Use evsel's cpus to replace user_requested_cpus
    (git-fixes).
  - commit a1f9340
  - nfs: Bump default write congestion size (bsc#1218442).
  - commit 563bd84
  - nfs: Avoid flushing many pages with NFS_FILE_SYNC (bsc#1218442).
  - commit 1092c12
  - blacklist.conf: remove fix for CVE-2024-35956 bsc#1224674, not applicable
  - Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch.
    Quoting bsc#1225945#c11:
    "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
    transaction for every subvol create")
    ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
    unwritten extent buffer after snapshotting a new subvolume") was never
    backported."
  - commit d947258
  - crypto: iaa - Fix async_disable descriptor leak (CVE-2024-35926
    bsc#1224655).
  - commit c5d6a9b
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
    (bsc#1224575 CVE-2024-35976).
  - commit 794d5e8
  - bpf, skmsg: Fix NULL pointer dereference in
    sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938).
  - commit 2f2e817
  - ipv4: check for NULL idev in ip_route_use_hint()
    (CVE-2024-36008 bsc#1224540)
  - commit d751eb5

------------------------------------------------------------------
------------------  2024-6-4  -  Jun 4 2024  -------------------
------------------------------------------------------------------

++++ chrony:

  - bsc#1225362, chrony-124-tai.patch: make 124-tai more reliable

++++ python-kiwi:

  - Bump version: 10.0.20 → 10.0.21

++++ python-kiwi:

  - Bump version: 10.0.20 → 10.0.21

++++ python-kiwi:

  - Bump version: 10.0.20 → 10.0.21

++++ kernel-default:

  - smb3: fix lock ordering potential deadlock in
    cifs_sync_mid_result (bsc#1225172, bsc#1224549, CVE-2024-35998).
  - commit 98bfec0
  - smb: client: fix potential deadlock when releasing mids
    (bsc#1225172, bsc#1225548, CVE-2023-52757).
  - commit 1b322a8
  - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6
    netrom: Fix data-races around sysctl_net_busy_read
    (CVE-2024-27419 bsc#1224759)
  - commit 1fe217c
  - octeontx2-af: avoid off-by-one read from userspace (bsc#1225762 CVE-2024-36957)
  - commit d3dcfbb

++++ kernel-default:

  - smb3: fix lock ordering potential deadlock in
    cifs_sync_mid_result (bsc#1225172, bsc#1224549, CVE-2024-35998).
  - commit 98bfec0
  - smb: client: fix potential deadlock when releasing mids
    (bsc#1225172, bsc#1225548, CVE-2023-52757).
  - commit 1b322a8
  - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6
    netrom: Fix data-races around sysctl_net_busy_read
    (CVE-2024-27419 bsc#1224759)
  - commit 1fe217c
  - octeontx2-af: avoid off-by-one read from userspace (bsc#1225762 CVE-2024-36957)
  - commit d3dcfbb

++++ kernel-default:

  - smb3: fix lock ordering potential deadlock in
    cifs_sync_mid_result (bsc#1225172, bsc#1224549, CVE-2024-35998).
  - commit 98bfec0
  - smb: client: fix potential deadlock when releasing mids
    (bsc#1225172, bsc#1225548, CVE-2023-52757).
  - commit 1b322a8
  - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6
    netrom: Fix data-races around sysctl_net_busy_read
    (CVE-2024-27419 bsc#1224759)
  - commit 1fe217c
  - octeontx2-af: avoid off-by-one read from userspace (bsc#1225762 CVE-2024-36957)
  - commit d3dcfbb

++++ nvidia-open-driver-G06-signed:

  - Security Update 550.90.07 (boo#1223356) [CVE-2024-0090,
    CVE-2024-0091, CVE-2024-0092]

------------------------------------------------------------------
------------------  2024-6-3  -  Jun 3 2024  -------------------
------------------------------------------------------------------

++++ aardvark-dns:

  - Remove redundant source: cargo_config
  - Update to version 1.11.0:
    * Release v1.11.0
    * v1.11.0 release notes
    * run cargo update
    * chore(deps): update dependency containers/automation_images to v20240529
    * Internal networks cannot make external DNS requests
    * fix(deps): update rust crate anyhow to 1.0.86
    * fix(deps): update rust crate nix to 0.29.0
    * [skip-ci] RPM: use default __cargo macro across all envs
    * chore(deps): update dependency containers/automation_images to v20240513
    * fix(deps): update rust crate anyhow to 1.0.83
    * [skip-ci] Packit: separate `packages` key for rhel jobs
    * fix(deps): update rust crate libc to 0.2.154
    * [skip-ci] Packit: enable rhel10, c10s tests and c10s downstream sync
    * [skip-ci] Packit: Remove EL8 jobs
    * fix(deps): update rust crate syslog to ^6.1.1
    * fix reverse ipv6 lookup test flake
    * fix(deps): update hickory-dns monorepo to 0.24.1
    * chore(deps): update rust crate chrono to 0.4.38
    * Don't tear down all server threads on SIGHUP (bsc#1224167)
    * fix(deps): update rust crate anyhow to 1.0.82
    * fix(deps): update rust crate tokio to 1.37.0
    * Update to nix-0.28.0
    * update chrono package
    * chore(deps): update dependency containers/automation_images to v20240320
    * fix(deps): update rust crate anyhow to 1.0.81
    * tests: check queried domain name in reverse lookup tests
    * fix: set name for answers in reverse lookups
    * chore: fix typo in runner script
    * chore: fix log message when doing reverse lookup
    * fix(deps): update rust crate log to 0.4.21
    * fix(deps): update rust crate anyhow to 1.0.80
    * chore(deps): update rust crate chrono to 0.4.34
    * fix(deps): update rust crate async-broadcast to 0.7.0
    * fix(deps): update rust crate tokio to 1.36.0
    * [CI:DOCS] Packit: disable bodhi tasks
    * chore(deps): update rust crate chrono to 0.4.33
    * Bump to 1.11.0-dev

++++ cloud-init:

  - Add cloud-init-skip-rename.patch (bsc#1219680)
    + Brute force appraoch to skip renames if the device is already present

++++ cloud-init:

  - Add cloud-init-skip-rename.patch (bsc#1219680)
    + Brute force approach to skip renames if the device is already present

++++ cloud-init:

  - Add cloud-init-skip-rename.patch (bsc#1219680)
    + Brute force approach to skip renames if the device is already present

++++ cloud-init:

  - Add cloud-init-skip-rename.patch (bsc#1219680)
    + Brute force approach to skip renames if the device is already present

++++ python-kiwi:

  - Add missing write_meta_data method to BLS base
    The standard bootloader interface class provided a method
    named write_meta_data which is expected to be implemented
    in the specialized bootloader implementation. For BLS
    bootloaders this method was missing in the BLS base class.
    write_meta_data can provide additional cmdline options
    for booting. If not covered some boot options might be
    missing. This patch fixes it
  - Fix TW integration test to build outside OBS
  - Make sure BootLoaderConfig fixes are effective
    The BootLoaderConfigGrub2 class has methods to fix the grub-mkconfig
    generated files. It does that by mounting the system and changing the
    respective files after the mkconfig call. However, after the change
    the class instance stays open in combination with BootLoaderInstallGrub2
    instance which itself under certain circumstances also mounts the
    system to call grub-install. At the time grub-install is called it
    cannot be guaranteed that all changes has been written unless an
    explicit umount in the BootLoaderConfigGrub2 class instance happened.
    This commit address the potential race condition.
  - Bump version: 10.0.19 → 10.0.20
  - Update rawhide integration test
    Use new arch attribute for testing in the repository
    element of the rawhide/test-image-live-disk integration
    test.

++++ python-kiwi:

  - Add missing write_meta_data method to BLS base
    The standard bootloader interface class provided a method
    named write_meta_data which is expected to be implemented
    in the specialized bootloader implementation. For BLS
    bootloaders this method was missing in the BLS base class.
    write_meta_data can provide additional cmdline options
    for booting. If not covered some boot options might be
    missing. This patch fixes it
  - Fix TW integration test to build outside OBS
  - Make sure BootLoaderConfig fixes are effective
    The BootLoaderConfigGrub2 class has methods to fix the grub-mkconfig
    generated files. It does that by mounting the system and changing the
    respective files after the mkconfig call. However, after the change
    the class instance stays open in combination with BootLoaderInstallGrub2
    instance which itself under certain circumstances also mounts the
    system to call grub-install. At the time grub-install is called it
    cannot be guaranteed that all changes has been written unless an
    explicit umount in the BootLoaderConfigGrub2 class instance happened.
    This commit address the potential race condition.
  - Bump version: 10.0.19 → 10.0.20
  - Update rawhide integration test
    Use new arch attribute for testing in the repository
    element of the rawhide/test-image-live-disk integration
    test.

++++ python-kiwi:

  - Add missing write_meta_data method to BLS base
    The standard bootloader interface class provided a method
    named write_meta_data which is expected to be implemented
    in the specialized bootloader implementation. For BLS
    bootloaders this method was missing in the BLS base class.
    write_meta_data can provide additional cmdline options
    for booting. If not covered some boot options might be
    missing. This patch fixes it
  - Fix TW integration test to build outside OBS
  - Make sure BootLoaderConfig fixes are effective
    The BootLoaderConfigGrub2 class has methods to fix the grub-mkconfig
    generated files. It does that by mounting the system and changing the
    respective files after the mkconfig call. However, after the change
    the class instance stays open in combination with BootLoaderInstallGrub2
    instance which itself under certain circumstances also mounts the
    system to call grub-install. At the time grub-install is called it
    cannot be guaranteed that all changes has been written unless an
    explicit umount in the BootLoaderConfigGrub2 class instance happened.
    This commit address the potential race condition.
  - Bump version: 10.0.19 → 10.0.20
  - Update rawhide integration test
    Use new arch attribute for testing in the repository
    element of the rawhide/test-image-live-disk integration
    test.

++++ kernel-default:

  - kabi/severities: Ignore io_uring internal symbols
  - commit 0e91c09
  - perf/x86: Fix out of range data (git-fixes).
  - perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last
    PEBS event (git-fixes).
  - perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
  - commit 664d77f
  - cifs: failure to add channel on iface should bump up weight
    (git-fixes, bsc#1225172).
  - commit 007b237
  - smb: client: fix parsing of SMB3.1.1 POSIX create context
    (git-fixes, bsc#1225172).
  - commit 5f27f69
  - Revert "cifs: reconnect work should have reference on server
    struct" (git-fixes, bsc#1225172).
  - commit 3ca4c0c
  - cifs: fix leak of iface for primary channel (git-fixes,
    bsc#1225172).
  - commit b7eb8e8
  - smb: client: fix mount when dns_resolver key is not available
    (git-fixes, bsc#1225172).
  - commit 28edb5c
  - scsi: lpfc: Copyright updates for 14.4.0.2 patches
    (bsc#1225842).
  - scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
  - scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
  - scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
    (bsc#1225842).
    Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
  - scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
    (bsc#1225842).
  - scsi: lpfc: Clear deferred RSCN processing flag when driver
    is unloading (bsc#1225842).
  - scsi: lpfc: Update logging of protection type for T10 DIF I/O
    (bsc#1225842).
  - scsi: lpfc: Change default logging level for unsolicited CT
    MIB commands (bsc#1225842).
  - commit 5a56384
  - nvmet: fix ns enable/disable possible hang (git-fixes).
  - nvme-multipath: fix io accounting on failover (git-fixes).
  - nvme: fix multipath batched completion accounting (git-fixes).
  - commit ed3b392
  - Update
    patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
    (git-fixes CVE-2024-36955).
  - Update
    patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
    (git-fixes bsc#1225715 CVE-2024-36906).
  - Update
    patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
    (git-fixes bsc#1225579 CVE-2024-36011).
  - Update
    patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
    (git-fixes bsc#1225578 CVE-2024-36013).
  - Update
    patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
    (git-fixes bsc#1225502 CVE-2024-36012).
  - Update
    patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
    (git-fixes bsc#1225722 CVE-2024-36880).
  - Update
    patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
    (git-fixes CVE-2024-36942).
  - Update
    patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
    (git-fixes bsc#1225720 CVE-2024-36032).
  - Update
    patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
    (git-fixes bsc#1223749 CVE-2024-26990).
  - Update
    patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
    (git-fixes bsc#1223692 CVE-2024-26992).
  - Update
    patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
    (stable-fixes CVE-2024-36944).
  - Update
    patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
    (git-fixes bsc#1225734 CVE-2024-36896).
  - Update
    patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
    (stable-fixes CVE-2024-36949).
  - Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
    (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
  - Update
    patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
    (git-fixes bsc#1225692 CVE-2023-52882).
  - Update
    patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
    (git-fixes CVE-2024-26761).
  - Update
    patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
    (stable-fixes bsc#1225735 CVE-2024-36897).
  - Update
    patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
    (stable-fixes bsc#1225705 CVE-2024-36026).
  - Update
    patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
    (stable-fixes CVE-2024-36951).
  - Update
    patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
    (git-fixes bsc#1225593 CVE-2024-36014).
  - Update
    patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
    (stable-fixes bsc#1225728 CVE-2024-36885).
  - Update
    patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
    (git-fixes bsc#1225773 CVE-2024-36936).
  - Update
    patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
    (stable-fixes CVE-2024-36950).
  - Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
    (git-fixes bsc#1225736 CVE-2024-36898).
  - Update
    patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
    (git-fixes bsc#1225698 CVE-2024-36020).
  - Update
    patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
    (git-fixes bsc#1225710 CVE-2024-36891).
  - Update
    patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
    (git-fixes bsc#1225714 CVE-2024-36890).
  - Update
    patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
    (git-fixes bsc#1225708 CVE-2024-36029).
  - Update
    patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
    (git-fixes bsc#1225699 CVE-2024-36021).
  - Update
    patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
    (git-fixes CVE-2024-26943).
  - Update
    patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
    (git-fixes bsc#1225694 CVE-2024-36018).
  - Update
    patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
    (git-fixes CVE-2024-36940).
  - Update
    patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
    (git-fixes CVE-2024-36959).
  - Update
    patches.suse/ppdev-Add-an-error-check-in-register_device.patch
    (git-fixes bsc#1225640 CVE-2024-36015).
  - Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
    CVE-2024-36947).
  - Update
    patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
    (git-fixes bsc#1225695 CVE-2024-36019).
  - Update
    patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
    (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
  - Update
    patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
    (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
  - Update
    patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
    (git-fixes bsc#1225704 CVE-2024-36025).
  - Update
    patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
    (git-fixes CVE-2024-36930).
  - Update
    patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
    (bsc#1224331 bsc#1224602 CVE-2024-35814).
  - Update
    patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
    (git-fixes bsc#1225642 CVE-2024-36016).
  - Update
    patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
    (git-fixes bsc#1225749 CVE-2024-36894).
  - Update
    patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
    (git-fixes bsc#1225750 CVE-2024-36895).
  - Update
    patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
    (git-fixes bsc#1225748 CVE-2024-36893).
  - Update
    patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
    (stable-fixes bsc#1225769 CVE-2024-36921).
  - Update
    patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
    (stable-fixes CVE-2024-36922).
  - Update
    patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
    (git-fixes CVE-2024-36941).
  - Update
    patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
    (git-fixes bsc#1224742 CVE-2024-35803).
  - commit 539780f
  - powerpc/pseries/lparcfg: drop error message from guest name
    lookup (bsc#1187716 ltc#193451 git-fixes).
  - commit ceab637
  - blacklist.conf: PPC fsl_msi is not used
  - commit ae6590d
  - powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
  - powerpc/uaccess: Fix build errors seen with GCC 13/14
    (bsc#1194869).
  - commit 46b5d84
  - Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
    The L3 bsc#1225765 was created seperately since our customer requires
    PTF.
  - Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
  - Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
  - Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
  - Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
  - commit 054635e
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from
    abort path (CVE-2024-26925 bsc#1223390).
  - commit 578a709
  - series.conf: cleanup
    Fix subsection header to silence series_insert error.
  - commit 4628dc3

++++ kernel-default:

  - kabi/severities: Ignore io_uring internal symbols
  - commit 0e91c09
  - perf/x86: Fix out of range data (git-fixes).
  - perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last
    PEBS event (git-fixes).
  - perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
  - commit 664d77f
  - cifs: failure to add channel on iface should bump up weight
    (git-fixes, bsc#1225172).
  - commit 007b237
  - smb: client: fix parsing of SMB3.1.1 POSIX create context
    (git-fixes, bsc#1225172).
  - commit 5f27f69
  - Revert "cifs: reconnect work should have reference on server
    struct" (git-fixes, bsc#1225172).
  - commit 3ca4c0c
  - cifs: fix leak of iface for primary channel (git-fixes,
    bsc#1225172).
  - commit b7eb8e8
  - smb: client: fix mount when dns_resolver key is not available
    (git-fixes, bsc#1225172).
  - commit 28edb5c
  - scsi: lpfc: Copyright updates for 14.4.0.2 patches
    (bsc#1225842).
  - scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
  - scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
  - scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
    (bsc#1225842).
    Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
  - scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
    (bsc#1225842).
  - scsi: lpfc: Clear deferred RSCN processing flag when driver
    is unloading (bsc#1225842).
  - scsi: lpfc: Update logging of protection type for T10 DIF I/O
    (bsc#1225842).
  - scsi: lpfc: Change default logging level for unsolicited CT
    MIB commands (bsc#1225842).
  - commit 5a56384
  - nvmet: fix ns enable/disable possible hang (git-fixes).
  - nvme-multipath: fix io accounting on failover (git-fixes).
  - nvme: fix multipath batched completion accounting (git-fixes).
  - commit ed3b392
  - Update
    patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
    (git-fixes CVE-2024-36955).
  - Update
    patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
    (git-fixes bsc#1225715 CVE-2024-36906).
  - Update
    patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
    (git-fixes bsc#1225579 CVE-2024-36011).
  - Update
    patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
    (git-fixes bsc#1225578 CVE-2024-36013).
  - Update
    patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
    (git-fixes bsc#1225502 CVE-2024-36012).
  - Update
    patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
    (git-fixes bsc#1225722 CVE-2024-36880).
  - Update
    patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
    (git-fixes CVE-2024-36942).
  - Update
    patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
    (git-fixes bsc#1225720 CVE-2024-36032).
  - Update
    patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
    (git-fixes bsc#1223749 CVE-2024-26990).
  - Update
    patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
    (git-fixes bsc#1223692 CVE-2024-26992).
  - Update
    patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
    (stable-fixes CVE-2024-36944).
  - Update
    patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
    (git-fixes bsc#1225734 CVE-2024-36896).
  - Update
    patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
    (stable-fixes CVE-2024-36949).
  - Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
    (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
  - Update
    patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
    (git-fixes bsc#1225692 CVE-2023-52882).
  - Update
    patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
    (git-fixes CVE-2024-26761).
  - Update
    patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
    (stable-fixes bsc#1225735 CVE-2024-36897).
  - Update
    patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
    (stable-fixes bsc#1225705 CVE-2024-36026).
  - Update
    patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
    (stable-fixes CVE-2024-36951).
  - Update
    patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
    (git-fixes bsc#1225593 CVE-2024-36014).
  - Update
    patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
    (stable-fixes bsc#1225728 CVE-2024-36885).
  - Update
    patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
    (git-fixes bsc#1225773 CVE-2024-36936).
  - Update
    patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
    (stable-fixes CVE-2024-36950).
  - Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
    (git-fixes bsc#1225736 CVE-2024-36898).
  - Update
    patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
    (git-fixes bsc#1225698 CVE-2024-36020).
  - Update
    patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
    (git-fixes bsc#1225710 CVE-2024-36891).
  - Update
    patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
    (git-fixes bsc#1225714 CVE-2024-36890).
  - Update
    patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
    (git-fixes bsc#1225708 CVE-2024-36029).
  - Update
    patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
    (git-fixes bsc#1225699 CVE-2024-36021).
  - Update
    patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
    (git-fixes CVE-2024-26943).
  - Update
    patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
    (git-fixes bsc#1225694 CVE-2024-36018).
  - Update
    patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
    (git-fixes CVE-2024-36940).
  - Update
    patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
    (git-fixes CVE-2024-36959).
  - Update
    patches.suse/ppdev-Add-an-error-check-in-register_device.patch
    (git-fixes bsc#1225640 CVE-2024-36015).
  - Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
    CVE-2024-36947).
  - Update
    patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
    (git-fixes bsc#1225695 CVE-2024-36019).
  - Update
    patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
    (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
  - Update
    patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
    (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
  - Update
    patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
    (git-fixes bsc#1225704 CVE-2024-36025).
  - Update
    patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
    (git-fixes CVE-2024-36930).
  - Update
    patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
    (bsc#1224331 bsc#1224602 CVE-2024-35814).
  - Update
    patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
    (git-fixes bsc#1225642 CVE-2024-36016).
  - Update
    patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
    (git-fixes bsc#1225749 CVE-2024-36894).
  - Update
    patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
    (git-fixes bsc#1225750 CVE-2024-36895).
  - Update
    patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
    (git-fixes bsc#1225748 CVE-2024-36893).
  - Update
    patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
    (stable-fixes bsc#1225769 CVE-2024-36921).
  - Update
    patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
    (stable-fixes CVE-2024-36922).
  - Update
    patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
    (git-fixes CVE-2024-36941).
  - Update
    patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
    (git-fixes bsc#1224742 CVE-2024-35803).
  - commit 539780f
  - powerpc/pseries/lparcfg: drop error message from guest name
    lookup (bsc#1187716 ltc#193451 git-fixes).
  - commit ceab637
  - blacklist.conf: PPC fsl_msi is not used
  - commit ae6590d
  - powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
  - powerpc/uaccess: Fix build errors seen with GCC 13/14
    (bsc#1194869).
  - commit 46b5d84
  - Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
    The L3 bsc#1225765 was created seperately since our customer requires
    PTF.
  - Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
  - Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
  - Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
  - Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
  - commit 054635e
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from
    abort path (CVE-2024-26925 bsc#1223390).
  - commit 578a709
  - series.conf: cleanup
    Fix subsection header to silence series_insert error.
  - commit 4628dc3

++++ kernel-default:

  - kabi/severities: Ignore io_uring internal symbols
  - commit 0e91c09
  - perf/x86: Fix out of range data (git-fixes).
  - perf/x86/intel/ds: Don't clear ->pebs_data_cfg for the last
    PEBS event (git-fixes).
  - perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
  - commit 664d77f
  - cifs: failure to add channel on iface should bump up weight
    (git-fixes, bsc#1225172).
  - commit 007b237
  - smb: client: fix parsing of SMB3.1.1 POSIX create context
    (git-fixes, bsc#1225172).
  - commit 5f27f69
  - Revert "cifs: reconnect work should have reference on server
    struct" (git-fixes, bsc#1225172).
  - commit 3ca4c0c
  - cifs: fix leak of iface for primary channel (git-fixes,
    bsc#1225172).
  - commit b7eb8e8
  - smb: client: fix mount when dns_resolver key is not available
    (git-fixes, bsc#1225172).
  - commit 28edb5c
  - scsi: lpfc: Copyright updates for 14.4.0.2 patches
    (bsc#1225842).
  - scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
  - scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
  - scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask
    (bsc#1225842).
    Refresh:
  - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
  - scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list
    (bsc#1225842).
  - scsi: lpfc: Clear deferred RSCN processing flag when driver
    is unloading (bsc#1225842).
  - scsi: lpfc: Update logging of protection type for T10 DIF I/O
    (bsc#1225842).
  - scsi: lpfc: Change default logging level for unsolicited CT
    MIB commands (bsc#1225842).
  - commit 5a56384
  - nvmet: fix ns enable/disable possible hang (git-fixes).
  - nvme-multipath: fix io accounting on failover (git-fixes).
  - nvme: fix multipath batched completion accounting (git-fixes).
  - commit ed3b392
  - Update
    patches.suse/ALSA-hda-intel-sdw-acpi-fix-usage-of-device_get_name.patch
    (git-fixes CVE-2024-36955).
  - Update
    patches.suse/ARM-9381-1-kasan-clear-stale-stack-poison.patch
    (git-fixes bsc#1225715 CVE-2024-36906).
  - Update
    patches.suse/Bluetooth-HCI-Fix-potential-null-ptr-deref.patch
    (git-fixes bsc#1225579 CVE-2024-36011).
  - Update
    patches.suse/Bluetooth-L2CAP-Fix-slab-use-after-free-in-l2cap_con.patch
    (git-fixes bsc#1225578 CVE-2024-36013).
  - Update
    patches.suse/Bluetooth-msft-fix-slab-use-after-free-in-msft_do_cl.patch
    (git-fixes bsc#1225502 CVE-2024-36012).
  - Update
    patches.suse/Bluetooth-qca-add-missing-firmware-sanity-checks.patch
    (git-fixes bsc#1225722 CVE-2024-36880).
  - Update
    patches.suse/Bluetooth-qca-fix-firmware-check-error-path.patch
    (git-fixes CVE-2024-36942).
  - Update
    patches.suse/Bluetooth-qca-fix-info-leak-when-fetching-fw-build-i.patch
    (git-fixes bsc#1225720 CVE-2024-36032).
  - Update
    patches.suse/KVM-x86-mmu-Write-protect-L2-SPTEs-in-TDP-MMU-when-c.patch
    (git-fixes bsc#1223749 CVE-2024-26990).
  - Update
    patches.suse/KVM-x86-pmu-Disable-support-for-adaptive-PEBS.patch
    (git-fixes bsc#1223692 CVE-2024-26992).
  - Update
    patches.suse/Reapply-drm-qxl-simplify-qxl_fence_wait.patch
    (stable-fixes CVE-2024-36944).
  - Update
    patches.suse/USB-core-Fix-access-violation-during-port-device-rem.patch
    (git-fixes bsc#1225734 CVE-2024-36896).
  - Update
    patches.suse/amd-amdkfd-sync-all-devices-to-wait-all-processes-be.patch
    (stable-fixes CVE-2024-36949).
  - Update patches.suse/bpf-Check-bloom-filter-map-value-size.patch
    (bsc#1224488 CVE-2024-35905 bsc#1225766 CVE-2024-36918).
  - Update
    patches.suse/clk-sunxi-ng-h6-Reparent-CPUX-during-PLL-CPUX-rate-c.patch
    (git-fixes bsc#1225692 CVE-2023-52882).
  - Update
    patches.suse/cxl-pci-Fix-disabling-memory-if-DVSEC-CXL-Range-does.patch
    (git-fixes CVE-2024-26761).
  - Update
    patches.suse/drm-amd-display-Atom-Integrated-System-Info-v2_2-for.patch
    (stable-fixes bsc#1225735 CVE-2024-36897).
  - Update
    patches.suse/drm-amd-pm-fixes-a-random-hang-in-S4-for-SMU-v13.0.4.patch
    (stable-fixes bsc#1225705 CVE-2024-36026).
  - Update
    patches.suse/drm-amdkfd-range-check-cp-bad-op-exception-interrupt.patch
    (stable-fixes CVE-2024-36951).
  - Update
    patches.suse/drm-arm-malidp-fix-a-possible-null-pointer-dereferen.patch
    (git-fixes bsc#1225593 CVE-2024-36014).
  - Update
    patches.suse/drm-nouveau-firmware-Fix-SG_DEBUG-error-with-nvkm_fi.patch
    (stable-fixes bsc#1225728 CVE-2024-36885).
  - Update
    patches.suse/efi-unaccepted-touch-soft-lockup-during-memory-accept.patch
    (git-fixes bsc#1225773 CVE-2024-36936).
  - Update
    patches.suse/firewire-ohci-mask-bus-reset-interrupts-between-ISR-.patch
    (stable-fixes CVE-2024-36950).
  - Update patches.suse/gpiolib-cdev-fix-uninitialised-kfifo.patch
    (git-fixes bsc#1225736 CVE-2024-36898).
  - Update
    patches.suse/i40e-fix-vf-may-be-used-uninitialized-in-this-functi.patch
    (git-fixes bsc#1225698 CVE-2024-36020).
  - Update
    patches.suse/maple_tree-fix-mas_empty_area_rev-null-pointer-deref.patch
    (git-fixes bsc#1225710 CVE-2024-36891).
  - Update
    patches.suse/mm-slab-make-__free-kfree-accept-error-pointers.patch
    (git-fixes bsc#1225714 CVE-2024-36890).
  - Update
    patches.suse/mmc-sdhci-msm-pervent-access-to-suspended-controller.patch
    (git-fixes bsc#1225708 CVE-2024-36029).
  - Update
    patches.suse/net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
    (git-fixes bsc#1225699 CVE-2024-36021).
  - Update
    patches.suse/nouveau-dmem-handle-kcalloc-allocation-failure.patch
    (git-fixes CVE-2024-26943).
  - Update
    patches.suse/nouveau-uvmm-fix-addr-range-calcs-for-remap-operatio.patch
    (git-fixes bsc#1225694 CVE-2024-36018).
  - Update
    patches.suse/pinctrl-core-delete-incorrect-free-in-pinctrl_enable.patch
    (git-fixes CVE-2024-36940).
  - Update
    patches.suse/pinctrl-devicetree-fix-refcount-leak-in-pinctrl_dt_t.patch
    (git-fixes CVE-2024-36959).
  - Update
    patches.suse/ppdev-Add-an-error-check-in-register_device.patch
    (git-fixes bsc#1225640 CVE-2024-36015).
  - Update patches.suse/qibfs-fix-dentry-leak.patch (git-fixes
    CVE-2024-36947).
  - Update
    patches.suse/regmap-maple-Fix-cache-corruption-in-regcache_maple_.patch
    (git-fixes bsc#1225695 CVE-2024-36019).
  - Update
    patches.suse/s390-cio-Ensure-the-copied-buf-is-NUL-terminated.patch
    (git-fixes bsc#1223869 bsc#1225747 CVE-2024-36931).
  - Update
    patches.suse/s390-qeth-Fix-kernel-panic-after-setting-hsuid.patch
    (git-fixes bsc#1223874 bsc#1225775 CVE-2024-36928).
  - Update
    patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
    (git-fixes bsc#1225704 CVE-2024-36025).
  - Update
    patches.suse/spi-fix-null-pointer-dereference-within-spi_sync.patch
    (git-fixes CVE-2024-36930).
  - Update
    patches.suse/swiotlb-Fix-double-allocation-of-slots-due-to-broken-alignment-handling.patch
    (bsc#1224331 bsc#1224602 CVE-2024-35814).
  - Update
    patches.suse/tty-n_gsm-fix-possible-out-of-bounds-in-gsm0_receive.patch
    (git-fixes bsc#1225642 CVE-2024-36016).
  - Update
    patches.suse/usb-gadget-f_fs-Fix-race-between-aio_cancel-and-AIO-.patch
    (git-fixes bsc#1225749 CVE-2024-36894).
  - Update
    patches.suse/usb-gadget-uvc-use-correct-buffer-size-when-parsing-.patch
    (git-fixes bsc#1225750 CVE-2024-36895).
  - Update
    patches.suse/usb-typec-tcpm-Check-for-port-partner-validity-befor.patch
    (git-fixes bsc#1225748 CVE-2024-36893).
  - Update
    patches.suse/wifi-iwlwifi-mvm-guard-against-invalid-STA-ID-on-rem.patch
    (stable-fixes bsc#1225769 CVE-2024-36921).
  - Update
    patches.suse/wifi-iwlwifi-read-txq-read_ptr-under-lock.patch
    (stable-fixes CVE-2024-36922).
  - Update
    patches.suse/wifi-nl80211-don-t-free-NULL-coalescing-rule.patch
    (git-fixes CVE-2024-36941).
  - Update
    patches.suse/x86-efistub-Call-mixed-mode-boot-services-on-the-firmware-.patch
    (git-fixes bsc#1224742 CVE-2024-35803).
  - commit 539780f
  - powerpc/pseries/lparcfg: drop error message from guest name
    lookup (bsc#1187716 ltc#193451 git-fixes).
  - commit ceab637
  - blacklist.conf: PPC fsl_msi is not used
  - commit ae6590d
  - powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
  - powerpc/uaccess: Fix build errors seen with GCC 13/14
    (bsc#1194869).
  - commit 46b5d84
  - Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756)
    The L3 bsc#1225765 was created seperately since our customer requires
    PTF.
  - Update patches.suse/bpf-fix-precision-backtracking-instruction-iteration.patch
  - Update patches.suse/bpf-handle-ldimm64-properly-in-check_cfg.patch
  - Update patches.suse/selftests-bpf-add-edge-case-backtracking-logic-test.patch
  - Update patches.suse/selftests-bpf-precision-tracking-test-for-BPF_NEG-an.patch
  - commit 054635e
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from
    abort path (CVE-2024-26925 bsc#1223390).
  - commit 578a709
  - series.conf: cleanup
    Fix subsection header to silence series_insert error.
  - commit 4628dc3

++++ netavark:

  - Remove redundant source: cargo_config
  - Update to version 1.11.0:
    * Release v1.11.0
    * Update release notes for 1.11.0
    * update netlink-packet-route to 0.20.0
    * run cargo update
    * fix: remove extra / in make install and uninstall
    * chore(deps): update dependency containers/automation_images to v20240529
    * fix(deps): update rust crate nix to 0.29.0
    * fix(deps): update rust crate nispor to 1.2.19
    * fix(deps): update rust crate anyhow to 1.0.86
    * fix(deps): update rust crate anyhow to 1.0.85
    * [skip-ci] Packit: do not create dup jobs on podman-next
    * fix(deps): update rust crate anyhow to 1.0.84
    * [skip-ci] RPM: use default __cargo macro across all envs
    * [skip-ci] RPM: switch default firewall to nftables on EL10+
    * chore(deps): update dependency containers/automation_images to v20240513
    * Add conditional compilation of default firewall driver
    * fix(deps): update rust crate serde_json to 1.0.117
    * fix new clippy warnings
    * Update CI image to fedora 40
    * fix ncat sctp tests
    * fix(deps): update rust crate anyhow to 1.0.83
    * build(deps): bump h2 from 0.3.25 to 0.3.26
    * [skip-ci] Packit: distinct `-rhel` packages value
    * [skip-ci] Packit: enable c10s downstream sync
    * fix(deps): update rust crate libc to 0.2.154
    * fix(deps): update rust crate ipnet to 2.9.0
    * fix(deps): update rust crate tower to 0.4.13
    * fix(deps): update rust crate tokio-stream to 0.1.15
    * fix(deps): update rust crate prost to 0.12.4
    * fix(deps): update rust crate iptables to 0.5.1
    * [skip-ci] Packit: remove el8 jobs
    * fix(deps): update rust crate anyhow to 1.0.82
    * fix(deps): update rust crate serde to 1.0.199
    * Add suffix to Aardvark internal network filenames
    * fix port forward with strict RPF and multi networks
    * renovate: stop rebasing PRs automatically
    * chore(deps): update rust crate chrono to 0.4.38
    * fix(deps): update rust crate serde_json to 1.0.116
    * fix(deps): update rust crate netlink-sys to 0.8.6
    * nftables: only dump netavark table rules
    * update nftables to 0.4
    * fix aardvark-dns netns check
    * fix(deps): update rust crate tokio to 1.37
    * fix(deps): update rust crate netlink-packet-route to 0.19.0
    * Update to nix-0.28.0
    * fix(deps): update rust crate mozim to 0.2.3
    * fix(deps): update rust crate nispor to 1.2.18
    * Update chrono
    * fix(deps): update rust crate serde_json to 1.0.115
    * build(deps): bump mio from 0.8.9 to 0.8.11
    * [skip-ci] rpm: aardvark-dns is a hard dep across the board
    * Update Rust crate env_logger to 0.11.3
    * Update Rust crate serde to 1.0.197
    * Update Rust crate tempfile to 3.10.1
    * Update Rust crate log to 0.4.21
    * Update Rust crate zbus to 3.15.2
    * Update Rust crate serde_json to 1.0.114
    * Update Rust crate env_logger to 0.11.2
    * Update Rust crate chrono to 0.4.34
    * Update Rust crate tonic-build to 0.11
    * Update Rust crate tonic to 0.11
    * fix netavark update to not start a new aardvark-dns
    * Update Rust crate tempfile to 3.10.0
    * Update Rust crate zbus to 3.15.0
    * Update Rust crate tokio to 1.36
    * Update Rust crate chrono to 0.4.33
    * Do not perform network namespace detection on AV update
    * [CI:BUILD] Packit/rpm: fix aardvark-dns handling
    * Update Rust crate serde_json to 1.0.113
    * Update Rust crate serde_json to 1.0.112
    * Update Rust crate env_logger to 0.11.1
    * update README with nftables support
    * Bump to v1.11.0-dev
    * perf-netavark: accept fw driver as argument
    * perf-netavark: fix missing --config arg

++++ python-Jinja2:

  - Add CVE-2024-34064.patch upstream patch
    (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4)
    Also fixes (CVE-2024-22195, bsc#1218722)

++++ python-Jinja2:

  - Add CVE-2024-34064.patch upstream patch
    (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4)
    Also fixes (CVE-2024-22195, bsc#1218722)

++++ python-Jinja2:

  - Add CVE-2024-34064.patch upstream patch
    (CVE-2024-34064, bsc#1223980, gh#pallets/jinja@0668239dc6b4)
    Also fixes (CVE-2024-22195, bsc#1218722)

++++ skopeo:

  - Update to version 1.14.4:
    * [release-1.14] Bump to Skopeo v1.14.4
    * [release-1.14] CVE-2024-3727 fix (bsc#1224123)
    * Packit: update packit targets
    * [release-1.14] Bump gopkg.in/go-jose to v2.6.3
    * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180
    * Freeze the fedora-minimal image reference at Fedora 38
    * [release-1.14] Bump to v1.14.3
    * [release-1.14] Bump c/common to v0.57.4
    * [release-1.14] Bump google.golang.org/protobuf to v1.33.0
    * [release-1.14] Bump Skopeo to v1.14.3-dev

++++ skopeo:

  - Update to version 1.14.4:
    * [release-1.14] Bump to Skopeo v1.14.4
    * [release-1.14] CVE-2024-3727 fix (bsc#1224123)
    * Packit: update packit targets
    * [release-1.14] Bump gopkg.in/go-jose to v2.6.3
    * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180
    * Freeze the fedora-minimal image reference at Fedora 38
    * [release-1.14] Bump to v1.14.3
    * [release-1.14] Bump c/common to v0.57.4
    * [release-1.14] Bump google.golang.org/protobuf to v1.33.0
    * [release-1.14] Bump Skopeo to v1.14.3-dev

++++ skopeo:

  - Update to version 1.14.4:
    * [release-1.14] Bump to Skopeo v1.14.4
    * [release-1.14] CVE-2024-3727 fix (bsc#1224123)
    * Packit: update packit targets
    * [release-1.14] Bump gopkg.in/go-jose to v2.6.3
    * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180
    * Freeze the fedora-minimal image reference at Fedora 38
    * [release-1.14] Bump to v1.14.3
    * [release-1.14] Bump c/common to v0.57.4
    * [release-1.14] Bump google.golang.org/protobuf to v1.33.0
    * [release-1.14] Bump Skopeo to v1.14.3-dev

++++ skopeo:

  - Update to version 1.14.4:
    * [release-1.14] Bump to Skopeo v1.14.4
    * [release-1.14] CVE-2024-3727 fix (bsc#1224123)
    * Packit: update packit targets
    * [release-1.14] Bump gopkg.in/go-jose to v2.6.3
    * [release-1.14] Bump ocicrypt and go-jose CVE-2024-28180
    * Freeze the fedora-minimal image reference at Fedora 38
    * [release-1.14] Bump to v1.14.3
    * [release-1.14] Bump c/common to v0.57.4
    * [release-1.14] Bump google.golang.org/protobuf to v1.33.0
    * [release-1.14] Bump Skopeo to v1.14.3-dev

------------------------------------------------------------------
------------------  2024-6-1  -  Jun 1 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add support for arch attr in repository element
    Allow to provide different repository sections per architecture

++++ python-kiwi:

  - Add support for arch attr in repository element
    Allow to provide different repository sections per architecture

++++ python-kiwi:

  - Add support for arch attr in repository element
    Allow to provide different repository sections per architecture

++++ kernel-default:

  - ASoC: wm_adsp: Add missing MODULE_DESCRIPTION() (git-fixes).
  - ALSA: ump: Set default protocol when not given explicitly
    (git-fixes).
  - ALSA/hda: intel-dsp-config: reduce log verbosity (git-fixes).
  - ALSA: core: Remove debugfs at disconnection (git-fixes).
  - commit f8e0906
  - drm/panel: sitronix-st7789v: fix display size for
    jt240mhqs_hwt_ek_e3 panel (git-fixes).
  - drm/panel: sitronix-st7789v: tweak timing for
    jt240mhqs_hwt_ek_e3 panel (git-fixes).
  - drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3
    panel (git-fixes).
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
    (git-fixes).
  - Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3
    devices" (stable-fixes).
  - drm/amd/display: Enable colorspace property for MST connectors
    (git-fixes).
  - drm/i915: Fix audio component initialization (git-fixes).
  - drm/i915/dpt: Make DPT object unshrinkable (git-fixes).
  - drm/i915/gt: Fix CCS id's calculation for CCS mode setting
    (git-fixes).
  - drm/i915/guc: avoid FIELD_PREP warning (git-fixes).
  - drm/i915/gt: Disarm breadcrumbs if engines are already idle
    (git-fixes).
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
    (git-fixes).
  - hwmon: (shtc1) Fix property misspelling (git-fixes).
  - hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board
    power sensor (git-fixes).
  - spi: stm32: Don't warn about spurious interrupts (git-fixes).
  - spi: Don't mark message DMA mapped when no transfer in it is
    (git-fixes).
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
    (git-fixes).
  - dma-mapping: benchmark: fix node id validation (git-fixes).
  - ALSA: seq: ump: Fix swapped song position pointer data
    (git-fixes).
  - ASoC: SOF: ipc4-topology: Fix input format query of process
    modules without base extension (git-fixes).
  - ALSA: seq: Fix yet another spot for system message conversion
    (git-fixes).
  - ALSA: ump: Don't accept an invalid UMP protocol number
    (git-fixes).
  - ALSA: ump: Don't clear bank selection after sending a program
    change (git-fixes).
  - ALSA: seq: Fix incorrect UMP type for system messages
    (git-fixes).
  - ALSA: seq: Don't clear bank selection at event -> UMP MIDI2
    conversion (git-fixes).
  - ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP
    conversion (git-fixes).
  - ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
    (git-fixes).
  - docs: netdev: Fix typo in Signed-off-by tag (git-fixes).
  - net: usb: smsc95xx: fix changing LED_SEL bit value updated
    from EEPROM (git-fixes).
  - net: phy: micrel: set soft_reset callback to genphy_soft_reset
    for KSZ8061 (git-fixes).
  - commit e5505a5
  - Add alt-commit to a nouveau patch
  - commit 0024d10

++++ kernel-default:

  - ASoC: wm_adsp: Add missing MODULE_DESCRIPTION() (git-fixes).
  - ALSA: ump: Set default protocol when not given explicitly
    (git-fixes).
  - ALSA/hda: intel-dsp-config: reduce log verbosity (git-fixes).
  - ALSA: core: Remove debugfs at disconnection (git-fixes).
  - commit f8e0906
  - drm/panel: sitronix-st7789v: fix display size for
    jt240mhqs_hwt_ek_e3 panel (git-fixes).
  - drm/panel: sitronix-st7789v: tweak timing for
    jt240mhqs_hwt_ek_e3 panel (git-fixes).
  - drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3
    panel (git-fixes).
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
    (git-fixes).
  - Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3
    devices" (stable-fixes).
  - drm/amd/display: Enable colorspace property for MST connectors
    (git-fixes).
  - drm/i915: Fix audio component initialization (git-fixes).
  - drm/i915/dpt: Make DPT object unshrinkable (git-fixes).
  - drm/i915/gt: Fix CCS id's calculation for CCS mode setting
    (git-fixes).
  - drm/i915/guc: avoid FIELD_PREP warning (git-fixes).
  - drm/i915/gt: Disarm breadcrumbs if engines are already idle
    (git-fixes).
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
    (git-fixes).
  - hwmon: (shtc1) Fix property misspelling (git-fixes).
  - hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board
    power sensor (git-fixes).
  - spi: stm32: Don't warn about spurious interrupts (git-fixes).
  - spi: Don't mark message DMA mapped when no transfer in it is
    (git-fixes).
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
    (git-fixes).
  - dma-mapping: benchmark: fix node id validation (git-fixes).
  - ALSA: seq: ump: Fix swapped song position pointer data
    (git-fixes).
  - ASoC: SOF: ipc4-topology: Fix input format query of process
    modules without base extension (git-fixes).
  - ALSA: seq: Fix yet another spot for system message conversion
    (git-fixes).
  - ALSA: ump: Don't accept an invalid UMP protocol number
    (git-fixes).
  - ALSA: ump: Don't clear bank selection after sending a program
    change (git-fixes).
  - ALSA: seq: Fix incorrect UMP type for system messages
    (git-fixes).
  - ALSA: seq: Don't clear bank selection at event -> UMP MIDI2
    conversion (git-fixes).
  - ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP
    conversion (git-fixes).
  - ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
    (git-fixes).
  - docs: netdev: Fix typo in Signed-off-by tag (git-fixes).
  - net: usb: smsc95xx: fix changing LED_SEL bit value updated
    from EEPROM (git-fixes).
  - net: phy: micrel: set soft_reset callback to genphy_soft_reset
    for KSZ8061 (git-fixes).
  - commit e5505a5
  - Add alt-commit to a nouveau patch
  - commit 0024d10

++++ kernel-default:

  - ASoC: wm_adsp: Add missing MODULE_DESCRIPTION() (git-fixes).
  - ALSA: ump: Set default protocol when not given explicitly
    (git-fixes).
  - ALSA/hda: intel-dsp-config: reduce log verbosity (git-fixes).
  - ALSA: core: Remove debugfs at disconnection (git-fixes).
  - commit f8e0906
  - drm/panel: sitronix-st7789v: fix display size for
    jt240mhqs_hwt_ek_e3 panel (git-fixes).
  - drm/panel: sitronix-st7789v: tweak timing for
    jt240mhqs_hwt_ek_e3 panel (git-fixes).
  - drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3
    panel (git-fixes).
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
    (git-fixes).
  - Revert "drm/amdkfd: fix gfx_target_version for certain 11.0.3
    devices" (stable-fixes).
  - drm/amd/display: Enable colorspace property for MST connectors
    (git-fixes).
  - drm/i915: Fix audio component initialization (git-fixes).
  - drm/i915/dpt: Make DPT object unshrinkable (git-fixes).
  - drm/i915/gt: Fix CCS id's calculation for CCS mode setting
    (git-fixes).
  - drm/i915/guc: avoid FIELD_PREP warning (git-fixes).
  - drm/i915/gt: Disarm breadcrumbs if engines are already idle
    (git-fixes).
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)
    (git-fixes).
  - hwmon: (shtc1) Fix property misspelling (git-fixes).
  - hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board
    power sensor (git-fixes).
  - spi: stm32: Don't warn about spurious interrupts (git-fixes).
  - spi: Don't mark message DMA mapped when no transfer in it is
    (git-fixes).
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly
    (git-fixes).
  - dma-mapping: benchmark: fix node id validation (git-fixes).
  - ALSA: seq: ump: Fix swapped song position pointer data
    (git-fixes).
  - ASoC: SOF: ipc4-topology: Fix input format query of process
    modules without base extension (git-fixes).
  - ALSA: seq: Fix yet another spot for system message conversion
    (git-fixes).
  - ALSA: ump: Don't accept an invalid UMP protocol number
    (git-fixes).
  - ALSA: ump: Don't clear bank selection after sending a program
    change (git-fixes).
  - ALSA: seq: Fix incorrect UMP type for system messages
    (git-fixes).
  - ALSA: seq: Don't clear bank selection at event -> UMP MIDI2
    conversion (git-fixes).
  - ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP
    conversion (git-fixes).
  - ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp
    (git-fixes).
  - docs: netdev: Fix typo in Signed-off-by tag (git-fixes).
  - net: usb: smsc95xx: fix changing LED_SEL bit value updated
    from EEPROM (git-fixes).
  - net: phy: micrel: set soft_reset callback to genphy_soft_reset
    for KSZ8061 (git-fixes).
  - commit e5505a5
  - Add alt-commit to a nouveau patch
  - commit 0024d10

------------------------------------------------------------------
------------------  2024-5-31  -  May 31 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add --list-profiles to image info
    Allow to list available profiles from the processed image
    description

++++ python-kiwi:

  - Add --list-profiles to image info
    Allow to list available profiles from the processed image
    description

++++ python-kiwi:

  - Add --list-profiles to image info
    Allow to list available profiles from the processed image
    description

++++ git:

  - Compat stub for %python3_fix_shebang_path
  - only call the %python3_fix_shebang_path if it is actually
    defined. This fixes the build on 15.x
  - update to 2.45.2:
    * Revert "defense in depth" fixes from 2.45.1 broke 'git lfs' and
    'git annex'

++++ kernel-default:

  - 9p: add missing locking around taking dentry fid list (git-fixes)
  - commit 581af2d
  - blacklist.conf: only a VFS cleanup
  - commit f4a0ca8
  - blacklist.conf: openpromfs not built
  - commit 475ff82
  - ecryptfs: Fix buffer size for tag 66 packet (git-fixes)
  - commit 17aae28
  - llc: call sock_orphan() at release time
    (CVE-2024-26625 bsc#1221086)
  - commit fe6bd4d
  - fs/9p: translate O_TRUNC into OTRUNC (git-fixes)
  - commit e03e9a5
  - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    (git-fixes).
  - commit e824dba
  - fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes)
  - commit ebd0dc6
  - selftests/bpf: precision tracking test for BPF_NEG and BPF_END
    (bsc#1225756).
  - commit a410d73
  - selftests/bpf: add edge case backtracking logic test
    (bsc#1225756).
  - bpf: fix precision backtracking instruction iteration
    (bsc#1225756).
  - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).
  - commit 9cbb99b
  - blacklist.conf: remove add and revert patch pair
  - commit f17fe30
  - fs: indicate request originates from old mount API (git-fixes)
  - commit 0754468
  - blacklist.conf: only comment fix
  - commit b912460
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock (git-fixes)
  - commit 4c48f9f
  - fs: Fix error checking for d_hash_and_lookup() (git-fixes)
  - commit c90513f
  - nvme-pci: Add quirk for broken MSIs (git-fixes).
  - nvme: fix warn output about shared namespaces without
    CONFIG_NVME_MULTIPATH (git-fixes).
  - drivers/nvme: Add quirks for device 126f:2262 (git-fixes).
  - commit fff60eb
  - Update
    patches.suse/nvme-ensure-disabling-pairs-with-unquiesce.patch
    (jsc#PED-6252 jsc#PED-5728 jsc#PED-5062 jsc#PED-3535
    bsc#1224534).
  - commit d9497f3
  - octeontx2-af: fix the double free in rvu_npc_freemem() (bsc#1225712 CVE-2024-36030)
  - commit 294ca99
  - idpf: extend tx watchdog timeout (bsc#1224137).
  - commit fbf0ed6
  - kABI fix of KVM: x86/pmu: Allow programming events that match
    unsupported arch events (bsc#1225696).
  - Refresh
    patches.suse/KVM-x86-pmu-Allow-programming-events-that-match-unsu.patch.
  - commit 0e4ccf5

++++ kernel-default:

  - 9p: add missing locking around taking dentry fid list (git-fixes)
  - commit 581af2d
  - blacklist.conf: only a VFS cleanup
  - commit f4a0ca8
  - blacklist.conf: openpromfs not built
  - commit 475ff82
  - ecryptfs: Fix buffer size for tag 66 packet (git-fixes)
  - commit 17aae28
  - llc: call sock_orphan() at release time
    (CVE-2024-26625 bsc#1221086)
  - commit fe6bd4d
  - fs/9p: translate O_TRUNC into OTRUNC (git-fixes)
  - commit e03e9a5
  - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    (git-fixes).
  - commit e824dba
  - fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes)
  - commit ebd0dc6
  - selftests/bpf: precision tracking test for BPF_NEG and BPF_END
    (bsc#1225756).
  - commit a410d73
  - selftests/bpf: add edge case backtracking logic test
    (bsc#1225756).
  - bpf: fix precision backtracking instruction iteration
    (bsc#1225756).
  - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).
  - commit 9cbb99b
  - blacklist.conf: remove add and revert patch pair
  - commit f17fe30
  - fs: indicate request originates from old mount API (git-fixes)
  - commit 0754468
  - blacklist.conf: only comment fix
  - commit b912460
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock (git-fixes)
  - commit 4c48f9f
  - fs: Fix error checking for d_hash_and_lookup() (git-fixes)
  - commit c90513f
  - nvme-pci: Add quirk for broken MSIs (git-fixes).
  - nvme: fix warn output about shared namespaces without
    CONFIG_NVME_MULTIPATH (git-fixes).
  - drivers/nvme: Add quirks for device 126f:2262 (git-fixes).
  - commit fff60eb
  - Update
    patches.suse/nvme-ensure-disabling-pairs-with-unquiesce.patch
    (jsc#PED-6252 jsc#PED-5728 jsc#PED-5062 jsc#PED-3535
    bsc#1224534).
  - commit d9497f3
  - octeontx2-af: fix the double free in rvu_npc_freemem() (bsc#1225712 CVE-2024-36030)
  - commit 294ca99
  - idpf: extend tx watchdog timeout (bsc#1224137).
  - commit fbf0ed6
  - kABI fix of KVM: x86/pmu: Allow programming events that match
    unsupported arch events (bsc#1225696).
  - Refresh
    patches.suse/KVM-x86-pmu-Allow-programming-events-that-match-unsu.patch.
  - commit 0e4ccf5

++++ kernel-default:

  - 9p: add missing locking around taking dentry fid list (git-fixes)
  - commit 581af2d
  - blacklist.conf: only a VFS cleanup
  - commit f4a0ca8
  - blacklist.conf: openpromfs not built
  - commit 475ff82
  - ecryptfs: Fix buffer size for tag 66 packet (git-fixes)
  - commit 17aae28
  - llc: call sock_orphan() at release time
    (CVE-2024-26625 bsc#1221086)
  - commit fe6bd4d
  - fs/9p: translate O_TRUNC into OTRUNC (git-fixes)
  - commit e03e9a5
  - bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    (git-fixes).
  - commit e824dba
  - fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes)
  - commit ebd0dc6
  - selftests/bpf: precision tracking test for BPF_NEG and BPF_END
    (bsc#1225756).
  - commit a410d73
  - selftests/bpf: add edge case backtracking logic test
    (bsc#1225756).
  - bpf: fix precision backtracking instruction iteration
    (bsc#1225756).
  - bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).
  - commit 9cbb99b
  - blacklist.conf: remove add and revert patch pair
  - commit f17fe30
  - fs: indicate request originates from old mount API (git-fixes)
  - commit 0754468
  - blacklist.conf: only comment fix
  - commit b912460
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock (git-fixes)
  - commit 4c48f9f
  - fs: Fix error checking for d_hash_and_lookup() (git-fixes)
  - commit c90513f
  - nvme-pci: Add quirk for broken MSIs (git-fixes).
  - nvme: fix warn output about shared namespaces without
    CONFIG_NVME_MULTIPATH (git-fixes).
  - drivers/nvme: Add quirks for device 126f:2262 (git-fixes).
  - commit fff60eb
  - Update
    patches.suse/nvme-ensure-disabling-pairs-with-unquiesce.patch
    (jsc#PED-6252 jsc#PED-5728 jsc#PED-5062 jsc#PED-3535
    bsc#1224534).
  - commit d9497f3
  - octeontx2-af: fix the double free in rvu_npc_freemem() (bsc#1225712 CVE-2024-36030)
  - commit 294ca99
  - idpf: extend tx watchdog timeout (bsc#1224137).
  - commit fbf0ed6
  - kABI fix of KVM: x86/pmu: Allow programming events that match
    unsupported arch events (bsc#1225696).
  - Refresh
    patches.suse/KVM-x86-pmu-Allow-programming-events-that-match-unsu.patch.
  - commit 0e4ccf5

++++ libzypp:

  - zypp-tui: Make sure translated texts use the correct textdomain
    (fixes #551)
  - Skip libproxy1 requires for tumbleweed.
  - version 17.34.1 (34)

++++ libzypp:

  - zypp-tui: Make sure translated texts use the correct textdomain
    (fixes #551)
  - Skip libproxy1 requires for tumbleweed.
  - version 17.34.1 (34)

++++ libzypp:

  - zypp-tui: Make sure translated texts use the correct textdomain
    (fixes #551)
  - Skip libproxy1 requires for tumbleweed.
  - version 17.34.1 (34)

++++ libzypp:

  - zypp-tui: Make sure translated texts use the correct textdomain
    (fixes #551)
  - Skip libproxy1 requires for tumbleweed.
  - version 17.34.1 (34)

++++ libzypp:

  - zypp-tui: Make sure translated texts use the correct textdomain
    (fixes #551)
  - Skip libproxy1 requires for tumbleweed.
  - version 17.34.1 (34)

++++ patterns-base:

  - require openSUSE-build key on openSUSE

------------------------------------------------------------------
------------------  2024-5-30  -  May 30 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.0.18 → 10.0.19

++++ python-kiwi:

  - Bump version: 10.0.18 → 10.0.19

++++ python-kiwi:

  - Bump version: 10.0.18 → 10.0.19

++++ kernel-default:

  - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331)
  - commit c148fd3
  - calipso: fix memory leak in netlbl_calipso_add_pass()
    (CVE-2023-52698 bsc#1224621)
  - commit 5fc90b9
  - kabi/severities: ignore IMS functions
    They were dropped in previous patches. Noone is supposed to use them.
  - commit 494909c
  - smb: client: set correct id, uid and cruid for multiuser
    automounts (bsc#1223011, CVE-2024-26822).
  - commit 6fce785
  - smb: client: fix potential OOBs in smb2_parse_contexts()
    (bsc#1220148, CVE-2023-52434).
  - commit a00a7f6

++++ kernel-default:

  - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331)
  - commit c148fd3
  - calipso: fix memory leak in netlbl_calipso_add_pass()
    (CVE-2023-52698 bsc#1224621)
  - commit 5fc90b9
  - kabi/severities: ignore IMS functions
    They were dropped in previous patches. Noone is supposed to use them.
  - commit 494909c
  - smb: client: set correct id, uid and cruid for multiuser
    automounts (bsc#1223011, CVE-2024-26822).
  - commit 6fce785
  - smb: client: fix potential OOBs in smb2_parse_contexts()
    (bsc#1220148, CVE-2023-52434).
  - commit a00a7f6

++++ kernel-default:

  - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331)
  - commit c148fd3
  - calipso: fix memory leak in netlbl_calipso_add_pass()
    (CVE-2023-52698 bsc#1224621)
  - commit 5fc90b9
  - kabi/severities: ignore IMS functions
    They were dropped in previous patches. Noone is supposed to use them.
  - commit 494909c
  - smb: client: set correct id, uid and cruid for multiuser
    automounts (bsc#1223011, CVE-2024-26822).
  - commit 6fce785
  - smb: client: fix potential OOBs in smb2_parse_contexts()
    (bsc#1220148, CVE-2023-52434).
  - commit a00a7f6

------------------------------------------------------------------
------------------  2024-5-29  -  May 29 2024  -------------------
------------------------------------------------------------------

++++ cups:

  - Update to version 2.4.8:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.8 brings many bug fixes which aggregated over the last
    half a year. It brings the important fix for race conditions
    and errors which can happen when installing permanent
    IPP Everywhere printer, support for PAM modules password-auth
    and system-auth and new option for lpstat which can show only
    the successful jobs.
    Detailed list (from CHANGES.md):
    * Added warning if the device has to be asked for
    'all,media-col-database' separately (Issue #829)
    * Added new value for 'lpstat' option '-W' - successfull - for
    getting successfully printed jobs (Issue #830)
    * Added support for PAM modules password-auth
    and system-auth (Issue #892)
    * Updated IPP Everywhere printer creation error
    reporting (Issue #347)
    * Updated and documented the MIME typing buffering
    limit (Issue #925)
    * Raised 'cups_enum_dests()' timeout for listing
    available IPP printers (Issue #751)
    * Now report an error for temporary printer defaults
    with lpadmin (Issue #237)
    * Fixed mapping of PPD InputSlot, MediaType,
    and OutputBin values (Issue #238)
    * Fixed "document-unprintable-error" handling (Issue #391)
    * Fixed the web interface not showing an error
    for a non-existent printer (Issue #423)
    * Fixed printing of jobs with job name longer than 255 chars
    on older printers (Issue #644)
    * Really backported fix for Issue #742
    * Fixed 'cupsCopyDestInfo' device connection
    detection (Issue #586)
    * Fixed "Upgrade" header handling when there is
    no TLS support (Issue #775)
    * Fixed memory leak when unloading a job (Issue #813)
    * Fixed memory leak when creating color profiles (Issue #815)
    * Fixed a punch finishing bug in the IPP Everywhere
    support (Issue #821)
    * Fixed crash in 'scan_ps()' if incoming argument
    is NULL (Issue #831)
    * Fixed setting job state reasons for successful
    jobs (Issue #832)
    * Fixed infinite loop in IPP backend if hostname
    is IP address with Kerberos (Issue #838)
    * Added additional check on socket if 'revents' from 'poll()'
    returns POLLHUP together with POLLIN or POLLOUT
    in 'httpAddrConnect2()' (Issue #839)
    * Fixed crash in 'ppdEmitString()' if 'size' is NULL (Issue #850)
    * Fixed reporting 'media-source-supported' when
    sharing printer  which has numbers as strings instead of
    keywords as 'InputSlot' values (Issue #859)
    * Fixed IPP backend to support the "print-scaling" option
    with IPP printers (Issue #862)
    * Fixed potential race condition for the creation
    of temporary queues (Issue #871)
    * Fixed 'httpGets' timeout handling (Issue #879)
    * Fixed checking for required attributes during
    PPD generation (Issue #890)
    * Fixed encoding of IPv6 addresses in HTTP requests (Issue #903)
    * Fixed sending response headers to client (Issue #927)
    * Fixed CGI program initialization and validation
    of form checkbox and text fields.
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.8

++++ cups:

  - Update to version 2.4.8:
    See https://github.com/openprinting/cups/releases
    CUPS 2.4.8 brings many bug fixes which aggregated over the last
    half a year. It brings the important fix for race conditions
    and errors which can happen when installing permanent
    IPP Everywhere printer, support for PAM modules password-auth
    and system-auth and new option for lpstat which can show only
    the successful jobs.
    Detailed list (from CHANGES.md):
    * Added warning if the device has to be asked for
    'all,media-col-database' separately (Issue #829)
    * Added new value for 'lpstat' option '-W' - successfull - for
    getting successfully printed jobs (Issue #830)
    * Added support for PAM modules password-auth
    and system-auth (Issue #892)
    * Updated IPP Everywhere printer creation error
    reporting (Issue #347)
    * Updated and documented the MIME typing buffering
    limit (Issue #925)
    * Raised 'cups_enum_dests()' timeout for listing
    available IPP printers (Issue #751)
    * Now report an error for temporary printer defaults
    with lpadmin (Issue #237)
    * Fixed mapping of PPD InputSlot, MediaType,
    and OutputBin values (Issue #238)
    * Fixed "document-unprintable-error" handling (Issue #391)
    * Fixed the web interface not showing an error
    for a non-existent printer (Issue #423)
    * Fixed printing of jobs with job name longer than 255 chars
    on older printers (Issue #644)
    * Really backported fix for Issue #742
    * Fixed 'cupsCopyDestInfo' device connection
    detection (Issue #586)
    * Fixed "Upgrade" header handling when there is
    no TLS support (Issue #775)
    * Fixed memory leak when unloading a job (Issue #813)
    * Fixed memory leak when creating color profiles (Issue #815)
    * Fixed a punch finishing bug in the IPP Everywhere
    support (Issue #821)
    * Fixed crash in 'scan_ps()' if incoming argument
    is NULL (Issue #831)
    * Fixed setting job state reasons for successful
    jobs (Issue #832)
    * Fixed infinite loop in IPP backend if hostname
    is IP address with Kerberos (Issue #838)
    * Added additional check on socket if 'revents' from 'poll()'
    returns POLLHUP together with POLLIN or POLLOUT
    in 'httpAddrConnect2()' (Issue #839)
    * Fixed crash in 'ppdEmitString()' if 'size' is NULL (Issue #850)
    * Fixed reporting 'media-source-supported' when
    sharing printer  which has numbers as strings instead of
    keywords as 'InputSlot' values (Issue #859)
    * Fixed IPP backend to support the "print-scaling" option
    with IPP printers (Issue #862)
    * Fixed potential race condition for the creation
    of temporary queues (Issue #871)
    * Fixed 'httpGets' timeout handling (Issue #879)
    * Fixed checking for required attributes during
    PPD generation (Issue #890)
    * Fixed encoding of IPv6 addresses in HTTP requests (Issue #903)
    * Fixed sending response headers to client (Issue #927)
    * Fixed CGI program initialization and validation
    of form checkbox and text fields.
    Issues are those at https://github.com/OpenPrinting/cups/issues
  - Adapted downgrade-autoconf-requirement.patch for CUPS 2.4.8

++++ python-kiwi:

  - package: Always include patches and number all sources and patches
    This ensures that stuff is applied reliably and all sources and patches
    are included as expected.
    Then the added kiwi-revert-bls-default-for-suse.patch is applied
    conditionally for SUSE distributions.
  - Bump version: 10.0.17 → 10.0.18
  - package: adjust openSUSE patch
  - Bump version: 10.0.16 → 10.0.17
  - Fixed box plugin documentation
    The provided example was no longer correct according to
    changes on the image description referenced in the example

++++ python-kiwi:

  - package: Always include patches and number all sources and patches
    This ensures that stuff is applied reliably and all sources and patches
    are included as expected.
    Then the added kiwi-revert-bls-default-for-suse.patch is applied
    conditionally for SUSE distributions.
  - Bump version: 10.0.17 → 10.0.18
  - package: adjust openSUSE patch
  - Bump version: 10.0.16 → 10.0.17
  - Fixed box plugin documentation
    The provided example was no longer correct according to
    changes on the image description referenced in the example

++++ python-kiwi:

  - package: Always include patches and number all sources and patches
    This ensures that stuff is applied reliably and all sources and patches
    are included as expected.
    Then the added kiwi-revert-bls-default-for-suse.patch is applied
    conditionally for SUSE distributions.
  - Bump version: 10.0.17 → 10.0.18
  - package: adjust openSUSE patch
  - Bump version: 10.0.16 → 10.0.17
  - Fixed box plugin documentation
    The provided example was no longer correct according to
    changes on the image description referenced in the example

++++ glibc:

  - Fix typo in last change

++++ glibc:

  - Fix typo in last change

++++ glibc:

  - Fix typo in last change

++++ glibc:

  - Fix typo in last change

++++ glibc:

  - Fix typo in last change

++++ kernel-default:

  - dm-integrity: fix a memory leak when rechecking the data
    (bsc#1223077, CVE-2024-26860).
  - commit 29984e7
  - btrfs: zoned: don't skip block groups with 100% zone unusable
    (bsc#1220120).
  - btrfs: don't refill whole delayed refs block reserve when
    starting transaction (bsc#1220120).
  - btrfs: add new unused block groups to the list of unused block
    groups (bsc#1220120).
  - btrfs: do not delete unused block group if it may be used soon
    (bsc#1220120).
  - btrfs: add and use helper to check if block group is used
    (bsc#1220120).
  - btrfs: always reserve space for delayed refs when starting
    transaction (bsc#1220120).
  - btrfs: stop doing excessive space reservation for csum deletion
    (bsc#1220120).
  - btrfs: remove pointless initialization at
    btrfs_delayed_refs_rsv_release() (bsc#1220120).
  - btrfs: reserve space for delayed refs on a per ref basis
    (bsc#1220120).
  - btrfs: allow to run delayed refs by bytes to be released
    instead of count (bsc#1220120).
  - btrfs: simplify check for extent item overrun at
    lookup_inline_extent_backref() (bsc#1220120).
  - btrfs: return -EUCLEAN if extent item is missing when searching
    inline backref (bsc#1220120).
  - btrfs: use a single variable for return value at
    lookup_inline_extent_backref() (bsc#1220120).
  - btrfs: use a single variable for return value at
    run_delayed_extent_op() (bsc#1220120).
  - btrfs: remove pointless 'ref_root' variable from
    run_delayed_data_ref() (bsc#1220120).
  - btrfs: initialize key where it's used when running delayed
    data ref (bsc#1220120).
  - btrfs: remove refs_to_drop argument from __btrfs_free_extent()
    (bsc#1220120).
  - btrfs: remove refs_to_add argument from __btrfs_inc_extent_ref()
    (bsc#1220120).
  - btrfs: remove the refcount warning/check at
    btrfs_put_delayed_ref() (bsc#1220120).
  - btrfs: remove unnecessary logic when running new delayed
    references (bsc#1220120).
  - btrfs: pass a space_info argument to
    btrfs_reserve_metadata_bytes() (bsc#1220120).
  - btrfs: log message if extent item not found when running
    delayed extent op (bsc#1220120).
  - btrfs: remove redundant BUG_ON() from __btrfs_inc_extent_ref()
    (bsc#1220120).
  - btrfs: move btrfs_free_excluded_extents() into block-group.c
    (bsc#1220120).
  - btrfs: open code trivial btrfs_add_excluded_extent()
    (bsc#1220120).
  - btrfs: make find_first_extent_bit() return a boolean
    (bsc#1220120).
  - btrfs: make btrfs_destroy_pinned_extent() return void
    (bsc#1220120).
  - btrfs: make btrfs_destroy_marked_extents() return void
    (bsc#1220120).
  - btrfs: rename add_new_free_space() to btrfs_add_new_free_space()
    (bsc#1220120).
  - btrfs: update documentation for add_new_free_space()
    (bsc#1220120).
  - commit 37b05cd
  - Refresh
    patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch (bsc#1222771).
    In preparation of enabling CONFIG_FIPS_SIGNATURE_SELFTEST, amend the
    missing 'usage' argument in the pkcs7_validate_trust() invocation
    from  the PKCS#7 selftest.
  - commit cfa0827
  - blacklist.conf: arm: kernel does not support folios
  - commit e0489ca
  - printk: Let no_printk() use _printk() (bsc#1225618).
  - commit 2abd745
  - printk: Update @console_may_schedule in
    console_trylock_spinning() (bsc#1225616).
  - commit e5e7ac5
  - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock
    (CVE-2024-26676 bsc#1222380).
  - af_unix: Don't peek OOB data without MSG_OOB (CVE-2024-26676 bsc#1222380).
  - af_unix: Clear stale u->oob_skb (CVE-2024-26676 bsc#1222380).
  - commit 7722c8d
  - af_unix: fix use-after-free in unix_stream_read_actor()
    (CVE-2023-52772 bsc#1224989).
  - commit 0f5ff3f
  - certs: Add ECDSA signature verification self-test (bsc#1222777).
  - Port "certs: Add ECDSA signature verification self-test".
  - Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_ECDSA.
  - Refresh
    0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch:
    trivial context update to Kconfig
  - commit 7338b2e
  - dump_stack: Do not get cpu_sync for panic CPU (bsc#1225607).
  - commit 3d953e1
  - printk: Avoid non-panic CPUs writing to ringbuffer
    (bsc#1225607).
  - commit 9a41cad
  - certs: Move RSA self-test data to separate file (bsc#1222777).
  - Port "certs: Move RSA self-test data to separate file".
  - Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_RSA.
  - Refresh
    patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch:
  - trivial context update to Kconfig,
  - account for changed pkcs7_validate_trust() callsite amended by
    this refreshed patch.
  - commit 248ad2a
  - printk: Disable passing console lock owner completely during
    panic() (bsc#1225607).
  - commit a31a4d6
  - printk: ringbuffer: Skip non-finalized records in panic
    (bsc#1225607).
  - commit 8be42db
  - Enable CONFIG_FIPS_SIGNATURE_SELFTEST (bsc#1222771)
  - commit 4ade1c7
  - printk: Wait for all reserved records with pr_flush()
    (bsc#1225607).
  - commit 4a07b6c
  - printk: ringbuffer: Cleanup reader terminology (bsc#1225607).
  - commit b3f2a50
  - printk: Add this_cpu_in_panic() (bsc#1225607).
  - commit 8afb830
  - printk: For @suppress_panic_printk check for other CPU in panic
    (bsc#1225607).
  - commit f2045e0
  - printk: ringbuffer: Clarify special lpos values (bsc#1225607).
  - commit d1338d8
  - printk: ringbuffer: Do not skip non-finalized records with
    prb_next_seq() (bsc#1225607).
  - commit 1ea687c
  - prctl: generalize PR_SET_MDWE support check to be per-arch
    (bsc#1225610).
  - commit b86afe4
  - printk: Use prb_first_seq() as base for 32bit seq macros
    (bsc#1225607).
  - commit ea93856
  - printk: Adjust mapping for 32bit seq macros (bsc#1225607).
  - commit e9e690d
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
    (bsc#1225605).
  - blk-cgroup: fix list corruption from resetting io stat
    (bsc#1225605).
  - commit c132bd3
  - printk: nbcon: Relocate 32bit seq macros (bsc#1225607).
  - commit 6293dd4
  - printk: Rename abandon_console_lock_in_panic() to
    other_cpu_in_panic() (bsc#1225607).
  - commit 74aec78
  - printk: Consolidate console deferred printing (bsc#1225607).
  - commit c45374f
  - printk: Do not take console lock for console_flush_on_panic()
    (bsc#1225607).
  - commit ca5038f
  - printk: Keep non-panic-CPUs out of console lock (bsc#1225607).
  - commit 2d7bf36
  - printk: Reduce console_unblank() usage in unsafe scenarios
    (bsc#1225607).
  - commit 54eafaa
  - livepatch: Fix missing newline character in
    klp_resolve_symbols() (bsc#1223539).
  - commit af0f908
  - blacklist.conf: workqueues: system-wide nr_active enforcement patchset;
    not worth the risk (bsc#1225580)
  - commit 059cebc
  - cpumap: Zero-initialise xdp_rxq_info struct before running
    XDP program (bsc#1224718 CVE-2024-27431).
  - commit fb7728a
  - kABI: bpf: struct bpf_link and bpf_link_ops kABI workaround
    (bsc#1224531 CVE-2024-35860).
  - commit 7744489
  - Revert "PCI/MSI: Provide IMS (Interrupt Message Store) support"
    (git-fixes).
  - Revert "PCI/MSI: Provide pci_ims_alloc/free_irq()" (git-fixes).
  - Revert "PCI/MSI: Provide stubs for IMS functions" (git-fixes).
  - commit 0dc394b
  - ppdev: Add an error check in register_device (git-fixes).
  - commit cfdb6a2
  - bpf: support deferring bpf_link dealloc to after RCU grace
    period (bsc#1224531 CVE-2024-35860).
  - bpf: put uprobe link's path and task in release callback
    (bsc#1224531 CVE-2024-35860).
  - commit a95dd44
  - Bluetooth: ISO: Fix not validating setsockopt user input
    (bsc#1224581 CVE-2024-35964).
  - commit 9d49d44
  - blacklist.conf: workqueues: cosmetic; truncated names in ps output
  - commit 2ed068f
  - Bluetooth: ISO: Add support for BT_PKT_STATUS (bsc#1224581
    CVE-2024-35964).
  - commit cadac48
  - Bluetooth: af_bluetooth: Make BT_PKT_STATUS generic (bsc#1224581
    CVE-2024-35964).
  - Refresh
    patches.suse/Bluetooth-SCO-Fix-not-validating-setsockopt-user-inp.patch.
  - commit 774d916
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
    (bsc#1209657 CVE-2023-0160 bsc#1224511 CVE-2024-35895).
  - commit fa3fb92
  - tpm_tis_spi: Account for SPI header when allocating TPM SPI
    xfer buffer (git-fixes).
  - commit 6d124e2

++++ kernel-default:

  - dm-integrity: fix a memory leak when rechecking the data
    (bsc#1223077, CVE-2024-26860).
  - commit 29984e7
  - btrfs: zoned: don't skip block groups with 100% zone unusable
    (bsc#1220120).
  - btrfs: don't refill whole delayed refs block reserve when
    starting transaction (bsc#1220120).
  - btrfs: add new unused block groups to the list of unused block
    groups (bsc#1220120).
  - btrfs: do not delete unused block group if it may be used soon
    (bsc#1220120).
  - btrfs: add and use helper to check if block group is used
    (bsc#1220120).
  - btrfs: always reserve space for delayed refs when starting
    transaction (bsc#1220120).
  - btrfs: stop doing excessive space reservation for csum deletion
    (bsc#1220120).
  - btrfs: remove pointless initialization at
    btrfs_delayed_refs_rsv_release() (bsc#1220120).
  - btrfs: reserve space for delayed refs on a per ref basis
    (bsc#1220120).
  - btrfs: allow to run delayed refs by bytes to be released
    instead of count (bsc#1220120).
  - btrfs: simplify check for extent item overrun at
    lookup_inline_extent_backref() (bsc#1220120).
  - btrfs: return -EUCLEAN if extent item is missing when searching
    inline backref (bsc#1220120).
  - btrfs: use a single variable for return value at
    lookup_inline_extent_backref() (bsc#1220120).
  - btrfs: use a single variable for return value at
    run_delayed_extent_op() (bsc#1220120).
  - btrfs: remove pointless 'ref_root' variable from
    run_delayed_data_ref() (bsc#1220120).
  - btrfs: initialize key where it's used when running delayed
    data ref (bsc#1220120).
  - btrfs: remove refs_to_drop argument from __btrfs_free_extent()
    (bsc#1220120).
  - btrfs: remove refs_to_add argument from __btrfs_inc_extent_ref()
    (bsc#1220120).
  - btrfs: remove the refcount warning/check at
    btrfs_put_delayed_ref() (bsc#1220120).
  - btrfs: remove unnecessary logic when running new delayed
    references (bsc#1220120).
  - btrfs: pass a space_info argument to
    btrfs_reserve_metadata_bytes() (bsc#1220120).
  - btrfs: log message if extent item not found when running
    delayed extent op (bsc#1220120).
  - btrfs: remove redundant BUG_ON() from __btrfs_inc_extent_ref()
    (bsc#1220120).
  - btrfs: move btrfs_free_excluded_extents() into block-group.c
    (bsc#1220120).
  - btrfs: open code trivial btrfs_add_excluded_extent()
    (bsc#1220120).
  - btrfs: make find_first_extent_bit() return a boolean
    (bsc#1220120).
  - btrfs: make btrfs_destroy_pinned_extent() return void
    (bsc#1220120).
  - btrfs: make btrfs_destroy_marked_extents() return void
    (bsc#1220120).
  - btrfs: rename add_new_free_space() to btrfs_add_new_free_space()
    (bsc#1220120).
  - btrfs: update documentation for add_new_free_space()
    (bsc#1220120).
  - commit 37b05cd
  - Refresh
    patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch (bsc#1222771).
    In preparation of enabling CONFIG_FIPS_SIGNATURE_SELFTEST, amend the
    missing 'usage' argument in the pkcs7_validate_trust() invocation
    from  the PKCS#7 selftest.
  - commit cfa0827
  - blacklist.conf: arm: kernel does not support folios
  - commit e0489ca
  - printk: Let no_printk() use _printk() (bsc#1225618).
  - commit 2abd745
  - printk: Update @console_may_schedule in
    console_trylock_spinning() (bsc#1225616).
  - commit e5e7ac5
  - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock
    (CVE-2024-26676 bsc#1222380).
  - af_unix: Don't peek OOB data without MSG_OOB (CVE-2024-26676 bsc#1222380).
  - af_unix: Clear stale u->oob_skb (CVE-2024-26676 bsc#1222380).
  - commit 7722c8d
  - af_unix: fix use-after-free in unix_stream_read_actor()
    (CVE-2023-52772 bsc#1224989).
  - commit 0f5ff3f
  - certs: Add ECDSA signature verification self-test (bsc#1222777).
  - Port "certs: Add ECDSA signature verification self-test".
  - Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_ECDSA.
  - Refresh
    0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch:
    trivial context update to Kconfig
  - commit 7338b2e
  - dump_stack: Do not get cpu_sync for panic CPU (bsc#1225607).
  - commit 3d953e1
  - printk: Avoid non-panic CPUs writing to ringbuffer
    (bsc#1225607).
  - commit 9a41cad
  - certs: Move RSA self-test data to separate file (bsc#1222777).
  - Port "certs: Move RSA self-test data to separate file".
  - Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_RSA.
  - Refresh
    patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch:
  - trivial context update to Kconfig,
  - account for changed pkcs7_validate_trust() callsite amended by
    this refreshed patch.
  - commit 248ad2a
  - printk: Disable passing console lock owner completely during
    panic() (bsc#1225607).
  - commit a31a4d6
  - printk: ringbuffer: Skip non-finalized records in panic
    (bsc#1225607).
  - commit 8be42db
  - Enable CONFIG_FIPS_SIGNATURE_SELFTEST (bsc#1222771)
  - commit 4ade1c7
  - printk: Wait for all reserved records with pr_flush()
    (bsc#1225607).
  - commit 4a07b6c
  - printk: ringbuffer: Cleanup reader terminology (bsc#1225607).
  - commit b3f2a50
  - printk: Add this_cpu_in_panic() (bsc#1225607).
  - commit 8afb830
  - printk: For @suppress_panic_printk check for other CPU in panic
    (bsc#1225607).
  - commit f2045e0
  - printk: ringbuffer: Clarify special lpos values (bsc#1225607).
  - commit d1338d8
  - printk: ringbuffer: Do not skip non-finalized records with
    prb_next_seq() (bsc#1225607).
  - commit 1ea687c
  - prctl: generalize PR_SET_MDWE support check to be per-arch
    (bsc#1225610).
  - commit b86afe4
  - printk: Use prb_first_seq() as base for 32bit seq macros
    (bsc#1225607).
  - commit ea93856
  - printk: Adjust mapping for 32bit seq macros (bsc#1225607).
  - commit e9e690d
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
    (bsc#1225605).
  - blk-cgroup: fix list corruption from resetting io stat
    (bsc#1225605).
  - commit c132bd3
  - printk: nbcon: Relocate 32bit seq macros (bsc#1225607).
  - commit 6293dd4
  - printk: Rename abandon_console_lock_in_panic() to
    other_cpu_in_panic() (bsc#1225607).
  - commit 74aec78
  - printk: Consolidate console deferred printing (bsc#1225607).
  - commit c45374f
  - printk: Do not take console lock for console_flush_on_panic()
    (bsc#1225607).
  - commit ca5038f
  - printk: Keep non-panic-CPUs out of console lock (bsc#1225607).
  - commit 2d7bf36
  - printk: Reduce console_unblank() usage in unsafe scenarios
    (bsc#1225607).
  - commit 54eafaa
  - livepatch: Fix missing newline character in
    klp_resolve_symbols() (bsc#1223539).
  - commit af0f908
  - blacklist.conf: workqueues: system-wide nr_active enforcement patchset;
    not worth the risk (bsc#1225580)
  - commit 059cebc
  - cpumap: Zero-initialise xdp_rxq_info struct before running
    XDP program (bsc#1224718 CVE-2024-27431).
  - commit fb7728a
  - kABI: bpf: struct bpf_link and bpf_link_ops kABI workaround
    (bsc#1224531 CVE-2024-35860).
  - commit 7744489
  - Revert "PCI/MSI: Provide IMS (Interrupt Message Store) support"
    (git-fixes).
  - Revert "PCI/MSI: Provide pci_ims_alloc/free_irq()" (git-fixes).
  - Revert "PCI/MSI: Provide stubs for IMS functions" (git-fixes).
  - commit 0dc394b
  - ppdev: Add an error check in register_device (git-fixes).
  - commit cfdb6a2
  - bpf: support deferring bpf_link dealloc to after RCU grace
    period (bsc#1224531 CVE-2024-35860).
  - bpf: put uprobe link's path and task in release callback
    (bsc#1224531 CVE-2024-35860).
  - commit a95dd44
  - Bluetooth: ISO: Fix not validating setsockopt user input
    (bsc#1224581 CVE-2024-35964).
  - commit 9d49d44
  - blacklist.conf: workqueues: cosmetic; truncated names in ps output
  - commit 2ed068f
  - Bluetooth: ISO: Add support for BT_PKT_STATUS (bsc#1224581
    CVE-2024-35964).
  - commit cadac48
  - Bluetooth: af_bluetooth: Make BT_PKT_STATUS generic (bsc#1224581
    CVE-2024-35964).
  - Refresh
    patches.suse/Bluetooth-SCO-Fix-not-validating-setsockopt-user-inp.patch.
  - commit 774d916
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
    (bsc#1209657 CVE-2023-0160 bsc#1224511 CVE-2024-35895).
  - commit fa3fb92
  - tpm_tis_spi: Account for SPI header when allocating TPM SPI
    xfer buffer (git-fixes).
  - commit 6d124e2

++++ kernel-default:

  - dm-integrity: fix a memory leak when rechecking the data
    (bsc#1223077, CVE-2024-26860).
  - commit 29984e7
  - btrfs: zoned: don't skip block groups with 100% zone unusable
    (bsc#1220120).
  - btrfs: don't refill whole delayed refs block reserve when
    starting transaction (bsc#1220120).
  - btrfs: add new unused block groups to the list of unused block
    groups (bsc#1220120).
  - btrfs: do not delete unused block group if it may be used soon
    (bsc#1220120).
  - btrfs: add and use helper to check if block group is used
    (bsc#1220120).
  - btrfs: always reserve space for delayed refs when starting
    transaction (bsc#1220120).
  - btrfs: stop doing excessive space reservation for csum deletion
    (bsc#1220120).
  - btrfs: remove pointless initialization at
    btrfs_delayed_refs_rsv_release() (bsc#1220120).
  - btrfs: reserve space for delayed refs on a per ref basis
    (bsc#1220120).
  - btrfs: allow to run delayed refs by bytes to be released
    instead of count (bsc#1220120).
  - btrfs: simplify check for extent item overrun at
    lookup_inline_extent_backref() (bsc#1220120).
  - btrfs: return -EUCLEAN if extent item is missing when searching
    inline backref (bsc#1220120).
  - btrfs: use a single variable for return value at
    lookup_inline_extent_backref() (bsc#1220120).
  - btrfs: use a single variable for return value at
    run_delayed_extent_op() (bsc#1220120).
  - btrfs: remove pointless 'ref_root' variable from
    run_delayed_data_ref() (bsc#1220120).
  - btrfs: initialize key where it's used when running delayed
    data ref (bsc#1220120).
  - btrfs: remove refs_to_drop argument from __btrfs_free_extent()
    (bsc#1220120).
  - btrfs: remove refs_to_add argument from __btrfs_inc_extent_ref()
    (bsc#1220120).
  - btrfs: remove the refcount warning/check at
    btrfs_put_delayed_ref() (bsc#1220120).
  - btrfs: remove unnecessary logic when running new delayed
    references (bsc#1220120).
  - btrfs: pass a space_info argument to
    btrfs_reserve_metadata_bytes() (bsc#1220120).
  - btrfs: log message if extent item not found when running
    delayed extent op (bsc#1220120).
  - btrfs: remove redundant BUG_ON() from __btrfs_inc_extent_ref()
    (bsc#1220120).
  - btrfs: move btrfs_free_excluded_extents() into block-group.c
    (bsc#1220120).
  - btrfs: open code trivial btrfs_add_excluded_extent()
    (bsc#1220120).
  - btrfs: make find_first_extent_bit() return a boolean
    (bsc#1220120).
  - btrfs: make btrfs_destroy_pinned_extent() return void
    (bsc#1220120).
  - btrfs: make btrfs_destroy_marked_extents() return void
    (bsc#1220120).
  - btrfs: rename add_new_free_space() to btrfs_add_new_free_space()
    (bsc#1220120).
  - btrfs: update documentation for add_new_free_space()
    (bsc#1220120).
  - commit 37b05cd
  - Refresh
    patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch (bsc#1222771).
    In preparation of enabling CONFIG_FIPS_SIGNATURE_SELFTEST, amend the
    missing 'usage' argument in the pkcs7_validate_trust() invocation
    from  the PKCS#7 selftest.
  - commit cfa0827
  - blacklist.conf: arm: kernel does not support folios
  - commit e0489ca
  - printk: Let no_printk() use _printk() (bsc#1225618).
  - commit 2abd745
  - printk: Update @console_may_schedule in
    console_trylock_spinning() (bsc#1225616).
  - commit e5e7ac5
  - af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock
    (CVE-2024-26676 bsc#1222380).
  - af_unix: Don't peek OOB data without MSG_OOB (CVE-2024-26676 bsc#1222380).
  - af_unix: Clear stale u->oob_skb (CVE-2024-26676 bsc#1222380).
  - commit 7722c8d
  - af_unix: fix use-after-free in unix_stream_read_actor()
    (CVE-2023-52772 bsc#1224989).
  - commit 0f5ff3f
  - certs: Add ECDSA signature verification self-test (bsc#1222777).
  - Port "certs: Add ECDSA signature verification self-test".
  - Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_ECDSA.
  - Refresh
    0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch:
    trivial context update to Kconfig
  - commit 7338b2e
  - dump_stack: Do not get cpu_sync for panic CPU (bsc#1225607).
  - commit 3d953e1
  - printk: Avoid non-panic CPUs writing to ringbuffer
    (bsc#1225607).
  - commit 9a41cad
  - certs: Move RSA self-test data to separate file (bsc#1222777).
  - Port "certs: Move RSA self-test data to separate file".
  - Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_RSA.
  - Refresh
    patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch:
  - trivial context update to Kconfig,
  - account for changed pkcs7_validate_trust() callsite amended by
    this refreshed patch.
  - commit 248ad2a
  - printk: Disable passing console lock owner completely during
    panic() (bsc#1225607).
  - commit a31a4d6
  - printk: ringbuffer: Skip non-finalized records in panic
    (bsc#1225607).
  - commit 8be42db
  - Enable CONFIG_FIPS_SIGNATURE_SELFTEST (bsc#1222771)
  - commit 4ade1c7
  - printk: Wait for all reserved records with pr_flush()
    (bsc#1225607).
  - commit 4a07b6c
  - printk: ringbuffer: Cleanup reader terminology (bsc#1225607).
  - commit b3f2a50
  - printk: Add this_cpu_in_panic() (bsc#1225607).
  - commit 8afb830
  - printk: For @suppress_panic_printk check for other CPU in panic
    (bsc#1225607).
  - commit f2045e0
  - printk: ringbuffer: Clarify special lpos values (bsc#1225607).
  - commit d1338d8
  - printk: ringbuffer: Do not skip non-finalized records with
    prb_next_seq() (bsc#1225607).
  - commit 1ea687c
  - prctl: generalize PR_SET_MDWE support check to be per-arch
    (bsc#1225610).
  - commit b86afe4
  - printk: Use prb_first_seq() as base for 32bit seq macros
    (bsc#1225607).
  - commit ea93856
  - printk: Adjust mapping for 32bit seq macros (bsc#1225607).
  - commit e9e690d
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued
    (bsc#1225605).
  - blk-cgroup: fix list corruption from resetting io stat
    (bsc#1225605).
  - commit c132bd3
  - printk: nbcon: Relocate 32bit seq macros (bsc#1225607).
  - commit 6293dd4
  - printk: Rename abandon_console_lock_in_panic() to
    other_cpu_in_panic() (bsc#1225607).
  - commit 74aec78
  - printk: Consolidate console deferred printing (bsc#1225607).
  - commit c45374f
  - printk: Do not take console lock for console_flush_on_panic()
    (bsc#1225607).
  - commit ca5038f
  - printk: Keep non-panic-CPUs out of console lock (bsc#1225607).
  - commit 2d7bf36
  - printk: Reduce console_unblank() usage in unsafe scenarios
    (bsc#1225607).
  - commit 54eafaa
  - livepatch: Fix missing newline character in
    klp_resolve_symbols() (bsc#1223539).
  - commit af0f908
  - blacklist.conf: workqueues: system-wide nr_active enforcement patchset;
    not worth the risk (bsc#1225580)
  - commit 059cebc
  - cpumap: Zero-initialise xdp_rxq_info struct before running
    XDP program (bsc#1224718 CVE-2024-27431).
  - commit fb7728a
  - kABI: bpf: struct bpf_link and bpf_link_ops kABI workaround
    (bsc#1224531 CVE-2024-35860).
  - commit 7744489
  - Revert "PCI/MSI: Provide IMS (Interrupt Message Store) support"
    (git-fixes).
  - Revert "PCI/MSI: Provide pci_ims_alloc/free_irq()" (git-fixes).
  - Revert "PCI/MSI: Provide stubs for IMS functions" (git-fixes).
  - commit 0dc394b
  - ppdev: Add an error check in register_device (git-fixes).
  - commit cfdb6a2
  - bpf: support deferring bpf_link dealloc to after RCU grace
    period (bsc#1224531 CVE-2024-35860).
  - bpf: put uprobe link's path and task in release callback
    (bsc#1224531 CVE-2024-35860).
  - commit a95dd44
  - Bluetooth: ISO: Fix not validating setsockopt user input
    (bsc#1224581 CVE-2024-35964).
  - commit 9d49d44
  - blacklist.conf: workqueues: cosmetic; truncated names in ps output
  - commit 2ed068f
  - Bluetooth: ISO: Add support for BT_PKT_STATUS (bsc#1224581
    CVE-2024-35964).
  - commit cadac48
  - Bluetooth: af_bluetooth: Make BT_PKT_STATUS generic (bsc#1224581
    CVE-2024-35964).
  - Refresh
    patches.suse/Bluetooth-SCO-Fix-not-validating-setsockopt-user-inp.patch.
  - commit 774d916
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
    (bsc#1209657 CVE-2023-0160 bsc#1224511 CVE-2024-35895).
  - commit fa3fb92
  - tpm_tis_spi: Account for SPI header when allocating TPM SPI
    xfer buffer (git-fixes).
  - commit 6d124e2

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

++++ openssl-3:

  - Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448,
    gh#openssl/openssl#23456)
    * Add openssl-Fix-EVP_PKEY_CTX_add1_hkdf_info-behavior.patch
    * Add openssl-Handle-empty-param-in-EVP_PKEY_CTX_add1_hkdf_info.patch

------------------------------------------------------------------
------------------  2024-5-28  -  May 28 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - smb: client: fix potential UAF in cifs_debug_files_proc_show()
    (bsc#1225172, bsc#1223532, CVE-2024-26928).
  - commit 1089c4a
  - smb3: missing lock when picking channel (bsc#1225172,
    bsc#1224550, CVE-2024-35999).
  - commit d7be3a1
  - smb: client: fix potential UAF in
    cifs_signal_cifsd_for_reconnect() (bsc#1225172, bsc#1224766,
    CVE-2024-35861).
  - commit 0d45a76
  - smb: client: fix potential UAF in smb2_is_network_name_deleted()
    (bsc#1225172, bsc#1224764, CVE-2024-35862).
  - commit 6632102
  - smb: client: fix potential UAF in is_valid_oplock_break()
    (bsc#1225172, bsc#1224763, CVE-2024-35863).
  - commit 06c348c
  - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
    (bsc#1225172, bsc#1224668, CVE-2024-35865).
  - commit 60bea5b
  - smb: client: fix potential UAF in smb2_is_valid_lease_break()
    (bsc#1225172, bsc#1224765, CVE-2024-35864).
  - commit 52cc8d8
  - smb: client: fix potential UAF in cifs_stats_proc_show()
    (bsc#1225172, bsc#1224664, CVE-2024-35867).
  - commit 3a82d6a
  - smb: client: fix potential UAF in cifs_stats_proc_write()
    (bsc#1225172, bsc#1224678, CVE-2024-35868).
  - commit fb4bf4e
  - smb: client: fix potential UAF in cifs_dump_full_key()
    (bsc#1225172, bsc#1224667, CVE-2024-35866).
  - commit b0961fe
  - smb: client: guarantee refcounted children from parent session
    (bsc#1225172, bsc#1224679, CVE-2024-35869).
  - commit 97642d2
  - smb: client: fix UAF in smb2_reconnect_server() (bsc#1225172,
    bsc#1224672, CVE-2024-35870).
  - commit e205efa
  - smb: Fix regression in writes when non-standard maximum write
    size negotiated (bsc#1222464, CVE-2024-26692).
  - commit 761be1f
  - cifs: Fix writeback data corruption (bsc#1225172,
    bsc#1223810, CVE-2024-27036).
  - commit 75108cc
  - cifs: Don't use certain unnecessary folio_*() functions
    (bsc#1225172).
  - commit 3ddf86f
  - blacklist.conf: Ignore all devicetree schemes changes
    We do not use them, so lets silence all git-fixes for them.
  - commit 84a3286
  - x86/bpf: Fix IP after emitting call depth accounting (bsc#1224493 CVE-2024-35903).
  - commit 1c0fa71
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery (CVE-2024-35931 bsc#1224652).
  - commit 1dec1c9
  - kabi/severities: ignore TAS2781 symbol drop, it's only locally used
  - commit f367fdb
  - ASoC: tas2781: Fix wrong loading calibrated data sequence
    (git-fixes).
  - commit 5851e36
  - mm: page_owner: fix wrong information in dump_page_owner
    (git-fixes).
  - ALSA: scarlett2: Add missing error check to
    scarlett2_config_save() (git-fixes).
  - commit 4b2ccd1
  - x86/mm/pat: fix VM_PAT handling in COW mappings (bsc#1224525
    CVE-2024-35877).
  - commit 24cc941
  - io_uring: fail NOP if non-zero op flags is passed in
    (git-fixes).
  - io_uring/net: fix sendzc lazy wake polling (git-fixes).
  - io-wq: write next_work before dropping acct_lock (git-fixes).
  - io_uring: use the right type for work_llist empty check
    (git-fixes).
  - io_uring/net: restore msg_control on sendzc retry (git-fixes).
  - commit 92fcddd
  - io_uring/kbuf: hold io_buffer_list reference over mmap
    (git-fixes bsc#1224523 CVE-2024-35880).
  - io_uring/kbuf: protect io_buffer_list teardown with a reference
    (git-fixes).
    Reuses a padding space in the structure.
  - io_uring/kbuf: get rid of bl->is_ready (git-fixes).
  - io_uring/kbuf: get rid of lower BGID lists (git-fixes).
    Including kabi preservation patch.
  - io_uring/kbuf: rename is_mapped (git-fixes).
  - commit 3037746
  - io_uring: use private workqueue for exit work (git-fixes).
  - io_uring/rw: don't allow multishot reads without NOWAIT support
    (git-fixes).
  - io_uring: clear opcode specific data for an early failure
    (git-fixes).
  - io_uring: fix poll_remove stalled req completion (git-fixes).
  - io_uring: Fix release of pinned pages when __io_uaddr_map fails
    (git-fixes bsc#1224698 CVE-2024-35831).
  - io_uring: clean rings on NO_MMAP alloc fail (git-fixes).
  - io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry
    (git-fixes).
  - io_uring: don't save/restore iowait state (git-fixes).
  - commit 289cc2c
  - io_uring: fix mshot io-wq checks (git-fixes).
  - io_uring/net: correctly handle multishot recvmsg retry setup
    (git-fixes).
  - io_uring: fix io_queue_proc modifying req->flags (git-fixes).
  - commit 78dda9b

++++ kernel-default:

  - smb: client: fix potential UAF in cifs_debug_files_proc_show()
    (bsc#1225172, bsc#1223532, CVE-2024-26928).
  - commit 1089c4a
  - smb3: missing lock when picking channel (bsc#1225172,
    bsc#1224550, CVE-2024-35999).
  - commit d7be3a1
  - smb: client: fix potential UAF in
    cifs_signal_cifsd_for_reconnect() (bsc#1225172, bsc#1224766,
    CVE-2024-35861).
  - commit 0d45a76
  - smb: client: fix potential UAF in smb2_is_network_name_deleted()
    (bsc#1225172, bsc#1224764, CVE-2024-35862).
  - commit 6632102
  - smb: client: fix potential UAF in is_valid_oplock_break()
    (bsc#1225172, bsc#1224763, CVE-2024-35863).
  - commit 06c348c
  - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
    (bsc#1225172, bsc#1224668, CVE-2024-35865).
  - commit 60bea5b
  - smb: client: fix potential UAF in smb2_is_valid_lease_break()
    (bsc#1225172, bsc#1224765, CVE-2024-35864).
  - commit 52cc8d8
  - smb: client: fix potential UAF in cifs_stats_proc_show()
    (bsc#1225172, bsc#1224664, CVE-2024-35867).
  - commit 3a82d6a
  - smb: client: fix potential UAF in cifs_stats_proc_write()
    (bsc#1225172, bsc#1224678, CVE-2024-35868).
  - commit fb4bf4e
  - smb: client: fix potential UAF in cifs_dump_full_key()
    (bsc#1225172, bsc#1224667, CVE-2024-35866).
  - commit b0961fe
  - smb: client: guarantee refcounted children from parent session
    (bsc#1225172, bsc#1224679, CVE-2024-35869).
  - commit 97642d2
  - smb: client: fix UAF in smb2_reconnect_server() (bsc#1225172,
    bsc#1224672, CVE-2024-35870).
  - commit e205efa
  - smb: Fix regression in writes when non-standard maximum write
    size negotiated (bsc#1222464, CVE-2024-26692).
  - commit 761be1f
  - cifs: Fix writeback data corruption (bsc#1225172,
    bsc#1223810, CVE-2024-27036).
  - commit 75108cc
  - cifs: Don't use certain unnecessary folio_*() functions
    (bsc#1225172).
  - commit 3ddf86f
  - blacklist.conf: Ignore all devicetree schemes changes
    We do not use them, so lets silence all git-fixes for them.
  - commit 84a3286
  - x86/bpf: Fix IP after emitting call depth accounting (bsc#1224493 CVE-2024-35903).
  - commit 1c0fa71
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery (CVE-2024-35931 bsc#1224652).
  - commit 1dec1c9
  - kabi/severities: ignore TAS2781 symbol drop, it's only locally used
  - commit f367fdb
  - ASoC: tas2781: Fix wrong loading calibrated data sequence
    (git-fixes).
  - commit 5851e36
  - mm: page_owner: fix wrong information in dump_page_owner
    (git-fixes).
  - ALSA: scarlett2: Add missing error check to
    scarlett2_config_save() (git-fixes).
  - commit 4b2ccd1
  - x86/mm/pat: fix VM_PAT handling in COW mappings (bsc#1224525
    CVE-2024-35877).
  - commit 24cc941
  - io_uring: fail NOP if non-zero op flags is passed in
    (git-fixes).
  - io_uring/net: fix sendzc lazy wake polling (git-fixes).
  - io-wq: write next_work before dropping acct_lock (git-fixes).
  - io_uring: use the right type for work_llist empty check
    (git-fixes).
  - io_uring/net: restore msg_control on sendzc retry (git-fixes).
  - commit 92fcddd
  - io_uring/kbuf: hold io_buffer_list reference over mmap
    (git-fixes bsc#1224523 CVE-2024-35880).
  - io_uring/kbuf: protect io_buffer_list teardown with a reference
    (git-fixes).
    Reuses a padding space in the structure.
  - io_uring/kbuf: get rid of bl->is_ready (git-fixes).
  - io_uring/kbuf: get rid of lower BGID lists (git-fixes).
    Including kabi preservation patch.
  - io_uring/kbuf: rename is_mapped (git-fixes).
  - commit 3037746
  - io_uring: use private workqueue for exit work (git-fixes).
  - io_uring/rw: don't allow multishot reads without NOWAIT support
    (git-fixes).
  - io_uring: clear opcode specific data for an early failure
    (git-fixes).
  - io_uring: fix poll_remove stalled req completion (git-fixes).
  - io_uring: Fix release of pinned pages when __io_uaddr_map fails
    (git-fixes bsc#1224698 CVE-2024-35831).
  - io_uring: clean rings on NO_MMAP alloc fail (git-fixes).
  - io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry
    (git-fixes).
  - io_uring: don't save/restore iowait state (git-fixes).
  - commit 289cc2c
  - io_uring: fix mshot io-wq checks (git-fixes).
  - io_uring/net: correctly handle multishot recvmsg retry setup
    (git-fixes).
  - io_uring: fix io_queue_proc modifying req->flags (git-fixes).
  - commit 78dda9b

++++ kernel-default:

  - smb: client: fix potential UAF in cifs_debug_files_proc_show()
    (bsc#1225172, bsc#1223532, CVE-2024-26928).
  - commit 1089c4a
  - smb3: missing lock when picking channel (bsc#1225172,
    bsc#1224550, CVE-2024-35999).
  - commit d7be3a1
  - smb: client: fix potential UAF in
    cifs_signal_cifsd_for_reconnect() (bsc#1225172, bsc#1224766,
    CVE-2024-35861).
  - commit 0d45a76
  - smb: client: fix potential UAF in smb2_is_network_name_deleted()
    (bsc#1225172, bsc#1224764, CVE-2024-35862).
  - commit 6632102
  - smb: client: fix potential UAF in is_valid_oplock_break()
    (bsc#1225172, bsc#1224763, CVE-2024-35863).
  - commit 06c348c
  - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
    (bsc#1225172, bsc#1224668, CVE-2024-35865).
  - commit 60bea5b
  - smb: client: fix potential UAF in smb2_is_valid_lease_break()
    (bsc#1225172, bsc#1224765, CVE-2024-35864).
  - commit 52cc8d8
  - smb: client: fix potential UAF in cifs_stats_proc_show()
    (bsc#1225172, bsc#1224664, CVE-2024-35867).
  - commit 3a82d6a
  - smb: client: fix potential UAF in cifs_stats_proc_write()
    (bsc#1225172, bsc#1224678, CVE-2024-35868).
  - commit fb4bf4e
  - smb: client: fix potential UAF in cifs_dump_full_key()
    (bsc#1225172, bsc#1224667, CVE-2024-35866).
  - commit b0961fe
  - smb: client: guarantee refcounted children from parent session
    (bsc#1225172, bsc#1224679, CVE-2024-35869).
  - commit 97642d2
  - smb: client: fix UAF in smb2_reconnect_server() (bsc#1225172,
    bsc#1224672, CVE-2024-35870).
  - commit e205efa
  - smb: Fix regression in writes when non-standard maximum write
    size negotiated (bsc#1222464, CVE-2024-26692).
  - commit 761be1f
  - cifs: Fix writeback data corruption (bsc#1225172,
    bsc#1223810, CVE-2024-27036).
  - commit 75108cc
  - cifs: Don't use certain unnecessary folio_*() functions
    (bsc#1225172).
  - commit 3ddf86f
  - blacklist.conf: Ignore all devicetree schemes changes
    We do not use them, so lets silence all git-fixes for them.
  - commit 84a3286
  - x86/bpf: Fix IP after emitting call depth accounting (bsc#1224493 CVE-2024-35903).
  - commit 1c0fa71
  - drm/amdgpu: Skip do PCI error slot reset during RAS recovery (CVE-2024-35931 bsc#1224652).
  - commit 1dec1c9
  - kabi/severities: ignore TAS2781 symbol drop, it's only locally used
  - commit f367fdb
  - ASoC: tas2781: Fix wrong loading calibrated data sequence
    (git-fixes).
  - commit 5851e36
  - mm: page_owner: fix wrong information in dump_page_owner
    (git-fixes).
  - ALSA: scarlett2: Add missing error check to
    scarlett2_config_save() (git-fixes).
  - commit 4b2ccd1
  - x86/mm/pat: fix VM_PAT handling in COW mappings (bsc#1224525
    CVE-2024-35877).
  - commit 24cc941
  - io_uring: fail NOP if non-zero op flags is passed in
    (git-fixes).
  - io_uring/net: fix sendzc lazy wake polling (git-fixes).
  - io-wq: write next_work before dropping acct_lock (git-fixes).
  - io_uring: use the right type for work_llist empty check
    (git-fixes).
  - io_uring/net: restore msg_control on sendzc retry (git-fixes).
  - commit 92fcddd
  - io_uring/kbuf: hold io_buffer_list reference over mmap
    (git-fixes bsc#1224523 CVE-2024-35880).
  - io_uring/kbuf: protect io_buffer_list teardown with a reference
    (git-fixes).
    Reuses a padding space in the structure.
  - io_uring/kbuf: get rid of bl->is_ready (git-fixes).
  - io_uring/kbuf: get rid of lower BGID lists (git-fixes).
    Including kabi preservation patch.
  - io_uring/kbuf: rename is_mapped (git-fixes).
  - commit 3037746
  - io_uring: use private workqueue for exit work (git-fixes).
  - io_uring/rw: don't allow multishot reads without NOWAIT support
    (git-fixes).
  - io_uring: clear opcode specific data for an early failure
    (git-fixes).
  - io_uring: fix poll_remove stalled req completion (git-fixes).
  - io_uring: Fix release of pinned pages when __io_uaddr_map fails
    (git-fixes bsc#1224698 CVE-2024-35831).
  - io_uring: clean rings on NO_MMAP alloc fail (git-fixes).
  - io_uring/rw: return IOU_ISSUE_SKIP_COMPLETE for multishot retry
    (git-fixes).
  - io_uring: don't save/restore iowait state (git-fixes).
  - commit 289cc2c
  - io_uring: fix mshot io-wq checks (git-fixes).
  - io_uring/net: correctly handle multishot recvmsg retry setup
    (git-fixes).
  - io_uring: fix io_queue_proc modifying req->flags (git-fixes).
  - commit 78dda9b

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

++++ openssl-3:

  - Enable livepatching support (bsc#1223428)

------------------------------------------------------------------
------------------  2024-5-27  -  May 27 2024  -------------------
------------------------------------------------------------------

++++ chrony:

  - Update clknetsim to snapshot 0a11a35.

++++ git:

  - remove dependency on /usr/bin/python3 using
    %python3_fix_shebang_path macro, [bsc#1212476]

++++ kernel-default:

  - io_uring: fix mshot read defer taskrun cqe posting (git-fixes).
  - commit de73141
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    (CVE-2024-35969 bsc#1224580)
  - commit f419c6d
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash
    work (CVE-2024-35852 bsc#1224502).
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
    (CVE-2024-36006 bsc#1224541).
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
    (CVE-2024-36007 bsc#1224543).
  - commit 88a980b
  - Revert "iommu/vt-d: Enable PCI/IMS" (git-fixes).
  - commit f424462
  - Revert "iommu/amd: Enable PCI/IMS" (git-fixes).
  - commit 278bf80
  - iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
    (git-fixes).
  - commit 481f9bd
  - btrfs: avoid start and commit empty transaction when flushing
    qgroups (bsc#1220120).
  - btrfs: avoid start and commit empty transaction when starting
    qgroup rescan (bsc#1220120).
  - btrfs: avoid starting and committing empty transaction when
    flushing space (bsc#1220120).
  - btrfs: avoid starting new transaction when flushing delayed
    items and refs (bsc#1220120).
  - btrfs: merge find_free_dev_extent() and
    find_free_dev_extent_start() (bsc#1220120).
  - btrfs: make find_free_dev_extent() static (bsc#1220120).
  - btrfs: make btrfs_cleanup_fs_roots() static (bsc#1220120).
  - btrfs: fail priority metadata ticket with real fs error
    (bsc#1220120).
  - btrfs: return real error when orphan cleanup fails due to a
    transaction abort (bsc#1220120).
  - btrfs: store the error that turned the fs into error state
    (bsc#1220120).
  - btrfs: don't steal space from global rsv after a transaction
    abort (bsc#1220120).
  - btrfs: print available space across all block groups when
    dumping space info (bsc#1220120).
  - btrfs: print available space for a block group when dumping
    a space info (bsc#1220120).
  - btrfs: print block group super and delalloc bytes when dumping
    space info (bsc#1220120).
  - btrfs: print target number of bytes when dumping free space
    (bsc#1220120).
  - btrfs: update comment for btrfs_join_transaction_nostart()
    (bsc#1220120).
  - commit b4554d4
  - mm/secretmem: fix GUP-fast succeeding on secretmem folios
    (CVE-2024-35872 bsc#1224530).
  - commit 42a2f6f
  - cifs: fix charset issue in reconnection (bsc#1225172).
  - commit b4ea103
  - btrfs: make btrfs_destroy_delayed_refs() return void
    (bsc#1220120).
  - btrfs: remove unnecessary prototype declarations at disk-io.c
    (bsc#1220120).
  - btrfs: use a single switch statement when initializing delayed
    ref head (bsc#1220120).
  - btrfs: use bool type for delayed ref head fields that are used
    as booleans (bsc#1220120).
  - btrfs: assert correct lock is held at btrfs_select_ref_head()
    (bsc#1220120).
  - btrfs: get rid of label and goto at insert_delayed_ref()
    (bsc#1220120).
  - btrfs: make insert_delayed_ref() return a bool instead of an
    int (bsc#1220120).
  - btrfs: use a bool to track qgroup record insertion when adding
    ref head (bsc#1220120).
  - btrfs: remove pointless in_tree field from struct
    btrfs_delayed_ref_node (bsc#1220120).
  - btrfs: remove unused is_head field from struct
    btrfs_delayed_ref_node (bsc#1220120).
  - btrfs: reorder some members of struct btrfs_delayed_ref_head
    (bsc#1220120).
  - commit 2e19466
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations (CVE-2024-35956 bsc#1224674)
  - commit 9bb0c20
  - Update patches.suse/btrfs-send-handle-path-ref-underflow-in-header-itera.patch (CVE-2024-35935 bsc#1224645)
  - commit 5aa2b5a
  - btrfs: make error messages more clear when getting a chunk map (git-fixes)
  - commit 47ecf55
  - blacklist.conf: btrfs: compilation warning fix
  - commit 02490e2
  - blacklist.conf: btrfs: code not built
  - commit 5199fc3
  - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super (git-fixes)
  - commit 907e740
  - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
    (git-fixes).
  - commit 113163c
  - btrfs: use the correct superblock to compare fsid in btrfs_validate_super (git-fixes)
  - commit 4318f3e
  - ring-buffer: Fix a race between readers and resize checks
    (git-fixes).
  - commit 568ebcf
  - btrfs: add a helper to read the superblock metadata_uuid (git-fixes)
  - commit 543d7b8
  - ftrace: Fix possible use-after-free issue in ftrace_location()
    (git-fixes).
  - commit 4cf7fca
  - tracing: hide unused ftrace_event_id_fops (git-fixes).
  - commit 61c90c7
  - blacklist.conf: add not-relevant tracing commits
  - commit b97c070
  - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk  for !SRSO (git-fixes).
  - commit 1340b2d
  - x86/efistub: Add missing boot_params for mixed mode compat entry (git-fixes).
  - commit 12dcb3a
  - x86/efistub: Call mixed mode boot services on the firmware's stack (git-fixes).
  - commit 9d83518
  - x86/pm: Work around false positive kmemleak report in msr_build_context() (git-fixes).
  - commit 2e5a312
  - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y (git-fixes).
  - commit 453faa5
  - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).
  - commit e894262
  - mm/slab: make __free(kfree) accept error pointers (git-fixes).
  - commit 8b5f449
  - x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT (git-fixes).
  - commit fa1d89a
  - Update
    patches.suse/virtio_net-Do-not-send-RSS-key-if-it-is-not-supporte.patch
    (bsc#1224565, CVE-2024-35981).
  - commit 50a448d
  - Update
    patches.suse/KVM-x86-Mark-target-gfn-of-emulated-atomic-instructi.patch
    (bsc#1224638, CVE-2024-35804).
  - commit aac65c3
  - Update
    patches.suse/KVM-SVM-Flush-pages-under-kvm-lock-to-fix-UAF-in-svm.patch
    (bsc#1224725, CVE-2024-35791).
  - commit 80eb8d1
  - cxl/port: Fix delete_endpoint() vs parent unregistration race
    (CVE-2023-52771 bsc#1225007).
  - commit b115e15

++++ kernel-default:

  - io_uring: fix mshot read defer taskrun cqe posting (git-fixes).
  - commit de73141
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    (CVE-2024-35969 bsc#1224580)
  - commit f419c6d
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash
    work (CVE-2024-35852 bsc#1224502).
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
    (CVE-2024-36006 bsc#1224541).
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
    (CVE-2024-36007 bsc#1224543).
  - commit 88a980b
  - Revert "iommu/vt-d: Enable PCI/IMS" (git-fixes).
  - commit f424462
  - Revert "iommu/amd: Enable PCI/IMS" (git-fixes).
  - commit 278bf80
  - iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
    (git-fixes).
  - commit 481f9bd
  - btrfs: avoid start and commit empty transaction when flushing
    qgroups (bsc#1220120).
  - btrfs: avoid start and commit empty transaction when starting
    qgroup rescan (bsc#1220120).
  - btrfs: avoid starting and committing empty transaction when
    flushing space (bsc#1220120).
  - btrfs: avoid starting new transaction when flushing delayed
    items and refs (bsc#1220120).
  - btrfs: merge find_free_dev_extent() and
    find_free_dev_extent_start() (bsc#1220120).
  - btrfs: make find_free_dev_extent() static (bsc#1220120).
  - btrfs: make btrfs_cleanup_fs_roots() static (bsc#1220120).
  - btrfs: fail priority metadata ticket with real fs error
    (bsc#1220120).
  - btrfs: return real error when orphan cleanup fails due to a
    transaction abort (bsc#1220120).
  - btrfs: store the error that turned the fs into error state
    (bsc#1220120).
  - btrfs: don't steal space from global rsv after a transaction
    abort (bsc#1220120).
  - btrfs: print available space across all block groups when
    dumping space info (bsc#1220120).
  - btrfs: print available space for a block group when dumping
    a space info (bsc#1220120).
  - btrfs: print block group super and delalloc bytes when dumping
    space info (bsc#1220120).
  - btrfs: print target number of bytes when dumping free space
    (bsc#1220120).
  - btrfs: update comment for btrfs_join_transaction_nostart()
    (bsc#1220120).
  - commit b4554d4
  - mm/secretmem: fix GUP-fast succeeding on secretmem folios
    (CVE-2024-35872 bsc#1224530).
  - commit 42a2f6f
  - cifs: fix charset issue in reconnection (bsc#1225172).
  - commit b4ea103
  - btrfs: make btrfs_destroy_delayed_refs() return void
    (bsc#1220120).
  - btrfs: remove unnecessary prototype declarations at disk-io.c
    (bsc#1220120).
  - btrfs: use a single switch statement when initializing delayed
    ref head (bsc#1220120).
  - btrfs: use bool type for delayed ref head fields that are used
    as booleans (bsc#1220120).
  - btrfs: assert correct lock is held at btrfs_select_ref_head()
    (bsc#1220120).
  - btrfs: get rid of label and goto at insert_delayed_ref()
    (bsc#1220120).
  - btrfs: make insert_delayed_ref() return a bool instead of an
    int (bsc#1220120).
  - btrfs: use a bool to track qgroup record insertion when adding
    ref head (bsc#1220120).
  - btrfs: remove pointless in_tree field from struct
    btrfs_delayed_ref_node (bsc#1220120).
  - btrfs: remove unused is_head field from struct
    btrfs_delayed_ref_node (bsc#1220120).
  - btrfs: reorder some members of struct btrfs_delayed_ref_head
    (bsc#1220120).
  - commit 2e19466
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations (CVE-2024-35956 bsc#1224674)
  - commit 9bb0c20
  - Update patches.suse/btrfs-send-handle-path-ref-underflow-in-header-itera.patch (CVE-2024-35935 bsc#1224645)
  - commit 5aa2b5a
  - btrfs: make error messages more clear when getting a chunk map (git-fixes)
  - commit 47ecf55
  - blacklist.conf: btrfs: compilation warning fix
  - commit 02490e2
  - blacklist.conf: btrfs: code not built
  - commit 5199fc3
  - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super (git-fixes)
  - commit 907e740
  - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
    (git-fixes).
  - commit 113163c
  - btrfs: use the correct superblock to compare fsid in btrfs_validate_super (git-fixes)
  - commit 4318f3e
  - ring-buffer: Fix a race between readers and resize checks
    (git-fixes).
  - commit 568ebcf
  - btrfs: add a helper to read the superblock metadata_uuid (git-fixes)
  - commit 543d7b8
  - ftrace: Fix possible use-after-free issue in ftrace_location()
    (git-fixes).
  - commit 4cf7fca
  - tracing: hide unused ftrace_event_id_fops (git-fixes).
  - commit 61c90c7
  - blacklist.conf: add not-relevant tracing commits
  - commit b97c070
  - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk  for !SRSO (git-fixes).
  - commit 1340b2d
  - x86/efistub: Add missing boot_params for mixed mode compat entry (git-fixes).
  - commit 12dcb3a
  - x86/efistub: Call mixed mode boot services on the firmware's stack (git-fixes).
  - commit 9d83518
  - x86/pm: Work around false positive kmemleak report in msr_build_context() (git-fixes).
  - commit 2e5a312
  - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y (git-fixes).
  - commit 453faa5
  - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).
  - commit e894262
  - mm/slab: make __free(kfree) accept error pointers (git-fixes).
  - commit 8b5f449
  - x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT (git-fixes).
  - commit fa1d89a
  - Update
    patches.suse/virtio_net-Do-not-send-RSS-key-if-it-is-not-supporte.patch
    (bsc#1224565, CVE-2024-35981).
  - commit 50a448d
  - Update
    patches.suse/KVM-x86-Mark-target-gfn-of-emulated-atomic-instructi.patch
    (bsc#1224638, CVE-2024-35804).
  - commit aac65c3
  - Update
    patches.suse/KVM-SVM-Flush-pages-under-kvm-lock-to-fix-UAF-in-svm.patch
    (bsc#1224725, CVE-2024-35791).
  - commit 80eb8d1
  - cxl/port: Fix delete_endpoint() vs parent unregistration race
    (CVE-2023-52771 bsc#1225007).
  - commit b115e15

++++ kernel-default:

  - io_uring: fix mshot read defer taskrun cqe posting (git-fixes).
  - commit de73141
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    (CVE-2024-35969 bsc#1224580)
  - commit f419c6d
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash
    work (CVE-2024-35852 bsc#1224502).
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
    (CVE-2024-36006 bsc#1224541).
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash
    (CVE-2024-36007 bsc#1224543).
  - commit 88a980b
  - Revert "iommu/vt-d: Enable PCI/IMS" (git-fixes).
  - commit f424462
  - Revert "iommu/amd: Enable PCI/IMS" (git-fixes).
  - commit 278bf80
  - iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest
    (git-fixes).
  - commit 481f9bd
  - btrfs: avoid start and commit empty transaction when flushing
    qgroups (bsc#1220120).
  - btrfs: avoid start and commit empty transaction when starting
    qgroup rescan (bsc#1220120).
  - btrfs: avoid starting and committing empty transaction when
    flushing space (bsc#1220120).
  - btrfs: avoid starting new transaction when flushing delayed
    items and refs (bsc#1220120).
  - btrfs: merge find_free_dev_extent() and
    find_free_dev_extent_start() (bsc#1220120).
  - btrfs: make find_free_dev_extent() static (bsc#1220120).
  - btrfs: make btrfs_cleanup_fs_roots() static (bsc#1220120).
  - btrfs: fail priority metadata ticket with real fs error
    (bsc#1220120).
  - btrfs: return real error when orphan cleanup fails due to a
    transaction abort (bsc#1220120).
  - btrfs: store the error that turned the fs into error state
    (bsc#1220120).
  - btrfs: don't steal space from global rsv after a transaction
    abort (bsc#1220120).
  - btrfs: print available space across all block groups when
    dumping space info (bsc#1220120).
  - btrfs: print available space for a block group when dumping
    a space info (bsc#1220120).
  - btrfs: print block group super and delalloc bytes when dumping
    space info (bsc#1220120).
  - btrfs: print target number of bytes when dumping free space
    (bsc#1220120).
  - btrfs: update comment for btrfs_join_transaction_nostart()
    (bsc#1220120).
  - commit b4554d4
  - mm/secretmem: fix GUP-fast succeeding on secretmem folios
    (CVE-2024-35872 bsc#1224530).
  - commit 42a2f6f
  - cifs: fix charset issue in reconnection (bsc#1225172).
  - commit b4ea103
  - btrfs: make btrfs_destroy_delayed_refs() return void
    (bsc#1220120).
  - btrfs: remove unnecessary prototype declarations at disk-io.c
    (bsc#1220120).
  - btrfs: use a single switch statement when initializing delayed
    ref head (bsc#1220120).
  - btrfs: use bool type for delayed ref head fields that are used
    as booleans (bsc#1220120).
  - btrfs: assert correct lock is held at btrfs_select_ref_head()
    (bsc#1220120).
  - btrfs: get rid of label and goto at insert_delayed_ref()
    (bsc#1220120).
  - btrfs: make insert_delayed_ref() return a bool instead of an
    int (bsc#1220120).
  - btrfs: use a bool to track qgroup record insertion when adding
    ref head (bsc#1220120).
  - btrfs: remove pointless in_tree field from struct
    btrfs_delayed_ref_node (bsc#1220120).
  - btrfs: remove unused is_head field from struct
    btrfs_delayed_ref_node (bsc#1220120).
  - btrfs: reorder some members of struct btrfs_delayed_ref_head
    (bsc#1220120).
  - commit 2e19466
  - btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations (CVE-2024-35956 bsc#1224674)
  - commit 9bb0c20
  - Update patches.suse/btrfs-send-handle-path-ref-underflow-in-header-itera.patch (CVE-2024-35935 bsc#1224645)
  - commit 5aa2b5a
  - btrfs: make error messages more clear when getting a chunk map (git-fixes)
  - commit 47ecf55
  - blacklist.conf: btrfs: compilation warning fix
  - commit 02490e2
  - blacklist.conf: btrfs: code not built
  - commit 5199fc3
  - btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super (git-fixes)
  - commit 907e740
  - tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test
    (git-fixes).
  - commit 113163c
  - btrfs: use the correct superblock to compare fsid in btrfs_validate_super (git-fixes)
  - commit 4318f3e
  - ring-buffer: Fix a race between readers and resize checks
    (git-fixes).
  - commit 568ebcf
  - btrfs: add a helper to read the superblock metadata_uuid (git-fixes)
  - commit 543d7b8
  - ftrace: Fix possible use-after-free issue in ftrace_location()
    (git-fixes).
  - commit 4cf7fca
  - tracing: hide unused ftrace_event_id_fops (git-fixes).
  - commit 61c90c7
  - blacklist.conf: add not-relevant tracing commits
  - commit b97c070
  - x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk  for !SRSO (git-fixes).
  - commit 1340b2d
  - x86/efistub: Add missing boot_params for mixed mode compat entry (git-fixes).
  - commit 12dcb3a
  - x86/efistub: Call mixed mode boot services on the firmware's stack (git-fixes).
  - commit 9d83518
  - x86/pm: Work around false positive kmemleak report in msr_build_context() (git-fixes).
  - commit 2e5a312
  - x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y (git-fixes).
  - commit 453faa5
  - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).
  - commit e894262
  - mm/slab: make __free(kfree) accept error pointers (git-fixes).
  - commit 8b5f449
  - x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT (git-fixes).
  - commit fa1d89a
  - Update
    patches.suse/virtio_net-Do-not-send-RSS-key-if-it-is-not-supporte.patch
    (bsc#1224565, CVE-2024-35981).
  - commit 50a448d
  - Update
    patches.suse/KVM-x86-Mark-target-gfn-of-emulated-atomic-instructi.patch
    (bsc#1224638, CVE-2024-35804).
  - commit aac65c3
  - Update
    patches.suse/KVM-SVM-Flush-pages-under-kvm-lock-to-fix-UAF-in-svm.patch
    (bsc#1224725, CVE-2024-35791).
  - commit 80eb8d1
  - cxl/port: Fix delete_endpoint() vs parent unregistration race
    (CVE-2023-52771 bsc#1225007).
  - commit b115e15

------------------------------------------------------------------
------------------  2024-5-26  -  May 26 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during
    start frame (git-fixes).
  - commit cc09a8e
  - kselftest: Add a ksft_perror() helper (stable-fixes).
  - Refresh
    patches.suse/selftests-timers-posix_timers-Reimplement-check_time.patch.
  - commit f14f41c
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
    (git-fixes).
  - nilfs2: fix use-after-free of timer for log writer thread
    (git-fixes).
  - kasan, fortify: properly rename memintrinsics (git-fixes).
  - i3c: master: svc: fix invalidate IBI type and miss call client
    IBI handler (git-fixes).
  - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
    (stable-fixes).
  - drm/amd/display: Fix division by zero in setup_dsc_config
    (stable-fixes).
  - docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).
  - mmc: core: Add HS400 tuning in HS400es initialization
    (stable-fixes).
  - commit 0b2962b
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
    (git-fixes).
  - commit 3e2fb47

++++ kernel-default:

  - i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during
    start frame (git-fixes).
  - commit cc09a8e
  - kselftest: Add a ksft_perror() helper (stable-fixes).
  - Refresh
    patches.suse/selftests-timers-posix_timers-Reimplement-check_time.patch.
  - commit f14f41c
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
    (git-fixes).
  - nilfs2: fix use-after-free of timer for log writer thread
    (git-fixes).
  - kasan, fortify: properly rename memintrinsics (git-fixes).
  - i3c: master: svc: fix invalidate IBI type and miss call client
    IBI handler (git-fixes).
  - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
    (stable-fixes).
  - drm/amd/display: Fix division by zero in setup_dsc_config
    (stable-fixes).
  - docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).
  - mmc: core: Add HS400 tuning in HS400es initialization
    (stable-fixes).
  - commit 0b2962b
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
    (git-fixes).
  - commit 3e2fb47

++++ kernel-default:

  - i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during
    start frame (git-fixes).
  - commit cc09a8e
  - kselftest: Add a ksft_perror() helper (stable-fixes).
  - Refresh
    patches.suse/selftests-timers-posix_timers-Reimplement-check_time.patch.
  - commit f14f41c
  - nilfs2: fix unexpected freezing of nilfs_segctor_sync()
    (git-fixes).
  - nilfs2: fix use-after-free of timer for log writer thread
    (git-fixes).
  - kasan, fortify: properly rename memintrinsics (git-fixes).
  - i3c: master: svc: fix invalidate IBI type and miss call client
    IBI handler (git-fixes).
  - serial: kgdboc: Fix NMI-safety problems from keyboard reset code
    (stable-fixes).
  - drm/amd/display: Fix division by zero in setup_dsc_config
    (stable-fixes).
  - docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).
  - mmc: core: Add HS400 tuning in HS400es initialization
    (stable-fixes).
  - commit 0b2962b
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
    (git-fixes).
  - commit 3e2fb47

------------------------------------------------------------------
------------------  2024-5-25  -  May 25 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook
    440/460 G11 (stable-fixes).
  - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with
    ALC897 (stable-fixes).
  - ALSA: usb-audio: Fix for sampling rates support for Mbox3
    (stable-fixes).
  - ALSA: timer: Set lower bound of start tick time (stable-fixes).
  - ALSA: usb-audio: Add sampling rates support for Mbox3
    (stable-fixes).
  - commit ae40914
  - drm/nouveau: use tile_mode and pte_kind for VM_BIND bo
    allocations (git-fixes).
  - Input: cyapa - add missing input core locking to suspend/resume
    functions (git-fixes).
  - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
    (git-fixes).
  - Input: ims-pcu - fix printf string overflow (git-fixes).
  - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
    (git-fixes).
  - ALSA: core: Fix NULL module pointer assignment at card init
    (git-fixes).
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).
  - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using
    prescaler (git-fixes).
  - serial: 8250_bcm7271: use default_mux_rate if possible
    (git-fixes).
  - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
    (git-fixes).
  - tty: n_gsm: fix missing receive state reset after mode switch
    (git-fixes).
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
    (git-fixes).
  - commit be92dbc
  - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
    (git-fixes CVE-2024-35827 bsc#1224606).
  - commit e6510ec
  - io_uring/net: move receive multishot out of the generic msghdr
    path (git-fixes).
  - commit 98302d6
  - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
    (git-fixes).
  - commit 8bed9be
  - cifs: handle cases where multiple sessions share connection
    (bsc#1225172).
  - commit 6704757
  - smb3: show beginning time for per share stats (bsc#1225172).
  - commit 9dab491
  - cifs: cifs_chan_is_iface_active should be called with chan_lock
    held (bsc#1225172).
  - commit 7f878c6
  - cifs: do not pass cifs_sb when trying to add channels
    (bsc#1225172).
  - commit b48e89f
  - smb: client: remove extra @chan_count check in
    __cifs_put_smb_ses() (bsc#1225172).
  - commit 58e3272
  - cifs: reconnect work should have reference on server struct
    (bsc#1225172).
  - commit f1bff59
  - cifs: handle cases where a channel is closed (bsc#1225172).
  - commit c305501
  - smb: client: reduce stack usage in cifs_try_adding_channels()
    (bsc#1225172).
  - commit 16a3d64
  - smb: client: get rid of dfs code dep in namespace.c
    (bsc#1225172).
  - commit 658ebd6
  - smb: client: get rid of dfs naming in automount code
    (bsc#1225172).
  - commit b47e685
  - smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1225172).
  - commit 429bc2d
  - smb: client: ensure to try all targets when finding nested links
    (bsc#1225172).
  - commit b03bac4
  - smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1225172).
  - commit f066846
  - cifs: account for primary channel in the interface list
    (bsc#1225172).
  - commit 28558fb
  - cifs: distribute channels across interfaces based on speed
    (bsc#1225172).
  - commit 66db7c6
  - io_uring: remove unconditional looping in local task_work
    handling (git-fixes).
  - commit 1df83aa
  - io_uring: remove looping around handling traditional task_work
    (git-fixes).
  - commit 6bdc394

++++ kernel-default:

  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook
    440/460 G11 (stable-fixes).
  - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with
    ALC897 (stable-fixes).
  - ALSA: usb-audio: Fix for sampling rates support for Mbox3
    (stable-fixes).
  - ALSA: timer: Set lower bound of start tick time (stable-fixes).
  - ALSA: usb-audio: Add sampling rates support for Mbox3
    (stable-fixes).
  - commit ae40914
  - drm/nouveau: use tile_mode and pte_kind for VM_BIND bo
    allocations (git-fixes).
  - Input: cyapa - add missing input core locking to suspend/resume
    functions (git-fixes).
  - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
    (git-fixes).
  - Input: ims-pcu - fix printf string overflow (git-fixes).
  - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
    (git-fixes).
  - ALSA: core: Fix NULL module pointer assignment at card init
    (git-fixes).
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).
  - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using
    prescaler (git-fixes).
  - serial: 8250_bcm7271: use default_mux_rate if possible
    (git-fixes).
  - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
    (git-fixes).
  - tty: n_gsm: fix missing receive state reset after mode switch
    (git-fixes).
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
    (git-fixes).
  - commit be92dbc
  - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
    (git-fixes CVE-2024-35827 bsc#1224606).
  - commit e6510ec
  - io_uring/net: move receive multishot out of the generic msghdr
    path (git-fixes).
  - commit 98302d6
  - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
    (git-fixes).
  - commit 8bed9be
  - cifs: handle cases where multiple sessions share connection
    (bsc#1225172).
  - commit 6704757
  - smb3: show beginning time for per share stats (bsc#1225172).
  - commit 9dab491
  - cifs: cifs_chan_is_iface_active should be called with chan_lock
    held (bsc#1225172).
  - commit 7f878c6
  - cifs: do not pass cifs_sb when trying to add channels
    (bsc#1225172).
  - commit b48e89f
  - smb: client: remove extra @chan_count check in
    __cifs_put_smb_ses() (bsc#1225172).
  - commit 58e3272
  - cifs: reconnect work should have reference on server struct
    (bsc#1225172).
  - commit f1bff59
  - cifs: handle cases where a channel is closed (bsc#1225172).
  - commit c305501
  - smb: client: reduce stack usage in cifs_try_adding_channels()
    (bsc#1225172).
  - commit 16a3d64
  - smb: client: get rid of dfs code dep in namespace.c
    (bsc#1225172).
  - commit 658ebd6
  - smb: client: get rid of dfs naming in automount code
    (bsc#1225172).
  - commit b47e685
  - smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1225172).
  - commit 429bc2d
  - smb: client: ensure to try all targets when finding nested links
    (bsc#1225172).
  - commit b03bac4
  - smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1225172).
  - commit f066846
  - cifs: account for primary channel in the interface list
    (bsc#1225172).
  - commit 28558fb
  - cifs: distribute channels across interfaces based on speed
    (bsc#1225172).
  - commit 66db7c6
  - io_uring: remove unconditional looping in local task_work
    handling (git-fixes).
  - commit 1df83aa
  - io_uring: remove looping around handling traditional task_work
    (git-fixes).
  - commit 6bdc394

++++ kernel-default:

  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for ProBook
    440/460 G11 (stable-fixes).
  - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with
    ALC897 (stable-fixes).
  - ALSA: usb-audio: Fix for sampling rates support for Mbox3
    (stable-fixes).
  - ALSA: timer: Set lower bound of start tick time (stable-fixes).
  - ALSA: usb-audio: Add sampling rates support for Mbox3
    (stable-fixes).
  - commit ae40914
  - drm/nouveau: use tile_mode and pte_kind for VM_BIND bo
    allocations (git-fixes).
  - Input: cyapa - add missing input core locking to suspend/resume
    functions (git-fixes).
  - Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation
    (git-fixes).
  - Input: ims-pcu - fix printf string overflow (git-fixes).
  - ASoC: tas2552: Add TX path for capturing AUDIO-OUT data
    (git-fixes).
  - ALSA: core: Fix NULL module pointer assignment at card init
    (git-fixes).
  - speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).
  - serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using
    prescaler (git-fixes).
  - serial: 8250_bcm7271: use default_mux_rate if possible
    (git-fixes).
  - serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup
    (git-fixes).
  - tty: n_gsm: fix missing receive state reset after mode switch
    (git-fixes).
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
    (git-fixes).
  - commit be92dbc
  - io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
    (git-fixes CVE-2024-35827 bsc#1224606).
  - commit e6510ec
  - io_uring/net: move receive multishot out of the generic msghdr
    path (git-fixes).
  - commit 98302d6
  - io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
    (git-fixes).
  - commit 8bed9be
  - cifs: handle cases where multiple sessions share connection
    (bsc#1225172).
  - commit 6704757
  - smb3: show beginning time for per share stats (bsc#1225172).
  - commit 9dab491
  - cifs: cifs_chan_is_iface_active should be called with chan_lock
    held (bsc#1225172).
  - commit 7f878c6
  - cifs: do not pass cifs_sb when trying to add channels
    (bsc#1225172).
  - commit b48e89f
  - smb: client: remove extra @chan_count check in
    __cifs_put_smb_ses() (bsc#1225172).
  - commit 58e3272
  - cifs: reconnect work should have reference on server struct
    (bsc#1225172).
  - commit f1bff59
  - cifs: handle cases where a channel is closed (bsc#1225172).
  - commit c305501
  - smb: client: reduce stack usage in cifs_try_adding_channels()
    (bsc#1225172).
  - commit 16a3d64
  - smb: client: get rid of dfs code dep in namespace.c
    (bsc#1225172).
  - commit 658ebd6
  - smb: client: get rid of dfs naming in automount code
    (bsc#1225172).
  - commit b47e685
  - smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1225172).
  - commit 429bc2d
  - smb: client: ensure to try all targets when finding nested links
    (bsc#1225172).
  - commit b03bac4
  - smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1225172).
  - commit f066846
  - cifs: account for primary channel in the interface list
    (bsc#1225172).
  - commit 28558fb
  - cifs: distribute channels across interfaces based on speed
    (bsc#1225172).
  - commit 66db7c6
  - io_uring: remove unconditional looping in local task_work
    handling (git-fixes).
  - commit 1df83aa
  - io_uring: remove looping around handling traditional task_work
    (git-fixes).
  - commit 6bdc394

------------------------------------------------------------------
------------------  2024-5-24  -  May 24 2024  -------------------
------------------------------------------------------------------

++++ aaa_base:

  - Update to version 84.87+git20240523.10a5692:
    * Add tmpfiles.d/soft-reboot-cleanup.conf

++++ curl:

  - Fix make install for curl-config.1
    * docs/Makefile.am: make curl-config.1 install
    * Fixed upstream in: github.com/curl/curl/pull/13741
    * Add curl-make-install-curl-config.patch

++++ curl:

  - Fix make install for curl-config.1
    * docs/Makefile.am: make curl-config.1 install
    * Fixed upstream in: github.com/curl/curl/pull/13741
    * Add curl-make-install-curl-config.patch

++++ curl:

  - Fix make install for curl-config.1
    * docs/Makefile.am: make curl-config.1 install
    * Fixed upstream in: github.com/curl/curl/pull/13741
    * Add curl-make-install-curl-config.patch

++++ curl:

  - Fix make install for curl-config.1
    * docs/Makefile.am: make curl-config.1 install
    * Fixed upstream in: github.com/curl/curl/pull/13741
    * Add curl-make-install-curl-config.patch

++++ curl:

  - Fix make install for curl-config.1
    * docs/Makefile.am: make curl-config.1 install
    * Fixed upstream in: github.com/curl/curl/pull/13741
    * Add curl-make-install-curl-config.patch

++++ curl:

  - Fix make install for curl-config.1
    * docs/Makefile.am: make curl-config.1 install
    * Fixed upstream in: github.com/curl/curl/pull/13741
    * Add curl-make-install-curl-config.patch

++++ docker-compose:

  - Update to version 2.27.1:
    * build(deps): bump github.com/containerd/containerd from 1.7.16
    to 1.7.17
    * build(deps): bump github.com/docker/buildx from 0.14.0 to
    0.14.1
    * drop COMPOSE_EXPERIMENTAL_OTEL as docker/cli has opentelemetry
    in
    * add gui/composeview as part of available commands
    * fix opentelemetry
    * bump compose-go to version v2.1.1
    * Set endpoint-specific DriverOpts
    * Bump compose-go version to latest main
    * Backport OpenBSD patches
    * add new navigation menu to open Compose app configuration in
    Docker Desktop
    * build(deps): bump github.com/fsnotify/fsevents from 0.1.1 to
    0.2.0
    * build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0
    * fix --resolve-image-digests
    * allow a local .env file to override compose.yaml sibling .env
    * Bump docker engine and cli to version 26.1.3
    * Bump docker to v26.1.2
    * Add documentation for --menu up option and COMPOSE_MENU
    environemnt variable
    * chore(deps): bump docker to v26.1.1 (#11794)

++++ docker-compose:

  - Update to version 2.27.1:
    * build(deps): bump github.com/containerd/containerd from 1.7.16
    to 1.7.17
    * build(deps): bump github.com/docker/buildx from 0.14.0 to
    0.14.1
    * drop COMPOSE_EXPERIMENTAL_OTEL as docker/cli has opentelemetry
    in
    * add gui/composeview as part of available commands
    * fix opentelemetry
    * bump compose-go to version v2.1.1
    * Set endpoint-specific DriverOpts
    * Bump compose-go version to latest main
    * Backport OpenBSD patches
    * add new navigation menu to open Compose app configuration in
    Docker Desktop
    * build(deps): bump github.com/fsnotify/fsevents from 0.1.1 to
    0.2.0
    * build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0
    * fix --resolve-image-digests
    * allow a local .env file to override compose.yaml sibling .env
    * Bump docker engine and cli to version 26.1.3
    * Bump docker to v26.1.2
    * Add documentation for --menu up option and COMPOSE_MENU
    environemnt variable
    * chore(deps): bump docker to v26.1.1 (#11794)

++++ docker-compose:

  - Update to version 2.27.1:
    * build(deps): bump github.com/containerd/containerd from 1.7.16
    to 1.7.17
    * build(deps): bump github.com/docker/buildx from 0.14.0 to
    0.14.1
    * drop COMPOSE_EXPERIMENTAL_OTEL as docker/cli has opentelemetry
    in
    * add gui/composeview as part of available commands
    * fix opentelemetry
    * bump compose-go to version v2.1.1
    * Set endpoint-specific DriverOpts
    * Bump compose-go version to latest main
    * Backport OpenBSD patches
    * add new navigation menu to open Compose app configuration in
    Docker Desktop
    * build(deps): bump github.com/fsnotify/fsevents from 0.1.1 to
    0.2.0
    * build(deps): bump golang.org/x/sys from 0.19.0 to 0.20.0
    * fix --resolve-image-digests
    * allow a local .env file to override compose.yaml sibling .env
    * Bump docker engine and cli to version 26.1.3
    * Bump docker to v26.1.2
    * Add documentation for --menu up option and COMPOSE_MENU
    environemnt variable
    * chore(deps): bump docker to v26.1.1 (#11794)

++++ kernel-default:

  - dmaengine: dw-edma: eDMA: Add sync read before starting the
    DMA transfer in remote setup (CVE-2024-27408 bsc#1224430).
  - commit 26ca7a6
  - pmdomain: ti: Add a null pointer check to the
    omap_prm_domain_init (CVE-2024-35943 bsc#1224649).
  - commit 4abda58
  - media: mediatek: vcodec: Fix oops when HEVC init fails
    (CVE-2024-35921 bsc#1224477).
  - commit 7226612
  - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls()
    for hisi_hns3_pmu uninit process (CVE-2023-52860 bsc#1224936).
  - commit f0f6842
  - kABI workaround for struct idxd_evl (CVE-2024-35991
    bsc#1224553).
  - commit 4c82821
  - dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
    (CVE-2024-35991 bsc#1224553).
  - commit bba26d6
  - sched/topology: Optimize topology_span_sane() (bsc#1225053).
  - cpumask: Add for_each_cpu_from() (bsc#1225053).
  - commit a6ca3d0
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during
    rehash (CVE-2024-35854 bsc#1224636).
  - commit 2a8bef6
  - net: mctp: take ownership of skb in mctp_local_output
    (CVE-2024-27418 bsc#1224720)
  - commit afb99d9
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
    (CVE-2024-27417 bsc#1224721)
  - commit 4e68c84
  - regulator: bd71828: Don't overwrite runtime voltages
    (git-fixes).
  - nfc: nci: Fix handling of zero-length payload packets in
    nci_rx_work() (git-fixes).
  - nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).
  - selftests: net: kill smcrouted in the cleanup logic in amt.sh
    (git-fixes).
  - tools/latency-collector: Fix -Wformat-security compile warns
    (git-fixes).
  - commit 3a26e1a
  - bpf: Protect against int overflow for stack access size
    (bsc#1224488 CVE-2024-35905).
  - bpf: Check bloom filter map value size (bsc#1224488
    CVE-2024-35905).
  - commit 5fa3c11
  - io_uring: drop any code related to SCM_RIGHTS (git-fixes
    CVE-2023-52656 bsc#1224187).
  - io_uring/unix: drop usage of io_uring socket (git-fixes).
  - Refresh
    patches.suse/fs-Rename-anon_inode_getfile_secure-and-anon_inode_getfd_secure.
    Commit together because this required explicit merging with the
    anonymous inode creation function change. Incldues kabi fix up.
  - commit b304b67
  - autofs: use wake_up() instead of wake_up_interruptible(()
    (bsc#1224166).
  - commit eb57c74

++++ kernel-default:

  - dmaengine: dw-edma: eDMA: Add sync read before starting the
    DMA transfer in remote setup (CVE-2024-27408 bsc#1224430).
  - commit 26ca7a6
  - pmdomain: ti: Add a null pointer check to the
    omap_prm_domain_init (CVE-2024-35943 bsc#1224649).
  - commit 4abda58
  - media: mediatek: vcodec: Fix oops when HEVC init fails
    (CVE-2024-35921 bsc#1224477).
  - commit 7226612
  - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls()
    for hisi_hns3_pmu uninit process (CVE-2023-52860 bsc#1224936).
  - commit f0f6842
  - kABI workaround for struct idxd_evl (CVE-2024-35991
    bsc#1224553).
  - commit 4c82821
  - dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
    (CVE-2024-35991 bsc#1224553).
  - commit bba26d6
  - sched/topology: Optimize topology_span_sane() (bsc#1225053).
  - cpumask: Add for_each_cpu_from() (bsc#1225053).
  - commit a6ca3d0
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during
    rehash (CVE-2024-35854 bsc#1224636).
  - commit 2a8bef6
  - net: mctp: take ownership of skb in mctp_local_output
    (CVE-2024-27418 bsc#1224720)
  - commit afb99d9
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
    (CVE-2024-27417 bsc#1224721)
  - commit 4e68c84
  - regulator: bd71828: Don't overwrite runtime voltages
    (git-fixes).
  - nfc: nci: Fix handling of zero-length payload packets in
    nci_rx_work() (git-fixes).
  - nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).
  - selftests: net: kill smcrouted in the cleanup logic in amt.sh
    (git-fixes).
  - tools/latency-collector: Fix -Wformat-security compile warns
    (git-fixes).
  - commit 3a26e1a
  - bpf: Protect against int overflow for stack access size
    (bsc#1224488 CVE-2024-35905).
  - bpf: Check bloom filter map value size (bsc#1224488
    CVE-2024-35905).
  - commit 5fa3c11
  - io_uring: drop any code related to SCM_RIGHTS (git-fixes
    CVE-2023-52656 bsc#1224187).
  - io_uring/unix: drop usage of io_uring socket (git-fixes).
  - Refresh
    patches.suse/fs-Rename-anon_inode_getfile_secure-and-anon_inode_getfd_secure.
    Commit together because this required explicit merging with the
    anonymous inode creation function change. Incldues kabi fix up.
  - commit b304b67
  - autofs: use wake_up() instead of wake_up_interruptible(()
    (bsc#1224166).
  - commit eb57c74

++++ kernel-default:

  - dmaengine: dw-edma: eDMA: Add sync read before starting the
    DMA transfer in remote setup (CVE-2024-27408 bsc#1224430).
  - commit 26ca7a6
  - pmdomain: ti: Add a null pointer check to the
    omap_prm_domain_init (CVE-2024-35943 bsc#1224649).
  - commit 4abda58
  - media: mediatek: vcodec: Fix oops when HEVC init fails
    (CVE-2024-35921 bsc#1224477).
  - commit 7226612
  - drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls()
    for hisi_hns3_pmu uninit process (CVE-2023-52860 bsc#1224936).
  - commit f0f6842
  - kABI workaround for struct idxd_evl (CVE-2024-35991
    bsc#1224553).
  - commit 4c82821
  - dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
    (CVE-2024-35991 bsc#1224553).
  - commit bba26d6
  - sched/topology: Optimize topology_span_sane() (bsc#1225053).
  - cpumask: Add for_each_cpu_from() (bsc#1225053).
  - commit a6ca3d0
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during
    rehash (CVE-2024-35854 bsc#1224636).
  - commit 2a8bef6
  - net: mctp: take ownership of skb in mctp_local_output
    (CVE-2024-27418 bsc#1224720)
  - commit afb99d9
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
    (CVE-2024-27417 bsc#1224721)
  - commit 4e68c84
  - regulator: bd71828: Don't overwrite runtime voltages
    (git-fixes).
  - nfc: nci: Fix handling of zero-length payload packets in
    nci_rx_work() (git-fixes).
  - nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).
  - selftests: net: kill smcrouted in the cleanup logic in amt.sh
    (git-fixes).
  - tools/latency-collector: Fix -Wformat-security compile warns
    (git-fixes).
  - commit 3a26e1a
  - bpf: Protect against int overflow for stack access size
    (bsc#1224488 CVE-2024-35905).
  - bpf: Check bloom filter map value size (bsc#1224488
    CVE-2024-35905).
  - commit 5fa3c11
  - io_uring: drop any code related to SCM_RIGHTS (git-fixes
    CVE-2023-52656 bsc#1224187).
  - io_uring/unix: drop usage of io_uring socket (git-fixes).
  - Refresh
    patches.suse/fs-Rename-anon_inode_getfile_secure-and-anon_inode_getfd_secure.
    Commit together because this required explicit merging with the
    anonymous inode creation function change. Incldues kabi fix up.
  - commit b304b67
  - autofs: use wake_up() instead of wake_up_interruptible(()
    (bsc#1224166).
  - commit eb57c74

++++ mozilla-nss:

  - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox
    when using FIPS-mode (bsc#1223724).

++++ mozilla-nss:

  - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox
    when using FIPS-mode (bsc#1223724).

++++ mozilla-nss:

  - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox
    when using FIPS-mode (bsc#1223724).

++++ mozilla-nss:

  - Adding nss-fips-bsc1223724.patch to fix startup crash of Firefox
    when using FIPS-mode (bsc#1223724).

------------------------------------------------------------------
------------------  2024-5-23  -  May 23 2024  -------------------
------------------------------------------------------------------

++++ glibc:

  - Also include stat64 in the 32-bit libc_nonshared.a workaround
    (bsc#1221482)

++++ glibc:

  - Also include stat64 in the 32-bit libc_nonshared.a workaround
    (bsc#1221482)

++++ glibc:

  - Also include stat64 in the 32-bit libc_nonshared.a workaround
    (bsc#1221482)

++++ glibc:

  - Also include stat64 in the 32-bit libc_nonshared.a workaround
    (bsc#1221482)

++++ glibc:

  - Also include stat64 in the 32-bit libc_nonshared.a workaround
    (bsc#1221482)

++++ kernel-default:

  - Update patches.suse/scsi-qedf-Wait-for-stag-work-during-unload.patch (bsc#1214852)
  - Update patches.suse/scsi-qedf-Don-t-process-stag-work-during-unload.patch (bsc#1214852)
  - commit 4cb5fde
  - Remove NTFSv3 from configs (bsc#1224429)
    References: bsc#1224429 comment#3
    We only support fuse version of the NTFS-3g driver. Disable NTFSv3 from
    all configs.
    This was enabled in
    d016c04d731 ("Bump to 6.4 kernel (jsc#PED-4593)")
  - commit b4be251
  - s390/ipl: Fix incorrect initialization of len fields in nvme
    reipl block (git-fixes bsc#1225136).
  - commit 273e6f4
  - s390/ipl: Fix incorrect initialization of nvme dump block
    (git-fixes bsc#1225134).
  - commit 955c716
  - s390/cpacf: Split and rework cpacf query functions (git-fixes
    bsc#1225133).
  - commit ee9583e
  - s390/bpf: Fix bpf_plt pointer arithmetic (git-fixes bsc#1224481
    CVE-2024-35917).
  - commit 34e1a55
  - Move upstreamed mm patches into sorted section
  - commit e3937f1
  - Move upstreamed powerpc patches into sorted section
  - commit fdb5fa6
  - kABI workaround for cs35l56 (git-fixes).
  - commit 331f8f7
  - ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails
    (stable-fixes).
  - Refresh
    patches.suse/ASoC-SOF-Intel-mtl-Implement-firmware-boot-state-che.patch.
  - commit 8e475f5
  - ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot
    failed (git-fixes).
  - ASoC: cs35l56: Prevent overwriting firmware ASP config
    (git-fixes).
  - commit 1a7f82c
  - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
    (CVE-2023-52674 bsc#1224727).
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
    (CVE-2023-52680 bsc#1224608).
  - ALSA: scarlett2: Add missing error check to
    scarlett2_usb_set_config() (CVE-2023-52692 bsc#1224628).
  - commit fff59c9
  - vmci: prevent speculation leaks by sanitizing event in
    event_deliver() (git-fixes).
  - VMCI: Fix an error handling path in vmci_guest_probe_device()
    (git-fixes).
  - VMCI: Fix possible memcpy() run-time warning in
    vmci_datagram_invoke_guest_handler() (stable-fixes).
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
    (stable-fixes CVE-2024-35944 bsc#1224648).
  - commit d9694ad
  - spmi: hisi-spmi-controller: Do not override device identifier
    (git-fixes).
  - extcon: max8997: select IRQ_DOMAIN instead of depending on it
    (git-fixes).
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port
    assignment (git-fixes).
  - iio: pressure: dps310: support negative temperature values
    (git-fixes).
  - iio: adc: stm32: Fixing err code to not indicate success
    (git-fixes).
  - iio: core: Leave private pointer NULL when no private data
    supplied (git-fixes).
  - counter: linux/counter.h: fix Excess kernel-doc description
    warning (git-fixes).
  - staging: vt6655: Remove unused declaration of
    RFbAL7230SelectChannelPostProcess() (git-fixes).
  - serial: sh-sci: protect invalidating RXDMA on shutdown
    (git-fixes).
  - serial: sc16is7xx: add proper sched.h include for
    sched_set_fifo() (git-fixes).
  - serial: max3100: Fix bitwise types (git-fixes).
  - serial: max3100: Update uart_driver_registered on driver removal
    (git-fixes).
  - serial: max3100: Lock port->lock when calling
    uart_handle_cts_change() (git-fixes).
  - usb: fotg210: Add missing kernel doc description (git-fixes).
  - usb: typec: tipd: fix event checking for tps6598x (git-fixes).
  - usb: typec: ucsi: displayport: Fix potential deadlock
    (git-fixes).
  - usb: dwc3: Wait unconditionally after issuing EndXfer command
    (git-fixes).
  - usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).
  - usb: gadget: u_audio: Fix race condition use of controls after
    free during gadget unbind (git-fixes).
  - usb: typec: ucsi: simplify partner's PD caps registration
    (git-fixes).
  - usb: typec: ucsi: always register a link to USB PD device
    (git-fixes).
  - leds: pwm: Disable PWM when going to suspend (git-fixes).
  - commit 0d08462

++++ kernel-default:

  - Update patches.suse/scsi-qedf-Wait-for-stag-work-during-unload.patch (bsc#1214852)
  - Update patches.suse/scsi-qedf-Don-t-process-stag-work-during-unload.patch (bsc#1214852)
  - commit 4cb5fde
  - Remove NTFSv3 from configs (bsc#1224429)
    References: bsc#1224429 comment#3
    We only support fuse version of the NTFS-3g driver. Disable NTFSv3 from
    all configs.
    This was enabled in
    d016c04d731 ("Bump to 6.4 kernel (jsc#PED-4593)")
  - commit b4be251
  - s390/ipl: Fix incorrect initialization of len fields in nvme
    reipl block (git-fixes bsc#1225136).
  - commit 273e6f4
  - s390/ipl: Fix incorrect initialization of nvme dump block
    (git-fixes bsc#1225134).
  - commit 955c716
  - s390/cpacf: Split and rework cpacf query functions (git-fixes
    bsc#1225133).
  - commit ee9583e
  - s390/bpf: Fix bpf_plt pointer arithmetic (git-fixes bsc#1224481
    CVE-2024-35917).
  - commit 34e1a55
  - Move upstreamed mm patches into sorted section
  - commit e3937f1
  - Move upstreamed powerpc patches into sorted section
  - commit fdb5fa6
  - kABI workaround for cs35l56 (git-fixes).
  - commit 331f8f7
  - ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails
    (stable-fixes).
  - Refresh
    patches.suse/ASoC-SOF-Intel-mtl-Implement-firmware-boot-state-che.patch.
  - commit 8e475f5
  - ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot
    failed (git-fixes).
  - ASoC: cs35l56: Prevent overwriting firmware ASP config
    (git-fixes).
  - commit 1a7f82c
  - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
    (CVE-2023-52674 bsc#1224727).
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
    (CVE-2023-52680 bsc#1224608).
  - ALSA: scarlett2: Add missing error check to
    scarlett2_usb_set_config() (CVE-2023-52692 bsc#1224628).
  - commit fff59c9
  - vmci: prevent speculation leaks by sanitizing event in
    event_deliver() (git-fixes).
  - VMCI: Fix an error handling path in vmci_guest_probe_device()
    (git-fixes).
  - VMCI: Fix possible memcpy() run-time warning in
    vmci_datagram_invoke_guest_handler() (stable-fixes).
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
    (stable-fixes CVE-2024-35944 bsc#1224648).
  - commit d9694ad
  - spmi: hisi-spmi-controller: Do not override device identifier
    (git-fixes).
  - extcon: max8997: select IRQ_DOMAIN instead of depending on it
    (git-fixes).
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port
    assignment (git-fixes).
  - iio: pressure: dps310: support negative temperature values
    (git-fixes).
  - iio: adc: stm32: Fixing err code to not indicate success
    (git-fixes).
  - iio: core: Leave private pointer NULL when no private data
    supplied (git-fixes).
  - counter: linux/counter.h: fix Excess kernel-doc description
    warning (git-fixes).
  - staging: vt6655: Remove unused declaration of
    RFbAL7230SelectChannelPostProcess() (git-fixes).
  - serial: sh-sci: protect invalidating RXDMA on shutdown
    (git-fixes).
  - serial: sc16is7xx: add proper sched.h include for
    sched_set_fifo() (git-fixes).
  - serial: max3100: Fix bitwise types (git-fixes).
  - serial: max3100: Update uart_driver_registered on driver removal
    (git-fixes).
  - serial: max3100: Lock port->lock when calling
    uart_handle_cts_change() (git-fixes).
  - usb: fotg210: Add missing kernel doc description (git-fixes).
  - usb: typec: tipd: fix event checking for tps6598x (git-fixes).
  - usb: typec: ucsi: displayport: Fix potential deadlock
    (git-fixes).
  - usb: dwc3: Wait unconditionally after issuing EndXfer command
    (git-fixes).
  - usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).
  - usb: gadget: u_audio: Fix race condition use of controls after
    free during gadget unbind (git-fixes).
  - usb: typec: ucsi: simplify partner's PD caps registration
    (git-fixes).
  - usb: typec: ucsi: always register a link to USB PD device
    (git-fixes).
  - leds: pwm: Disable PWM when going to suspend (git-fixes).
  - commit 0d08462

++++ kernel-default:

  - Update patches.suse/scsi-qedf-Wait-for-stag-work-during-unload.patch (bsc#1214852)
  - Update patches.suse/scsi-qedf-Don-t-process-stag-work-during-unload.patch (bsc#1214852)
  - commit 4cb5fde
  - Remove NTFSv3 from configs (bsc#1224429)
    References: bsc#1224429 comment#3
    We only support fuse version of the NTFS-3g driver. Disable NTFSv3 from
    all configs.
    This was enabled in
    d016c04d731 ("Bump to 6.4 kernel (jsc#PED-4593)")
  - commit b4be251
  - s390/ipl: Fix incorrect initialization of len fields in nvme
    reipl block (git-fixes bsc#1225136).
  - commit 273e6f4
  - s390/ipl: Fix incorrect initialization of nvme dump block
    (git-fixes bsc#1225134).
  - commit 955c716
  - s390/cpacf: Split and rework cpacf query functions (git-fixes
    bsc#1225133).
  - commit ee9583e
  - s390/bpf: Fix bpf_plt pointer arithmetic (git-fixes bsc#1224481
    CVE-2024-35917).
  - commit 34e1a55
  - Move upstreamed mm patches into sorted section
  - commit e3937f1
  - Move upstreamed powerpc patches into sorted section
  - commit fdb5fa6
  - kABI workaround for cs35l56 (git-fixes).
  - commit 331f8f7
  - ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails
    (stable-fixes).
  - Refresh
    patches.suse/ASoC-SOF-Intel-mtl-Implement-firmware-boot-state-che.patch.
  - commit 8e475f5
  - ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot
    failed (git-fixes).
  - ASoC: cs35l56: Prevent overwriting firmware ASP config
    (git-fixes).
  - commit 1a7f82c
  - ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
    (CVE-2023-52674 bsc#1224727).
  - ALSA: scarlett2: Add missing error checks to *_ctl_get()
    (CVE-2023-52680 bsc#1224608).
  - ALSA: scarlett2: Add missing error check to
    scarlett2_usb_set_config() (CVE-2023-52692 bsc#1224628).
  - commit fff59c9
  - vmci: prevent speculation leaks by sanitizing event in
    event_deliver() (git-fixes).
  - VMCI: Fix an error handling path in vmci_guest_probe_device()
    (git-fixes).
  - VMCI: Fix possible memcpy() run-time warning in
    vmci_datagram_invoke_guest_handler() (stable-fixes).
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
    (stable-fixes CVE-2024-35944 bsc#1224648).
  - commit d9694ad
  - spmi: hisi-spmi-controller: Do not override device identifier
    (git-fixes).
  - extcon: max8997: select IRQ_DOMAIN instead of depending on it
    (git-fixes).
  - interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port
    assignment (git-fixes).
  - iio: pressure: dps310: support negative temperature values
    (git-fixes).
  - iio: adc: stm32: Fixing err code to not indicate success
    (git-fixes).
  - iio: core: Leave private pointer NULL when no private data
    supplied (git-fixes).
  - counter: linux/counter.h: fix Excess kernel-doc description
    warning (git-fixes).
  - staging: vt6655: Remove unused declaration of
    RFbAL7230SelectChannelPostProcess() (git-fixes).
  - serial: sh-sci: protect invalidating RXDMA on shutdown
    (git-fixes).
  - serial: sc16is7xx: add proper sched.h include for
    sched_set_fifo() (git-fixes).
  - serial: max3100: Fix bitwise types (git-fixes).
  - serial: max3100: Update uart_driver_registered on driver removal
    (git-fixes).
  - serial: max3100: Lock port->lock when calling
    uart_handle_cts_change() (git-fixes).
  - usb: fotg210: Add missing kernel doc description (git-fixes).
  - usb: typec: tipd: fix event checking for tps6598x (git-fixes).
  - usb: typec: ucsi: displayport: Fix potential deadlock
    (git-fixes).
  - usb: dwc3: Wait unconditionally after issuing EndXfer command
    (git-fixes).
  - usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).
  - usb: gadget: u_audio: Fix race condition use of controls after
    free during gadget unbind (git-fixes).
  - usb: typec: ucsi: simplify partner's PD caps registration
    (git-fixes).
  - usb: typec: ucsi: always register a link to USB PD device
    (git-fixes).
  - leds: pwm: Disable PWM when going to suspend (git-fixes).
  - commit 0d08462

++++ util-linux:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

++++ util-linux:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

++++ util-linux:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

++++ util-linux:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

++++ sqlite3:

  - Update to release 3.46.0:
    * https://sqlite.org/releaselog/3_46_0.html
    * Enhance PRAGMA optimize in multiple ways.
    * Enhancements to the date and time functions.
    * Add support for underscore ("_") characters between digits in
    numeric literals.
    * Add the json_pretty() SQL function.
    * Query planner improvements.
    * Allocate additional memory from the heap for the SQL parser
    stack if that stack overflows, rather than reporting a "parser
    stack overflow" error.
    * Allow ASCII control characters within JSON5 string literals.
    * Fix the -> and ->> JSON operators so that when the right-hand
    side operand is a string that looks like an integer it is still
    treated as a string, because that is what PostgreSQL does.
    * Obsoletes sqlite3-float-i586.patch.

++++ sqlite3:

  - Update to release 3.46.0:
    * https://sqlite.org/releaselog/3_46_0.html
    * Enhance PRAGMA optimize in multiple ways.
    * Enhancements to the date and time functions.
    * Add support for underscore ("_") characters between digits in
    numeric literals.
    * Add the json_pretty() SQL function.
    * Query planner improvements.
    * Allocate additional memory from the heap for the SQL parser
    stack if that stack overflows, rather than reporting a "parser
    stack overflow" error.
    * Allow ASCII control characters within JSON5 string literals.
    * Fix the -> and ->> JSON operators so that when the right-hand
    side operand is a string that looks like an integer it is still
    treated as a string, because that is what PostgreSQL does.
    * Obsoletes sqlite3-float-i586.patch.

++++ sqlite3:

  - Update to release 3.46.0:
    * https://sqlite.org/releaselog/3_46_0.html
    * Enhance PRAGMA optimize in multiple ways.
    * Enhancements to the date and time functions.
    * Add support for underscore ("_") characters between digits in
    numeric literals.
    * Add the json_pretty() SQL function.
    * Query planner improvements.
    * Allocate additional memory from the heap for the SQL parser
    stack if that stack overflows, rather than reporting a "parser
    stack overflow" error.
    * Allow ASCII control characters within JSON5 string literals.
    * Fix the -> and ->> JSON operators so that when the right-hand
    side operand is a string that looks like an integer it is still
    treated as a string, because that is what PostgreSQL does.
    * Obsoletes sqlite3-float-i586.patch.

++++ sqlite3:

  - Update to release 3.46.0:
    * https://sqlite.org/releaselog/3_46_0.html
    * Enhance PRAGMA optimize in multiple ways.
    * Enhancements to the date and time functions.
    * Add support for underscore ("_") characters between digits in
    numeric literals.
    * Add the json_pretty() SQL function.
    * Query planner improvements.
    * Allocate additional memory from the heap for the SQL parser
    stack if that stack overflows, rather than reporting a "parser
    stack overflow" error.
    * Allow ASCII control characters within JSON5 string literals.
    * Fix the -> and ->> JSON operators so that when the right-hand
    side operand is a string that looks like an integer it is still
    treated as a string, because that is what PostgreSQL does.
    * Obsoletes sqlite3-float-i586.patch.

++++ suseconnect-ng:

  - Update version to 1.10.0
    * Build zypper-migration and zypper-packages-search as standalone
    binaries rather then one single binary
    * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004)
    * Include /etc/products.d in directories whose content are backed
    up and restored if a zypper-migration rollback happens. (bsc#1219004)
    * Add the ability to upload the system uptime logs, produced by the
    suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report.
    (jsc#PED-7982) (jsc#PED-8018)
    * Add support for third party packages in SUSEConnect
    * Refactor existing system information collection implementation

++++ suseconnect-ng:

  - Update version to 1.10.0
    * Build zypper-migration and zypper-packages-search as standalone
    binaries rather then one single binary
    * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004)
    * Include /etc/products.d in directories whose content are backed
    up and restored if a zypper-migration rollback happens. (bsc#1219004)
    * Add the ability to upload the system uptime logs, produced by the
    suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report.
    (jsc#PED-7982) (jsc#PED-8018)
    * Add support for third party packages in SUSEConnect
    * Refactor existing system information collection implementation

++++ suseconnect-ng:

  - Update version to 1.10.0
    * Build zypper-migration and zypper-packages-search as standalone
    binaries rather then one single binary
    * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004)
    * Include /etc/products.d in directories whose content are backed
    up and restored if a zypper-migration rollback happens. (bsc#1219004)
    * Add the ability to upload the system uptime logs, produced by the
    suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report.
    (jsc#PED-7982) (jsc#PED-8018)
    * Add support for third party packages in SUSEConnect
    * Refactor existing system information collection implementation

++++ suseconnect-ng:

  - Update version to 1.10.0
    * Build zypper-migration and zypper-packages-search as standalone
    binaries rather then one single binary
    * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004)
    * Include /etc/products.d in directories whose content are backed
    up and restored if a zypper-migration rollback happens. (bsc#1219004)
    * Add the ability to upload the system uptime logs, produced by the
    suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report.
    (jsc#PED-7982) (jsc#PED-8018)
    * Add support for third party packages in SUSEConnect
    * Refactor existing system information collection implementation

++++ suseconnect-ng:

  - Update version to 1.10.0
    * Build zypper-migration and zypper-packages-search as standalone
    binaries rather then one single binary
    * Add --gpg-auto-import-keys flag before action in zypper command (bsc#1219004)
    * Include /etc/products.d in directories whose content are backed
    up and restored if a zypper-migration rollback happens. (bsc#1219004)
    * Add the ability to upload the system uptime logs, produced by the
    suse-uptime-tracker daemon, to SCC/RMT as part of keepalive report.
    (jsc#PED-7982) (jsc#PED-8018)
    * Add support for third party packages in SUSEConnect
    * Refactor existing system information collection implementation

++++ util-linux-systemd:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

++++ util-linux-systemd:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

++++ util-linux-systemd:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

++++ util-linux-systemd:

  - lscpu: Add more ARM cores (bsc#1223605,
    util-linux-lscpu-add-ARM-cores-neoverse3.patch).

------------------------------------------------------------------
------------------  2024-5-22  -  May 22 2024  -------------------
------------------------------------------------------------------

++++ containerd:

  - Update to containerd v1.7.17. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.17>
  - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
    and storage than a locally-compressed tar.xz, it seems there's some weird
    issue with paths in obscpio that break our SLE-12-only patch.
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
  - Update to containerd v1.7.16. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.16>
    CVE-2023-45288 bsc#1221400

++++ containerd:

  - Update to containerd v1.7.17. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.17>
  - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
    and storage than a locally-compressed tar.xz, it seems there's some weird
    issue with paths in obscpio that break our SLE-12-only patch.
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
  - Update to containerd v1.7.16. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.16>
    CVE-2023-45288 bsc#1221400

++++ containerd:

  - Update to containerd v1.7.17. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.17>
  - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
    and storage than a locally-compressed tar.xz, it seems there's some weird
    issue with paths in obscpio that break our SLE-12-only patch.
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
  - Update to containerd v1.7.16. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.16>
    CVE-2023-45288 bsc#1221400

++++ containerd:

  - Update to containerd v1.7.17. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.17>
  - Switch back to using tar_scm service. Aside from obs_scm using more bandwidth
    and storage than a locally-compressed tar.xz, it seems there's some weird
    issue with paths in obscpio that break our SLE-12-only patch.
  - Rebase patches:
    * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
  - Update to containerd v1.7.16. Upstream release notes:
    <https://github.com/containerd/containerd/releases/tag/v1.7.16>
    CVE-2023-45288 bsc#1221400

++++ curl:

  - Update to 8.8.0:
    * Changes:
  - curl_version_info: provide librtmp version
  - file: add support for directory listings
  - lib: add curl_multi_waitfds
  - NTLM_WB: drop support
  - TLS: add support for ECH (Encrypted Client Hello)
  - urlapi: add CURLU_GET_EMPTY for empty queries and fragments
    * Bugfixes:
  - build: prefer "USE_IPV6" macro internally (was: "ENABLE_IPV6")
  - cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set
  - cf-socket: don't try getting local IP without socket
  - cf-socket: remove references to l_ip, l_port
  - configure: make --disable-docs imply --disable-manual
  - curl.h: change CURL_SSLVERSION_* from enum to defines
  - curl_path: make Curl_get_pathname use dynbuf
  - curl_sha512_256: do not use workaround for NetBSD when not needed
  - curl_sha512_256: fix detection of OpenSSL 1.1.1 or later
  - curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY
  - DEPRECATE.md: TLS libraries without 1.3 support
  - digest: replace strcpy for empty string with simple assignment
  - doc: pytest "--repeat" -> "--count"
  - docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd
  - dynbuf: fix returncode on memory error
  - ftp: add tracing support
  - ftp: fix socket leak on rare error
  - gnutls: lazy init the trust settings
  - hsts: explicitly skip blank lines
  - http2 + ngtcp2: pass CURLcode errors from callbacks
  - http2, http3: decouple stream state from easy handle
  - http2: emit RST when client write fails
  - http: HEAD response body tolerance
  - http: reject HTTP major version switch mid connection
  - http: with chunked POST forced, disable length check on read callback
  - idn: make Curl_idnconvert_hostname() use Curl_idn_decode()
  - if2ip: make the buf_size arg a size_t
  - krb5: use dynbuf
  - lib/cf-h1-proxy: silence compiler warnings (gcc 14)
  - lib: add trace support for client reads and writes
  - lib: bump hash sizes to "size_t"
  - lib: clear the easy handle's saved errno before transfer
  - lib: make protocol handlers store scheme name lowercase
  - lib: merge "ENABLE_QUIC" C macro into "USE_HTTP3"
  - libssh2: set length to 0 if strdup failed
  - openssl: do not set SSL_MODE_RELEASE_BUFFERS
  - openssl: revert keylog_callback support for LibreSSL
  - OS400: fix shellcheck warnings in scripts
  - quiche: expire all active transfers on connection close
  - quiche: trust its timeout handling
  - tls: use shared init code for TCP+QUIC
  - tool_cfgable: free {proxy_}cipher13_list on exit
  - url: do not URL decode proxy crendentials
  - url: fix use of an uninitialized variable
  - url: make parse_login_details use memdup0
  - urlapi: allow setting port number zero
  - version: use msnprintf instead of strncpy
  - vtls: TLS session storage overhaul
  - wakeup_create: use FD_CLOEXEC/SOCK_CLOEXEC
  - websocket: avoid memory leak in error path
  - Add split-provides for libcurl-devel -> libcurl-devel-doc.

++++ curl:

  - Update to 8.8.0:
    * Changes:
  - curl_version_info: provide librtmp version
  - file: add support for directory listings
  - lib: add curl_multi_waitfds
  - NTLM_WB: drop support
  - TLS: add support for ECH (Encrypted Client Hello)
  - urlapi: add CURLU_GET_EMPTY for empty queries and fragments
    * Bugfixes:
  - build: prefer "USE_IPV6" macro internally (was: "ENABLE_IPV6")
  - cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set
  - cf-socket: don't try getting local IP without socket
  - cf-socket: remove references to l_ip, l_port
  - configure: make --disable-docs imply --disable-manual
  - curl.h: change CURL_SSLVERSION_* from enum to defines
  - curl_path: make Curl_get_pathname use dynbuf
  - curl_sha512_256: do not use workaround for NetBSD when not needed
  - curl_sha512_256: fix detection of OpenSSL 1.1.1 or later
  - curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY
  - DEPRECATE.md: TLS libraries without 1.3 support
  - digest: replace strcpy for empty string with simple assignment
  - doc: pytest "--repeat" -> "--count"
  - docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd
  - dynbuf: fix returncode on memory error
  - ftp: add tracing support
  - ftp: fix socket leak on rare error
  - gnutls: lazy init the trust settings
  - hsts: explicitly skip blank lines
  - http2 + ngtcp2: pass CURLcode errors from callbacks
  - http2, http3: decouple stream state from easy handle
  - http2: emit RST when client write fails
  - http: HEAD response body tolerance
  - http: reject HTTP major version switch mid connection
  - http: with chunked POST forced, disable length check on read callback
  - idn: make Curl_idnconvert_hostname() use Curl_idn_decode()
  - if2ip: make the buf_size arg a size_t
  - krb5: use dynbuf
  - lib/cf-h1-proxy: silence compiler warnings (gcc 14)
  - lib: add trace support for client reads and writes
  - lib: bump hash sizes to "size_t"
  - lib: clear the easy handle's saved errno before transfer
  - lib: make protocol handlers store scheme name lowercase
  - lib: merge "ENABLE_QUIC" C macro into "USE_HTTP3"
  - libssh2: set length to 0 if strdup failed
  - openssl: do not set SSL_MODE_RELEASE_BUFFERS
  - openssl: revert keylog_callback support for LibreSSL
  - OS400: fix shellcheck warnings in scripts
  - quiche: expire all active transfers on connection close
  - quiche: trust its timeout handling
  - tls: use shared init code for TCP+QUIC
  - tool_cfgable: free {proxy_}cipher13_list on exit
  - url: do not URL decode proxy crendentials
  - url: fix use of an uninitialized variable
  - url: make parse_login_details use memdup0
  - urlapi: allow setting port number zero
  - version: use msnprintf instead of strncpy
  - vtls: TLS session storage overhaul
  - wakeup_create: use FD_CLOEXEC/SOCK_CLOEXEC
  - websocket: avoid memory leak in error path
  - Add split-provides for libcurl-devel -> libcurl-devel-doc.

++++ curl:

  - Update to 8.8.0:
    * Changes:
  - curl_version_info: provide librtmp version
  - file: add support for directory listings
  - lib: add curl_multi_waitfds
  - NTLM_WB: drop support
  - TLS: add support for ECH (Encrypted Client Hello)
  - urlapi: add CURLU_GET_EMPTY for empty queries and fragments
    * Bugfixes:
  - build: prefer "USE_IPV6" macro internally (was: "ENABLE_IPV6")
  - cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set
  - cf-socket: don't try getting local IP without socket
  - cf-socket: remove references to l_ip, l_port
  - configure: make --disable-docs imply --disable-manual
  - curl.h: change CURL_SSLVERSION_* from enum to defines
  - curl_path: make Curl_get_pathname use dynbuf
  - curl_sha512_256: do not use workaround for NetBSD when not needed
  - curl_sha512_256: fix detection of OpenSSL 1.1.1 or later
  - curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY
  - DEPRECATE.md: TLS libraries without 1.3 support
  - digest: replace strcpy for empty string with simple assignment
  - doc: pytest "--repeat" -> "--count"
  - docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd
  - dynbuf: fix returncode on memory error
  - ftp: add tracing support
  - ftp: fix socket leak on rare error
  - gnutls: lazy init the trust settings
  - hsts: explicitly skip blank lines
  - http2 + ngtcp2: pass CURLcode errors from callbacks
  - http2, http3: decouple stream state from easy handle
  - http2: emit RST when client write fails
  - http: HEAD response body tolerance
  - http: reject HTTP major version switch mid connection
  - http: with chunked POST forced, disable length check on read callback
  - idn: make Curl_idnconvert_hostname() use Curl_idn_decode()
  - if2ip: make the buf_size arg a size_t
  - krb5: use dynbuf
  - lib/cf-h1-proxy: silence compiler warnings (gcc 14)
  - lib: add trace support for client reads and writes
  - lib: bump hash sizes to "size_t"
  - lib: clear the easy handle's saved errno before transfer
  - lib: make protocol handlers store scheme name lowercase
  - lib: merge "ENABLE_QUIC" C macro into "USE_HTTP3"
  - libssh2: set length to 0 if strdup failed
  - openssl: do not set SSL_MODE_RELEASE_BUFFERS
  - openssl: revert keylog_callback support for LibreSSL
  - OS400: fix shellcheck warnings in scripts
  - quiche: expire all active transfers on connection close
  - quiche: trust its timeout handling
  - tls: use shared init code for TCP+QUIC
  - tool_cfgable: free {proxy_}cipher13_list on exit
  - url: do not URL decode proxy crendentials
  - url: fix use of an uninitialized variable
  - url: make parse_login_details use memdup0
  - urlapi: allow setting port number zero
  - version: use msnprintf instead of strncpy
  - vtls: TLS session storage overhaul
  - wakeup_create: use FD_CLOEXEC/SOCK_CLOEXEC
  - websocket: avoid memory leak in error path
  - Add split-provides for libcurl-devel -> libcurl-devel-doc.

++++ curl:

  - Update to 8.8.0:
    * Changes:
  - curl_version_info: provide librtmp version
  - file: add support for directory listings
  - lib: add curl_multi_waitfds
  - NTLM_WB: drop support
  - TLS: add support for ECH (Encrypted Client Hello)
  - urlapi: add CURLU_GET_EMPTY for empty queries and fragments
    * Bugfixes:
  - build: prefer "USE_IPV6" macro internally (was: "ENABLE_IPV6")
  - cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set
  - cf-socket: don't try getting local IP without socket
  - cf-socket: remove references to l_ip, l_port
  - configure: make --disable-docs imply --disable-manual
  - curl.h: change CURL_SSLVERSION_* from enum to defines
  - curl_path: make Curl_get_pathname use dynbuf
  - curl_sha512_256: do not use workaround for NetBSD when not needed
  - curl_sha512_256: fix detection of OpenSSL 1.1.1 or later
  - curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY
  - DEPRECATE.md: TLS libraries without 1.3 support
  - digest: replace strcpy for empty string with simple assignment
  - doc: pytest "--repeat" -> "--count"
  - docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd
  - dynbuf: fix returncode on memory error
  - ftp: add tracing support
  - ftp: fix socket leak on rare error
  - gnutls: lazy init the trust settings
  - hsts: explicitly skip blank lines
  - http2 + ngtcp2: pass CURLcode errors from callbacks
  - http2, http3: decouple stream state from easy handle
  - http2: emit RST when client write fails
  - http: HEAD response body tolerance
  - http: reject HTTP major version switch mid connection
  - http: with chunked POST forced, disable length check on read callback
  - idn: make Curl_idnconvert_hostname() use Curl_idn_decode()
  - if2ip: make the buf_size arg a size_t
  - krb5: use dynbuf
  - lib/cf-h1-proxy: silence compiler warnings (gcc 14)
  - lib: add trace support for client reads and writes
  - lib: bump hash sizes to "size_t"
  - lib: clear the easy handle's saved errno before transfer
  - lib: make protocol handlers store scheme name lowercase
  - lib: merge "ENABLE_QUIC" C macro into "USE_HTTP3"
  - libssh2: set length to 0 if strdup failed
  - openssl: do not set SSL_MODE_RELEASE_BUFFERS
  - openssl: revert keylog_callback support for LibreSSL
  - OS400: fix shellcheck warnings in scripts
  - quiche: expire all active transfers on connection close
  - quiche: trust its timeout handling
  - tls: use shared init code for TCP+QUIC
  - tool_cfgable: free {proxy_}cipher13_list on exit
  - url: do not URL decode proxy crendentials
  - url: fix use of an uninitialized variable
  - url: make parse_login_details use memdup0
  - urlapi: allow setting port number zero
  - version: use msnprintf instead of strncpy
  - vtls: TLS session storage overhaul
  - wakeup_create: use FD_CLOEXEC/SOCK_CLOEXEC
  - websocket: avoid memory leak in error path
  - Add split-provides for libcurl-devel -> libcurl-devel-doc.

++++ curl:

  - Update to 8.8.0:
    * Changes:
  - curl_version_info: provide librtmp version
  - file: add support for directory listings
  - lib: add curl_multi_waitfds
  - NTLM_WB: drop support
  - TLS: add support for ECH (Encrypted Client Hello)
  - urlapi: add CURLU_GET_EMPTY for empty queries and fragments
    * Bugfixes:
  - build: prefer "USE_IPV6" macro internally (was: "ENABLE_IPV6")
  - cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set
  - cf-socket: don't try getting local IP without socket
  - cf-socket: remove references to l_ip, l_port
  - configure: make --disable-docs imply --disable-manual
  - curl.h: change CURL_SSLVERSION_* from enum to defines
  - curl_path: make Curl_get_pathname use dynbuf
  - curl_sha512_256: do not use workaround for NetBSD when not needed
  - curl_sha512_256: fix detection of OpenSSL 1.1.1 or later
  - curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY
  - DEPRECATE.md: TLS libraries without 1.3 support
  - digest: replace strcpy for empty string with simple assignment
  - doc: pytest "--repeat" -> "--count"
  - docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd
  - dynbuf: fix returncode on memory error
  - ftp: add tracing support
  - ftp: fix socket leak on rare error
  - gnutls: lazy init the trust settings
  - hsts: explicitly skip blank lines
  - http2 + ngtcp2: pass CURLcode errors from callbacks
  - http2, http3: decouple stream state from easy handle
  - http2: emit RST when client write fails
  - http: HEAD response body tolerance
  - http: reject HTTP major version switch mid connection
  - http: with chunked POST forced, disable length check on read callback
  - idn: make Curl_idnconvert_hostname() use Curl_idn_decode()
  - if2ip: make the buf_size arg a size_t
  - krb5: use dynbuf
  - lib/cf-h1-proxy: silence compiler warnings (gcc 14)
  - lib: add trace support for client reads and writes
  - lib: bump hash sizes to "size_t"
  - lib: clear the easy handle's saved errno before transfer
  - lib: make protocol handlers store scheme name lowercase
  - lib: merge "ENABLE_QUIC" C macro into "USE_HTTP3"
  - libssh2: set length to 0 if strdup failed
  - openssl: do not set SSL_MODE_RELEASE_BUFFERS
  - openssl: revert keylog_callback support for LibreSSL
  - OS400: fix shellcheck warnings in scripts
  - quiche: expire all active transfers on connection close
  - quiche: trust its timeout handling
  - tls: use shared init code for TCP+QUIC
  - tool_cfgable: free {proxy_}cipher13_list on exit
  - url: do not URL decode proxy crendentials
  - url: fix use of an uninitialized variable
  - url: make parse_login_details use memdup0
  - urlapi: allow setting port number zero
  - version: use msnprintf instead of strncpy
  - vtls: TLS session storage overhaul
  - wakeup_create: use FD_CLOEXEC/SOCK_CLOEXEC
  - websocket: avoid memory leak in error path
  - Add split-provides for libcurl-devel -> libcurl-devel-doc.

++++ curl:

  - Update to 8.8.0:
    * Changes:
  - curl_version_info: provide librtmp version
  - file: add support for directory listings
  - lib: add curl_multi_waitfds
  - NTLM_WB: drop support
  - TLS: add support for ECH (Encrypted Client Hello)
  - urlapi: add CURLU_GET_EMPTY for empty queries and fragments
    * Bugfixes:
  - build: prefer "USE_IPV6" macro internally (was: "ENABLE_IPV6")
  - cd2nroff/manage: use UTC when SOURCE_DATE_EPOCH is set
  - cf-socket: don't try getting local IP without socket
  - cf-socket: remove references to l_ip, l_port
  - configure: make --disable-docs imply --disable-manual
  - curl.h: change CURL_SSLVERSION_* from enum to defines
  - curl_path: make Curl_get_pathname use dynbuf
  - curl_sha512_256: do not use workaround for NetBSD when not needed
  - curl_sha512_256: fix detection of OpenSSL 1.1.1 or later
  - curl_url_get.md: clarify queries and fragments and CURLU_GET_EMPTY
  - DEPRECATE.md: TLS libraries without 1.3 support
  - digest: replace strcpy for empty string with simple assignment
  - doc: pytest "--repeat" -> "--count"
  - docs/cmdline-opts: mention STARTTLS for --ssl and --ssl-reqd
  - dynbuf: fix returncode on memory error
  - ftp: add tracing support
  - ftp: fix socket leak on rare error
  - gnutls: lazy init the trust settings
  - hsts: explicitly skip blank lines
  - http2 + ngtcp2: pass CURLcode errors from callbacks
  - http2, http3: decouple stream state from easy handle
  - http2: emit RST when client write fails
  - http: HEAD response body tolerance
  - http: reject HTTP major version switch mid connection
  - http: with chunked POST forced, disable length check on read callback
  - idn: make Curl_idnconvert_hostname() use Curl_idn_decode()
  - if2ip: make the buf_size arg a size_t
  - krb5: use dynbuf
  - lib/cf-h1-proxy: silence compiler warnings (gcc 14)
  - lib: add trace support for client reads and writes
  - lib: bump hash sizes to "size_t"
  - lib: clear the easy handle's saved errno before transfer
  - lib: make protocol handlers store scheme name lowercase
  - lib: merge "ENABLE_QUIC" C macro into "USE_HTTP3"
  - libssh2: set length to 0 if strdup failed
  - openssl: do not set SSL_MODE_RELEASE_BUFFERS
  - openssl: revert keylog_callback support for LibreSSL
  - OS400: fix shellcheck warnings in scripts
  - quiche: expire all active transfers on connection close
  - quiche: trust its timeout handling
  - tls: use shared init code for TCP+QUIC
  - tool_cfgable: free {proxy_}cipher13_list on exit
  - url: do not URL decode proxy crendentials
  - url: fix use of an uninitialized variable
  - url: make parse_login_details use memdup0
  - urlapi: allow setting port number zero
  - version: use msnprintf instead of strncpy
  - vtls: TLS session storage overhaul
  - wakeup_create: use FD_CLOEXEC/SOCK_CLOEXEC
  - websocket: avoid memory leak in error path
  - Add split-provides for libcurl-devel -> libcurl-devel-doc.

++++ kernel-default:

  - af_unix: Suppress false-positive lockdep splat for spin_lock()
    in __unix_gc() (CVE-2024-26923 bsc#1223384).
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
    (CVE-2024-26923 bsc#1223384).
  - commit a652e3a
  - Update
    patches.suse/ACPI-CPPC-Use-access_width-over-bit_width-for-system.patch
    (stable-fixes CVE-2024-35995 bsc#1224557).
  - Update
    patches.suse/ALSA-usb-audio-Stop-parsing-channels-bits-when-all-c.patch
    (git-fixes CVE-2024-27436 bsc#1224803).
  - Update
    patches.suse/ASoC-SOF-ipc4-pcm-Workaround-for-crashed-firmware-on.patch
    (stable-fixes CVE-2024-27057 bsc#1223831).
  - Update
    patches.suse/ASoC-mediatek-sof-common-Add-NULL-check-for-normal_l.patch
    (git-fixes CVE-2024-35842 bsc#1224688).
  - Update
    patches.suse/Bluetooth-Fix-memory-leak-in-hci_req_sync_complete.patch
    (git-fixes CVE-2024-35978 bsc#1224571).
  - Update
    patches.suse/Bluetooth-Fix-use-after-free-bugs-caused-by-sco_sock.patch
    (git-fixes CVE-2024-27398 bsc#1224174).
  - Update
    patches.suse/Bluetooth-L2CAP-Fix-not-validating-setsockopt-user-i.patch
    (git-fixes CVE-2024-35965 bsc#1224579).
  - Update
    patches.suse/Bluetooth-RFCOMM-Fix-not-validating-setsockopt-user-.patch
    (git-fixes CVE-2024-35966 bsc#1224576).
  - Update
    patches.suse/Bluetooth-SCO-Fix-not-validating-setsockopt-user-inp.patch
    (git-fixes CVE-2024-35967 bsc#1224587).
  - Update
    patches.suse/Bluetooth-btintel-Fix-null-ptr-deref-in-btintel_read.patch
    (stable-fixes CVE-2024-35933 bsc#1224640).
  - Update
    patches.suse/Bluetooth-hci_event-Fix-handling-of-HCI_EV_IO_CAPA_R.patch
    (git-fixes CVE-2024-27416 bsc#1224723).
  - Update
    patches.suse/Bluetooth-hci_sock-Fix-not-validating-setsockopt-use.patch
    (git-fixes CVE-2024-35963 bsc#1224582).
  - Update
    patches.suse/Bluetooth-l2cap-fix-null-ptr-deref-in-l2cap_chan_tim.patch
    (git-fixes CVE-2024-27399 bsc#1224177).
  - Update
    patches.suse/Bluetooth-qca-fix-NULL-deref-on-non-serdev-setup.patch
    (git-fixes CVE-2024-35850 bsc#1224600).
  - Update
    patches.suse/Bluetooth-qca-fix-NULL-deref-on-non-serdev-suspend.patch
    (git-fixes CVE-2024-35851 bsc#1224509).
  - Update
    patches.suse/Bluetooth-rfcomm-Fix-null-ptr-deref-in-rfcomm_check_.patch
    (bsc#1219170 CVE-2024-22099 CVE-2024-26903 bsc#1223187).
  - Update
    patches.suse/HID-i2c-hid-remove-I2C_HID_READ_PENDING-flag-to-prev.patch
    (git-fixes CVE-2024-35997 bsc#1224552).
  - Update
    patches.suse/NFS-Fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch
    (git-fixes CVE-2024-27031 bsc#1223805).
  - Update
    patches.suse/NFSv4.2-fix-nfs4_listxattr-kernel-BUG-at-mm-usercopy.patch
    (git-fixes CVE-2024-26870 bsc#1223113).
  - Update
    patches.suse/PCI-PM-Drain-runtime-idle-callbacks-before-driver-re.patch
    (stable-fixes CVE-2024-35809 bsc#1224738).
  - Update
    patches.suse/SUNRPC-fix-some-memleaks-in-gssx_dec_option_array.patch
    (git-fixes CVE-2024-27388 bsc#1223744).
  - Update
    patches.suse/USB-core-Fix-deadlock-in-usb_deauthorize_interface.patch
    (git-fixes CVE-2024-26934 bsc#1223671).
  - Update patches.suse/accel-ivpu-Fix-deadlock-in-context_xa.patch
    (git-fixes CVE-2024-35953 bsc#1224704).
  - Update
    patches.suse/arm64-hibernate-Fix-level3-translation-fault-in-swsu.patch
    (git-fixes CVE-2024-26989 bsc#1223748).
  - Update patches.suse/ax25-Fix-netdev-refcount-issue.patch
    (git-fixes CVE-2024-36009 bsc#1224542).
  - Update
    patches.suse/ax25-fix-use-after-free-bugs-caused-by-ax25_ds_del_t.patch
    (git-fixes CVE-2024-35887 bsc#1224663).
  - Update
    patches.suse/batman-adv-Avoid-infinite-loop-trying-to-resize-loca.patch
    (git-fixes CVE-2024-35982 bsc#1224566).
  - Update
    patches.suse/block-fix-q-blkg_list-corruption-during-disk-rebind.patch
    (bsc#1223591 CVE-2024-35974 bsc#1224573).
  - Update
    patches.suse/bnxt_en-Fix-possible-memory-leak-in-bnxt_rdma_aux_de.patch
    (git-fixes CVE-2024-35972 bsc#1224577).
  - Update
    patches.suse/bootconfig-use-memblock_free_late-to-free-xbc-memory.patch
    (git-fixes CVE-2024-26983 bsc#1223637).
  - Update
    patches.suse/btrfs-fix-deadlock-with-fiemap-and-extent-locking.patch
    (bsc#1223285 CVE-2024-35784 bsc#1224804).
  - Update
    patches.suse/btrfs-fix-information-leak-in-btrfs_ioctl_logical_to.patch
    (git-fixes CVE-2024-35849 bsc#1224733).
  - Update
    patches.suse/btrfs-fix-race-between-ordered-extent-completion-and.patch
    (bsc#1223285 CVE-2024-26794 bsc#1222426).
  - Update
    patches.suse/btrfs-fix-race-when-detecting-delalloc-ranges-during.patch
    (bsc#1223285 CVE-2024-27080 bsc#1223782).
  - Update
    patches.suse/btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch
    (git-fixes CVE-2024-35936 bsc#1224644).
  - Update
    patches.suse/clk-Get-runtime-PM-before-walking-tree-during-disabl.patch
    (git-fixes CVE-2024-27004 bsc#1223762).
  - Update
    patches.suse/clk-Get-runtime-PM-before-walking-tree-for-clk_summa.patch
    (git-fixes CVE-2024-27003 bsc#1223761).
  - Update
    patches.suse/clk-mediatek-Do-a-runtime-PM-get-on-controllers-duri.patch
    (git-fixes CVE-2024-27002 bsc#1223759).
  - Update
    patches.suse/comedi-vmk80xx-fix-incomplete-endpoint-checking.patch
    (git-fixes CVE-2024-27001 bsc#1223698).
  - Update
    patches.suse/dm-raid-really-frozen-sync_thread-during-suspend-16c4.patch
    (jsc#PED-7542 CVE-2024-35794 bsc#1224706).
  - Update
    patches.suse/dm-raid456-md-raid456-fix-a-deadlock-for-dm-raid456-4142.patch
    (bsc#1219596 CVE-2024-26962 bsc#1223654).
  - Update
    patches.suse/dma-buf-Fix-NULL-pointer-dereference-in-sanitycheck.patch
    (git-fixes CVE-2024-35916 bsc#1224480).
  - Update patches.suse/dma-xilinx_dpdma-Fix-locking.patch
    (git-fixes CVE-2024-35990 bsc#1224559).
  - Update
    patches.suse/dmaengine-fsl-qdma-Fix-a-memory-leak-related-to-the--3aa58cb.patch
    (git-fixes CVE-2024-35833 bsc#1224632).
  - Update
    patches.suse/dmaengine-idxd-Fix-oops-during-rmmod-on-single-CPU-p.patch
    (git-fixes CVE-2024-35989 bsc#1224558).
  - Update
    patches.suse/dpll-fix-dpll_pin_on_pin_register-for-multiple-paren.patch
    (CVE-2024-27027 bsc#1223787 CVE-2024-36002 bsc#1224546).
  - Update
    patches.suse/dpll-fix-pin-dump-crash-for-rebound-module.patch
    (jsc#PED-6079 CVE-2024-35836 bsc#1224633).
  - Update
    patches.suse/drm-Check-output-polling-initialized-before-disablin.patch
    (stable-fixes CVE-2024-35927 bsc#1224654).
  - Update
    patches.suse/drm-amd-amdgpu-Fix-potential-ioremap-memory-leaks-in.patch
    (stable-fixes CVE-2024-35928 bsc#1224653).
  - Update
    patches.suse/drm-amd-display-Fix-bounds-check-for-dcn35-DcfClocks.patch
    (git-fixes CVE-2024-35788 bsc#1224709).
  - Update
    patches.suse/drm-amd-display-Prevent-crash-when-disable-stream.patch
    (stable-fixes CVE-2024-35799 bsc#1224740).
  - Update
    patches.suse/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch
    (stable-fixes CVE-2024-35817 bsc#1224736).
  - Update
    patches.suse/drm-amdgpu-fix-deadlock-while-reading-mqd-from-debug.patch
    (git-fixes CVE-2024-35795 bsc#1224634).
  - Update
    patches.suse/drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch
    (git-fixes CVE-2024-27029 bsc#1223789).
  - Update
    patches.suse/drm-amdgpu-once-more-fix-the-call-oder-in-amdgpu_ttm.patch
    (git-fixes CVE-2024-27400 bsc#1224180).
  - Update
    patches.suse/drm-amdgpu-pm-Fix-NULL-pointer-dereference-when-get-.patch
    (git-fixes CVE-2024-26949 bsc#1223665).
  - Update
    patches.suse/drm-amdgpu-validate-the-parameters-of-bo-mapping-ope.patch
    (git-fixes CVE-2024-26922 bsc#1223315).
  - Update
    patches.suse/drm-amdkfd-Fix-memory-leak-in-create_process-failure.patch
    (git-fixes CVE-2024-26986 bsc#1223728).
  - Update patches.suse/drm-ast-Fix-soft-lockup.patch (git-fixes
    CVE-2024-35952 bsc#1224705).
  - Update
    patches.suse/drm-client-Fully-protect-modes-with-dev-mode_config..patch
    (stable-fixes CVE-2024-35950 bsc#1224703).
  - Update
    patches.suse/drm-i915-bios-Tolerate-devdata-NULL-in-intel_bios_en.patch
    (stable-fixes CVE-2024-26938 bsc#1223678).
  - Update
    patches.suse/drm-i915-gt-Reset-queue_priority_hint-on-parking.patch
    (git-fixes CVE-2024-26937 bsc#1223677).
  - Update
    patches.suse/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
    (git-fixes CVE-2024-35829 bsc#1224707).
  - Update
    patches.suse/drm-nouveau-fix-stale-locked-mutex-in-nouveau_gem_io.patch
    (git-fixes CVE-2024-35786 bsc#1224714).
  - Update
    patches.suse/drm-nouveau-keep-DMA-buffers-required-for-suspend-re.patch
    (git-fixes CVE-2024-27411 bsc#1224433).
  - Update patches.suse/drm-nv04-Fix-out-of-bounds-access.patch
    (git-fixes CVE-2024-27008 bsc#1223802).
  - Update
    patches.suse/drm-panfrost-Fix-the-error-path-in-panfrost_mmu_map_.patch
    (git-fixes CVE-2024-35951 bsc#1224701).
  - Update
    patches.suse/drm-vc4-don-t-check-if-plane-state-fb-state-fb.patch
    (stable-fixes CVE-2024-35932 bsc#1224650).
  - Update
    patches.suse/drm-vmwgfx-Create-debugfs-ttm_resource_manager-entry.patch
    (git-fixes CVE-2024-26940 bsc#1223718).
  - Update
    patches.suse/drm-vmwgfx-Fix-the-lifetime-of-the-bo-cursor-memory.patch
    (git-fixes CVE-2024-35810 bsc#1224626).
  - Update
    patches.suse/dyndbg-fix-old-BUG_ON-in-control-parser.patch
    (stable-fixes CVE-2024-35947 bsc#1224647).
  - Update
    patches.suse/efi-capsule-loader-fix-incorrect-allocation-size.patch
    (git-fixes CVE-2024-27413 bsc#1224438).
  - Update patches.suse/efi-fix-panic-in-kdump-kernel.patch
    (git-fixes CVE-2024-35800 bsc#1224507).
  - Update
    patches.suse/fat-fix-uninitialized-field-in-nostale-filehandles.patch
    (git-fixes CVE-2024-26973 bsc#1223641).
  - Update
    patches.suse/fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch
    (stable-fixes CVE-2024-35922 bsc#1224660).
  - Update
    patches.suse/fs-aio-Check-IOCB_AIO_RW-before-the-struct-aio_kiocb.patch
    (bsc#1222721 CVE-2024-26764 CVE-2024-35815 bsc#1224685).
  - Update
    patches.suse/geneve-fix-header-validation-in-geneve-6-_xmit_skb.patch
    (git-fixes CVE-2024-35973 bsc#1224586).
  - Update
    patches.suse/geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch
    (git-fixes CVE-2024-26857 bsc#1223058).
  - Update
    patches.suse/i2c-smbus-fix-NULL-function-pointer-dereference.patch
    (git-fixes CVE-2024-35984 bsc#1224567).
  - Update
    patches.suse/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch
    (git-fixes CVE-2024-35911 bsc#1224486).
  - Update
    patches.suse/ice-fix-uninitialized-dplls-mutex-usage.patch
    (git-fixes CVE-2024-26854 bsc#1223039).
  - Update
    patches.suse/idpf-fix-kernel-panic-on-unknown-packet-types.patch
    (git-fixes CVE-2024-35889 bsc#1224517).
  - Update
    patches.suse/igc-avoid-returning-frame-twice-in-XDP_REDIRECT.patch
    (git-fixes CVE-2024-26853 bsc#1223061).
  - Update
    patches.suse/init-main.c-Fix-potential-static_command_line-memory.patch
    (git-fixes CVE-2024-26988 bsc#1223747).
  - Update
    patches.suse/iommufd-Fix-iopt_access_list_id-overwrite-bug.patch
    (git-fixes CVE-2024-26786 bsc#1222780).
  - Update
    patches.suse/irqchip-gic-v3-its-Prevent-double-free-on-error.patch
    (git-fixes CVE-2024-35847 bsc#1224697).
  - Update
    patches.suse/kprobes-Fix-possible-use-after-free-issue-on-kprobe-registration.patch
    (git-fixes CVE-2024-35955 bsc#1224676).
  - Update
    patches.suse/mac802154-fix-llsec-key-resources-release-in-mac8021.patch
    (git-fixes CVE-2024-26961 bsc#1223652).
  - Update
    patches.suse/md-dm-raid-don-t-call-md_reap_sync_thread-directly-cd32.patch
    (jsc#PED-7542 CVE-2024-35808 bsc#1224623).
  - Update patches.suse/md-fix-kmemleak-of-rdev-serial-6cf3.patch
    (jsc#PED-7542 CVE-2024-26900 bsc#1223046).
  - Update
    patches.suse/media-tc358743-register-v4l2-async-device-only-after.patch
    (git-fixes CVE-2024-35830 bsc#1224680).
  - Update
    patches.suse/misc-lis3lv02d_i2c-Fix-regulators-getting-en-dis-abl.patch
    (git-fixes CVE-2024-35824 bsc#1224609).
  - Update
    patches.suse/mlxbf_gige-call-request_irq-after-NAPI-initialized.patch
    (git-fixes CVE-2024-35907 bsc#1224492).
  - Update
    patches.suse/mlxbf_gige-stop-interface-during-shutdown.patch
    (git-fixes CVE-2024-35885 bsc#1224519).
  - Update
    patches.suse/mmc-core-Avoid-negative-index-with-array-access.patch
    (git-fixes CVE-2024-35813 bsc#1224618).
  - Update
    patches.suse/msft-hv-2971-net-mana-Fix-Rx-DMA-datasize-and-skb_over_panic.patch
    (git-fixes CVE-2024-35901 bsc#1224495).
  - Update
    patches.suse/net-ena-Fix-incorrect-descriptor-free-behavior.patch
    (git-fixes CVE-2024-35958 bsc#1224677).
  - Update
    patches.suse/net-ethernet-mtk_eth_soc-fix-PPE-hanging-issue.patch
    (git-fixes CVE-2024-27432 bsc#1224716).
  - Update
    patches.suse/net-hns3-fix-kernel-crash-when-1588-is-received-on-H.patch
    (git-fixes CVE-2024-26881 bsc#1223041).
  - Update
    patches.suse/net-ice-Fix-potential-NULL-pointer-dereference-in-ic.patch
    (git-fixes CVE-2024-26855 bsc#1223051).
  - Update
    patches.suse/net-ks8851-Handle-softirqs-at-the-end-of-IRQ-thread-.patch
    (git-fixes CVE-2024-35971 bsc#1224578).
  - Update
    patches.suse/net-ll_temac-platform_get_resource-replaced-by-wrong.patch
    (git-fixes CVE-2024-35796 bsc#1224615).
  - Update
    patches.suse/net-mlx5-Properly-link-new-fs-rules-into-the-tree.patch
    (git-fixes CVE-2024-35960 bsc#1224588).
  - Update
    patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch
    (git-fixes CVE-2024-35961 bsc#1224585).
  - Update
    patches.suse/net-mlx5e-Fix-mlx5e_priv_init-cleanup-flow.patch
    (git-fixes CVE-2024-35959 bsc#1224666).
  - Update
    patches.suse/net-mlx5e-Use-a-memory-barrier-to-enforce-PTP-WQ-xmi.patch
    (git-fixes CVE-2024-26858 bsc#1223020).
  - Update
    patches.suse/net-mlx5e-fix-a-double-free-in-arfs_create_groups.patch
    (jsc#PED-3311 CVE-2024-35835 bsc#1224605).
  - Update
    patches.suse/net-mvpp2-clear-BM-pool-before-initialization.patch
    (git-fixes CVE-2024-35837 bsc#1224500).
  - Update
    patches.suse/net-phy-micrel-Fix-potential-null-pointer-dereferenc.patch
    (git-fixes CVE-2024-35891 bsc#1224513).
  - Update
    patches.suse/net-phy-phy_device-Prevent-nullptr-exceptions-on-ISR.patch
    (stable-fixes CVE-2024-35945 bsc#1224639).
  - Update
    patches.suse/net-sparx5-Fix-use-after-free-inside-sparx5_del_mact.patch
    (git-fixes CVE-2024-26856 bsc#1223052).
  - Update patches.suse/net-tls-fix-WARNIING-in-__sk_msg_free.patch
    (bsc#1221858 CVE-2024-35841 bsc#1224687).
  - Update
    patches.suse/net-wwan-t7xx-Split-64bit-accesses-to-fix-alignment-.patch
    (git-fixes CVE-2024-35909 bsc#1224491).
  - Update
    patches.suse/nfc-nci-Fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch
    (git-fixes CVE-2024-35915 bsc#1224479).
  - Update
    patches.suse/nfp-flower-handle-acti_netdevs-allocation-failure.patch
    (git-fixes CVE-2024-27046 bsc#1223827).
  - Update
    patches.suse/nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch
    (git-fixes CVE-2024-26868 bsc#1223038).
  - Update
    patches.suse/nfsd-Fix-error-cleanup-path-in-nfsd_rename.patch
    (bsc#1221044 CVE-2023-52591 CVE-2024-35914 bsc#1224482).
  - Update
    patches.suse/nouveau-fix-instmem-race-condition-around-ptr-stores.patch
    (git-fixes CVE-2024-26984 bsc#1223633).
  - Update patches.suse/nouveau-lock-the-client-object-tree.patch
    (stable-fixes CVE-2024-27062 bsc#1223834).
  - Update
    patches.suse/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch
    (git-fixes CVE-2024-26846 bsc#1223023).
  - Update
    patches.suse/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch
    (git-fixes CVE-2024-27435 bsc#1224717).
  - Update
    patches.suse/octeontx2-af-Use-separate-handlers-for-interrupts.patch
    (git-fixes CVE-2024-27030 bsc#1223790).
  - Update
    patches.suse/octeontx2-pf-Fix-transmit-scheduler-resource-leak.patch
    (git-fixes CVE-2024-35975 bsc#1224569).
  - Update
    patches.suse/of-dynamic-Synchronize-of_changeset_destroy-with-the.patch
    (git-fixes CVE-2024-35879 bsc#1224524).
  - Update
    patches.suse/of-module-prevent-NULL-pointer-dereference-in-vsnpri.patch
    (stable-fixes CVE-2024-35878 bsc#1224671).
  - Update
    patches.suse/phy-marvell-a3700-comphy-Fix-out-of-bounds-read.patch
    (git-fixes CVE-2024-35992 bsc#1224555).
  - Update
    patches.suse/phy-ti-tusb1210-Resolve-charger-det-crash-if-charger.patch
    (git-fixes CVE-2024-35986 bsc#1224562).
  - Update
    patches.suse/platform-chrome-cros_ec_uart-properly-fix-race-condi.patch
    (git-fixes CVE-2024-35977 bsc#1224568).
  - Update
    patches.suse/power-supply-bq27xxx-i2c-Do-not-free-non-existing-IR.patch
    (git-fixes CVE-2024-27412 bsc#1224437).
  - Update
    patches.suse/pstore-inode-Only-d_invalidate-is-needed.patch
    (git-fixes CVE-2024-27389 bsc#1223705).
  - Update
    patches.suse/pstore-zone-Add-a-null-pointer-check-to-the-psz_kmsg.patch
    (stable-fixes CVE-2024-35940 bsc#1224537).
  - Update
    patches.suse/s390-zcrypt-fix-reference-counting-on-zcrypt-card-objects.patch
    (git-fixes bsc#1223592 CVE-2024-26957 bsc#1223666).
  - Update
    patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch
    (git-fixes CVE-2024-26935 bsc#1223675).
  - Update
    patches.suse/scsi-lpfc-Fix-possible-memory-leak-in-lpfc_rcv_padis.patch
    (bsc#1220021 CVE-2024-35930 bsc#1224651).
  - Update patches.suse/scsi-sg-Avoid-sg-device-teardown-race.patch
    (git-fixes CVE-2024-35954 bsc#1224675).
  - Update
    patches.suse/scsi-smartpqi-Fix-disable_managed_interrupts.patch
    (git-fixes CVE-2024-26742 bsc#1222608).
  - Update
    patches.suse/selinux-avoid-dereference-of-garbage-after-mount-fai.patch
    (git-fixes CVE-2024-35904 bsc#1224494).
  - Update
    patches.suse/serial-mxs-auart-add-spinlock-around-changing-cts-st.patch
    (git-fixes CVE-2024-27000 bsc#1223757).
  - Update
    patches.suse/serial-pmac_zilog-Remove-flawed-mitigation-for-rx-ir.patch
    (git-fixes CVE-2024-26999 bsc#1223754).
  - Update
    patches.suse/soc-fsl-qbman-Always-disable-interrupts-when-taking-.patch
    (git-fixes CVE-2024-35806 bsc#1224699).
  - Update
    patches.suse/soc-fsl-qbman-Use-raw-spinlock-for-cgr_lock.patch
    (git-fixes CVE-2024-35819 bsc#1224683).
  - Update patches.suse/speakup-Avoid-crash-on-very-long-word.patch
    (git-fixes CVE-2024-26994 bsc#1223750).
  - Update
    patches.suse/spi-lpspi-Avoid-potential-use-after-free-in-probe.patch
    (git-fixes CVE-2024-26866 bsc#1223024).
  - Update
    patches.suse/spi-mchp-pci1xxx-Fix-a-possible-null-pointer-derefer.patch
    (git-fixes CVE-2024-35883 bsc#1224521).
  - Update
    patches.suse/spi-spi-mt65xx-Fix-NULL-pointer-access-in-interrupt-.patch
    (git-fixes CVE-2024-27028 bsc#1223788).
  - Update
    patches.suse/ubifs-Set-page-uptodate-in-the-correct-place.patch
    (git-fixes CVE-2024-35821 bsc#1224629).
  - Update
    patches.suse/usb-cdc-wdm-close-race-between-read-and-workqueue.patch
    (git-fixes CVE-2024-35812 bsc#1224624).
  - Update
    patches.suse/usb-dwc2-host-Fix-dereference-issue-in-DDMA-completi.patch
    (git-fixes CVE-2024-26997 bsc#1223741).
  - Update
    patches.suse/usb-dwc3-am62-fix-module-unload-reload-behavior.patch
    (git-fixes CVE-2024-26963 bsc#1223651).
  - Update
    patches.suse/usb-gadget-f_ncm-Fix-UAF-ncm-object-at-re-bind-after.patch
    (stable-fixes CVE-2024-26996 bsc#1223752).
  - Update
    patches.suse/usb-gadget-ncm-Avoid-dropping-datagrams-of-properly-.patch
    (git-fixes CVE-2024-27405 bsc#1224423).
  - Update
    patches.suse/usb-gadget-ncm-Fix-handling-of-zero-block-length-pac.patch
    (git-fixes CVE-2024-35825 bsc#1224681).
  - Update
    patches.suse/usb-typec-altmodes-displayport-create-sysfs-nodes-as.patch
    (git-fixes CVE-2024-35790 bsc#1224712).
  - Update
    patches.suse/usb-typec-tcpm-Correct-the-PDO-counting-in-pd_set.patch
    (git-fixes CVE-2024-26995 bsc#1223696).
  - Update
    patches.suse/usb-typec-tcpm-fix-double-free-issue-in-tcpm_port_un.patch
    (git-fixes CVE-2024-26932 bsc#1223649).
  - Update patches.suse/usb-typec-ucsi-Limit-read-size-on-v1.2.patch
    (stable-fixes CVE-2024-35924 bsc#1224657).
  - Update
    patches.suse/usb-udc-remove-warning-when-queue-disabled-ep.patch
    (stable-fixes CVE-2024-35822 bsc#1224739).
  - Update
    patches.suse/usb-xhci-Add-error-handling-in-xhci_map_urb_for_dma.patch
    (git-fixes CVE-2024-26964 bsc#1223650).
  - Update
    patches.suse/vt-fix-unicode-buffer-corruption-when-deleting-chara.patch
    (git-fixes CVE-2024-35823 bsc#1224692).
  - Update
    patches.suse/wifi-ath11k-decrease-MHI-channel-buffer-length-to-8K.patch
    (bsc#1207948 CVE-2024-35938 bsc#1224643).
  - Update
    patches.suse/wifi-brcmfmac-Fix-use-after-free-bug-in-brcmf_cfg802.patch
    (CVE-2023-47233 bsc#1216702 CVE-2024-35811 bsc#1224592).
  - Update
    patches.suse/wifi-cfg80211-check-A-MSDU-format-more-carefully.patch
    (stable-fixes CVE-2024-35937 bsc#1224526).
  - Update
    patches.suse/wifi-iwlwifi-dbg-tlv-ensure-NUL-termination.patch
    (git-fixes CVE-2024-35845 bsc#1224731).
  - Update
    patches.suse/wifi-iwlwifi-mvm-don-t-set-the-MFP-flag-for-the-GTK.patch
    (git-fixes CVE-2024-27434 bsc#1224710).
  - Update
    patches.suse/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch
    (git-fixes CVE-2024-35912 bsc#1224487).
  - Update
    patches.suse/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
    (git-fixes CVE-2024-35828 bsc#1224622).
  - Update
    patches.suse/wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch
    (stable-fixes CVE-2024-35789 bsc#1224749).
  - Update
    patches.suse/wifi-mac80211-fix-potential-sta-link-leak.patch
    (git-fixes CVE-2024-35838 bsc#1224613).
  - Update
    patches.suse/wifi-nl80211-reject-iftype-change-with-mesh-ID-chang.patch
    (git-fixes CVE-2024-27410 bsc#1224432).
  - Update
    patches.suse/wifi-rtw89-fix-null-pointer-access-when-abort-scan.patch
    (stable-fixes CVE-2024-35946 bsc#1224646).
  - Update
    patches.suse/wireguard-netlink-access-device-through-ctx-instead-.patch
    (git-fixes CVE-2024-26950 bsc#1223661).
  - Update
    patches.suse/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch
    (git-fixes CVE-2024-26951 bsc#1223660).
  - Update
    patches.suse/wireguard-receive-annotate-data-race-around-receivin.patch
    (git-fixes CVE-2024-26861 bsc#1223076).
  - Update
    patches.suse/x86-coco-Require-seeding-RNG-with-RDRAND-on-CoCo-systems.patch
    (git-fixes CVE-2024-35875 bsc#1224665).
  - Update
    patches.suse/x86-fpu-Keep-xfd_state-in-sync-with-MSR_IA32_XFD.patch
    (git-fixes CVE-2024-35801 bsc#1224732).
  - Update
    patches.suse/xen-evtchn-avoid-WARN-when-unbinding-an-event-channe.patch
    (git-fixes CVE-2024-27067 bsc#1223739).
  - Update
    patches.suse/xsk-recycle-buffer-in-case-Rx-queue-was-full.patch
    (bsc#1221303 CVE-2024-26611 CVE-2024-35834 bsc#1224620).
  - commit 005afc6
  - Update
    patches.suse/ACPI-LPIT-Avoid-u32-multiplication-overflow.patch
    (git-fixes CVE-2023-52683 bsc#1224627).
  - Update
    patches.suse/ACPI-video-check-for-error-while-searching-for-backl.patch
    (git-fixes CVE-2023-52693 bsc#1224686).
  - Update
    patches.suse/ASoC-Intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch
    (git-fixes CVE-2023-52697 bsc#1224596).
  - Update
    patches.suse/ASoC-SOF-amd-Fix-memory-leak-in-amd_sof_acp_probe.patch
    (git-fixes CVE-2023-52663 bsc#1224630).
  - Update
    patches.suse/Revert-drm-amd-pm-resolve-reboot-exception-for-si-ol.patch
    (git-fixes CVE-2023-52657 bsc#1224722).
  - Update
    patches.suse/Revert-net-mlx5-Block-entering-switchdev-mode-with-n.patch
    (git-fixes CVE-2023-52658 bsc#1224719).
  - Update
    patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch
    (git-fixes CVE-2023-52653 bsc#1223712).
  - Update
    patches.suse/bpf-Guard-stack-limits-against-32bit-overflow.patch
    (git-fixes CVE-2023-52676 bsc#1224730).
  - Update
    patches.suse/crypto-rsa-add-a-check-for-allocation-failure.patch
    (bsc#1222775 CVE-2023-52472 bsc#1220430).
  - Update
    patches.suse/crypto-s390-aes-Fix-buffer-overread-in-CTR-mode.patch
    (git-fixes CVE-2023-52669 bsc#1224637).
  - Update
    patches.suse/crypto-safexcel-Add-error-handling-for-dma_map_sg-ca.patch
    (git-fixes CVE-2023-52687 bsc#1224501).
  - Update
    patches.suse/drm-amd-display-Check-writeback-connectors-in-create.patch
    (git-fixes CVE-2023-52695 bsc#1224506).
  - Update
    patches.suse/drm-amd-display-Fix-a-debugfs-null-pointer-error.patch
    (git-fixes CVE-2023-52673 bsc#1224741).
  - Update
    patches.suse/drm-amd-display-Fix-hang-underflow-when-transitionin.patch
    (git-fixes CVE-2023-52671 bsc#1224729).
  - Update
    patches.suse/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
    (git-fixes CVE-2023-52691 bsc#1224607).
  - Update
    patches.suse/drm-amdkfd-Confirm-list-is-non-empty-before-utilizin.patch
    (git-fixes CVE-2023-52678 bsc#1224617).
  - Update
    patches.suse/drm-bridge-tpd12s015-Drop-buggy-__exit-annotation-fo.patch
    (git-fixes CVE-2023-52694 bsc#1224598).
  - Update
    patches.suse/drm-tegra-rgb-Fix-missing-clk_put-in-the-error-handl.patch
    (git-fixes CVE-2023-52661 bsc#1224445).
  - Update
    patches.suse/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
    (git-fixes CVE-2023-52662 bsc#1224449).
  - Update patches.suse/efivarfs-Free-s_fs_info-on-unmount.patch
    (bsc#1220328 CVE-2023-52463 CVE-2023-52681 bsc#1224505).
  - Update
    patches.suse/media-rkisp1-Fix-IRQ-handling-due-to-shared-interrup.patch
    (stable-fixes CVE-2023-52660 bsc#1224443).
  - Update
    patches.suse/net-atlantic-eliminate-double-free-in-error-handling.patch
    (git-fixes CVE-2023-52664 bsc#1224747).
  - Update
    patches.suse/net-mlx5e-fix-a-potential-double-free-in-fs_any_crea.patch
    (jsc#PED-3311 CVE-2023-52667 bsc#1224603).
  - Update
    patches.suse/of-Fix-double-free-in-of_parse_phandle_with_args_map.patch
    (git-fixes CVE-2023-52679 bsc#1224508).
  - Update
    patches.suse/powerpc-imc-pmu-Add-a-null-pointer-check-in-update_events_in_group.patch
    (git-fixes CVE-2023-52675 bsc#1224504).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_eve.patch
    (bsc#1065729 CVE-2023-52686 bsc#1224682).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_pow.patch
    (bsc#1181674 ltc#189159 git-fixes CVE-2023-52696 bsc#1224601).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-to-scom_deb.patch
    (bsc#1194869 CVE-2023-52690 bsc#1224611).
  - Update
    patches.suse/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
    (git-fixes CVE-2023-52685 bsc#1224728).
  - Update
    patches.suse/rpmsg-virtio-Free-driver_override-when-rpmsg_remove.patch
    (git-fixes CVE-2023-52670 bsc#1224696).
  - commit 578211b
  - vhost: Add smp_rmb() in vhost_enable_notify() (git-fixes).
  - commit 2e20e2c
  - vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).
  - commit 936d53e
  - virtio_net: Do not send RSS key if it is not supported
    (git-fixes).
  - commit cc7c4a0
  - vsock/virtio: fix packet delivery to tap device (git-fixes).
  - commit dfd8673
  - virtio-blk: Ensure no requests in virtqueues before deleting
    vqs (git-fixes).
  - commit 966a23e
  - KVM: VMX: Disable LBR virtualization if the CPU doesn't support
    LBR callstacks (git-fixes).
  - commit f941b05
  - efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory (git-fixes).
  - commit c99f198
  - proc/kcore: do not try to access unaccepted memory (git-fixes).
  - commit 2daf00c
  - efi/unaccepted: touch soft lockup during memory accept (git-fixes).
  - commit 45ed7cb
  - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (bsc#1224442 CVE-2023-52659).
  - commit dad72fd
  - kabi fix of perf/x86/intel: Expose existence of callback support to KVM
    (git fixes).
  - commit 5db441c
  - perf/x86/intel: Expose existence of callback support to KVM
    (git-fixes).
  - commit b24b5fc
  - kABI fix of KVM: x86: Snapshot if a vCPU's vendor model is AMD vs.
    Intel compatible (git-fixes).
  - commit 38bcaaa
  - ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE
    (bsc#1224866).
  - commit 6a4b4a1
  - supported.conf: Add APM X-Gene SoC hardware monitoring driver (bsc#1223265 jsc#PED-8570)
  - commit 4b0eeb3
  - blacklist.conf: cephfs client logging infrastructure commits
    These two commits are useless in isolation, they are part of a larger set
    of commits that add extra info to debug logs.
  - commit 2056926
  - remoteproc: k3-r5: Jump to error handling labels in start/stop
    errors (git-fixes).
  - commit 6f545f8
  - libsubcmd: Fix parse-options memory leak (git-fixes).
  - dmaengine: idxd: Avoid unnecessary destruction of file_ida
    (git-fixes).
  - dmaengine: axi-dmac: fix possible race in remove() (git-fixes).
  - dmaengine: idma64: Add check for dma_set_max_seg_size
    (git-fixes).
  - remoteproc: k3-r5: Do not allow core1 to power up before core0
    via sysfs (git-fixes).
  - remoteproc: k3-r5: Wait for core0 power-up before powering up
    core1 (git-fixes).
  - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
    (git-fixes).
  - PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).
  - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
    (git-fixes).
  - PCI: dwc: ep: Fix DBI access failure for drivers requiring
    refclk from host (git-fixes).
  - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
    (git-fixes).
  - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
    (git-fixes).
  - KEYS: trusted: Do not use WARN when encode fails (git-fixes).
  - KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).
  - commit d7da373

++++ kernel-default:

  - af_unix: Suppress false-positive lockdep splat for spin_lock()
    in __unix_gc() (CVE-2024-26923 bsc#1223384).
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
    (CVE-2024-26923 bsc#1223384).
  - commit a652e3a
  - Update
    patches.suse/ACPI-CPPC-Use-access_width-over-bit_width-for-system.patch
    (stable-fixes CVE-2024-35995 bsc#1224557).
  - Update
    patches.suse/ALSA-usb-audio-Stop-parsing-channels-bits-when-all-c.patch
    (git-fixes CVE-2024-27436 bsc#1224803).
  - Update
    patches.suse/ASoC-SOF-ipc4-pcm-Workaround-for-crashed-firmware-on.patch
    (stable-fixes CVE-2024-27057 bsc#1223831).
  - Update
    patches.suse/ASoC-mediatek-sof-common-Add-NULL-check-for-normal_l.patch
    (git-fixes CVE-2024-35842 bsc#1224688).
  - Update
    patches.suse/Bluetooth-Fix-memory-leak-in-hci_req_sync_complete.patch
    (git-fixes CVE-2024-35978 bsc#1224571).
  - Update
    patches.suse/Bluetooth-Fix-use-after-free-bugs-caused-by-sco_sock.patch
    (git-fixes CVE-2024-27398 bsc#1224174).
  - Update
    patches.suse/Bluetooth-L2CAP-Fix-not-validating-setsockopt-user-i.patch
    (git-fixes CVE-2024-35965 bsc#1224579).
  - Update
    patches.suse/Bluetooth-RFCOMM-Fix-not-validating-setsockopt-user-.patch
    (git-fixes CVE-2024-35966 bsc#1224576).
  - Update
    patches.suse/Bluetooth-SCO-Fix-not-validating-setsockopt-user-inp.patch
    (git-fixes CVE-2024-35967 bsc#1224587).
  - Update
    patches.suse/Bluetooth-btintel-Fix-null-ptr-deref-in-btintel_read.patch
    (stable-fixes CVE-2024-35933 bsc#1224640).
  - Update
    patches.suse/Bluetooth-hci_event-Fix-handling-of-HCI_EV_IO_CAPA_R.patch
    (git-fixes CVE-2024-27416 bsc#1224723).
  - Update
    patches.suse/Bluetooth-hci_sock-Fix-not-validating-setsockopt-use.patch
    (git-fixes CVE-2024-35963 bsc#1224582).
  - Update
    patches.suse/Bluetooth-l2cap-fix-null-ptr-deref-in-l2cap_chan_tim.patch
    (git-fixes CVE-2024-27399 bsc#1224177).
  - Update
    patches.suse/Bluetooth-qca-fix-NULL-deref-on-non-serdev-setup.patch
    (git-fixes CVE-2024-35850 bsc#1224600).
  - Update
    patches.suse/Bluetooth-qca-fix-NULL-deref-on-non-serdev-suspend.patch
    (git-fixes CVE-2024-35851 bsc#1224509).
  - Update
    patches.suse/Bluetooth-rfcomm-Fix-null-ptr-deref-in-rfcomm_check_.patch
    (bsc#1219170 CVE-2024-22099 CVE-2024-26903 bsc#1223187).
  - Update
    patches.suse/HID-i2c-hid-remove-I2C_HID_READ_PENDING-flag-to-prev.patch
    (git-fixes CVE-2024-35997 bsc#1224552).
  - Update
    patches.suse/NFS-Fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch
    (git-fixes CVE-2024-27031 bsc#1223805).
  - Update
    patches.suse/NFSv4.2-fix-nfs4_listxattr-kernel-BUG-at-mm-usercopy.patch
    (git-fixes CVE-2024-26870 bsc#1223113).
  - Update
    patches.suse/PCI-PM-Drain-runtime-idle-callbacks-before-driver-re.patch
    (stable-fixes CVE-2024-35809 bsc#1224738).
  - Update
    patches.suse/SUNRPC-fix-some-memleaks-in-gssx_dec_option_array.patch
    (git-fixes CVE-2024-27388 bsc#1223744).
  - Update
    patches.suse/USB-core-Fix-deadlock-in-usb_deauthorize_interface.patch
    (git-fixes CVE-2024-26934 bsc#1223671).
  - Update patches.suse/accel-ivpu-Fix-deadlock-in-context_xa.patch
    (git-fixes CVE-2024-35953 bsc#1224704).
  - Update
    patches.suse/arm64-hibernate-Fix-level3-translation-fault-in-swsu.patch
    (git-fixes CVE-2024-26989 bsc#1223748).
  - Update patches.suse/ax25-Fix-netdev-refcount-issue.patch
    (git-fixes CVE-2024-36009 bsc#1224542).
  - Update
    patches.suse/ax25-fix-use-after-free-bugs-caused-by-ax25_ds_del_t.patch
    (git-fixes CVE-2024-35887 bsc#1224663).
  - Update
    patches.suse/batman-adv-Avoid-infinite-loop-trying-to-resize-loca.patch
    (git-fixes CVE-2024-35982 bsc#1224566).
  - Update
    patches.suse/block-fix-q-blkg_list-corruption-during-disk-rebind.patch
    (bsc#1223591 CVE-2024-35974 bsc#1224573).
  - Update
    patches.suse/bnxt_en-Fix-possible-memory-leak-in-bnxt_rdma_aux_de.patch
    (git-fixes CVE-2024-35972 bsc#1224577).
  - Update
    patches.suse/bootconfig-use-memblock_free_late-to-free-xbc-memory.patch
    (git-fixes CVE-2024-26983 bsc#1223637).
  - Update
    patches.suse/btrfs-fix-deadlock-with-fiemap-and-extent-locking.patch
    (bsc#1223285 CVE-2024-35784 bsc#1224804).
  - Update
    patches.suse/btrfs-fix-information-leak-in-btrfs_ioctl_logical_to.patch
    (git-fixes CVE-2024-35849 bsc#1224733).
  - Update
    patches.suse/btrfs-fix-race-between-ordered-extent-completion-and.patch
    (bsc#1223285 CVE-2024-26794 bsc#1222426).
  - Update
    patches.suse/btrfs-fix-race-when-detecting-delalloc-ranges-during.patch
    (bsc#1223285 CVE-2024-27080 bsc#1223782).
  - Update
    patches.suse/btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch
    (git-fixes CVE-2024-35936 bsc#1224644).
  - Update
    patches.suse/clk-Get-runtime-PM-before-walking-tree-during-disabl.patch
    (git-fixes CVE-2024-27004 bsc#1223762).
  - Update
    patches.suse/clk-Get-runtime-PM-before-walking-tree-for-clk_summa.patch
    (git-fixes CVE-2024-27003 bsc#1223761).
  - Update
    patches.suse/clk-mediatek-Do-a-runtime-PM-get-on-controllers-duri.patch
    (git-fixes CVE-2024-27002 bsc#1223759).
  - Update
    patches.suse/comedi-vmk80xx-fix-incomplete-endpoint-checking.patch
    (git-fixes CVE-2024-27001 bsc#1223698).
  - Update
    patches.suse/dm-raid-really-frozen-sync_thread-during-suspend-16c4.patch
    (jsc#PED-7542 CVE-2024-35794 bsc#1224706).
  - Update
    patches.suse/dm-raid456-md-raid456-fix-a-deadlock-for-dm-raid456-4142.patch
    (bsc#1219596 CVE-2024-26962 bsc#1223654).
  - Update
    patches.suse/dma-buf-Fix-NULL-pointer-dereference-in-sanitycheck.patch
    (git-fixes CVE-2024-35916 bsc#1224480).
  - Update patches.suse/dma-xilinx_dpdma-Fix-locking.patch
    (git-fixes CVE-2024-35990 bsc#1224559).
  - Update
    patches.suse/dmaengine-fsl-qdma-Fix-a-memory-leak-related-to-the--3aa58cb.patch
    (git-fixes CVE-2024-35833 bsc#1224632).
  - Update
    patches.suse/dmaengine-idxd-Fix-oops-during-rmmod-on-single-CPU-p.patch
    (git-fixes CVE-2024-35989 bsc#1224558).
  - Update
    patches.suse/dpll-fix-dpll_pin_on_pin_register-for-multiple-paren.patch
    (CVE-2024-27027 bsc#1223787 CVE-2024-36002 bsc#1224546).
  - Update
    patches.suse/dpll-fix-pin-dump-crash-for-rebound-module.patch
    (jsc#PED-6079 CVE-2024-35836 bsc#1224633).
  - Update
    patches.suse/drm-Check-output-polling-initialized-before-disablin.patch
    (stable-fixes CVE-2024-35927 bsc#1224654).
  - Update
    patches.suse/drm-amd-amdgpu-Fix-potential-ioremap-memory-leaks-in.patch
    (stable-fixes CVE-2024-35928 bsc#1224653).
  - Update
    patches.suse/drm-amd-display-Fix-bounds-check-for-dcn35-DcfClocks.patch
    (git-fixes CVE-2024-35788 bsc#1224709).
  - Update
    patches.suse/drm-amd-display-Prevent-crash-when-disable-stream.patch
    (stable-fixes CVE-2024-35799 bsc#1224740).
  - Update
    patches.suse/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch
    (stable-fixes CVE-2024-35817 bsc#1224736).
  - Update
    patches.suse/drm-amdgpu-fix-deadlock-while-reading-mqd-from-debug.patch
    (git-fixes CVE-2024-35795 bsc#1224634).
  - Update
    patches.suse/drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch
    (git-fixes CVE-2024-27029 bsc#1223789).
  - Update
    patches.suse/drm-amdgpu-once-more-fix-the-call-oder-in-amdgpu_ttm.patch
    (git-fixes CVE-2024-27400 bsc#1224180).
  - Update
    patches.suse/drm-amdgpu-pm-Fix-NULL-pointer-dereference-when-get-.patch
    (git-fixes CVE-2024-26949 bsc#1223665).
  - Update
    patches.suse/drm-amdgpu-validate-the-parameters-of-bo-mapping-ope.patch
    (git-fixes CVE-2024-26922 bsc#1223315).
  - Update
    patches.suse/drm-amdkfd-Fix-memory-leak-in-create_process-failure.patch
    (git-fixes CVE-2024-26986 bsc#1223728).
  - Update patches.suse/drm-ast-Fix-soft-lockup.patch (git-fixes
    CVE-2024-35952 bsc#1224705).
  - Update
    patches.suse/drm-client-Fully-protect-modes-with-dev-mode_config..patch
    (stable-fixes CVE-2024-35950 bsc#1224703).
  - Update
    patches.suse/drm-i915-bios-Tolerate-devdata-NULL-in-intel_bios_en.patch
    (stable-fixes CVE-2024-26938 bsc#1223678).
  - Update
    patches.suse/drm-i915-gt-Reset-queue_priority_hint-on-parking.patch
    (git-fixes CVE-2024-26937 bsc#1223677).
  - Update
    patches.suse/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
    (git-fixes CVE-2024-35829 bsc#1224707).
  - Update
    patches.suse/drm-nouveau-fix-stale-locked-mutex-in-nouveau_gem_io.patch
    (git-fixes CVE-2024-35786 bsc#1224714).
  - Update
    patches.suse/drm-nouveau-keep-DMA-buffers-required-for-suspend-re.patch
    (git-fixes CVE-2024-27411 bsc#1224433).
  - Update patches.suse/drm-nv04-Fix-out-of-bounds-access.patch
    (git-fixes CVE-2024-27008 bsc#1223802).
  - Update
    patches.suse/drm-panfrost-Fix-the-error-path-in-panfrost_mmu_map_.patch
    (git-fixes CVE-2024-35951 bsc#1224701).
  - Update
    patches.suse/drm-vc4-don-t-check-if-plane-state-fb-state-fb.patch
    (stable-fixes CVE-2024-35932 bsc#1224650).
  - Update
    patches.suse/drm-vmwgfx-Create-debugfs-ttm_resource_manager-entry.patch
    (git-fixes CVE-2024-26940 bsc#1223718).
  - Update
    patches.suse/drm-vmwgfx-Fix-the-lifetime-of-the-bo-cursor-memory.patch
    (git-fixes CVE-2024-35810 bsc#1224626).
  - Update
    patches.suse/dyndbg-fix-old-BUG_ON-in-control-parser.patch
    (stable-fixes CVE-2024-35947 bsc#1224647).
  - Update
    patches.suse/efi-capsule-loader-fix-incorrect-allocation-size.patch
    (git-fixes CVE-2024-27413 bsc#1224438).
  - Update patches.suse/efi-fix-panic-in-kdump-kernel.patch
    (git-fixes CVE-2024-35800 bsc#1224507).
  - Update
    patches.suse/fat-fix-uninitialized-field-in-nostale-filehandles.patch
    (git-fixes CVE-2024-26973 bsc#1223641).
  - Update
    patches.suse/fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch
    (stable-fixes CVE-2024-35922 bsc#1224660).
  - Update
    patches.suse/fs-aio-Check-IOCB_AIO_RW-before-the-struct-aio_kiocb.patch
    (bsc#1222721 CVE-2024-26764 CVE-2024-35815 bsc#1224685).
  - Update
    patches.suse/geneve-fix-header-validation-in-geneve-6-_xmit_skb.patch
    (git-fixes CVE-2024-35973 bsc#1224586).
  - Update
    patches.suse/geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch
    (git-fixes CVE-2024-26857 bsc#1223058).
  - Update
    patches.suse/i2c-smbus-fix-NULL-function-pointer-dereference.patch
    (git-fixes CVE-2024-35984 bsc#1224567).
  - Update
    patches.suse/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch
    (git-fixes CVE-2024-35911 bsc#1224486).
  - Update
    patches.suse/ice-fix-uninitialized-dplls-mutex-usage.patch
    (git-fixes CVE-2024-26854 bsc#1223039).
  - Update
    patches.suse/idpf-fix-kernel-panic-on-unknown-packet-types.patch
    (git-fixes CVE-2024-35889 bsc#1224517).
  - Update
    patches.suse/igc-avoid-returning-frame-twice-in-XDP_REDIRECT.patch
    (git-fixes CVE-2024-26853 bsc#1223061).
  - Update
    patches.suse/init-main.c-Fix-potential-static_command_line-memory.patch
    (git-fixes CVE-2024-26988 bsc#1223747).
  - Update
    patches.suse/iommufd-Fix-iopt_access_list_id-overwrite-bug.patch
    (git-fixes CVE-2024-26786 bsc#1222780).
  - Update
    patches.suse/irqchip-gic-v3-its-Prevent-double-free-on-error.patch
    (git-fixes CVE-2024-35847 bsc#1224697).
  - Update
    patches.suse/kprobes-Fix-possible-use-after-free-issue-on-kprobe-registration.patch
    (git-fixes CVE-2024-35955 bsc#1224676).
  - Update
    patches.suse/mac802154-fix-llsec-key-resources-release-in-mac8021.patch
    (git-fixes CVE-2024-26961 bsc#1223652).
  - Update
    patches.suse/md-dm-raid-don-t-call-md_reap_sync_thread-directly-cd32.patch
    (jsc#PED-7542 CVE-2024-35808 bsc#1224623).
  - Update patches.suse/md-fix-kmemleak-of-rdev-serial-6cf3.patch
    (jsc#PED-7542 CVE-2024-26900 bsc#1223046).
  - Update
    patches.suse/media-tc358743-register-v4l2-async-device-only-after.patch
    (git-fixes CVE-2024-35830 bsc#1224680).
  - Update
    patches.suse/misc-lis3lv02d_i2c-Fix-regulators-getting-en-dis-abl.patch
    (git-fixes CVE-2024-35824 bsc#1224609).
  - Update
    patches.suse/mlxbf_gige-call-request_irq-after-NAPI-initialized.patch
    (git-fixes CVE-2024-35907 bsc#1224492).
  - Update
    patches.suse/mlxbf_gige-stop-interface-during-shutdown.patch
    (git-fixes CVE-2024-35885 bsc#1224519).
  - Update
    patches.suse/mmc-core-Avoid-negative-index-with-array-access.patch
    (git-fixes CVE-2024-35813 bsc#1224618).
  - Update
    patches.suse/msft-hv-2971-net-mana-Fix-Rx-DMA-datasize-and-skb_over_panic.patch
    (git-fixes CVE-2024-35901 bsc#1224495).
  - Update
    patches.suse/net-ena-Fix-incorrect-descriptor-free-behavior.patch
    (git-fixes CVE-2024-35958 bsc#1224677).
  - Update
    patches.suse/net-ethernet-mtk_eth_soc-fix-PPE-hanging-issue.patch
    (git-fixes CVE-2024-27432 bsc#1224716).
  - Update
    patches.suse/net-hns3-fix-kernel-crash-when-1588-is-received-on-H.patch
    (git-fixes CVE-2024-26881 bsc#1223041).
  - Update
    patches.suse/net-ice-Fix-potential-NULL-pointer-dereference-in-ic.patch
    (git-fixes CVE-2024-26855 bsc#1223051).
  - Update
    patches.suse/net-ks8851-Handle-softirqs-at-the-end-of-IRQ-thread-.patch
    (git-fixes CVE-2024-35971 bsc#1224578).
  - Update
    patches.suse/net-ll_temac-platform_get_resource-replaced-by-wrong.patch
    (git-fixes CVE-2024-35796 bsc#1224615).
  - Update
    patches.suse/net-mlx5-Properly-link-new-fs-rules-into-the-tree.patch
    (git-fixes CVE-2024-35960 bsc#1224588).
  - Update
    patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch
    (git-fixes CVE-2024-35961 bsc#1224585).
  - Update
    patches.suse/net-mlx5e-Fix-mlx5e_priv_init-cleanup-flow.patch
    (git-fixes CVE-2024-35959 bsc#1224666).
  - Update
    patches.suse/net-mlx5e-Use-a-memory-barrier-to-enforce-PTP-WQ-xmi.patch
    (git-fixes CVE-2024-26858 bsc#1223020).
  - Update
    patches.suse/net-mlx5e-fix-a-double-free-in-arfs_create_groups.patch
    (jsc#PED-3311 CVE-2024-35835 bsc#1224605).
  - Update
    patches.suse/net-mvpp2-clear-BM-pool-before-initialization.patch
    (git-fixes CVE-2024-35837 bsc#1224500).
  - Update
    patches.suse/net-phy-micrel-Fix-potential-null-pointer-dereferenc.patch
    (git-fixes CVE-2024-35891 bsc#1224513).
  - Update
    patches.suse/net-phy-phy_device-Prevent-nullptr-exceptions-on-ISR.patch
    (stable-fixes CVE-2024-35945 bsc#1224639).
  - Update
    patches.suse/net-sparx5-Fix-use-after-free-inside-sparx5_del_mact.patch
    (git-fixes CVE-2024-26856 bsc#1223052).
  - Update patches.suse/net-tls-fix-WARNIING-in-__sk_msg_free.patch
    (bsc#1221858 CVE-2024-35841 bsc#1224687).
  - Update
    patches.suse/net-wwan-t7xx-Split-64bit-accesses-to-fix-alignment-.patch
    (git-fixes CVE-2024-35909 bsc#1224491).
  - Update
    patches.suse/nfc-nci-Fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch
    (git-fixes CVE-2024-35915 bsc#1224479).
  - Update
    patches.suse/nfp-flower-handle-acti_netdevs-allocation-failure.patch
    (git-fixes CVE-2024-27046 bsc#1223827).
  - Update
    patches.suse/nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch
    (git-fixes CVE-2024-26868 bsc#1223038).
  - Update
    patches.suse/nfsd-Fix-error-cleanup-path-in-nfsd_rename.patch
    (bsc#1221044 CVE-2023-52591 CVE-2024-35914 bsc#1224482).
  - Update
    patches.suse/nouveau-fix-instmem-race-condition-around-ptr-stores.patch
    (git-fixes CVE-2024-26984 bsc#1223633).
  - Update patches.suse/nouveau-lock-the-client-object-tree.patch
    (stable-fixes CVE-2024-27062 bsc#1223834).
  - Update
    patches.suse/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch
    (git-fixes CVE-2024-26846 bsc#1223023).
  - Update
    patches.suse/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch
    (git-fixes CVE-2024-27435 bsc#1224717).
  - Update
    patches.suse/octeontx2-af-Use-separate-handlers-for-interrupts.patch
    (git-fixes CVE-2024-27030 bsc#1223790).
  - Update
    patches.suse/octeontx2-pf-Fix-transmit-scheduler-resource-leak.patch
    (git-fixes CVE-2024-35975 bsc#1224569).
  - Update
    patches.suse/of-dynamic-Synchronize-of_changeset_destroy-with-the.patch
    (git-fixes CVE-2024-35879 bsc#1224524).
  - Update
    patches.suse/of-module-prevent-NULL-pointer-dereference-in-vsnpri.patch
    (stable-fixes CVE-2024-35878 bsc#1224671).
  - Update
    patches.suse/phy-marvell-a3700-comphy-Fix-out-of-bounds-read.patch
    (git-fixes CVE-2024-35992 bsc#1224555).
  - Update
    patches.suse/phy-ti-tusb1210-Resolve-charger-det-crash-if-charger.patch
    (git-fixes CVE-2024-35986 bsc#1224562).
  - Update
    patches.suse/platform-chrome-cros_ec_uart-properly-fix-race-condi.patch
    (git-fixes CVE-2024-35977 bsc#1224568).
  - Update
    patches.suse/power-supply-bq27xxx-i2c-Do-not-free-non-existing-IR.patch
    (git-fixes CVE-2024-27412 bsc#1224437).
  - Update
    patches.suse/pstore-inode-Only-d_invalidate-is-needed.patch
    (git-fixes CVE-2024-27389 bsc#1223705).
  - Update
    patches.suse/pstore-zone-Add-a-null-pointer-check-to-the-psz_kmsg.patch
    (stable-fixes CVE-2024-35940 bsc#1224537).
  - Update
    patches.suse/s390-zcrypt-fix-reference-counting-on-zcrypt-card-objects.patch
    (git-fixes bsc#1223592 CVE-2024-26957 bsc#1223666).
  - Update
    patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch
    (git-fixes CVE-2024-26935 bsc#1223675).
  - Update
    patches.suse/scsi-lpfc-Fix-possible-memory-leak-in-lpfc_rcv_padis.patch
    (bsc#1220021 CVE-2024-35930 bsc#1224651).
  - Update patches.suse/scsi-sg-Avoid-sg-device-teardown-race.patch
    (git-fixes CVE-2024-35954 bsc#1224675).
  - Update
    patches.suse/scsi-smartpqi-Fix-disable_managed_interrupts.patch
    (git-fixes CVE-2024-26742 bsc#1222608).
  - Update
    patches.suse/selinux-avoid-dereference-of-garbage-after-mount-fai.patch
    (git-fixes CVE-2024-35904 bsc#1224494).
  - Update
    patches.suse/serial-mxs-auart-add-spinlock-around-changing-cts-st.patch
    (git-fixes CVE-2024-27000 bsc#1223757).
  - Update
    patches.suse/serial-pmac_zilog-Remove-flawed-mitigation-for-rx-ir.patch
    (git-fixes CVE-2024-26999 bsc#1223754).
  - Update
    patches.suse/soc-fsl-qbman-Always-disable-interrupts-when-taking-.patch
    (git-fixes CVE-2024-35806 bsc#1224699).
  - Update
    patches.suse/soc-fsl-qbman-Use-raw-spinlock-for-cgr_lock.patch
    (git-fixes CVE-2024-35819 bsc#1224683).
  - Update patches.suse/speakup-Avoid-crash-on-very-long-word.patch
    (git-fixes CVE-2024-26994 bsc#1223750).
  - Update
    patches.suse/spi-lpspi-Avoid-potential-use-after-free-in-probe.patch
    (git-fixes CVE-2024-26866 bsc#1223024).
  - Update
    patches.suse/spi-mchp-pci1xxx-Fix-a-possible-null-pointer-derefer.patch
    (git-fixes CVE-2024-35883 bsc#1224521).
  - Update
    patches.suse/spi-spi-mt65xx-Fix-NULL-pointer-access-in-interrupt-.patch
    (git-fixes CVE-2024-27028 bsc#1223788).
  - Update
    patches.suse/ubifs-Set-page-uptodate-in-the-correct-place.patch
    (git-fixes CVE-2024-35821 bsc#1224629).
  - Update
    patches.suse/usb-cdc-wdm-close-race-between-read-and-workqueue.patch
    (git-fixes CVE-2024-35812 bsc#1224624).
  - Update
    patches.suse/usb-dwc2-host-Fix-dereference-issue-in-DDMA-completi.patch
    (git-fixes CVE-2024-26997 bsc#1223741).
  - Update
    patches.suse/usb-dwc3-am62-fix-module-unload-reload-behavior.patch
    (git-fixes CVE-2024-26963 bsc#1223651).
  - Update
    patches.suse/usb-gadget-f_ncm-Fix-UAF-ncm-object-at-re-bind-after.patch
    (stable-fixes CVE-2024-26996 bsc#1223752).
  - Update
    patches.suse/usb-gadget-ncm-Avoid-dropping-datagrams-of-properly-.patch
    (git-fixes CVE-2024-27405 bsc#1224423).
  - Update
    patches.suse/usb-gadget-ncm-Fix-handling-of-zero-block-length-pac.patch
    (git-fixes CVE-2024-35825 bsc#1224681).
  - Update
    patches.suse/usb-typec-altmodes-displayport-create-sysfs-nodes-as.patch
    (git-fixes CVE-2024-35790 bsc#1224712).
  - Update
    patches.suse/usb-typec-tcpm-Correct-the-PDO-counting-in-pd_set.patch
    (git-fixes CVE-2024-26995 bsc#1223696).
  - Update
    patches.suse/usb-typec-tcpm-fix-double-free-issue-in-tcpm_port_un.patch
    (git-fixes CVE-2024-26932 bsc#1223649).
  - Update patches.suse/usb-typec-ucsi-Limit-read-size-on-v1.2.patch
    (stable-fixes CVE-2024-35924 bsc#1224657).
  - Update
    patches.suse/usb-udc-remove-warning-when-queue-disabled-ep.patch
    (stable-fixes CVE-2024-35822 bsc#1224739).
  - Update
    patches.suse/usb-xhci-Add-error-handling-in-xhci_map_urb_for_dma.patch
    (git-fixes CVE-2024-26964 bsc#1223650).
  - Update
    patches.suse/vt-fix-unicode-buffer-corruption-when-deleting-chara.patch
    (git-fixes CVE-2024-35823 bsc#1224692).
  - Update
    patches.suse/wifi-ath11k-decrease-MHI-channel-buffer-length-to-8K.patch
    (bsc#1207948 CVE-2024-35938 bsc#1224643).
  - Update
    patches.suse/wifi-brcmfmac-Fix-use-after-free-bug-in-brcmf_cfg802.patch
    (CVE-2023-47233 bsc#1216702 CVE-2024-35811 bsc#1224592).
  - Update
    patches.suse/wifi-cfg80211-check-A-MSDU-format-more-carefully.patch
    (stable-fixes CVE-2024-35937 bsc#1224526).
  - Update
    patches.suse/wifi-iwlwifi-dbg-tlv-ensure-NUL-termination.patch
    (git-fixes CVE-2024-35845 bsc#1224731).
  - Update
    patches.suse/wifi-iwlwifi-mvm-don-t-set-the-MFP-flag-for-the-GTK.patch
    (git-fixes CVE-2024-27434 bsc#1224710).
  - Update
    patches.suse/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch
    (git-fixes CVE-2024-35912 bsc#1224487).
  - Update
    patches.suse/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
    (git-fixes CVE-2024-35828 bsc#1224622).
  - Update
    patches.suse/wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch
    (stable-fixes CVE-2024-35789 bsc#1224749).
  - Update
    patches.suse/wifi-mac80211-fix-potential-sta-link-leak.patch
    (git-fixes CVE-2024-35838 bsc#1224613).
  - Update
    patches.suse/wifi-nl80211-reject-iftype-change-with-mesh-ID-chang.patch
    (git-fixes CVE-2024-27410 bsc#1224432).
  - Update
    patches.suse/wifi-rtw89-fix-null-pointer-access-when-abort-scan.patch
    (stable-fixes CVE-2024-35946 bsc#1224646).
  - Update
    patches.suse/wireguard-netlink-access-device-through-ctx-instead-.patch
    (git-fixes CVE-2024-26950 bsc#1223661).
  - Update
    patches.suse/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch
    (git-fixes CVE-2024-26951 bsc#1223660).
  - Update
    patches.suse/wireguard-receive-annotate-data-race-around-receivin.patch
    (git-fixes CVE-2024-26861 bsc#1223076).
  - Update
    patches.suse/x86-coco-Require-seeding-RNG-with-RDRAND-on-CoCo-systems.patch
    (git-fixes CVE-2024-35875 bsc#1224665).
  - Update
    patches.suse/x86-fpu-Keep-xfd_state-in-sync-with-MSR_IA32_XFD.patch
    (git-fixes CVE-2024-35801 bsc#1224732).
  - Update
    patches.suse/xen-evtchn-avoid-WARN-when-unbinding-an-event-channe.patch
    (git-fixes CVE-2024-27067 bsc#1223739).
  - Update
    patches.suse/xsk-recycle-buffer-in-case-Rx-queue-was-full.patch
    (bsc#1221303 CVE-2024-26611 CVE-2024-35834 bsc#1224620).
  - commit 005afc6
  - Update
    patches.suse/ACPI-LPIT-Avoid-u32-multiplication-overflow.patch
    (git-fixes CVE-2023-52683 bsc#1224627).
  - Update
    patches.suse/ACPI-video-check-for-error-while-searching-for-backl.patch
    (git-fixes CVE-2023-52693 bsc#1224686).
  - Update
    patches.suse/ASoC-Intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch
    (git-fixes CVE-2023-52697 bsc#1224596).
  - Update
    patches.suse/ASoC-SOF-amd-Fix-memory-leak-in-amd_sof_acp_probe.patch
    (git-fixes CVE-2023-52663 bsc#1224630).
  - Update
    patches.suse/Revert-drm-amd-pm-resolve-reboot-exception-for-si-ol.patch
    (git-fixes CVE-2023-52657 bsc#1224722).
  - Update
    patches.suse/Revert-net-mlx5-Block-entering-switchdev-mode-with-n.patch
    (git-fixes CVE-2023-52658 bsc#1224719).
  - Update
    patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch
    (git-fixes CVE-2023-52653 bsc#1223712).
  - Update
    patches.suse/bpf-Guard-stack-limits-against-32bit-overflow.patch
    (git-fixes CVE-2023-52676 bsc#1224730).
  - Update
    patches.suse/crypto-rsa-add-a-check-for-allocation-failure.patch
    (bsc#1222775 CVE-2023-52472 bsc#1220430).
  - Update
    patches.suse/crypto-s390-aes-Fix-buffer-overread-in-CTR-mode.patch
    (git-fixes CVE-2023-52669 bsc#1224637).
  - Update
    patches.suse/crypto-safexcel-Add-error-handling-for-dma_map_sg-ca.patch
    (git-fixes CVE-2023-52687 bsc#1224501).
  - Update
    patches.suse/drm-amd-display-Check-writeback-connectors-in-create.patch
    (git-fixes CVE-2023-52695 bsc#1224506).
  - Update
    patches.suse/drm-amd-display-Fix-a-debugfs-null-pointer-error.patch
    (git-fixes CVE-2023-52673 bsc#1224741).
  - Update
    patches.suse/drm-amd-display-Fix-hang-underflow-when-transitionin.patch
    (git-fixes CVE-2023-52671 bsc#1224729).
  - Update
    patches.suse/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
    (git-fixes CVE-2023-52691 bsc#1224607).
  - Update
    patches.suse/drm-amdkfd-Confirm-list-is-non-empty-before-utilizin.patch
    (git-fixes CVE-2023-52678 bsc#1224617).
  - Update
    patches.suse/drm-bridge-tpd12s015-Drop-buggy-__exit-annotation-fo.patch
    (git-fixes CVE-2023-52694 bsc#1224598).
  - Update
    patches.suse/drm-tegra-rgb-Fix-missing-clk_put-in-the-error-handl.patch
    (git-fixes CVE-2023-52661 bsc#1224445).
  - Update
    patches.suse/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
    (git-fixes CVE-2023-52662 bsc#1224449).
  - Update patches.suse/efivarfs-Free-s_fs_info-on-unmount.patch
    (bsc#1220328 CVE-2023-52463 CVE-2023-52681 bsc#1224505).
  - Update
    patches.suse/media-rkisp1-Fix-IRQ-handling-due-to-shared-interrup.patch
    (stable-fixes CVE-2023-52660 bsc#1224443).
  - Update
    patches.suse/net-atlantic-eliminate-double-free-in-error-handling.patch
    (git-fixes CVE-2023-52664 bsc#1224747).
  - Update
    patches.suse/net-mlx5e-fix-a-potential-double-free-in-fs_any_crea.patch
    (jsc#PED-3311 CVE-2023-52667 bsc#1224603).
  - Update
    patches.suse/of-Fix-double-free-in-of_parse_phandle_with_args_map.patch
    (git-fixes CVE-2023-52679 bsc#1224508).
  - Update
    patches.suse/powerpc-imc-pmu-Add-a-null-pointer-check-in-update_events_in_group.patch
    (git-fixes CVE-2023-52675 bsc#1224504).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_eve.patch
    (bsc#1065729 CVE-2023-52686 bsc#1224682).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_pow.patch
    (bsc#1181674 ltc#189159 git-fixes CVE-2023-52696 bsc#1224601).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-to-scom_deb.patch
    (bsc#1194869 CVE-2023-52690 bsc#1224611).
  - Update
    patches.suse/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
    (git-fixes CVE-2023-52685 bsc#1224728).
  - Update
    patches.suse/rpmsg-virtio-Free-driver_override-when-rpmsg_remove.patch
    (git-fixes CVE-2023-52670 bsc#1224696).
  - commit 578211b
  - vhost: Add smp_rmb() in vhost_enable_notify() (git-fixes).
  - commit 2e20e2c
  - vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).
  - commit 936d53e
  - virtio_net: Do not send RSS key if it is not supported
    (git-fixes).
  - commit cc7c4a0
  - vsock/virtio: fix packet delivery to tap device (git-fixes).
  - commit dfd8673
  - virtio-blk: Ensure no requests in virtqueues before deleting
    vqs (git-fixes).
  - commit 966a23e
  - KVM: VMX: Disable LBR virtualization if the CPU doesn't support
    LBR callstacks (git-fixes).
  - commit f941b05
  - efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory (git-fixes).
  - commit c99f198
  - proc/kcore: do not try to access unaccepted memory (git-fixes).
  - commit 2daf00c
  - efi/unaccepted: touch soft lockup during memory accept (git-fixes).
  - commit 45ed7cb
  - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (bsc#1224442 CVE-2023-52659).
  - commit dad72fd
  - kabi fix of perf/x86/intel: Expose existence of callback support to KVM
    (git fixes).
  - commit 5db441c
  - perf/x86/intel: Expose existence of callback support to KVM
    (git-fixes).
  - commit b24b5fc
  - kABI fix of KVM: x86: Snapshot if a vCPU's vendor model is AMD vs.
    Intel compatible (git-fixes).
  - commit 38bcaaa
  - ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE
    (bsc#1224866).
  - commit 6a4b4a1
  - supported.conf: Add APM X-Gene SoC hardware monitoring driver (bsc#1223265 jsc#PED-8570)
  - commit 4b0eeb3
  - blacklist.conf: cephfs client logging infrastructure commits
    These two commits are useless in isolation, they are part of a larger set
    of commits that add extra info to debug logs.
  - commit 2056926
  - remoteproc: k3-r5: Jump to error handling labels in start/stop
    errors (git-fixes).
  - commit 6f545f8
  - libsubcmd: Fix parse-options memory leak (git-fixes).
  - dmaengine: idxd: Avoid unnecessary destruction of file_ida
    (git-fixes).
  - dmaengine: axi-dmac: fix possible race in remove() (git-fixes).
  - dmaengine: idma64: Add check for dma_set_max_seg_size
    (git-fixes).
  - remoteproc: k3-r5: Do not allow core1 to power up before core0
    via sysfs (git-fixes).
  - remoteproc: k3-r5: Wait for core0 power-up before powering up
    core1 (git-fixes).
  - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
    (git-fixes).
  - PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).
  - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
    (git-fixes).
  - PCI: dwc: ep: Fix DBI access failure for drivers requiring
    refclk from host (git-fixes).
  - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
    (git-fixes).
  - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
    (git-fixes).
  - KEYS: trusted: Do not use WARN when encode fails (git-fixes).
  - KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).
  - commit d7da373

++++ kernel-default:

  - af_unix: Suppress false-positive lockdep splat for spin_lock()
    in __unix_gc() (CVE-2024-26923 bsc#1223384).
  - af_unix: fix lockdep positive in sk_diag_dump_icons()
    (CVE-2024-26923 bsc#1223384).
  - commit a652e3a
  - Update
    patches.suse/ACPI-CPPC-Use-access_width-over-bit_width-for-system.patch
    (stable-fixes CVE-2024-35995 bsc#1224557).
  - Update
    patches.suse/ALSA-usb-audio-Stop-parsing-channels-bits-when-all-c.patch
    (git-fixes CVE-2024-27436 bsc#1224803).
  - Update
    patches.suse/ASoC-SOF-ipc4-pcm-Workaround-for-crashed-firmware-on.patch
    (stable-fixes CVE-2024-27057 bsc#1223831).
  - Update
    patches.suse/ASoC-mediatek-sof-common-Add-NULL-check-for-normal_l.patch
    (git-fixes CVE-2024-35842 bsc#1224688).
  - Update
    patches.suse/Bluetooth-Fix-memory-leak-in-hci_req_sync_complete.patch
    (git-fixes CVE-2024-35978 bsc#1224571).
  - Update
    patches.suse/Bluetooth-Fix-use-after-free-bugs-caused-by-sco_sock.patch
    (git-fixes CVE-2024-27398 bsc#1224174).
  - Update
    patches.suse/Bluetooth-L2CAP-Fix-not-validating-setsockopt-user-i.patch
    (git-fixes CVE-2024-35965 bsc#1224579).
  - Update
    patches.suse/Bluetooth-RFCOMM-Fix-not-validating-setsockopt-user-.patch
    (git-fixes CVE-2024-35966 bsc#1224576).
  - Update
    patches.suse/Bluetooth-SCO-Fix-not-validating-setsockopt-user-inp.patch
    (git-fixes CVE-2024-35967 bsc#1224587).
  - Update
    patches.suse/Bluetooth-btintel-Fix-null-ptr-deref-in-btintel_read.patch
    (stable-fixes CVE-2024-35933 bsc#1224640).
  - Update
    patches.suse/Bluetooth-hci_event-Fix-handling-of-HCI_EV_IO_CAPA_R.patch
    (git-fixes CVE-2024-27416 bsc#1224723).
  - Update
    patches.suse/Bluetooth-hci_sock-Fix-not-validating-setsockopt-use.patch
    (git-fixes CVE-2024-35963 bsc#1224582).
  - Update
    patches.suse/Bluetooth-l2cap-fix-null-ptr-deref-in-l2cap_chan_tim.patch
    (git-fixes CVE-2024-27399 bsc#1224177).
  - Update
    patches.suse/Bluetooth-qca-fix-NULL-deref-on-non-serdev-setup.patch
    (git-fixes CVE-2024-35850 bsc#1224600).
  - Update
    patches.suse/Bluetooth-qca-fix-NULL-deref-on-non-serdev-suspend.patch
    (git-fixes CVE-2024-35851 bsc#1224509).
  - Update
    patches.suse/Bluetooth-rfcomm-Fix-null-ptr-deref-in-rfcomm_check_.patch
    (bsc#1219170 CVE-2024-22099 CVE-2024-26903 bsc#1223187).
  - Update
    patches.suse/HID-i2c-hid-remove-I2C_HID_READ_PENDING-flag-to-prev.patch
    (git-fixes CVE-2024-35997 bsc#1224552).
  - Update
    patches.suse/NFS-Fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch
    (git-fixes CVE-2024-27031 bsc#1223805).
  - Update
    patches.suse/NFSv4.2-fix-nfs4_listxattr-kernel-BUG-at-mm-usercopy.patch
    (git-fixes CVE-2024-26870 bsc#1223113).
  - Update
    patches.suse/PCI-PM-Drain-runtime-idle-callbacks-before-driver-re.patch
    (stable-fixes CVE-2024-35809 bsc#1224738).
  - Update
    patches.suse/SUNRPC-fix-some-memleaks-in-gssx_dec_option_array.patch
    (git-fixes CVE-2024-27388 bsc#1223744).
  - Update
    patches.suse/USB-core-Fix-deadlock-in-usb_deauthorize_interface.patch
    (git-fixes CVE-2024-26934 bsc#1223671).
  - Update patches.suse/accel-ivpu-Fix-deadlock-in-context_xa.patch
    (git-fixes CVE-2024-35953 bsc#1224704).
  - Update
    patches.suse/arm64-hibernate-Fix-level3-translation-fault-in-swsu.patch
    (git-fixes CVE-2024-26989 bsc#1223748).
  - Update patches.suse/ax25-Fix-netdev-refcount-issue.patch
    (git-fixes CVE-2024-36009 bsc#1224542).
  - Update
    patches.suse/ax25-fix-use-after-free-bugs-caused-by-ax25_ds_del_t.patch
    (git-fixes CVE-2024-35887 bsc#1224663).
  - Update
    patches.suse/batman-adv-Avoid-infinite-loop-trying-to-resize-loca.patch
    (git-fixes CVE-2024-35982 bsc#1224566).
  - Update
    patches.suse/block-fix-q-blkg_list-corruption-during-disk-rebind.patch
    (bsc#1223591 CVE-2024-35974 bsc#1224573).
  - Update
    patches.suse/bnxt_en-Fix-possible-memory-leak-in-bnxt_rdma_aux_de.patch
    (git-fixes CVE-2024-35972 bsc#1224577).
  - Update
    patches.suse/bootconfig-use-memblock_free_late-to-free-xbc-memory.patch
    (git-fixes CVE-2024-26983 bsc#1223637).
  - Update
    patches.suse/btrfs-fix-deadlock-with-fiemap-and-extent-locking.patch
    (bsc#1223285 CVE-2024-35784 bsc#1224804).
  - Update
    patches.suse/btrfs-fix-information-leak-in-btrfs_ioctl_logical_to.patch
    (git-fixes CVE-2024-35849 bsc#1224733).
  - Update
    patches.suse/btrfs-fix-race-between-ordered-extent-completion-and.patch
    (bsc#1223285 CVE-2024-26794 bsc#1222426).
  - Update
    patches.suse/btrfs-fix-race-when-detecting-delalloc-ranges-during.patch
    (bsc#1223285 CVE-2024-27080 bsc#1223782).
  - Update
    patches.suse/btrfs-handle-chunk-tree-lookup-error-in-btrfs_reloca.patch
    (git-fixes CVE-2024-35936 bsc#1224644).
  - Update
    patches.suse/clk-Get-runtime-PM-before-walking-tree-during-disabl.patch
    (git-fixes CVE-2024-27004 bsc#1223762).
  - Update
    patches.suse/clk-Get-runtime-PM-before-walking-tree-for-clk_summa.patch
    (git-fixes CVE-2024-27003 bsc#1223761).
  - Update
    patches.suse/clk-mediatek-Do-a-runtime-PM-get-on-controllers-duri.patch
    (git-fixes CVE-2024-27002 bsc#1223759).
  - Update
    patches.suse/comedi-vmk80xx-fix-incomplete-endpoint-checking.patch
    (git-fixes CVE-2024-27001 bsc#1223698).
  - Update
    patches.suse/dm-raid-really-frozen-sync_thread-during-suspend-16c4.patch
    (jsc#PED-7542 CVE-2024-35794 bsc#1224706).
  - Update
    patches.suse/dm-raid456-md-raid456-fix-a-deadlock-for-dm-raid456-4142.patch
    (bsc#1219596 CVE-2024-26962 bsc#1223654).
  - Update
    patches.suse/dma-buf-Fix-NULL-pointer-dereference-in-sanitycheck.patch
    (git-fixes CVE-2024-35916 bsc#1224480).
  - Update patches.suse/dma-xilinx_dpdma-Fix-locking.patch
    (git-fixes CVE-2024-35990 bsc#1224559).
  - Update
    patches.suse/dmaengine-fsl-qdma-Fix-a-memory-leak-related-to-the--3aa58cb.patch
    (git-fixes CVE-2024-35833 bsc#1224632).
  - Update
    patches.suse/dmaengine-idxd-Fix-oops-during-rmmod-on-single-CPU-p.patch
    (git-fixes CVE-2024-35989 bsc#1224558).
  - Update
    patches.suse/dpll-fix-dpll_pin_on_pin_register-for-multiple-paren.patch
    (CVE-2024-27027 bsc#1223787 CVE-2024-36002 bsc#1224546).
  - Update
    patches.suse/dpll-fix-pin-dump-crash-for-rebound-module.patch
    (jsc#PED-6079 CVE-2024-35836 bsc#1224633).
  - Update
    patches.suse/drm-Check-output-polling-initialized-before-disablin.patch
    (stable-fixes CVE-2024-35927 bsc#1224654).
  - Update
    patches.suse/drm-amd-amdgpu-Fix-potential-ioremap-memory-leaks-in.patch
    (stable-fixes CVE-2024-35928 bsc#1224653).
  - Update
    patches.suse/drm-amd-display-Fix-bounds-check-for-dcn35-DcfClocks.patch
    (git-fixes CVE-2024-35788 bsc#1224709).
  - Update
    patches.suse/drm-amd-display-Prevent-crash-when-disable-stream.patch
    (stable-fixes CVE-2024-35799 bsc#1224740).
  - Update
    patches.suse/drm-amdgpu-amdgpu_ttm_gart_bind-set-gtt-bound-flag.patch
    (stable-fixes CVE-2024-35817 bsc#1224736).
  - Update
    patches.suse/drm-amdgpu-fix-deadlock-while-reading-mqd-from-debug.patch
    (git-fixes CVE-2024-35795 bsc#1224634).
  - Update
    patches.suse/drm-amdgpu-fix-mmhub-client-id-out-of-bounds-access.patch
    (git-fixes CVE-2024-27029 bsc#1223789).
  - Update
    patches.suse/drm-amdgpu-once-more-fix-the-call-oder-in-amdgpu_ttm.patch
    (git-fixes CVE-2024-27400 bsc#1224180).
  - Update
    patches.suse/drm-amdgpu-pm-Fix-NULL-pointer-dereference-when-get-.patch
    (git-fixes CVE-2024-26949 bsc#1223665).
  - Update
    patches.suse/drm-amdgpu-validate-the-parameters-of-bo-mapping-ope.patch
    (git-fixes CVE-2024-26922 bsc#1223315).
  - Update
    patches.suse/drm-amdkfd-Fix-memory-leak-in-create_process-failure.patch
    (git-fixes CVE-2024-26986 bsc#1223728).
  - Update patches.suse/drm-ast-Fix-soft-lockup.patch (git-fixes
    CVE-2024-35952 bsc#1224705).
  - Update
    patches.suse/drm-client-Fully-protect-modes-with-dev-mode_config..patch
    (stable-fixes CVE-2024-35950 bsc#1224703).
  - Update
    patches.suse/drm-i915-bios-Tolerate-devdata-NULL-in-intel_bios_en.patch
    (stable-fixes CVE-2024-26938 bsc#1223678).
  - Update
    patches.suse/drm-i915-gt-Reset-queue_priority_hint-on-parking.patch
    (git-fixes CVE-2024-26937 bsc#1223677).
  - Update
    patches.suse/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
    (git-fixes CVE-2024-35829 bsc#1224707).
  - Update
    patches.suse/drm-nouveau-fix-stale-locked-mutex-in-nouveau_gem_io.patch
    (git-fixes CVE-2024-35786 bsc#1224714).
  - Update
    patches.suse/drm-nouveau-keep-DMA-buffers-required-for-suspend-re.patch
    (git-fixes CVE-2024-27411 bsc#1224433).
  - Update patches.suse/drm-nv04-Fix-out-of-bounds-access.patch
    (git-fixes CVE-2024-27008 bsc#1223802).
  - Update
    patches.suse/drm-panfrost-Fix-the-error-path-in-panfrost_mmu_map_.patch
    (git-fixes CVE-2024-35951 bsc#1224701).
  - Update
    patches.suse/drm-vc4-don-t-check-if-plane-state-fb-state-fb.patch
    (stable-fixes CVE-2024-35932 bsc#1224650).
  - Update
    patches.suse/drm-vmwgfx-Create-debugfs-ttm_resource_manager-entry.patch
    (git-fixes CVE-2024-26940 bsc#1223718).
  - Update
    patches.suse/drm-vmwgfx-Fix-the-lifetime-of-the-bo-cursor-memory.patch
    (git-fixes CVE-2024-35810 bsc#1224626).
  - Update
    patches.suse/dyndbg-fix-old-BUG_ON-in-control-parser.patch
    (stable-fixes CVE-2024-35947 bsc#1224647).
  - Update
    patches.suse/efi-capsule-loader-fix-incorrect-allocation-size.patch
    (git-fixes CVE-2024-27413 bsc#1224438).
  - Update patches.suse/efi-fix-panic-in-kdump-kernel.patch
    (git-fixes CVE-2024-35800 bsc#1224507).
  - Update
    patches.suse/fat-fix-uninitialized-field-in-nostale-filehandles.patch
    (git-fixes CVE-2024-26973 bsc#1223641).
  - Update
    patches.suse/fbmon-prevent-division-by-zero-in-fb_videomode_from_.patch
    (stable-fixes CVE-2024-35922 bsc#1224660).
  - Update
    patches.suse/fs-aio-Check-IOCB_AIO_RW-before-the-struct-aio_kiocb.patch
    (bsc#1222721 CVE-2024-26764 CVE-2024-35815 bsc#1224685).
  - Update
    patches.suse/geneve-fix-header-validation-in-geneve-6-_xmit_skb.patch
    (git-fixes CVE-2024-35973 bsc#1224586).
  - Update
    patches.suse/geneve-make-sure-to-pull-inner-header-in-geneve_rx.patch
    (git-fixes CVE-2024-26857 bsc#1223058).
  - Update
    patches.suse/i2c-smbus-fix-NULL-function-pointer-dereference.patch
    (git-fixes CVE-2024-35984 bsc#1224567).
  - Update
    patches.suse/ice-fix-memory-corruption-bug-with-suspend-and-rebui.patch
    (git-fixes CVE-2024-35911 bsc#1224486).
  - Update
    patches.suse/ice-fix-uninitialized-dplls-mutex-usage.patch
    (git-fixes CVE-2024-26854 bsc#1223039).
  - Update
    patches.suse/idpf-fix-kernel-panic-on-unknown-packet-types.patch
    (git-fixes CVE-2024-35889 bsc#1224517).
  - Update
    patches.suse/igc-avoid-returning-frame-twice-in-XDP_REDIRECT.patch
    (git-fixes CVE-2024-26853 bsc#1223061).
  - Update
    patches.suse/init-main.c-Fix-potential-static_command_line-memory.patch
    (git-fixes CVE-2024-26988 bsc#1223747).
  - Update
    patches.suse/iommufd-Fix-iopt_access_list_id-overwrite-bug.patch
    (git-fixes CVE-2024-26786 bsc#1222780).
  - Update
    patches.suse/irqchip-gic-v3-its-Prevent-double-free-on-error.patch
    (git-fixes CVE-2024-35847 bsc#1224697).
  - Update
    patches.suse/kprobes-Fix-possible-use-after-free-issue-on-kprobe-registration.patch
    (git-fixes CVE-2024-35955 bsc#1224676).
  - Update
    patches.suse/mac802154-fix-llsec-key-resources-release-in-mac8021.patch
    (git-fixes CVE-2024-26961 bsc#1223652).
  - Update
    patches.suse/md-dm-raid-don-t-call-md_reap_sync_thread-directly-cd32.patch
    (jsc#PED-7542 CVE-2024-35808 bsc#1224623).
  - Update patches.suse/md-fix-kmemleak-of-rdev-serial-6cf3.patch
    (jsc#PED-7542 CVE-2024-26900 bsc#1223046).
  - Update
    patches.suse/media-tc358743-register-v4l2-async-device-only-after.patch
    (git-fixes CVE-2024-35830 bsc#1224680).
  - Update
    patches.suse/misc-lis3lv02d_i2c-Fix-regulators-getting-en-dis-abl.patch
    (git-fixes CVE-2024-35824 bsc#1224609).
  - Update
    patches.suse/mlxbf_gige-call-request_irq-after-NAPI-initialized.patch
    (git-fixes CVE-2024-35907 bsc#1224492).
  - Update
    patches.suse/mlxbf_gige-stop-interface-during-shutdown.patch
    (git-fixes CVE-2024-35885 bsc#1224519).
  - Update
    patches.suse/mmc-core-Avoid-negative-index-with-array-access.patch
    (git-fixes CVE-2024-35813 bsc#1224618).
  - Update
    patches.suse/msft-hv-2971-net-mana-Fix-Rx-DMA-datasize-and-skb_over_panic.patch
    (git-fixes CVE-2024-35901 bsc#1224495).
  - Update
    patches.suse/net-ena-Fix-incorrect-descriptor-free-behavior.patch
    (git-fixes CVE-2024-35958 bsc#1224677).
  - Update
    patches.suse/net-ethernet-mtk_eth_soc-fix-PPE-hanging-issue.patch
    (git-fixes CVE-2024-27432 bsc#1224716).
  - Update
    patches.suse/net-hns3-fix-kernel-crash-when-1588-is-received-on-H.patch
    (git-fixes CVE-2024-26881 bsc#1223041).
  - Update
    patches.suse/net-ice-Fix-potential-NULL-pointer-dereference-in-ic.patch
    (git-fixes CVE-2024-26855 bsc#1223051).
  - Update
    patches.suse/net-ks8851-Handle-softirqs-at-the-end-of-IRQ-thread-.patch
    (git-fixes CVE-2024-35971 bsc#1224578).
  - Update
    patches.suse/net-ll_temac-platform_get_resource-replaced-by-wrong.patch
    (git-fixes CVE-2024-35796 bsc#1224615).
  - Update
    patches.suse/net-mlx5-Properly-link-new-fs-rules-into-the-tree.patch
    (git-fixes CVE-2024-35960 bsc#1224588).
  - Update
    patches.suse/net-mlx5-Register-devlink-first-under-devlink-lock.patch
    (git-fixes CVE-2024-35961 bsc#1224585).
  - Update
    patches.suse/net-mlx5e-Fix-mlx5e_priv_init-cleanup-flow.patch
    (git-fixes CVE-2024-35959 bsc#1224666).
  - Update
    patches.suse/net-mlx5e-Use-a-memory-barrier-to-enforce-PTP-WQ-xmi.patch
    (git-fixes CVE-2024-26858 bsc#1223020).
  - Update
    patches.suse/net-mlx5e-fix-a-double-free-in-arfs_create_groups.patch
    (jsc#PED-3311 CVE-2024-35835 bsc#1224605).
  - Update
    patches.suse/net-mvpp2-clear-BM-pool-before-initialization.patch
    (git-fixes CVE-2024-35837 bsc#1224500).
  - Update
    patches.suse/net-phy-micrel-Fix-potential-null-pointer-dereferenc.patch
    (git-fixes CVE-2024-35891 bsc#1224513).
  - Update
    patches.suse/net-phy-phy_device-Prevent-nullptr-exceptions-on-ISR.patch
    (stable-fixes CVE-2024-35945 bsc#1224639).
  - Update
    patches.suse/net-sparx5-Fix-use-after-free-inside-sparx5_del_mact.patch
    (git-fixes CVE-2024-26856 bsc#1223052).
  - Update patches.suse/net-tls-fix-WARNIING-in-__sk_msg_free.patch
    (bsc#1221858 CVE-2024-35841 bsc#1224687).
  - Update
    patches.suse/net-wwan-t7xx-Split-64bit-accesses-to-fix-alignment-.patch
    (git-fixes CVE-2024-35909 bsc#1224491).
  - Update
    patches.suse/nfc-nci-Fix-uninit-value-in-nci_dev_up-and-nci_ntf_p.patch
    (git-fixes CVE-2024-35915 bsc#1224479).
  - Update
    patches.suse/nfp-flower-handle-acti_netdevs-allocation-failure.patch
    (git-fixes CVE-2024-27046 bsc#1223827).
  - Update
    patches.suse/nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch
    (git-fixes CVE-2024-26868 bsc#1223038).
  - Update
    patches.suse/nfsd-Fix-error-cleanup-path-in-nfsd_rename.patch
    (bsc#1221044 CVE-2023-52591 CVE-2024-35914 bsc#1224482).
  - Update
    patches.suse/nouveau-fix-instmem-race-condition-around-ptr-stores.patch
    (git-fixes CVE-2024-26984 bsc#1223633).
  - Update patches.suse/nouveau-lock-the-client-object-tree.patch
    (stable-fixes CVE-2024-27062 bsc#1223834).
  - Update
    patches.suse/nvme-fc-do-not-wait-in-vain-when-unloading-module.patch
    (git-fixes CVE-2024-26846 bsc#1223023).
  - Update
    patches.suse/nvme-fix-reconnection-fail-due-to-reserved-tag-alloc.patch
    (git-fixes CVE-2024-27435 bsc#1224717).
  - Update
    patches.suse/octeontx2-af-Use-separate-handlers-for-interrupts.patch
    (git-fixes CVE-2024-27030 bsc#1223790).
  - Update
    patches.suse/octeontx2-pf-Fix-transmit-scheduler-resource-leak.patch
    (git-fixes CVE-2024-35975 bsc#1224569).
  - Update
    patches.suse/of-dynamic-Synchronize-of_changeset_destroy-with-the.patch
    (git-fixes CVE-2024-35879 bsc#1224524).
  - Update
    patches.suse/of-module-prevent-NULL-pointer-dereference-in-vsnpri.patch
    (stable-fixes CVE-2024-35878 bsc#1224671).
  - Update
    patches.suse/phy-marvell-a3700-comphy-Fix-out-of-bounds-read.patch
    (git-fixes CVE-2024-35992 bsc#1224555).
  - Update
    patches.suse/phy-ti-tusb1210-Resolve-charger-det-crash-if-charger.patch
    (git-fixes CVE-2024-35986 bsc#1224562).
  - Update
    patches.suse/platform-chrome-cros_ec_uart-properly-fix-race-condi.patch
    (git-fixes CVE-2024-35977 bsc#1224568).
  - Update
    patches.suse/power-supply-bq27xxx-i2c-Do-not-free-non-existing-IR.patch
    (git-fixes CVE-2024-27412 bsc#1224437).
  - Update
    patches.suse/pstore-inode-Only-d_invalidate-is-needed.patch
    (git-fixes CVE-2024-27389 bsc#1223705).
  - Update
    patches.suse/pstore-zone-Add-a-null-pointer-check-to-the-psz_kmsg.patch
    (stable-fixes CVE-2024-35940 bsc#1224537).
  - Update
    patches.suse/s390-zcrypt-fix-reference-counting-on-zcrypt-card-objects.patch
    (git-fixes bsc#1223592 CVE-2024-26957 bsc#1223666).
  - Update
    patches.suse/scsi-core-Fix-unremoved-procfs-host-directory-regression.patch
    (git-fixes CVE-2024-26935 bsc#1223675).
  - Update
    patches.suse/scsi-lpfc-Fix-possible-memory-leak-in-lpfc_rcv_padis.patch
    (bsc#1220021 CVE-2024-35930 bsc#1224651).
  - Update patches.suse/scsi-sg-Avoid-sg-device-teardown-race.patch
    (git-fixes CVE-2024-35954 bsc#1224675).
  - Update
    patches.suse/scsi-smartpqi-Fix-disable_managed_interrupts.patch
    (git-fixes CVE-2024-26742 bsc#1222608).
  - Update
    patches.suse/selinux-avoid-dereference-of-garbage-after-mount-fai.patch
    (git-fixes CVE-2024-35904 bsc#1224494).
  - Update
    patches.suse/serial-mxs-auart-add-spinlock-around-changing-cts-st.patch
    (git-fixes CVE-2024-27000 bsc#1223757).
  - Update
    patches.suse/serial-pmac_zilog-Remove-flawed-mitigation-for-rx-ir.patch
    (git-fixes CVE-2024-26999 bsc#1223754).
  - Update
    patches.suse/soc-fsl-qbman-Always-disable-interrupts-when-taking-.patch
    (git-fixes CVE-2024-35806 bsc#1224699).
  - Update
    patches.suse/soc-fsl-qbman-Use-raw-spinlock-for-cgr_lock.patch
    (git-fixes CVE-2024-35819 bsc#1224683).
  - Update patches.suse/speakup-Avoid-crash-on-very-long-word.patch
    (git-fixes CVE-2024-26994 bsc#1223750).
  - Update
    patches.suse/spi-lpspi-Avoid-potential-use-after-free-in-probe.patch
    (git-fixes CVE-2024-26866 bsc#1223024).
  - Update
    patches.suse/spi-mchp-pci1xxx-Fix-a-possible-null-pointer-derefer.patch
    (git-fixes CVE-2024-35883 bsc#1224521).
  - Update
    patches.suse/spi-spi-mt65xx-Fix-NULL-pointer-access-in-interrupt-.patch
    (git-fixes CVE-2024-27028 bsc#1223788).
  - Update
    patches.suse/ubifs-Set-page-uptodate-in-the-correct-place.patch
    (git-fixes CVE-2024-35821 bsc#1224629).
  - Update
    patches.suse/usb-cdc-wdm-close-race-between-read-and-workqueue.patch
    (git-fixes CVE-2024-35812 bsc#1224624).
  - Update
    patches.suse/usb-dwc2-host-Fix-dereference-issue-in-DDMA-completi.patch
    (git-fixes CVE-2024-26997 bsc#1223741).
  - Update
    patches.suse/usb-dwc3-am62-fix-module-unload-reload-behavior.patch
    (git-fixes CVE-2024-26963 bsc#1223651).
  - Update
    patches.suse/usb-gadget-f_ncm-Fix-UAF-ncm-object-at-re-bind-after.patch
    (stable-fixes CVE-2024-26996 bsc#1223752).
  - Update
    patches.suse/usb-gadget-ncm-Avoid-dropping-datagrams-of-properly-.patch
    (git-fixes CVE-2024-27405 bsc#1224423).
  - Update
    patches.suse/usb-gadget-ncm-Fix-handling-of-zero-block-length-pac.patch
    (git-fixes CVE-2024-35825 bsc#1224681).
  - Update
    patches.suse/usb-typec-altmodes-displayport-create-sysfs-nodes-as.patch
    (git-fixes CVE-2024-35790 bsc#1224712).
  - Update
    patches.suse/usb-typec-tcpm-Correct-the-PDO-counting-in-pd_set.patch
    (git-fixes CVE-2024-26995 bsc#1223696).
  - Update
    patches.suse/usb-typec-tcpm-fix-double-free-issue-in-tcpm_port_un.patch
    (git-fixes CVE-2024-26932 bsc#1223649).
  - Update patches.suse/usb-typec-ucsi-Limit-read-size-on-v1.2.patch
    (stable-fixes CVE-2024-35924 bsc#1224657).
  - Update
    patches.suse/usb-udc-remove-warning-when-queue-disabled-ep.patch
    (stable-fixes CVE-2024-35822 bsc#1224739).
  - Update
    patches.suse/usb-xhci-Add-error-handling-in-xhci_map_urb_for_dma.patch
    (git-fixes CVE-2024-26964 bsc#1223650).
  - Update
    patches.suse/vt-fix-unicode-buffer-corruption-when-deleting-chara.patch
    (git-fixes CVE-2024-35823 bsc#1224692).
  - Update
    patches.suse/wifi-ath11k-decrease-MHI-channel-buffer-length-to-8K.patch
    (bsc#1207948 CVE-2024-35938 bsc#1224643).
  - Update
    patches.suse/wifi-brcmfmac-Fix-use-after-free-bug-in-brcmf_cfg802.patch
    (CVE-2023-47233 bsc#1216702 CVE-2024-35811 bsc#1224592).
  - Update
    patches.suse/wifi-cfg80211-check-A-MSDU-format-more-carefully.patch
    (stable-fixes CVE-2024-35937 bsc#1224526).
  - Update
    patches.suse/wifi-iwlwifi-dbg-tlv-ensure-NUL-termination.patch
    (git-fixes CVE-2024-35845 bsc#1224731).
  - Update
    patches.suse/wifi-iwlwifi-mvm-don-t-set-the-MFP-flag-for-the-GTK.patch
    (git-fixes CVE-2024-27434 bsc#1224710).
  - Update
    patches.suse/wifi-iwlwifi-mvm-rfi-fix-potential-response-leaks.patch
    (git-fixes CVE-2024-35912 bsc#1224487).
  - Update
    patches.suse/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
    (git-fixes CVE-2024-35828 bsc#1224622).
  - Update
    patches.suse/wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch
    (stable-fixes CVE-2024-35789 bsc#1224749).
  - Update
    patches.suse/wifi-mac80211-fix-potential-sta-link-leak.patch
    (git-fixes CVE-2024-35838 bsc#1224613).
  - Update
    patches.suse/wifi-nl80211-reject-iftype-change-with-mesh-ID-chang.patch
    (git-fixes CVE-2024-27410 bsc#1224432).
  - Update
    patches.suse/wifi-rtw89-fix-null-pointer-access-when-abort-scan.patch
    (stable-fixes CVE-2024-35946 bsc#1224646).
  - Update
    patches.suse/wireguard-netlink-access-device-through-ctx-instead-.patch
    (git-fixes CVE-2024-26950 bsc#1223661).
  - Update
    patches.suse/wireguard-netlink-check-for-dangling-peer-via-is_dea.patch
    (git-fixes CVE-2024-26951 bsc#1223660).
  - Update
    patches.suse/wireguard-receive-annotate-data-race-around-receivin.patch
    (git-fixes CVE-2024-26861 bsc#1223076).
  - Update
    patches.suse/x86-coco-Require-seeding-RNG-with-RDRAND-on-CoCo-systems.patch
    (git-fixes CVE-2024-35875 bsc#1224665).
  - Update
    patches.suse/x86-fpu-Keep-xfd_state-in-sync-with-MSR_IA32_XFD.patch
    (git-fixes CVE-2024-35801 bsc#1224732).
  - Update
    patches.suse/xen-evtchn-avoid-WARN-when-unbinding-an-event-channe.patch
    (git-fixes CVE-2024-27067 bsc#1223739).
  - Update
    patches.suse/xsk-recycle-buffer-in-case-Rx-queue-was-full.patch
    (bsc#1221303 CVE-2024-26611 CVE-2024-35834 bsc#1224620).
  - commit 005afc6
  - Update
    patches.suse/ACPI-LPIT-Avoid-u32-multiplication-overflow.patch
    (git-fixes CVE-2023-52683 bsc#1224627).
  - Update
    patches.suse/ACPI-video-check-for-error-while-searching-for-backl.patch
    (git-fixes CVE-2023-52693 bsc#1224686).
  - Update
    patches.suse/ASoC-Intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch
    (git-fixes CVE-2023-52697 bsc#1224596).
  - Update
    patches.suse/ASoC-SOF-amd-Fix-memory-leak-in-amd_sof_acp_probe.patch
    (git-fixes CVE-2023-52663 bsc#1224630).
  - Update
    patches.suse/Revert-drm-amd-pm-resolve-reboot-exception-for-si-ol.patch
    (git-fixes CVE-2023-52657 bsc#1224722).
  - Update
    patches.suse/Revert-net-mlx5-Block-entering-switchdev-mode-with-n.patch
    (git-fixes CVE-2023-52658 bsc#1224719).
  - Update
    patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch
    (git-fixes CVE-2023-52653 bsc#1223712).
  - Update
    patches.suse/bpf-Guard-stack-limits-against-32bit-overflow.patch
    (git-fixes CVE-2023-52676 bsc#1224730).
  - Update
    patches.suse/crypto-rsa-add-a-check-for-allocation-failure.patch
    (bsc#1222775 CVE-2023-52472 bsc#1220430).
  - Update
    patches.suse/crypto-s390-aes-Fix-buffer-overread-in-CTR-mode.patch
    (git-fixes CVE-2023-52669 bsc#1224637).
  - Update
    patches.suse/crypto-safexcel-Add-error-handling-for-dma_map_sg-ca.patch
    (git-fixes CVE-2023-52687 bsc#1224501).
  - Update
    patches.suse/drm-amd-display-Check-writeback-connectors-in-create.patch
    (git-fixes CVE-2023-52695 bsc#1224506).
  - Update
    patches.suse/drm-amd-display-Fix-a-debugfs-null-pointer-error.patch
    (git-fixes CVE-2023-52673 bsc#1224741).
  - Update
    patches.suse/drm-amd-display-Fix-hang-underflow-when-transitionin.patch
    (git-fixes CVE-2023-52671 bsc#1224729).
  - Update
    patches.suse/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
    (git-fixes CVE-2023-52691 bsc#1224607).
  - Update
    patches.suse/drm-amdkfd-Confirm-list-is-non-empty-before-utilizin.patch
    (git-fixes CVE-2023-52678 bsc#1224617).
  - Update
    patches.suse/drm-bridge-tpd12s015-Drop-buggy-__exit-annotation-fo.patch
    (git-fixes CVE-2023-52694 bsc#1224598).
  - Update
    patches.suse/drm-tegra-rgb-Fix-missing-clk_put-in-the-error-handl.patch
    (git-fixes CVE-2023-52661 bsc#1224445).
  - Update
    patches.suse/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
    (git-fixes CVE-2023-52662 bsc#1224449).
  - Update patches.suse/efivarfs-Free-s_fs_info-on-unmount.patch
    (bsc#1220328 CVE-2023-52463 CVE-2023-52681 bsc#1224505).
  - Update
    patches.suse/media-rkisp1-Fix-IRQ-handling-due-to-shared-interrup.patch
    (stable-fixes CVE-2023-52660 bsc#1224443).
  - Update
    patches.suse/net-atlantic-eliminate-double-free-in-error-handling.patch
    (git-fixes CVE-2023-52664 bsc#1224747).
  - Update
    patches.suse/net-mlx5e-fix-a-potential-double-free-in-fs_any_crea.patch
    (jsc#PED-3311 CVE-2023-52667 bsc#1224603).
  - Update
    patches.suse/of-Fix-double-free-in-of_parse_phandle_with_args_map.patch
    (git-fixes CVE-2023-52679 bsc#1224508).
  - Update
    patches.suse/powerpc-imc-pmu-Add-a-null-pointer-check-in-update_events_in_group.patch
    (git-fixes CVE-2023-52675 bsc#1224504).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_eve.patch
    (bsc#1065729 CVE-2023-52686 bsc#1224682).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_pow.patch
    (bsc#1181674 ltc#189159 git-fixes CVE-2023-52696 bsc#1224601).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-to-scom_deb.patch
    (bsc#1194869 CVE-2023-52690 bsc#1224611).
  - Update
    patches.suse/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
    (git-fixes CVE-2023-52685 bsc#1224728).
  - Update
    patches.suse/rpmsg-virtio-Free-driver_override-when-rpmsg_remove.patch
    (git-fixes CVE-2023-52670 bsc#1224696).
  - commit 578211b
  - vhost: Add smp_rmb() in vhost_enable_notify() (git-fixes).
  - commit 2e20e2c
  - vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).
  - commit 936d53e
  - virtio_net: Do not send RSS key if it is not supported
    (git-fixes).
  - commit cc7c4a0
  - vsock/virtio: fix packet delivery to tap device (git-fixes).
  - commit dfd8673
  - virtio-blk: Ensure no requests in virtqueues before deleting
    vqs (git-fixes).
  - commit 966a23e
  - KVM: VMX: Disable LBR virtualization if the CPU doesn't support
    LBR callstacks (git-fixes).
  - commit f941b05
  - efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory (git-fixes).
  - commit c99f198
  - proc/kcore: do not try to access unaccepted memory (git-fixes).
  - commit 2daf00c
  - efi/unaccepted: touch soft lockup during memory accept (git-fixes).
  - commit 45ed7cb
  - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (bsc#1224442 CVE-2023-52659).
  - commit dad72fd
  - kabi fix of perf/x86/intel: Expose existence of callback support to KVM
    (git fixes).
  - commit 5db441c
  - perf/x86/intel: Expose existence of callback support to KVM
    (git-fixes).
  - commit b24b5fc
  - kABI fix of KVM: x86: Snapshot if a vCPU's vendor model is AMD vs.
    Intel compatible (git-fixes).
  - commit 38bcaaa
  - ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE
    (bsc#1224866).
  - commit 6a4b4a1
  - supported.conf: Add APM X-Gene SoC hardware monitoring driver (bsc#1223265 jsc#PED-8570)
  - commit 4b0eeb3
  - blacklist.conf: cephfs client logging infrastructure commits
    These two commits are useless in isolation, they are part of a larger set
    of commits that add extra info to debug logs.
  - commit 2056926
  - remoteproc: k3-r5: Jump to error handling labels in start/stop
    errors (git-fixes).
  - commit 6f545f8
  - libsubcmd: Fix parse-options memory leak (git-fixes).
  - dmaengine: idxd: Avoid unnecessary destruction of file_ida
    (git-fixes).
  - dmaengine: axi-dmac: fix possible race in remove() (git-fixes).
  - dmaengine: idma64: Add check for dma_set_max_seg_size
    (git-fixes).
  - remoteproc: k3-r5: Do not allow core1 to power up before core0
    via sysfs (git-fixes).
  - remoteproc: k3-r5: Wait for core0 power-up before powering up
    core1 (git-fixes).
  - remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
    (git-fixes).
  - PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).
  - PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id
    (git-fixes).
  - PCI: dwc: ep: Fix DBI access failure for drivers requiring
    refclk from host (git-fixes).
  - PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3
    (git-fixes).
  - PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3
    (git-fixes).
  - KEYS: trusted: Do not use WARN when encode fails (git-fixes).
  - KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).
  - commit d7da373

++++ python-requests:

  - Update to 2.32.2
    * To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,
    we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing
    custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
    considered deprecated in all versions of Requests>=2.32.0.

++++ python-requests:

  - Update to 2.32.2
    * To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,
    we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing
    custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
    considered deprecated in all versions of Requests>=2.32.0.

++++ python-requests:

  - Update to 2.32.2
    * To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,
    we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing
    custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
    considered deprecated in all versions of Requests>=2.32.0.

++++ python-requests:

  - Update to 2.32.2
    * To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,
    we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing
    custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
    considered deprecated in all versions of Requests>=2.32.0.

------------------------------------------------------------------
------------------  2024-5-21  -  May 21 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is
    enabled (git-fixes).
  - commit 7d13726
  - KVM: x86: Allow, don't ignore, same-value writes to immutable
    MSRs (git-fixes).
  - commit e25e965
  - KVM: nVMX: Clear EXIT_QUALIFICATION when injecting an EPT
    Misconfig (git-fixes).
  - commit 21a74db
  - KVM: x86/mmu: Don't force emulation of L2 accesses to non-APIC
    internal slots (git-fixes).
  - commit b2d6429
  - KVM: x86/mmu: Move private vs. shared check above slot validity
    checks (git-fixes).
  - commit 2108d3a
  - KVM: x86: Fully re-initialize supported_mce_cap on vendor
    module load (git-fixes).
  - commit 52160e6
  - KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing
    dirty status (git-fixes).
  - commit 7bdd69f
  - blacklist.conf: Add a1fd0b9d751f sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
  - commit 3d0aa70
  - drm/nouveau/disp: Fix missing backlight control on Macbook 5,
    1 (bsc#1223838).
  - commit 07ffc12
  - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)
  - commit 55fb87b
  - swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)
  - commit 8bebd77
  - swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)
  - commit fcf796a
  - swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)
  - commit c65bb03
  - KVM: x86/pmu: Set enable bits for GP counters in
    PERF_GLOBAL_CTRL at "RESET" (git-fixes).
  - commit 1ba62ae
  - KVM: x86/pmu: Disable support for adaptive PEBS (git-fixes).
  - commit 9862bdd
  - KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD
    platforms (git-fixes).
  - commit 5f8077d
  - KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel
    compatible (git-fixes).
  - commit c9c8902
  - x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM
    (git-fixes).
  - commit f882a8e
  - KVM: x86: Use actual kvm_cpuid.base for clearing
    KVM_FEATURE_PV_UNHALT (git-fixes).
  - commit 80b67d0
  - s390/cio: fix tracepoint subchannel type field (git-fixes
    bsc#1224793).
  - commit f1aa928
  - s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes
    bsc#1224792).
  - commit d08e4ce
  - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M
    (git-fixes bsc#1224790).
  - commit b0b1c22
  - KVM: x86: Introduce __kvm_get_hypervisor_cpuid() helper
    (git-fixes).
  - commit 652c188
  - rpm/kernel-obs-build.spec.in: remove reiserfs from OBS initrd
    We disabled the FS in bug 1202309. And we actively blacklist it in:
    /usr/lib/modprobe.d/60-blacklist_fs-reiserfs.conf
    This, as a side-effect, fixes obs-build's warning:
    dracut-pre-udev[1463]: sh: line 1: /usr/lib/module-init-tools/unblacklist: No such file or directory
    Exactly due to the above 60-blacklist_fs-reiserfs.conf trying to call the
    above unblacklist.
    We should likely drop ext2+ext3 from the list too, as we don't build
    them at all. But that's a different story.
  - commit 9e1a078
  - KVM: SVM: Add support for allowing zero SEV ASIDs (git-fixes).
  - commit 9327154
  - KVM: SVM: Use unsigned integers when dealing with ASIDs
    (git-fixes).
  - commit b0fec37
  - tools/power turbostat: Expand probe_intel_uncore_frequency()
    (bsc#1221765).
  - commit 7c0d70f
  - KVM: x86/xen: fix recursive deadlock in timer injection
    (git-fixes).
  - commit 389ea84
  - KVM: x86/xen: remove WARN_ON_ONCE() with false positives in
    evtchn delivery (git-fixes).
  - commit d63a8c9
  - KVM: x86/xen: inject vCPU upcall vector when local APIC is
    enabled (git-fixes).
  - commit 538dcab
  - KVM: x86/xen: improve accuracy of Xen timers (git-fixes).
  - commit 921d76d
  - KVM: x86/pmu: Explicitly check NMI from guest to reducee false
    positives (git-fixes).
  - commit be2edf0
  - KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled
    (git-fixes).
  - commit fe18eef
  - KVM: x86/pmu: Disallow "fast" RDPMC for architectural Intel PMUs
    (git-fixes).
  - commit 406de6b
  - KVM: x86/pmu: Apply "fast" RDPMC only to Intel PMUs (git-fixes).
  - commit dd1520f
  - KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC
    due to bad index (git-fixes).
  - commit b2e9cf1
  - blacklist.conf: add "libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos"
  - commit f859338
  - KVM: x86/pmu: Don't ignore bits 31:30 for RDPMC index on AMD
    (git-fixes).
  - commit fd656b7
  - KVM: x86/pmu: Allow programming events that match unsupported
    arch events (git-fixes).
  - commit 60f57dc
  - firmware: dmi-id: add a release callback function (git-fixes).
  - watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in
    sa1100dog_probe() (git-fixes).
  - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a
    safety margin (git-fixes).
  - watchdog: bd9576: Drop "always-running" property (git-fixes).
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by
    cpu5wdt_trigger (git-fixes).
  - i2c: acpi: Unbind mux adapters before delete (git-fixes).
  - i2c: synquacer: Fix an error handling path in
    synquacer_i2c_probe() (git-fixes).
  - i2c: cadence: Avoid fifo clear after start (git-fixes).
  - pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins
    regs (git-fixes).
  - pinctrl: armada-37xx: remove an unused variable (git-fixes).
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (git-fixes).
  - commit 60d82a4
  - KVM: x86/pmu: Always treat Fixed counters as available when
    supported (git-fixes).
  - commit c4b0d18
  - KVM: VMX: Report up-to-date exit qualification to userspace
    (git-fixes).
  - commit d6b020d
  - KVM: x86: Fix broken debugregs ABI for 32 bit kernels
    (git-fixes).
  - commit 69a1ee8
  - SEV: disable SEV-ES DebugSwap by default (git-fixes).
  - commit dcaff2f
  - KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU
    (git-fixes).
  - commit c561279
  - KVM: x86: Update KVM_SW_PROTECTED_VM docs to make it clear
    they're a WIP (git-fixes).
  - commit aba16e8
  - KVM: x86: Mark target gfn of emulated atomic instruction as
    dirty (git-fixes).
  - commit 303882a
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in
    svm_register_enc_region() (git-fixes).
  - commit 4382f8a

++++ kernel-default:

  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is
    enabled (git-fixes).
  - commit 7d13726
  - KVM: x86: Allow, don't ignore, same-value writes to immutable
    MSRs (git-fixes).
  - commit e25e965
  - KVM: nVMX: Clear EXIT_QUALIFICATION when injecting an EPT
    Misconfig (git-fixes).
  - commit 21a74db
  - KVM: x86/mmu: Don't force emulation of L2 accesses to non-APIC
    internal slots (git-fixes).
  - commit b2d6429
  - KVM: x86/mmu: Move private vs. shared check above slot validity
    checks (git-fixes).
  - commit 2108d3a
  - KVM: x86: Fully re-initialize supported_mce_cap on vendor
    module load (git-fixes).
  - commit 52160e6
  - KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing
    dirty status (git-fixes).
  - commit 7bdd69f
  - blacklist.conf: Add a1fd0b9d751f sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
  - commit 3d0aa70
  - drm/nouveau/disp: Fix missing backlight control on Macbook 5,
    1 (bsc#1223838).
  - commit 07ffc12
  - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)
  - commit 55fb87b
  - swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)
  - commit 8bebd77
  - swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)
  - commit fcf796a
  - swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)
  - commit c65bb03
  - KVM: x86/pmu: Set enable bits for GP counters in
    PERF_GLOBAL_CTRL at "RESET" (git-fixes).
  - commit 1ba62ae
  - KVM: x86/pmu: Disable support for adaptive PEBS (git-fixes).
  - commit 9862bdd
  - KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD
    platforms (git-fixes).
  - commit 5f8077d
  - KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel
    compatible (git-fixes).
  - commit c9c8902
  - x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM
    (git-fixes).
  - commit f882a8e
  - KVM: x86: Use actual kvm_cpuid.base for clearing
    KVM_FEATURE_PV_UNHALT (git-fixes).
  - commit 80b67d0
  - s390/cio: fix tracepoint subchannel type field (git-fixes
    bsc#1224793).
  - commit f1aa928
  - s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes
    bsc#1224792).
  - commit d08e4ce
  - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M
    (git-fixes bsc#1224790).
  - commit b0b1c22
  - KVM: x86: Introduce __kvm_get_hypervisor_cpuid() helper
    (git-fixes).
  - commit 652c188
  - rpm/kernel-obs-build.spec.in: remove reiserfs from OBS initrd
    We disabled the FS in bug 1202309. And we actively blacklist it in:
    /usr/lib/modprobe.d/60-blacklist_fs-reiserfs.conf
    This, as a side-effect, fixes obs-build's warning:
    dracut-pre-udev[1463]: sh: line 1: /usr/lib/module-init-tools/unblacklist: No such file or directory
    Exactly due to the above 60-blacklist_fs-reiserfs.conf trying to call the
    above unblacklist.
    We should likely drop ext2+ext3 from the list too, as we don't build
    them at all. But that's a different story.
  - commit 9e1a078
  - KVM: SVM: Add support for allowing zero SEV ASIDs (git-fixes).
  - commit 9327154
  - KVM: SVM: Use unsigned integers when dealing with ASIDs
    (git-fixes).
  - commit b0fec37
  - tools/power turbostat: Expand probe_intel_uncore_frequency()
    (bsc#1221765).
  - commit 7c0d70f
  - KVM: x86/xen: fix recursive deadlock in timer injection
    (git-fixes).
  - commit 389ea84
  - KVM: x86/xen: remove WARN_ON_ONCE() with false positives in
    evtchn delivery (git-fixes).
  - commit d63a8c9
  - KVM: x86/xen: inject vCPU upcall vector when local APIC is
    enabled (git-fixes).
  - commit 538dcab
  - KVM: x86/xen: improve accuracy of Xen timers (git-fixes).
  - commit 921d76d
  - KVM: x86/pmu: Explicitly check NMI from guest to reducee false
    positives (git-fixes).
  - commit be2edf0
  - KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled
    (git-fixes).
  - commit fe18eef
  - KVM: x86/pmu: Disallow "fast" RDPMC for architectural Intel PMUs
    (git-fixes).
  - commit 406de6b
  - KVM: x86/pmu: Apply "fast" RDPMC only to Intel PMUs (git-fixes).
  - commit dd1520f
  - KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC
    due to bad index (git-fixes).
  - commit b2e9cf1
  - blacklist.conf: add "libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos"
  - commit f859338
  - KVM: x86/pmu: Don't ignore bits 31:30 for RDPMC index on AMD
    (git-fixes).
  - commit fd656b7
  - KVM: x86/pmu: Allow programming events that match unsupported
    arch events (git-fixes).
  - commit 60f57dc
  - firmware: dmi-id: add a release callback function (git-fixes).
  - watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in
    sa1100dog_probe() (git-fixes).
  - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a
    safety margin (git-fixes).
  - watchdog: bd9576: Drop "always-running" property (git-fixes).
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by
    cpu5wdt_trigger (git-fixes).
  - i2c: acpi: Unbind mux adapters before delete (git-fixes).
  - i2c: synquacer: Fix an error handling path in
    synquacer_i2c_probe() (git-fixes).
  - i2c: cadence: Avoid fifo clear after start (git-fixes).
  - pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins
    regs (git-fixes).
  - pinctrl: armada-37xx: remove an unused variable (git-fixes).
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (git-fixes).
  - commit 60d82a4
  - KVM: x86/pmu: Always treat Fixed counters as available when
    supported (git-fixes).
  - commit c4b0d18
  - KVM: VMX: Report up-to-date exit qualification to userspace
    (git-fixes).
  - commit d6b020d
  - KVM: x86: Fix broken debugregs ABI for 32 bit kernels
    (git-fixes).
  - commit 69a1ee8
  - SEV: disable SEV-ES DebugSwap by default (git-fixes).
  - commit dcaff2f
  - KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU
    (git-fixes).
  - commit c561279
  - KVM: x86: Update KVM_SW_PROTECTED_VM docs to make it clear
    they're a WIP (git-fixes).
  - commit aba16e8
  - KVM: x86: Mark target gfn of emulated atomic instruction as
    dirty (git-fixes).
  - commit 303882a
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in
    svm_register_enc_region() (git-fixes).
  - commit 4382f8a

++++ kernel-default:

  - KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is
    enabled (git-fixes).
  - commit 7d13726
  - KVM: x86: Allow, don't ignore, same-value writes to immutable
    MSRs (git-fixes).
  - commit e25e965
  - KVM: nVMX: Clear EXIT_QUALIFICATION when injecting an EPT
    Misconfig (git-fixes).
  - commit 21a74db
  - KVM: x86/mmu: Don't force emulation of L2 accesses to non-APIC
    internal slots (git-fixes).
  - commit b2d6429
  - KVM: x86/mmu: Move private vs. shared check above slot validity
    checks (git-fixes).
  - commit 2108d3a
  - KVM: x86: Fully re-initialize supported_mce_cap on vendor
    module load (git-fixes).
  - commit 52160e6
  - KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing
    dirty status (git-fixes).
  - commit 7bdd69f
  - blacklist.conf: Add a1fd0b9d751f sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
  - commit 3d0aa70
  - drm/nouveau/disp: Fix missing backlight control on Macbook 5,
    1 (bsc#1223838).
  - commit 07ffc12
  - iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)
  - commit 55fb87b
  - swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)
  - commit 8bebd77
  - swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)
  - commit fcf796a
  - swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)
  - commit c65bb03
  - KVM: x86/pmu: Set enable bits for GP counters in
    PERF_GLOBAL_CTRL at "RESET" (git-fixes).
  - commit 1ba62ae
  - KVM: x86/pmu: Disable support for adaptive PEBS (git-fixes).
  - commit 9862bdd
  - KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD
    platforms (git-fixes).
  - commit 5f8077d
  - KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel
    compatible (git-fixes).
  - commit c9c8902
  - x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM
    (git-fixes).
  - commit f882a8e
  - KVM: x86: Use actual kvm_cpuid.base for clearing
    KVM_FEATURE_PV_UNHALT (git-fixes).
  - commit 80b67d0
  - s390/cio: fix tracepoint subchannel type field (git-fixes
    bsc#1224793).
  - commit f1aa928
  - s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes
    bsc#1224792).
  - commit d08e4ce
  - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M
    (git-fixes bsc#1224790).
  - commit b0b1c22
  - KVM: x86: Introduce __kvm_get_hypervisor_cpuid() helper
    (git-fixes).
  - commit 652c188
  - rpm/kernel-obs-build.spec.in: remove reiserfs from OBS initrd
    We disabled the FS in bug 1202309. And we actively blacklist it in:
    /usr/lib/modprobe.d/60-blacklist_fs-reiserfs.conf
    This, as a side-effect, fixes obs-build's warning:
    dracut-pre-udev[1463]: sh: line 1: /usr/lib/module-init-tools/unblacklist: No such file or directory
    Exactly due to the above 60-blacklist_fs-reiserfs.conf trying to call the
    above unblacklist.
    We should likely drop ext2+ext3 from the list too, as we don't build
    them at all. But that's a different story.
  - commit 9e1a078
  - KVM: SVM: Add support for allowing zero SEV ASIDs (git-fixes).
  - commit 9327154
  - KVM: SVM: Use unsigned integers when dealing with ASIDs
    (git-fixes).
  - commit b0fec37
  - tools/power turbostat: Expand probe_intel_uncore_frequency()
    (bsc#1221765).
  - commit 7c0d70f
  - KVM: x86/xen: fix recursive deadlock in timer injection
    (git-fixes).
  - commit 389ea84
  - KVM: x86/xen: remove WARN_ON_ONCE() with false positives in
    evtchn delivery (git-fixes).
  - commit d63a8c9
  - KVM: x86/xen: inject vCPU upcall vector when local APIC is
    enabled (git-fixes).
  - commit 538dcab
  - KVM: x86/xen: improve accuracy of Xen timers (git-fixes).
  - commit 921d76d
  - KVM: x86/pmu: Explicitly check NMI from guest to reducee false
    positives (git-fixes).
  - commit be2edf0
  - KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled
    (git-fixes).
  - commit fe18eef
  - KVM: x86/pmu: Disallow "fast" RDPMC for architectural Intel PMUs
    (git-fixes).
  - commit 406de6b
  - KVM: x86/pmu: Apply "fast" RDPMC only to Intel PMUs (git-fixes).
  - commit dd1520f
  - KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC
    due to bad index (git-fixes).
  - commit b2e9cf1
  - blacklist.conf: add "libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos"
  - commit f859338
  - KVM: x86/pmu: Don't ignore bits 31:30 for RDPMC index on AMD
    (git-fixes).
  - commit fd656b7
  - KVM: x86/pmu: Allow programming events that match unsupported
    arch events (git-fixes).
  - commit 60f57dc
  - firmware: dmi-id: add a release callback function (git-fixes).
  - watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in
    sa1100dog_probe() (git-fixes).
  - watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a
    safety margin (git-fixes).
  - watchdog: bd9576: Drop "always-running" property (git-fixes).
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by
    cpu5wdt_trigger (git-fixes).
  - i2c: acpi: Unbind mux adapters before delete (git-fixes).
  - i2c: synquacer: Fix an error handling path in
    synquacer_i2c_probe() (git-fixes).
  - i2c: cadence: Avoid fifo clear after start (git-fixes).
  - pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins
    regs (git-fixes).
  - pinctrl: armada-37xx: remove an unused variable (git-fixes).
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (git-fixes).
  - commit 60d82a4
  - KVM: x86/pmu: Always treat Fixed counters as available when
    supported (git-fixes).
  - commit c4b0d18
  - KVM: VMX: Report up-to-date exit qualification to userspace
    (git-fixes).
  - commit d6b020d
  - KVM: x86: Fix broken debugregs ABI for 32 bit kernels
    (git-fixes).
  - commit 69a1ee8
  - SEV: disable SEV-ES DebugSwap by default (git-fixes).
  - commit dcaff2f
  - KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU
    (git-fixes).
  - commit c561279
  - KVM: x86: Update KVM_SW_PROTECTED_VM docs to make it clear
    they're a WIP (git-fixes).
  - commit aba16e8
  - KVM: x86: Mark target gfn of emulated atomic instruction as
    dirty (git-fixes).
  - commit 303882a
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in
    svm_register_enc_region() (git-fixes).
  - commit 4382f8a

++++ kernel-firmware:

  - Update to version 20240519 (git commit aae8224390e2):
    * amdgpu: add new ISP 4.1.1 firmware

++++ kernel-firmware:

  - Update to version 20240519 (git commit aae8224390e2):
    * amdgpu: add new ISP 4.1.1 firmware

++++ kernel-firmware:

  - Update to version 20240519 (git commit aae8224390e2):
    * amdgpu: add new ISP 4.1.1 firmware

++++ gcc13:

  - Update to GCC 13.3 release

++++ gcc13:

  - Update to GCC 13.3 release

++++ util-linux:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

++++ util-linux:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

++++ util-linux:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

++++ util-linux:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

++++ python-requests:

  - Update to 2.32.1
    * Fixed an issue where setting verify=False on the first request from a Session
    will cause subsequent requests to the same origin to also ignore cert verification,
    regardless of the value of verify. (bsc#1224788, CVE-2024-35195)
    * verify=True now reuses a global SSLContext which should improve request time
    variance between first and subsequent requests.
    * Requests now supports optional use of character detection (chardet or charset_normalizer)
    when repackaged or vendored. This enables pip and other projects to minimize their
    vendoring surface area.
    * Requests has officially added support for CPython 3.12 and dropped support for CPython 3.7.
    * Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system using hatchling.

++++ python-requests:

  - Update to 2.32.1
    * Fixed an issue where setting verify=False on the first request from a Session
    will cause subsequent requests to the same origin to also ignore cert verification,
    regardless of the value of verify. (bsc#1224788, CVE-2024-35195)
    * verify=True now reuses a global SSLContext which should improve request time
    variance between first and subsequent requests.
    * Requests now supports optional use of character detection (chardet or charset_normalizer)
    when repackaged or vendored. This enables pip and other projects to minimize their
    vendoring surface area.
    * Requests has officially added support for CPython 3.12 and dropped support for CPython 3.7.
    * Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system using hatchling.

++++ python-requests:

  - Update to 2.32.1
    * Fixed an issue where setting verify=False on the first request from a Session
    will cause subsequent requests to the same origin to also ignore cert verification,
    regardless of the value of verify. (bsc#1224788, CVE-2024-35195)
    * verify=True now reuses a global SSLContext which should improve request time
    variance between first and subsequent requests.
    * Requests now supports optional use of character detection (chardet or charset_normalizer)
    when repackaged or vendored. This enables pip and other projects to minimize their
    vendoring surface area.
    * Requests has officially added support for CPython 3.12 and dropped support for CPython 3.7.
    * Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system using hatchling.

++++ python-requests:

  - Update to 2.32.1
    * Fixed an issue where setting verify=False on the first request from a Session
    will cause subsequent requests to the same origin to also ignore cert verification,
    regardless of the value of verify. (bsc#1224788, CVE-2024-35195)
    * verify=True now reuses a global SSLContext which should improve request time
    variance between first and subsequent requests.
    * Requests now supports optional use of character detection (chardet or charset_normalizer)
    when repackaged or vendored. This enables pip and other projects to minimize their
    vendoring surface area.
    * Requests has officially added support for CPython 3.12 and dropped support for CPython 3.7.
    * Starting in Requests 2.33.0, Requests will migrate to a PEP 517 build system using hatchling.

++++ util-linux-systemd:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

++++ util-linux-systemd:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

++++ util-linux-systemd:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

++++ util-linux-systemd:

  - Document that chcpu -g is not supported on IBM z/VM (bsc#1218609,
    util-linux-chcpu-document-zVM-limitations.patch,
    util-linux-chcpu-document-zVM-limitations-generated.patch).

------------------------------------------------------------------
------------------  2024-5-20  -  May 20 2024  -------------------
------------------------------------------------------------------

++++ curl:

  - Spin documentation off to libcurl-devel-doc, this saves buildroots
    495 files and time (mandb is run in %posttrans).

++++ curl:

  - Spin documentation off to libcurl-devel-doc, this saves buildroots
    495 files and time (mandb is run in %posttrans).

++++ curl:

  - Spin documentation off to libcurl-devel-doc, this saves buildroots
    495 files and time (mandb is run in %posttrans).

++++ curl:

  - Spin documentation off to libcurl-devel-doc, this saves buildroots
    495 files and time (mandb is run in %posttrans).

++++ curl:

  - Spin documentation off to libcurl-devel-doc, this saves buildroots
    495 files and time (mandb is run in %posttrans).

++++ curl:

  - Spin documentation off to libcurl-devel-doc, this saves buildroots
    495 files and time (mandb is run in %posttrans).

++++ kernel-default:

  - sysv: don't call sb_bread() with pointers_lock held
    (bsc#1224659 CVE-2023-52699).
  - commit 6cad3fd
  - Update
    patches.suse/scsi-smartpqi-Fix-disable_managed_interrupts.patch
    (git-fixes bsc#1222608 CVE-2024-26742).
  - commit 950259c
  - btrfs: always clear PERTRANS metadata during commit (git-fixes)
  - commit f24386b
  - btrfs: record delayed inode root in transaction (git-fixes)
  - commit 3382370
  - btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)
  - commit 21cfc26
  - btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)
  - commit a357818
  - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() (git-fixes)
  - commit 3227c75
  - btrfs: sysfs: validate scrub_speed_max value (git-fixes)
  - commit 333b480
  - blacklist.conf: btrfs: build fix for config we don't use
  - commit d489b93
  - btrfs: prevent transaction block reserve underflow when starting transaction (git-fixes)
  - commit e1ff84f
  - btrfs: fix race when refilling delayed refs block reserve (git-fixes)
  - commit f241886
  - btrfs: assert delayed node locked when removing delayed item (git-fixes)
  - commit 7298484
  - btrfs: check for BTRFS_FS_ERROR in pending ordered assert (git-fixes)
  - commit f5815af
  - btrfs: output extra debug info if we failed to find an inline backref (git-fixes)
  - commit 92fba41
  - btrfs: set page extent mapped after read_folio in relocate_one_page (git-fixes)
  - commit 446041f
  - btrfs: handle errors properly in update_inline_extent_backref() (git-fixes)
  - commit ca5b7a2
  - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw (git-fixes)
  - commit 4bdc550
  - RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)
  - commit 6d737b0
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)
  - commit 3e0bec3
  - IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)
  - commit 9a3847d
  - RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)
  - commit c50f3b5
  - RDMA/rxe: Allow good work requests to be executed (git-fixes)
  - commit b36653a
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)
  - commit ba9e71d
  - RDMA/hns: Modify the print level of CQE error (git-fixes)
  - commit 12a2ba5
  - RDMA/hns: Use complete parentheses in macros (git-fixes)
  - commit 7a9c544
  - RDMA/hns: Fix GMV table pagesize (git-fixes)
  - commit fb0321b
  - RDMA/hns: Fix UAF for cq async event (git-fixes)
  - commit 8ea7fea
  - RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)
  - commit fb64efc
  - RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)
  - commit 6c2f69b
  - RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)
  - commit 60cadbc
  - RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)
  - commit dacefcf
  - RDMA/mlx5: Change check for cacheable mkeys (git-fixes)
  - commit c838c29
  - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent (git-fixes)
  - commit 3012f2a
  - qibfs: fix dentry leak (git-fixes)
  - commit 3dd0249
  - RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)
  - commit 52028fd
  - RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes)
  - commit 1a1a1ef
  - RDMA/rxe: Fix the problem "mutex_destroy missing" (git-fixes)
  - commit 0a73f85
  - blacklist.conf: ("arm64: dts: broadcom: bcmbca: bcm4908: set brcm,wp-not-connected")
  - commit a7b0273
  - arm64: dts: microchip: sparx5: fix mdio reg (git-fixes)
  - commit 88132f5
  - arm64: dts: hi3798cv200: fix the size of GICR (git-fixes)
  - commit 366d274
  - arm64: tegra: Correct Tegra132 I2C alias (git-fixes)
  - commit da1130e
  - arm64: dts: allwinner: h616: Fix I2C0 pins (git-fixes)
  - commit eee423c
  - arm64: dts: allwinner: Pine H64: correctly remove reg_gmac_3v3 (git-fixes)
  - commit 7d432cc
  - arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  - commit d52e38e
  - arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  - commit 029788f
  - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma (git-fixes)
    Refresh patches.suse/arm64-dts-rockchip-enable-internal-pull-up-on-PCIE_WAKE-for-RK3399-Puma.patch
  - commit aeac8db
  - blacklist.conf: ("dt-bindings: display: samsung,ams495qa01: add missing SPI properties")
  - commit f4f5a90
  - blacklist.conf: ("dt-bindings: iio: health: maxim,max30102: fix compatible check")
  - commit 1690e24
  - blacklist.conf: ("dt-bindings: pwm: mediatek,pwm-disp: Document power-domains property")
  - commit 6958159
  - blacklist.conf: ("dt-bindings: fsl-imx-sdma: fix HDMI audio index")
  - commit 952bf73
  - blacklist.conf: ("dt-bindings: lcdif: Do not require power-domains for i.MX6ULL")
  - commit eabdd33
  - blacklist.conf: ("dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Update")
  - commit ad9009e
  - blacklist.conf: ("dt-bindings: mtd: avoid automatically select from mtd.yaml")
  - commit 2d9981a
  - blacklist.conf: ("dt-bindings: can: mpfs: add missing required clock")
  - commit d5f79eb
  - blacklist.conf: ("dt-bindings: mfd: dlg,da9063: Make #interrupt-cells required")
  - commit a6ea77b
  - blacklist.conf: ("dt-bindings: pinctr: pinctrl-zynq: Fix compatible string")
  - commit f208a95
  - blacklist.conf: ("dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible")
  - commit 3478db8
  - blacklist.conf: ("dt-bindings: display: ti,am65x-dss: Add support for common1 region")
  - commit 7eb6591
  - blacklist.conf: ("dt-bindings: opp: drop maxItems from inner items")
  - commit 878a019
  - blacklist.conf: ("dt-bindings: pwm: amlogic: fix s4 bindings")
  - commit e2029e3
  - blacklist.conf: ("dt-bindings: arm: rockchip: Correct vendor for Banana Pi R2 Pro")
  - commit c1d1519
  - blacklist.conf: ("dt-bindings: arm: rockchip: Correct vendor for Orange Pi RK3399 board")
  - commit 88539b6
  - dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)
  - commit 4e403e4
  - blacklist.conf: ("dt-bindings: arm: qcom: drop the superfluous device compatibility")
  - commit f6fdbc2
  - blacklist.conf: ("dt-bindings: riscv: cpus: Clarify mmu-type interpretation")
  - commit 4b6b7f4
  - blacklist.conf: ("dt-bindings: power: reset: qcom-pon: fix inconsistent example")
  - commit b2da43b
  - blacklist.conf: ("dt-bindings: rtc: qcom-pm8xxx: fix inconsistent example")
  - commit 673e959
  - blacklist.conf: ("dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: fix path to header")
  - commit 2965719
  - blacklist.conf: ("dt-bindings: phy: amlogic,g12a-mipi-dphy-analog: drop unneeded reg")
  - commit 44293cc
  - blacklist.conf: ("dt-bindings: gpio: xilinx: Fix node address in gpio")
  - commit 51eae0f
  - blacklist.conf: ("dt-bindings: iio/adc: qcom,spmi-vadc: fix example node names")
  - commit 5559cae
  - blacklist.conf: ("dt-bindings: iio/adc: qcom,spmi-iadc: fix example node name")
  - commit 6d910c5
  - blacklist.conf: ("dt-bindings: PCI: qcom: Correct reset-names property")
  - commit cfa6f44
  - blacklist.conf: ("dt-bindings: mailbox: zynqmp: extend required list")
  - commit 193f0ac
  - blacklist.conf: ("dt-bindings: mailbox: qcom,apcs-kpss-global: drop duplicated")
  - commit 855a271
  - blacklist.conf: ("dt-bindings: mfd: hisilicon,hi6421-spmi-pmic: Fix regulator binding")
  - commit 9b3e020
  - blacklist.conf: ("dt-bindings: mfd: hisilicon,hi6421-spmi-pmic: Fix up binding")
  - commit a0c4967
  - blacklist.conf: ("dt-bindings: remoteproc: qcom: sc7180-pas: Fix SC7280 MPSS PD-names")
  - commit de1ba63
  - blacklist.conf: ("dt-bindings: mmc: sdhci-pxa: Fix 'regs' typo")
  - commit 3378497
  - blacklist.conf: ("dt-bindings: Remove alt_ref from versal")
  - commit 4d14333
  - blacklist.conf: ("dt-bindings: watchdog: qcom-wdt: Make the interrupt example edge")
  - commit 17a3ab8
  - blacklist.conf: ("dt-bindings: display: msm: qcm2290-mdss: Use the non-deprecated DSI")
  - commit 4aa1481
  - blacklist.conf: ("dt-bindings: arm: stm32: don't mix SCMI and non-SCMI board")
  - commit 448ff06
  - blacklist.conf: ("dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with")
  - commit ab03332
  - blacklist.conf: ("dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp")
  - commit 1d6fc28
  - blacklist.conf: ("dt-bindings: interrupt-controller: Allow #power-domain-cells")
  - commit 027195f
  - blacklist.conf: ("dt: dt-extract-compatibles: Don't follow symlinks when walking tree")
  - commit 60fcfee
  - blacklist.conf: ("dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Fix example property")
  - commit de60146
  - blacklist.conf: ("dt-bindings: PCI: brcm,iproc-pcie: Fix 'msi' child node schema")
  - commit d7b96e4
  - blacklist.conf: ("dt-bindings: soc: qcom: smd-rpm: Add MSM8909 to qcom,smd-channels")
  - commit 1171729
  - selftests/kcmp: remove unused open mode (git-fixes).
  - nilfs2: make superblock data array index computation sparse
    friendly (git-fixes).
  - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS
    filter matching sysfs file (git-fixes).
  - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
    (git-fixes).
  - commit 7902091
  - powerpc/pseries/vio: Don't return ENODEV if node or compatible
    missing (bsc#1220783).
  - commit 19e446b

++++ kernel-default:

  - sysv: don't call sb_bread() with pointers_lock held
    (bsc#1224659 CVE-2023-52699).
  - commit 6cad3fd
  - Update
    patches.suse/scsi-smartpqi-Fix-disable_managed_interrupts.patch
    (git-fixes bsc#1222608 CVE-2024-26742).
  - commit 950259c
  - btrfs: always clear PERTRANS metadata during commit (git-fixes)
  - commit f24386b
  - btrfs: record delayed inode root in transaction (git-fixes)
  - commit 3382370
  - btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)
  - commit 21cfc26
  - btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)
  - commit a357818
  - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() (git-fixes)
  - commit 3227c75
  - btrfs: sysfs: validate scrub_speed_max value (git-fixes)
  - commit 333b480
  - blacklist.conf: btrfs: build fix for config we don't use
  - commit d489b93
  - btrfs: prevent transaction block reserve underflow when starting transaction (git-fixes)
  - commit e1ff84f
  - btrfs: fix race when refilling delayed refs block reserve (git-fixes)
  - commit f241886
  - btrfs: assert delayed node locked when removing delayed item (git-fixes)
  - commit 7298484
  - btrfs: check for BTRFS_FS_ERROR in pending ordered assert (git-fixes)
  - commit f5815af
  - btrfs: output extra debug info if we failed to find an inline backref (git-fixes)
  - commit 92fba41
  - btrfs: set page extent mapped after read_folio in relocate_one_page (git-fixes)
  - commit 446041f
  - btrfs: handle errors properly in update_inline_extent_backref() (git-fixes)
  - commit ca5b7a2
  - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw (git-fixes)
  - commit 4bdc550
  - RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)
  - commit 6d737b0
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)
  - commit 3e0bec3
  - IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)
  - commit 9a3847d
  - RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)
  - commit c50f3b5
  - RDMA/rxe: Allow good work requests to be executed (git-fixes)
  - commit b36653a
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)
  - commit ba9e71d
  - RDMA/hns: Modify the print level of CQE error (git-fixes)
  - commit 12a2ba5
  - RDMA/hns: Use complete parentheses in macros (git-fixes)
  - commit 7a9c544
  - RDMA/hns: Fix GMV table pagesize (git-fixes)
  - commit fb0321b
  - RDMA/hns: Fix UAF for cq async event (git-fixes)
  - commit 8ea7fea
  - RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)
  - commit fb64efc
  - RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)
  - commit 6c2f69b
  - RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)
  - commit 60cadbc
  - RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)
  - commit dacefcf
  - RDMA/mlx5: Change check for cacheable mkeys (git-fixes)
  - commit c838c29
  - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent (git-fixes)
  - commit 3012f2a
  - qibfs: fix dentry leak (git-fixes)
  - commit 3dd0249
  - RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)
  - commit 52028fd
  - RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes)
  - commit 1a1a1ef
  - RDMA/rxe: Fix the problem "mutex_destroy missing" (git-fixes)
  - commit 0a73f85
  - blacklist.conf: ("arm64: dts: broadcom: bcmbca: bcm4908: set brcm,wp-not-connected")
  - commit a7b0273
  - arm64: dts: microchip: sparx5: fix mdio reg (git-fixes)
  - commit 88132f5
  - arm64: dts: hi3798cv200: fix the size of GICR (git-fixes)
  - commit 366d274
  - arm64: tegra: Correct Tegra132 I2C alias (git-fixes)
  - commit da1130e
  - arm64: dts: allwinner: h616: Fix I2C0 pins (git-fixes)
  - commit eee423c
  - arm64: dts: allwinner: Pine H64: correctly remove reg_gmac_3v3 (git-fixes)
  - commit 7d432cc
  - arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  - commit d52e38e
  - arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  - commit 029788f
  - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma (git-fixes)
    Refresh patches.suse/arm64-dts-rockchip-enable-internal-pull-up-on-PCIE_WAKE-for-RK3399-Puma.patch
  - commit aeac8db
  - blacklist.conf: ("dt-bindings: display: samsung,ams495qa01: add missing SPI properties")
  - commit f4f5a90
  - blacklist.conf: ("dt-bindings: iio: health: maxim,max30102: fix compatible check")
  - commit 1690e24
  - blacklist.conf: ("dt-bindings: pwm: mediatek,pwm-disp: Document power-domains property")
  - commit 6958159
  - blacklist.conf: ("dt-bindings: fsl-imx-sdma: fix HDMI audio index")
  - commit 952bf73
  - blacklist.conf: ("dt-bindings: lcdif: Do not require power-domains for i.MX6ULL")
  - commit eabdd33
  - blacklist.conf: ("dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Update")
  - commit ad9009e
  - blacklist.conf: ("dt-bindings: mtd: avoid automatically select from mtd.yaml")
  - commit 2d9981a
  - blacklist.conf: ("dt-bindings: can: mpfs: add missing required clock")
  - commit d5f79eb
  - blacklist.conf: ("dt-bindings: mfd: dlg,da9063: Make #interrupt-cells required")
  - commit a6ea77b
  - blacklist.conf: ("dt-bindings: pinctr: pinctrl-zynq: Fix compatible string")
  - commit f208a95
  - blacklist.conf: ("dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible")
  - commit 3478db8
  - blacklist.conf: ("dt-bindings: display: ti,am65x-dss: Add support for common1 region")
  - commit 7eb6591
  - blacklist.conf: ("dt-bindings: opp: drop maxItems from inner items")
  - commit 878a019
  - blacklist.conf: ("dt-bindings: pwm: amlogic: fix s4 bindings")
  - commit e2029e3
  - blacklist.conf: ("dt-bindings: arm: rockchip: Correct vendor for Banana Pi R2 Pro")
  - commit c1d1519
  - blacklist.conf: ("dt-bindings: arm: rockchip: Correct vendor for Orange Pi RK3399 board")
  - commit 88539b6
  - dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)
  - commit 4e403e4
  - blacklist.conf: ("dt-bindings: arm: qcom: drop the superfluous device compatibility")
  - commit f6fdbc2
  - blacklist.conf: ("dt-bindings: riscv: cpus: Clarify mmu-type interpretation")
  - commit 4b6b7f4
  - blacklist.conf: ("dt-bindings: power: reset: qcom-pon: fix inconsistent example")
  - commit b2da43b
  - blacklist.conf: ("dt-bindings: rtc: qcom-pm8xxx: fix inconsistent example")
  - commit 673e959
  - blacklist.conf: ("dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: fix path to header")
  - commit 2965719
  - blacklist.conf: ("dt-bindings: phy: amlogic,g12a-mipi-dphy-analog: drop unneeded reg")
  - commit 44293cc
  - blacklist.conf: ("dt-bindings: gpio: xilinx: Fix node address in gpio")
  - commit 51eae0f
  - blacklist.conf: ("dt-bindings: iio/adc: qcom,spmi-vadc: fix example node names")
  - commit 5559cae
  - blacklist.conf: ("dt-bindings: iio/adc: qcom,spmi-iadc: fix example node name")
  - commit 6d910c5
  - blacklist.conf: ("dt-bindings: PCI: qcom: Correct reset-names property")
  - commit cfa6f44
  - blacklist.conf: ("dt-bindings: mailbox: zynqmp: extend required list")
  - commit 193f0ac
  - blacklist.conf: ("dt-bindings: mailbox: qcom,apcs-kpss-global: drop duplicated")
  - commit 855a271
  - blacklist.conf: ("dt-bindings: mfd: hisilicon,hi6421-spmi-pmic: Fix regulator binding")
  - commit 9b3e020
  - blacklist.conf: ("dt-bindings: mfd: hisilicon,hi6421-spmi-pmic: Fix up binding")
  - commit a0c4967
  - blacklist.conf: ("dt-bindings: remoteproc: qcom: sc7180-pas: Fix SC7280 MPSS PD-names")
  - commit de1ba63
  - blacklist.conf: ("dt-bindings: mmc: sdhci-pxa: Fix 'regs' typo")
  - commit 3378497
  - blacklist.conf: ("dt-bindings: Remove alt_ref from versal")
  - commit 4d14333
  - blacklist.conf: ("dt-bindings: watchdog: qcom-wdt: Make the interrupt example edge")
  - commit 17a3ab8
  - blacklist.conf: ("dt-bindings: display: msm: qcm2290-mdss: Use the non-deprecated DSI")
  - commit 4aa1481
  - blacklist.conf: ("dt-bindings: arm: stm32: don't mix SCMI and non-SCMI board")
  - commit 448ff06
  - blacklist.conf: ("dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with")
  - commit ab03332
  - blacklist.conf: ("dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp")
  - commit 1d6fc28
  - blacklist.conf: ("dt-bindings: interrupt-controller: Allow #power-domain-cells")
  - commit 027195f
  - blacklist.conf: ("dt: dt-extract-compatibles: Don't follow symlinks when walking tree")
  - commit 60fcfee
  - blacklist.conf: ("dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Fix example property")
  - commit de60146
  - blacklist.conf: ("dt-bindings: PCI: brcm,iproc-pcie: Fix 'msi' child node schema")
  - commit d7b96e4
  - blacklist.conf: ("dt-bindings: soc: qcom: smd-rpm: Add MSM8909 to qcom,smd-channels")
  - commit 1171729
  - selftests/kcmp: remove unused open mode (git-fixes).
  - nilfs2: make superblock data array index computation sparse
    friendly (git-fixes).
  - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS
    filter matching sysfs file (git-fixes).
  - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
    (git-fixes).
  - commit 7902091
  - powerpc/pseries/vio: Don't return ENODEV if node or compatible
    missing (bsc#1220783).
  - commit 19e446b

++++ kernel-default:

  - sysv: don't call sb_bread() with pointers_lock held
    (bsc#1224659 CVE-2023-52699).
  - commit 6cad3fd
  - Update
    patches.suse/scsi-smartpqi-Fix-disable_managed_interrupts.patch
    (git-fixes bsc#1222608 CVE-2024-26742).
  - commit 950259c
  - btrfs: always clear PERTRANS metadata during commit (git-fixes)
  - commit f24386b
  - btrfs: record delayed inode root in transaction (git-fixes)
  - commit 3382370
  - btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)
  - commit 21cfc26
  - btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)
  - commit a357818
  - btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() (git-fixes)
  - commit 3227c75
  - btrfs: sysfs: validate scrub_speed_max value (git-fixes)
  - commit 333b480
  - blacklist.conf: btrfs: build fix for config we don't use
  - commit d489b93
  - btrfs: prevent transaction block reserve underflow when starting transaction (git-fixes)
  - commit e1ff84f
  - btrfs: fix race when refilling delayed refs block reserve (git-fixes)
  - commit f241886
  - btrfs: assert delayed node locked when removing delayed item (git-fixes)
  - commit 7298484
  - btrfs: check for BTRFS_FS_ERROR in pending ordered assert (git-fixes)
  - commit f5815af
  - btrfs: output extra debug info if we failed to find an inline backref (git-fixes)
  - commit 92fba41
  - btrfs: set page extent mapped after read_folio in relocate_one_page (git-fixes)
  - commit 446041f
  - btrfs: handle errors properly in update_inline_extent_backref() (git-fixes)
  - commit ca5b7a2
  - RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw (git-fixes)
  - commit 4bdc550
  - RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)
  - commit 6d737b0
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)
  - commit 3e0bec3
  - IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)
  - commit 9a3847d
  - RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)
  - commit c50f3b5
  - RDMA/rxe: Allow good work requests to be executed (git-fixes)
  - commit b36653a
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)
  - commit ba9e71d
  - RDMA/hns: Modify the print level of CQE error (git-fixes)
  - commit 12a2ba5
  - RDMA/hns: Use complete parentheses in macros (git-fixes)
  - commit 7a9c544
  - RDMA/hns: Fix GMV table pagesize (git-fixes)
  - commit fb0321b
  - RDMA/hns: Fix UAF for cq async event (git-fixes)
  - commit 8ea7fea
  - RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)
  - commit fb64efc
  - RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)
  - commit 6c2f69b
  - RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)
  - commit 60cadbc
  - RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)
  - commit dacefcf
  - RDMA/mlx5: Change check for cacheable mkeys (git-fixes)
  - commit c838c29
  - RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent (git-fixes)
  - commit 3012f2a
  - qibfs: fix dentry leak (git-fixes)
  - commit 3dd0249
  - RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)
  - commit 52028fd
  - RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes)
  - commit 1a1a1ef
  - RDMA/rxe: Fix the problem "mutex_destroy missing" (git-fixes)
  - commit 0a73f85
  - blacklist.conf: ("arm64: dts: broadcom: bcmbca: bcm4908: set brcm,wp-not-connected")
  - commit a7b0273
  - arm64: dts: microchip: sparx5: fix mdio reg (git-fixes)
  - commit 88132f5
  - arm64: dts: hi3798cv200: fix the size of GICR (git-fixes)
  - commit 366d274
  - arm64: tegra: Correct Tegra132 I2C alias (git-fixes)
  - commit da1130e
  - arm64: dts: allwinner: h616: Fix I2C0 pins (git-fixes)
  - commit eee423c
  - arm64: dts: allwinner: Pine H64: correctly remove reg_gmac_3v3 (git-fixes)
  - commit 7d432cc
  - arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  - commit d52e38e
  - arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  - commit 029788f
  - arm64: dts: rockchip: fix alphabetical ordering RK3399 puma (git-fixes)
    Refresh patches.suse/arm64-dts-rockchip-enable-internal-pull-up-on-PCIE_WAKE-for-RK3399-Puma.patch
  - commit aeac8db
  - blacklist.conf: ("dt-bindings: display: samsung,ams495qa01: add missing SPI properties")
  - commit f4f5a90
  - blacklist.conf: ("dt-bindings: iio: health: maxim,max30102: fix compatible check")
  - commit 1690e24
  - blacklist.conf: ("dt-bindings: pwm: mediatek,pwm-disp: Document power-domains property")
  - commit 6958159
  - blacklist.conf: ("dt-bindings: fsl-imx-sdma: fix HDMI audio index")
  - commit 952bf73
  - blacklist.conf: ("dt-bindings: lcdif: Do not require power-domains for i.MX6ULL")
  - commit eabdd33
  - blacklist.conf: ("dt-bindings: interrupt-controller: renesas,rzg2l-irqc: Update")
  - commit ad9009e
  - blacklist.conf: ("dt-bindings: mtd: avoid automatically select from mtd.yaml")
  - commit 2d9981a
  - blacklist.conf: ("dt-bindings: can: mpfs: add missing required clock")
  - commit d5f79eb
  - blacklist.conf: ("dt-bindings: mfd: dlg,da9063: Make #interrupt-cells required")
  - commit a6ea77b
  - blacklist.conf: ("dt-bindings: pinctr: pinctrl-zynq: Fix compatible string")
  - commit f208a95
  - blacklist.conf: ("dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible")
  - commit 3478db8
  - blacklist.conf: ("dt-bindings: display: ti,am65x-dss: Add support for common1 region")
  - commit 7eb6591
  - blacklist.conf: ("dt-bindings: opp: drop maxItems from inner items")
  - commit 878a019
  - blacklist.conf: ("dt-bindings: pwm: amlogic: fix s4 bindings")
  - commit e2029e3
  - blacklist.conf: ("dt-bindings: arm: rockchip: Correct vendor for Banana Pi R2 Pro")
  - commit c1d1519
  - blacklist.conf: ("dt-bindings: arm: rockchip: Correct vendor for Orange Pi RK3399 board")
  - commit 88539b6
  - dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)
  - commit 4e403e4
  - blacklist.conf: ("dt-bindings: arm: qcom: drop the superfluous device compatibility")
  - commit f6fdbc2
  - blacklist.conf: ("dt-bindings: riscv: cpus: Clarify mmu-type interpretation")
  - commit 4b6b7f4
  - blacklist.conf: ("dt-bindings: power: reset: qcom-pon: fix inconsistent example")
  - commit b2da43b
  - blacklist.conf: ("dt-bindings: rtc: qcom-pm8xxx: fix inconsistent example")
  - commit 673e959
  - blacklist.conf: ("dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: fix path to header")
  - commit 2965719
  - blacklist.conf: ("dt-bindings: phy: amlogic,g12a-mipi-dphy-analog: drop unneeded reg")
  - commit 44293cc
  - blacklist.conf: ("dt-bindings: gpio: xilinx: Fix node address in gpio")
  - commit 51eae0f
  - blacklist.conf: ("dt-bindings: iio/adc: qcom,spmi-vadc: fix example node names")
  - commit 5559cae
  - blacklist.conf: ("dt-bindings: iio/adc: qcom,spmi-iadc: fix example node name")
  - commit 6d910c5
  - blacklist.conf: ("dt-bindings: PCI: qcom: Correct reset-names property")
  - commit cfa6f44
  - blacklist.conf: ("dt-bindings: mailbox: zynqmp: extend required list")
  - commit 193f0ac
  - blacklist.conf: ("dt-bindings: mailbox: qcom,apcs-kpss-global: drop duplicated")
  - commit 855a271
  - blacklist.conf: ("dt-bindings: mfd: hisilicon,hi6421-spmi-pmic: Fix regulator binding")
  - commit 9b3e020
  - blacklist.conf: ("dt-bindings: mfd: hisilicon,hi6421-spmi-pmic: Fix up binding")
  - commit a0c4967
  - blacklist.conf: ("dt-bindings: remoteproc: qcom: sc7180-pas: Fix SC7280 MPSS PD-names")
  - commit de1ba63
  - blacklist.conf: ("dt-bindings: mmc: sdhci-pxa: Fix 'regs' typo")
  - commit 3378497
  - blacklist.conf: ("dt-bindings: Remove alt_ref from versal")
  - commit 4d14333
  - blacklist.conf: ("dt-bindings: watchdog: qcom-wdt: Make the interrupt example edge")
  - commit 17a3ab8
  - blacklist.conf: ("dt-bindings: display: msm: qcm2290-mdss: Use the non-deprecated DSI")
  - commit 4aa1481
  - blacklist.conf: ("dt-bindings: arm: stm32: don't mix SCMI and non-SCMI board")
  - commit 448ff06
  - blacklist.conf: ("dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with")
  - commit ab03332
  - blacklist.conf: ("dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp")
  - commit 1d6fc28
  - blacklist.conf: ("dt-bindings: interrupt-controller: Allow #power-domain-cells")
  - commit 027195f
  - blacklist.conf: ("dt: dt-extract-compatibles: Don't follow symlinks when walking tree")
  - commit 60fcfee
  - blacklist.conf: ("dt-bindings: soc: fsl: cpm_qe: cpm1-scc-qmc: Fix example property")
  - commit de60146
  - blacklist.conf: ("dt-bindings: PCI: brcm,iproc-pcie: Fix 'msi' child node schema")
  - commit d7b96e4
  - blacklist.conf: ("dt-bindings: soc: qcom: smd-rpm: Add MSM8909 to qcom,smd-channels")
  - commit 1171729
  - selftests/kcmp: remove unused open mode (git-fixes).
  - nilfs2: make superblock data array index computation sparse
    friendly (git-fixes).
  - Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS
    filter matching sysfs file (git-fixes).
  - lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure
    (git-fixes).
  - commit 7902091
  - powerpc/pseries/vio: Don't return ENODEV if node or compatible
    missing (bsc#1220783).
  - commit 19e446b

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openssl-3:

  - Security fix: [bsc#1224388, CVE-2024-4603]
    * Check DSA parameters for excessive sizes before validating
    * Add openssl-CVE-2024-4603.patch

++++ openSUSE-repos-LeapMicro:

  - Fix macro reference

------------------------------------------------------------------
------------------  2024-5-19  -  May 19 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs
    (git-fixes).
  - clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).
  - clk: qcom: dispcc-sm8550: fix DisplayPort clocks (git-fixes).
  - clk: qcom: dispcc-sm6350: fix DisplayPort clocks (git-fixes).
  - clk: qcom: dispcc-sm8450: fix DisplayPort clocks (git-fixes).
  - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
    (git-fixes).
  - clk: samsung: exynosautov9: fix wrong pll clock id value
    (git-fixes).
  - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
    (git-fixes).
  - clk: renesas: r8a779a0: Fix CANFD parent clock (git-fixes).
  - clk: rs9: fix wrong default value for clock amplitude
    (git-fixes).
  - clk: mediatek: mt8365-mm: fix DPI0 parent (git-fixes).
  - clk: mediatek: pllfh: Don't log error for missing fhctl node
    (git-fixes).
  - commit 8bfa411

++++ kernel-default:

  - clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs
    (git-fixes).
  - clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).
  - clk: qcom: dispcc-sm8550: fix DisplayPort clocks (git-fixes).
  - clk: qcom: dispcc-sm6350: fix DisplayPort clocks (git-fixes).
  - clk: qcom: dispcc-sm8450: fix DisplayPort clocks (git-fixes).
  - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
    (git-fixes).
  - clk: samsung: exynosautov9: fix wrong pll clock id value
    (git-fixes).
  - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
    (git-fixes).
  - clk: renesas: r8a779a0: Fix CANFD parent clock (git-fixes).
  - clk: rs9: fix wrong default value for clock amplitude
    (git-fixes).
  - clk: mediatek: mt8365-mm: fix DPI0 parent (git-fixes).
  - clk: mediatek: pllfh: Don't log error for missing fhctl node
    (git-fixes).
  - commit 8bfa411

++++ kernel-default:

  - clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs
    (git-fixes).
  - clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).
  - clk: qcom: dispcc-sm8550: fix DisplayPort clocks (git-fixes).
  - clk: qcom: dispcc-sm6350: fix DisplayPort clocks (git-fixes).
  - clk: qcom: dispcc-sm8450: fix DisplayPort clocks (git-fixes).
  - clk: qcom: clk-alpha-pll: remove invalid Stromer register offset
    (git-fixes).
  - clk: samsung: exynosautov9: fix wrong pll clock id value
    (git-fixes).
  - clk: renesas: r9a07g043: Add clock and reset entry for PLIC
    (git-fixes).
  - clk: renesas: r8a779a0: Fix CANFD parent clock (git-fixes).
  - clk: rs9: fix wrong default value for clock amplitude
    (git-fixes).
  - clk: mediatek: mt8365-mm: fix DPI0 parent (git-fixes).
  - clk: mediatek: pllfh: Don't log error for missing fhctl node
    (git-fixes).
  - commit 8bfa411

++++ shim:

  -- Update to version 15.8
  - Various CVE fixes are already merged into this version
    mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
    avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
    Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
    Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
    pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
    pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)
  - remove shim-Enable-the-NX-compatibility-flag-by-default.patch
    The codes in this patch are already existing in shim-15.8
    The NX flag is disable which is same as the default value of shim-15.8,
    hence, not need to enable it by this patch now.
  - Patches (git log --oneline --reverse 15.7..15.8)
    657b248 Make sbat_var.S parse right with buggy gcc/binutils
    7c76425 Enable the NX compatibility flag by default.
    89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper
    c7b3051 pe: Align section size up to page size for mem attrs
    e4f40ae pe: Add IS_PAGE_ALIGNED macro
    f23883c Don't loop forever in load_certs() with buggy firmware
    1f38cb3 Optionally allow to keep shim protocol installed
    102a658 Drop invalid calls to `CRYPTO_set_mem_functions`
    aae3df0 test-sbat: Fix exit code
    cca3933 Block Debian grub binaries with SBAT < 4
    cf59f34 Further improve load_certs() for non-compliant drivers/firmwares
    0601f44 SBAT-related documents formatting and spelling
    0640e13 Add a security contact email address in README.md
    0bfc397 Work around malformed path delimiters in file paths from DHCP
    a8b0b60 pe: only process RelocDir->Size of reloc section
    f7a4338 Skip testing msleep()
    549d346 Rename 'msecs' to 'usecs' to avoid potential confusion
    908c388 Change type of fallback_verbose_wait from int to unsigned long
    05eae92 Add SbatLevel_Variable.txt to document the various revocations
    243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL
    89d25a1 Add a make rule for compile_commands.json
    118ff87 Add gnu-stack notes
    f132655 test: Make our fake dprintf be a statement.
    be00279 Remove CentOS 7 test builds.
    9964960 Split pe.c up even more.
    569270d Test (and fix) ImageAddress()
    61e9894 Verify signature before verifying sbat levels
    1578b55 Add libFuzzer support for csv.c
    a0673e3 Fix a 1-byte memory leak in .sbat parsing.
    e246812 Add libFuzzer support to the .sbat parser.
    fd43eda Work around ImageAddress() usage mistake
    1e985a3 Correctly free memory allocated in handle_image()
    dbbe3c8 mok: Avoid underflow in maximum variable size calculation
    04111d4 Make some of the static analysis tools a little easier to run
    7ba7440 compile_commands.json: remove stuff clang doesn't like
    66e6579 CVE-2023-40546 mok: fix LogError() invocation
    f271826 Add primitives for overflow-checked arithmetic operations.
    8372147 pe-relocate: Add a fuzzer for read_header()
    5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries
    e912071 pe-relocate: make read_header() use checked arithmetic operations.
    93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat()
    e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550
    afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds.
    96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system
    dae82f6 Further mitigations against CVE-2023-40546 as a class
    ea0f9df Allow SbatLevel data from external binary
    b078ef2 Always clear SbatLevel when Secure Boot is disabled
    7dfb687 BS Variables for bootmgr revocations
    a967c0e shim should not self revoke
    577cedd Print message when refusing to apply SbatLevel
    e801b0d sbat revocations: check the full section name
    0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers
    6f0c8d2 Print errors when setting/clearing memory attrs
    57c0eed Updated Revocations for January 2024 CVEs
    49c6d95 Fix some minor ia32 build issues.
    be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all.
    13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5
    c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist
    30a4f37 Rename "previous" revocations to "automatic"
    6f395c2 Build time selectable automatic SBATLevel revocations
    a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER
    993a345 Try to load revocations.efi even if directory read fails
    1770a03 gitmodules: use shim-15.8 for gnu-efi branch
    5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8

++++ shim:

  -- Update to version 15.8
  - Various CVE fixes are already merged into this version
    mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
    avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
    Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
    Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
    pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
    pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)
  - remove shim-Enable-the-NX-compatibility-flag-by-default.patch
    The codes in this patch are already existing in shim-15.8
    The NX flag is disable which is same as the default value of shim-15.8,
    hence, not need to enable it by this patch now.
  - Patches (git log --oneline --reverse 15.7..15.8)
    657b248 Make sbat_var.S parse right with buggy gcc/binutils
    7c76425 Enable the NX compatibility flag by default.
    89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper
    c7b3051 pe: Align section size up to page size for mem attrs
    e4f40ae pe: Add IS_PAGE_ALIGNED macro
    f23883c Don't loop forever in load_certs() with buggy firmware
    1f38cb3 Optionally allow to keep shim protocol installed
    102a658 Drop invalid calls to `CRYPTO_set_mem_functions`
    aae3df0 test-sbat: Fix exit code
    cca3933 Block Debian grub binaries with SBAT < 4
    cf59f34 Further improve load_certs() for non-compliant drivers/firmwares
    0601f44 SBAT-related documents formatting and spelling
    0640e13 Add a security contact email address in README.md
    0bfc397 Work around malformed path delimiters in file paths from DHCP
    a8b0b60 pe: only process RelocDir->Size of reloc section
    f7a4338 Skip testing msleep()
    549d346 Rename 'msecs' to 'usecs' to avoid potential confusion
    908c388 Change type of fallback_verbose_wait from int to unsigned long
    05eae92 Add SbatLevel_Variable.txt to document the various revocations
    243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL
    89d25a1 Add a make rule for compile_commands.json
    118ff87 Add gnu-stack notes
    f132655 test: Make our fake dprintf be a statement.
    be00279 Remove CentOS 7 test builds.
    9964960 Split pe.c up even more.
    569270d Test (and fix) ImageAddress()
    61e9894 Verify signature before verifying sbat levels
    1578b55 Add libFuzzer support for csv.c
    a0673e3 Fix a 1-byte memory leak in .sbat parsing.
    e246812 Add libFuzzer support to the .sbat parser.
    fd43eda Work around ImageAddress() usage mistake
    1e985a3 Correctly free memory allocated in handle_image()
    dbbe3c8 mok: Avoid underflow in maximum variable size calculation
    04111d4 Make some of the static analysis tools a little easier to run
    7ba7440 compile_commands.json: remove stuff clang doesn't like
    66e6579 CVE-2023-40546 mok: fix LogError() invocation
    f271826 Add primitives for overflow-checked arithmetic operations.
    8372147 pe-relocate: Add a fuzzer for read_header()
    5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries
    e912071 pe-relocate: make read_header() use checked arithmetic operations.
    93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat()
    e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550
    afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds.
    96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system
    dae82f6 Further mitigations against CVE-2023-40546 as a class
    ea0f9df Allow SbatLevel data from external binary
    b078ef2 Always clear SbatLevel when Secure Boot is disabled
    7dfb687 BS Variables for bootmgr revocations
    a967c0e shim should not self revoke
    577cedd Print message when refusing to apply SbatLevel
    e801b0d sbat revocations: check the full section name
    0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers
    6f0c8d2 Print errors when setting/clearing memory attrs
    57c0eed Updated Revocations for January 2024 CVEs
    49c6d95 Fix some minor ia32 build issues.
    be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all.
    13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5
    c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist
    30a4f37 Rename "previous" revocations to "automatic"
    6f395c2 Build time selectable automatic SBATLevel revocations
    a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER
    993a345 Try to load revocations.efi even if directory read fails
    1770a03 gitmodules: use shim-15.8 for gnu-efi branch
    5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8

------------------------------------------------------------------
------------------  2024-5-18  -  May 18 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - blacklist.conf: Add reverted dmaengine commit entries
  - commit 134f997
  - selftests: net: bridge: increase IGMP/MLD exclude timeout
    membership interval (git-fixes).
  - of: module: add buffer overflow check in of_modalias()
    (git-fixes).
  - selftests/powerpc/dexcr: Add -no-pie to hashchk tests
    (git-fixes).
  - firmware: raspberrypi: Use correct device for DMA mappings
    (git-fixes).
  - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with
    nvkm_firmware_ctor()" (stable-fixes).
  - drm/i915/audio: Fix audio time stamp programming for DP
    (stable-fixes).
  - gpiolib: cdev: fix uninitialised kfifo (git-fixes).
  - selftests: test_bridge_neigh_suppress.sh: Fix failures due to
    duplicate MAC (git-fixes).
  - Bluetooth: qca: fix firmware check error path (git-fixes).
  - dyndbg: fix old BUG_ON in >control parser (stable-fixes).
  - mei: me: add lunar lake point M DID (stable-fixes).
  - usb: xhci-plat: Don't include xhci.h (stable-fixes).
  - ASoC: meson: axg-fifo: use threaded irq to check periods
    (git-fixes).
  - drm/nouveau/firmware: Fix SG_DEBUG error with
    nvkm_firmware_ctor() (stable-fixes).
  - drm/amd/display: Fix incorrect DSC instance for MST
    (stable-fixes).
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
    (stable-fixes).
  - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
    (stable-fixes).
  - clk: Don't hold prepare_lock when calling kref_put()
    (stable-fixes).
  - drm/nouveau/dp: Don't probe eDP ports twice harder
    (stable-fixes).
  - drm/radeon: silence UBSAN warning (v3) (stable-fixes).
  - net:usb:qmi_wwan: support Rolling modules (stable-fixes).
  - gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).
  - gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).
  - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
    (stable-fixes).
  - selftests: timers: Fix valid-adjtimex signed left-shift
    undefined behavior (stable-fixes).
  - gpu: host1x: Do not setup DMA for virtual devices
    (stable-fixes).
  - amd/amdkfd: sync all devices to wait all processes being evicted
    (stable-fixes).
  - drm/amdgpu: Fix VCN allocation in CPX partition (stable-fixes).
  - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
    (stable-fixes).
  - drm/amdgpu: Refine IB schedule error logging (stable-fixes).
  - firewire: ohci: mask bus reset interrupts between ISR and
    bottom half (stable-fixes).
  - regulator: tps65132: Add of_match table (stable-fixes).
  - ata: sata_gemini: Check clk_enable() result (stable-fixes).
  - ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in
    case of S3 suspend (stable-fixes).
  - ALSA: line6: Zero-initialize message buffers (stable-fixes).
  - vboxsf: explicitly deny setlease attempts (stable-fixes).
  - drm/amdkfd: range check cp bad op exception interrupts
    (stable-fixes).
  - drm/amdkfd: Check cgroup when returning DMABuf info
    (stable-fixes).
  - selftests/ftrace: Fix event filter target_func selection
    (stable-fixes).
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
    (stable-fixes).
  - wifi: iwlwifi: read txq->read_ptr under lock (stable-fixes).
  - wifi: mac80211: fix prep_connection error path (stable-fixes).
  - wifi: cfg80211: fix rdev_dump_mpp() arguments order
    (stable-fixes).
  - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
    (stable-fixes).
  - ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).
  - gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
    (stable-fixes).
  - selftests/net: convert test_bridge_neigh_suppress.sh to run
    it in unique namespace (stable-fixes).
  - commit 2872089

++++ kernel-default:

  - blacklist.conf: Add reverted dmaengine commit entries
  - commit 134f997
  - selftests: net: bridge: increase IGMP/MLD exclude timeout
    membership interval (git-fixes).
  - of: module: add buffer overflow check in of_modalias()
    (git-fixes).
  - selftests/powerpc/dexcr: Add -no-pie to hashchk tests
    (git-fixes).
  - firmware: raspberrypi: Use correct device for DMA mappings
    (git-fixes).
  - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with
    nvkm_firmware_ctor()" (stable-fixes).
  - drm/i915/audio: Fix audio time stamp programming for DP
    (stable-fixes).
  - gpiolib: cdev: fix uninitialised kfifo (git-fixes).
  - selftests: test_bridge_neigh_suppress.sh: Fix failures due to
    duplicate MAC (git-fixes).
  - Bluetooth: qca: fix firmware check error path (git-fixes).
  - dyndbg: fix old BUG_ON in >control parser (stable-fixes).
  - mei: me: add lunar lake point M DID (stable-fixes).
  - usb: xhci-plat: Don't include xhci.h (stable-fixes).
  - ASoC: meson: axg-fifo: use threaded irq to check periods
    (git-fixes).
  - drm/nouveau/firmware: Fix SG_DEBUG error with
    nvkm_firmware_ctor() (stable-fixes).
  - drm/amd/display: Fix incorrect DSC instance for MST
    (stable-fixes).
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
    (stable-fixes).
  - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
    (stable-fixes).
  - clk: Don't hold prepare_lock when calling kref_put()
    (stable-fixes).
  - drm/nouveau/dp: Don't probe eDP ports twice harder
    (stable-fixes).
  - drm/radeon: silence UBSAN warning (v3) (stable-fixes).
  - net:usb:qmi_wwan: support Rolling modules (stable-fixes).
  - gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).
  - gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).
  - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
    (stable-fixes).
  - selftests: timers: Fix valid-adjtimex signed left-shift
    undefined behavior (stable-fixes).
  - gpu: host1x: Do not setup DMA for virtual devices
    (stable-fixes).
  - amd/amdkfd: sync all devices to wait all processes being evicted
    (stable-fixes).
  - drm/amdgpu: Fix VCN allocation in CPX partition (stable-fixes).
  - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
    (stable-fixes).
  - drm/amdgpu: Refine IB schedule error logging (stable-fixes).
  - firewire: ohci: mask bus reset interrupts between ISR and
    bottom half (stable-fixes).
  - regulator: tps65132: Add of_match table (stable-fixes).
  - ata: sata_gemini: Check clk_enable() result (stable-fixes).
  - ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in
    case of S3 suspend (stable-fixes).
  - ALSA: line6: Zero-initialize message buffers (stable-fixes).
  - vboxsf: explicitly deny setlease attempts (stable-fixes).
  - drm/amdkfd: range check cp bad op exception interrupts
    (stable-fixes).
  - drm/amdkfd: Check cgroup when returning DMABuf info
    (stable-fixes).
  - selftests/ftrace: Fix event filter target_func selection
    (stable-fixes).
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
    (stable-fixes).
  - wifi: iwlwifi: read txq->read_ptr under lock (stable-fixes).
  - wifi: mac80211: fix prep_connection error path (stable-fixes).
  - wifi: cfg80211: fix rdev_dump_mpp() arguments order
    (stable-fixes).
  - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
    (stable-fixes).
  - ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).
  - gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
    (stable-fixes).
  - selftests/net: convert test_bridge_neigh_suppress.sh to run
    it in unique namespace (stable-fixes).
  - commit 2872089

++++ kernel-default:

  - blacklist.conf: Add reverted dmaengine commit entries
  - commit 134f997
  - selftests: net: bridge: increase IGMP/MLD exclude timeout
    membership interval (git-fixes).
  - of: module: add buffer overflow check in of_modalias()
    (git-fixes).
  - selftests/powerpc/dexcr: Add -no-pie to hashchk tests
    (git-fixes).
  - firmware: raspberrypi: Use correct device for DMA mappings
    (git-fixes).
  - Revert "drm/nouveau/firmware: Fix SG_DEBUG error with
    nvkm_firmware_ctor()" (stable-fixes).
  - drm/i915/audio: Fix audio time stamp programming for DP
    (stable-fixes).
  - gpiolib: cdev: fix uninitialised kfifo (git-fixes).
  - selftests: test_bridge_neigh_suppress.sh: Fix failures due to
    duplicate MAC (git-fixes).
  - Bluetooth: qca: fix firmware check error path (git-fixes).
  - dyndbg: fix old BUG_ON in >control parser (stable-fixes).
  - mei: me: add lunar lake point M DID (stable-fixes).
  - usb: xhci-plat: Don't include xhci.h (stable-fixes).
  - ASoC: meson: axg-fifo: use threaded irq to check periods
    (git-fixes).
  - drm/nouveau/firmware: Fix SG_DEBUG error with
    nvkm_firmware_ctor() (stable-fixes).
  - drm/amd/display: Fix incorrect DSC instance for MST
    (stable-fixes).
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35
    (stable-fixes).
  - drm/amd/display: Handle Y carry-over in VCP X.Y calculation
    (stable-fixes).
  - clk: Don't hold prepare_lock when calling kref_put()
    (stable-fixes).
  - drm/nouveau/dp: Don't probe eDP ports twice harder
    (stable-fixes).
  - drm/radeon: silence UBSAN warning (v3) (stable-fixes).
  - net:usb:qmi_wwan: support Rolling modules (stable-fixes).
  - gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).
  - gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).
  - platform/x86: ISST: Add Granite Rapids-D to HPM CPU list
    (stable-fixes).
  - selftests: timers: Fix valid-adjtimex signed left-shift
    undefined behavior (stable-fixes).
  - gpu: host1x: Do not setup DMA for virtual devices
    (stable-fixes).
  - amd/amdkfd: sync all devices to wait all processes being evicted
    (stable-fixes).
  - drm/amdgpu: Fix VCN allocation in CPX partition (stable-fixes).
  - drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2
    (stable-fixes).
  - drm/amdgpu: Refine IB schedule error logging (stable-fixes).
  - firewire: ohci: mask bus reset interrupts between ISR and
    bottom half (stable-fixes).
  - regulator: tps65132: Add of_match table (stable-fixes).
  - ata: sata_gemini: Check clk_enable() result (stable-fixes).
  - ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in
    case of S3 suspend (stable-fixes).
  - ALSA: line6: Zero-initialize message buffers (stable-fixes).
  - vboxsf: explicitly deny setlease attempts (stable-fixes).
  - drm/amdkfd: range check cp bad op exception interrupts
    (stable-fixes).
  - drm/amdkfd: Check cgroup when returning DMABuf info
    (stable-fixes).
  - selftests/ftrace: Fix event filter target_func selection
    (stable-fixes).
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal
    (stable-fixes).
  - wifi: iwlwifi: read txq->read_ptr under lock (stable-fixes).
  - wifi: mac80211: fix prep_connection error path (stable-fixes).
  - wifi: cfg80211: fix rdev_dump_mpp() arguments order
    (stable-fixes).
  - wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
    (stable-fixes).
  - ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).
  - gpiolib: cdev: relocate debounce_period_us from struct gpio_desc
    (stable-fixes).
  - selftests/net: convert test_bridge_neigh_suppress.sh to run
    it in unique namespace (stable-fixes).
  - commit 2872089

------------------------------------------------------------------
------------------  2024-5-17  -  May 17 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add procps to Tumbleweed integration tests

++++ python-kiwi:

  - Add procps to Tumbleweed integration tests

++++ python-kiwi:

  - Add procps to Tumbleweed integration tests

++++ kernel-default:

  - af_unix: Fix garbage collector racing against connect()
    (CVE-2024-26923 bsc#1223384).
  - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (CVE-2024-26923
    bsc#1223384).
  - af_unix: Do not use atomic ops for unix_sk(sk)->inflight
    (CVE-2024-26923 bsc#1223384).
  - commit a683abb
  - dm-multipath: dont't attempt SG_IO on non-SCSI-disks
    (bsc#1223575).
  - commit 2f6779f
  - btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans (git-fixes)
  - commit b85295a
  - btrfs: don't arbitrarily slow down delalloc if we're committing (git-fixes)
  - commit d9b2223
  - btrfs: reset destination buffer when read_extent_buffer() gets invalid range (git-fixes)
  - commit 7ef02d5
  - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 (git-fixes)
  - commit e6b51c1
  - btrfs: file_remove_privs needs an exclusive lock in direct io write (git-fixes)
  - commit 0bc88db
  - blacklist.conf: btrfs: cleanup, v0 extent removal
  - commit fecc398
  - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART (git-fixes)
  - commit 74fcad3
  - btrfs: fix start transaction qgroup rsv double free (git-fixes)
  - commit 272247e
  - btrfs: free qgroup rsv on io failure (git-fixes)
  - commit 384dac4
  - netfilter: nf_tables: disable toggling dormant table state
    more than once (git-fixes).
  - commit 76bebd5
  - mptcp: process pending subflow error on close (git-fixes).
  - commit ef629c5
  - mptcp: move __mptcp_error_report in protocol.c (git-fixes).
  - commit a777e91
  - mptcp: fix bogus receive window shrinkage with multiple subflows
    (git-fixes).
  - commit deea9a0
  - netfilter: nft_set_rbtree: use read spinlock to avoid datapath
    contention (git-fixes).
  - commit ddc952e
  - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list
    iterate in smcr_port_add (git-fixes).
  - commit 2d7895b
  - net/smc: bugfix for smcr v2 server connect success statistic
    (git-fixes).
  - commit e746f6b
  - netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID
    (git-fixes).
  - commit ec5b855
  - net: annotate data-races around sk->sk_bind_phc (git-fixes).
  - commit 16b7a1e
  - net: annotate data-races around sk->sk_tsflags (git-fixes).
  - commit b028530
  - arm64: Add the arm64.no32bit_el0 command line option
    (jsc#PED-3184).
    Please note that some adjustments were needed since the upstream commit
    is based on kernel 6.9 which has idreg-override.c moved under
    arch/arm64/kernel/pi/.
  - commit 4fba46a
  - af_unix: Drop oob_skb ref before purging queue in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 57acc3a
  - af_unix: Fix task hung while purging oob_skb in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 3af3fbb
  - af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 7728cdc
  - platform/x86/intel-uncore-freq: Don't present root domain on
    error (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
    (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix meter_show display (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
    (git-fixes).
  - platform/x86: xiaomi-wmi: Fix race condition when reporting
    key events (git-fixes).
  - mtd: rawnand: hynix: fixed typo (git-fixes).
  - mtd: core: Report error if first mtd_otp_size() call fails in
    mtd_otp_nvmem_add() (git-fixes).
  - mmc: davinci: Don't strip remove function when driver is builtin
    (git-fixes).
  - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing (git-fixes).
  - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
    (git-fixes).
  - mmc: sdhci_am654: Add OTAP/ITAP delay enable (git-fixes).
  - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).
  - mmc: sdhci_am654: Add tuning algorithm for delay chain
    (git-fixes).
  - media: sunxi: a83-mips-csi2: also select GENERIC_PHY
    (git-fixes).
  - media: flexcop-usb: fix sanity check of bNumEndpoints
    (git-fixes).
  - media: stk1160: fix bounds checking in stk1160_copy_video()
    (git-fixes).
  - media: uvcvideo: Add quirk for Logitech Rally Bar (git-fixes).
  - media: v4l: Don't turn on privacy LED if streamon fails
    (git-fixes).
  - media: mc: mark the media devnode as registered from the,
    start (git-fixes).
  - media: atomisp: ssh_css: Fix a null-pointer dereference in
    load_video_binaries (git-fixes).
  - media: v4l2-subdev: Fix stream handling for crop API
    (git-fixes).
  - media: mc: Fix graph walk in media_pipeline_start (git-fixes).
  - media: i2c: et8ek8: Don't strip remove function when driver
    is builtin (git-fixes).
  - media: dt-bindings: ovti,ov2680: Fix the power supply names
    (git-fixes).
  - media: ipu3-cio2: Request IRQ earlier (git-fixes).
  - media: rcar-vin: work around -Wenum-compare-conditional warning
    (git-fixes).
  - media: ngene: Add dvb_ca_en50221_init return value check
    (git-fixes).
  - commit ceb1555
  - Move upstreamed media patches into sorted section
  - commit 521e539

++++ kernel-default:

  - af_unix: Fix garbage collector racing against connect()
    (CVE-2024-26923 bsc#1223384).
  - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (CVE-2024-26923
    bsc#1223384).
  - af_unix: Do not use atomic ops for unix_sk(sk)->inflight
    (CVE-2024-26923 bsc#1223384).
  - commit a683abb
  - dm-multipath: dont't attempt SG_IO on non-SCSI-disks
    (bsc#1223575).
  - commit 2f6779f
  - btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans (git-fixes)
  - commit b85295a
  - btrfs: don't arbitrarily slow down delalloc if we're committing (git-fixes)
  - commit d9b2223
  - btrfs: reset destination buffer when read_extent_buffer() gets invalid range (git-fixes)
  - commit 7ef02d5
  - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 (git-fixes)
  - commit e6b51c1
  - btrfs: file_remove_privs needs an exclusive lock in direct io write (git-fixes)
  - commit 0bc88db
  - blacklist.conf: btrfs: cleanup, v0 extent removal
  - commit fecc398
  - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART (git-fixes)
  - commit 74fcad3
  - btrfs: fix start transaction qgroup rsv double free (git-fixes)
  - commit 272247e
  - btrfs: free qgroup rsv on io failure (git-fixes)
  - commit 384dac4
  - netfilter: nf_tables: disable toggling dormant table state
    more than once (git-fixes).
  - commit 76bebd5
  - mptcp: process pending subflow error on close (git-fixes).
  - commit ef629c5
  - mptcp: move __mptcp_error_report in protocol.c (git-fixes).
  - commit a777e91
  - mptcp: fix bogus receive window shrinkage with multiple subflows
    (git-fixes).
  - commit deea9a0
  - netfilter: nft_set_rbtree: use read spinlock to avoid datapath
    contention (git-fixes).
  - commit ddc952e
  - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list
    iterate in smcr_port_add (git-fixes).
  - commit 2d7895b
  - net/smc: bugfix for smcr v2 server connect success statistic
    (git-fixes).
  - commit e746f6b
  - netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID
    (git-fixes).
  - commit ec5b855
  - net: annotate data-races around sk->sk_bind_phc (git-fixes).
  - commit 16b7a1e
  - net: annotate data-races around sk->sk_tsflags (git-fixes).
  - commit b028530
  - arm64: Add the arm64.no32bit_el0 command line option
    (jsc#PED-3184).
    Please note that some adjustments were needed since the upstream commit
    is based on kernel 6.9 which has idreg-override.c moved under
    arch/arm64/kernel/pi/.
  - commit 4fba46a
  - af_unix: Drop oob_skb ref before purging queue in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 57acc3a
  - af_unix: Fix task hung while purging oob_skb in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 3af3fbb
  - af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 7728cdc
  - platform/x86/intel-uncore-freq: Don't present root domain on
    error (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
    (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix meter_show display (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
    (git-fixes).
  - platform/x86: xiaomi-wmi: Fix race condition when reporting
    key events (git-fixes).
  - mtd: rawnand: hynix: fixed typo (git-fixes).
  - mtd: core: Report error if first mtd_otp_size() call fails in
    mtd_otp_nvmem_add() (git-fixes).
  - mmc: davinci: Don't strip remove function when driver is builtin
    (git-fixes).
  - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing (git-fixes).
  - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
    (git-fixes).
  - mmc: sdhci_am654: Add OTAP/ITAP delay enable (git-fixes).
  - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).
  - mmc: sdhci_am654: Add tuning algorithm for delay chain
    (git-fixes).
  - media: sunxi: a83-mips-csi2: also select GENERIC_PHY
    (git-fixes).
  - media: flexcop-usb: fix sanity check of bNumEndpoints
    (git-fixes).
  - media: stk1160: fix bounds checking in stk1160_copy_video()
    (git-fixes).
  - media: uvcvideo: Add quirk for Logitech Rally Bar (git-fixes).
  - media: v4l: Don't turn on privacy LED if streamon fails
    (git-fixes).
  - media: mc: mark the media devnode as registered from the,
    start (git-fixes).
  - media: atomisp: ssh_css: Fix a null-pointer dereference in
    load_video_binaries (git-fixes).
  - media: v4l2-subdev: Fix stream handling for crop API
    (git-fixes).
  - media: mc: Fix graph walk in media_pipeline_start (git-fixes).
  - media: i2c: et8ek8: Don't strip remove function when driver
    is builtin (git-fixes).
  - media: dt-bindings: ovti,ov2680: Fix the power supply names
    (git-fixes).
  - media: ipu3-cio2: Request IRQ earlier (git-fixes).
  - media: rcar-vin: work around -Wenum-compare-conditional warning
    (git-fixes).
  - media: ngene: Add dvb_ca_en50221_init return value check
    (git-fixes).
  - commit ceb1555
  - Move upstreamed media patches into sorted section
  - commit 521e539

++++ kernel-default:

  - af_unix: Fix garbage collector racing against connect()
    (CVE-2024-26923 bsc#1223384).
  - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (CVE-2024-26923
    bsc#1223384).
  - af_unix: Do not use atomic ops for unix_sk(sk)->inflight
    (CVE-2024-26923 bsc#1223384).
  - commit a683abb
  - dm-multipath: dont't attempt SG_IO on non-SCSI-disks
    (bsc#1223575).
  - commit 2f6779f
  - btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans (git-fixes)
  - commit b85295a
  - btrfs: don't arbitrarily slow down delalloc if we're committing (git-fixes)
  - commit d9b2223
  - btrfs: reset destination buffer when read_extent_buffer() gets invalid range (git-fixes)
  - commit 7ef02d5
  - btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 (git-fixes)
  - commit e6b51c1
  - btrfs: file_remove_privs needs an exclusive lock in direct io write (git-fixes)
  - commit 0bc88db
  - blacklist.conf: btrfs: cleanup, v0 extent removal
  - commit fecc398
  - btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART (git-fixes)
  - commit 74fcad3
  - btrfs: fix start transaction qgroup rsv double free (git-fixes)
  - commit 272247e
  - btrfs: free qgroup rsv on io failure (git-fixes)
  - commit 384dac4
  - netfilter: nf_tables: disable toggling dormant table state
    more than once (git-fixes).
  - commit 76bebd5
  - mptcp: process pending subflow error on close (git-fixes).
  - commit ef629c5
  - mptcp: move __mptcp_error_report in protocol.c (git-fixes).
  - commit a777e91
  - mptcp: fix bogus receive window shrinkage with multiple subflows
    (git-fixes).
  - commit deea9a0
  - netfilter: nft_set_rbtree: use read spinlock to avoid datapath
    contention (git-fixes).
  - commit ddc952e
  - net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list
    iterate in smcr_port_add (git-fixes).
  - commit 2d7895b
  - net/smc: bugfix for smcr v2 server connect success statistic
    (git-fixes).
  - commit e746f6b
  - netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID
    (git-fixes).
  - commit ec5b855
  - net: annotate data-races around sk->sk_bind_phc (git-fixes).
  - commit 16b7a1e
  - net: annotate data-races around sk->sk_tsflags (git-fixes).
  - commit b028530
  - arm64: Add the arm64.no32bit_el0 command line option
    (jsc#PED-3184).
    Please note that some adjustments were needed since the upstream commit
    is based on kernel 6.9 which has idreg-override.c moved under
    arch/arm64/kernel/pi/.
  - commit 4fba46a
  - af_unix: Drop oob_skb ref before purging queue in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 57acc3a
  - af_unix: Fix task hung while purging oob_skb in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 3af3fbb
  - af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC
    (CVE-2024-26676 bsc#1222380).
  - commit 7728cdc
  - platform/x86/intel-uncore-freq: Don't present root domain on
    error (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix meter_certificate decoding
    (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix meter_show display (git-fixes).
  - tools/arch/x86/intel_sdsi: Fix maximum meter bundle length
    (git-fixes).
  - platform/x86: xiaomi-wmi: Fix race condition when reporting
    key events (git-fixes).
  - mtd: rawnand: hynix: fixed typo (git-fixes).
  - mtd: core: Report error if first mtd_otp_size() call fails in
    mtd_otp_nvmem_add() (git-fixes).
  - mmc: davinci: Don't strip remove function when driver is builtin
    (git-fixes).
  - mmc: sdhci_am654: Fix ITAPDLY for HS400 timing (git-fixes).
  - mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock
    (git-fixes).
  - mmc: sdhci_am654: Add OTAP/ITAP delay enable (git-fixes).
  - mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).
  - mmc: sdhci_am654: Add tuning algorithm for delay chain
    (git-fixes).
  - media: sunxi: a83-mips-csi2: also select GENERIC_PHY
    (git-fixes).
  - media: flexcop-usb: fix sanity check of bNumEndpoints
    (git-fixes).
  - media: stk1160: fix bounds checking in stk1160_copy_video()
    (git-fixes).
  - media: uvcvideo: Add quirk for Logitech Rally Bar (git-fixes).
  - media: v4l: Don't turn on privacy LED if streamon fails
    (git-fixes).
  - media: mc: mark the media devnode as registered from the,
    start (git-fixes).
  - media: atomisp: ssh_css: Fix a null-pointer dereference in
    load_video_binaries (git-fixes).
  - media: v4l2-subdev: Fix stream handling for crop API
    (git-fixes).
  - media: mc: Fix graph walk in media_pipeline_start (git-fixes).
  - media: i2c: et8ek8: Don't strip remove function when driver
    is builtin (git-fixes).
  - media: dt-bindings: ovti,ov2680: Fix the power supply names
    (git-fixes).
  - media: ipu3-cio2: Request IRQ earlier (git-fixes).
  - media: rcar-vin: work around -Wenum-compare-conditional warning
    (git-fixes).
  - media: ngene: Add dvb_ca_en50221_init return value check
    (git-fixes).
  - commit ceb1555
  - Move upstreamed media patches into sorted section
  - commit 521e539

------------------------------------------------------------------
------------------  2024-5-16  -  May 16 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Add procps to Tumbleweed integration tests

++++ python-kiwi:

  - Add procps to Tumbleweed integration tests

++++ python-kiwi:

  - Add procps to Tumbleweed integration tests

++++ gdk-pixbuf:

  - Enable test suite on x86_64 (other arches seem too flaky for now):
    + Add %check section and call %meson_test
    + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for
    more than 30s, by marking it as a slow test
    (glgo#GNOME/gdk-pixbuf!174).
  - Migrate package to a regular obs_scm service, no longer password
    protecting a zip file. The originally reported bsc#1159337 seems
    no longer be applicable and we prefer the easier route.
  - Drop unzip BuildRequires and pre_checkin.sh script.

++++ gdk-pixbuf:

  - Enable test suite on x86_64 (other arches seem too flaky for now):
    + Add %check section and call %meson_test
    + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for
    more than 30s, by marking it as a slow test
    (glgo#GNOME/gdk-pixbuf!174).
  - Migrate package to a regular obs_scm service, no longer password
    protecting a zip file. The originally reported bsc#1159337 seems
    no longer be applicable and we prefer the easier route.
  - Drop unzip BuildRequires and pre_checkin.sh script.

++++ gdk-pixbuf:

  - Enable test suite on x86_64 (other arches seem too flaky for now):
    + Add %check section and call %meson_test
    + Add gdk-pixbuf-jpeg-slow.patch: allow pixbuf-jpeg to run for
    more than 30s, by marking it as a slow test
    (glgo#GNOME/gdk-pixbuf!174).
  - Migrate package to a regular obs_scm service, no longer password
    protecting a zip file. The originally reported bsc#1159337 seems
    no longer be applicable and we prefer the easier route.
  - Drop unzip BuildRequires and pre_checkin.sh script.

++++ kernel-default:

  - dmaengine: idxd: move safety flag to struct ends (bsc#1223625
    CVE-2024-21823).
  - dmaengine: idxd: add a write() method for applications to
    submit work (bsc#1223625 CVE-2024-21823).
  - dmaengine: idxd: add a new security check to deal with a
    hardware erratum (bsc#1223625 CVE-2024-21823).
  - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
    (bsc#1223625 CVE-2024-21823).
  - commit 8718675
  - Update
    patches.suse/io_uring-af_unix-disable-sending-io_uring-over-socke.patch
    (bsc#1218447 CVE-2023-6531 CVE-2023-52654 bsc#1224099).
  - Update
    patches.suse/usb-aqc111-check-packet-for-fixup-for-true-limit.patch
    (git-fixes CVE-2023-52655 bsc#1217169).
  - commit 07c8bc1
  - octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
    (git-fixes).
  - commit 78ec58d
  - net/mlx5: Fix peer devlink set for SF representor devlink port
    (git-fixes).
  - commit 6a691b6
  - net/mlx5: Lag, restore buckets number to default after hash
    LAG deactivation (git-fixes).
  - commit 19da0bb
  - net: sparx5: flower: fix fragment flags handling (git-fixes).
  - commit 5fd27e9
  - net: ena: Set tx_info->xdpf value to NULL (git-fixes).
  - commit 7d1d83a
  - net: ena: Fix incorrect descriptor free behavior (git-fixes).
  - commit 69577fd
  - net: ena: Wrong missing IO completions check order (git-fixes).
  - commit fbbd86e
  - net: ena: Fix potential sign extension issue (git-fixes).
  - commit b3cc5f8
  - net: dsa: mt7530: trap link-local frames regardless of ST Port
    State (git-fixes).
  - commit 726080b
  - net: sparx5: fix wrong config being used when reconfiguring PCS
    (git-fixes).
  - commit d2d1229
  - net/mlx5e: RSS, Block XOR hash with over 128 channels
    (git-fixes).
  - commit 40b1ccb
  - net/mlx5: Restore mistakenly dropped parts in register devlink
    flow (git-fixes).
  - commit dfb4099
  - btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size (git-fixes)
  - commit a1c6e8c
  - btrfs: don't warn if discard range is not aligned to sector (git-fixes)
  - commit f239c2a
  - btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
  - commit a304971
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (git-fixes)
  - commit 81a1329
  - btrfs: do not allow non subvolume root targets for snapshot (git-fixes)
  - commit d495a4b
  - btrfs: send: ensure send_fd is writable (git-fixes)
  - commit 5055583
  - btrfs: free the allocated memory if btrfs_alloc_page_array() fails (git-fixes)
  - commit 532ad3c
  - btrfs: fix 64bit compat send ioctl arguments not initializing version member (git-fixes)
  - commit 2c30d15
  - btrfs: fix off-by-one when checking chunk map includes logical address (git-fixes)
  - commit e5842bb
  - blacklist.conf: btrfs: ref-verify not built
  - commit 701d654
  - btrfs: use u64 for buffer sizes in the tree search ioctls (git-fixes)
  - commit a1c6ed1
  - btrfs: error out when reallocating block for defrag using a stale transaction (git-fixes)
  - commit e6bb34b
  - btrfs: error when COWing block from a root that is being deleted (git-fixes)
  - commit 78a2694
  - btrfs: error out when COWing block using a stale transaction (git-fixes)
  - commit 850d86f
  - s390/cpum_cf: make crypto counters upward compatible across
    machine types (bsc#1224348).
  - commit 36c1e09
  - btrfs: always print transaction aborted messages with an error level (git-fixes)
  - commit 26fa5ae
  - net/mlx5e: Do not produce metadata freelist entries in Tx port
    ts WQE xmit (git-fixes).
  - commit 287b501
  - net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
    (git-fixes).
  - commit 0085432
  - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (git-fixes).
  - commit 01134b3
  - net/mlx5e: RSS, Block changing channels number when RXFH is
    configured (git-fixes).
  - commit c93a7d5
  - net/mlx5: Correctly compare pkt reformat ids (git-fixes).
  - commit 76a7159
  - net/mlx5: Properly link new fs rules into the tree (git-fixes).
  - commit 7272c33
  - net/mlx5: offset comp irq index in name by one (git-fixes).
  - commit 56809e4
  - net/mlx5: Register devlink first under devlink lock (git-fixes).
  - commit 3162538
  - net/mlx5: E-switch, store eswitch pointer before registering
    devlink_param (git-fixes).
  - commit d6f7fd4
  - ALSA: hda/realtek - fixed headset Mic not show (stable-fixes).
  - ALSA: hda: hda_cs_dsp_ctl: Remove notification of driver write
    (stable-fixes).
  - ALSA: Fix deadlocks with kctl removals at disconnection
    (stable-fixes).
  - ALSA: hda: clarify Copyright information (stable-fixes).
  - ALSA: hda/realtek: Add support for ASUS Zenbook 2024 HN7306W
    (stable-fixes).
  - ALSA: hda/realtek: Fix internal speakers for Legion Y9000X
    2022 IAH7 (stable-fixes).
  - ALSA: hda: Add Intel BMG PCI ID and HDMI codec vid
    (stable-fixes).
  - ALSA: hda: cs35l41: Add support for ASUS ROG 2024 Laptops
    (stable-fixes).
  - ALSA: hda: cs35l41: Ignore errors when configuring IRQs
    (stable-fixes).
  - ALSA: hda/realtek: Add quirks for Lenovo 13X (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo 13X laptop without _DSD
    (stable-fixes).
  - ALSA: hda: cs35l41: Remove redundant argument to
    cs35l41_request_firmware_file() (stable-fixes).
  - ALSA: hda: cs35l41: Update DSP1RX5/6 Sources for DSP config
    (stable-fixes).
  - ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
    (stable-fixes).
  - ALSA: hda: cs35l41: Support HP Omen models without _DSD
    (stable-fixes).
  - ALSA: hda: cs35l41: Set the max PCM Gain using tuning setting
    (stable-fixes).
  - commit bd5e5fc
  - Add cherry-picked patch references to amdgpu patches
  - commit fb4ef8e
  - ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e
    (git-fixes).
  - ASoC: tas2781: Fix a warning reported by robot kernel test
    (git-fixes).
  - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
    (git-fixes).
  - ASoC: Intel: avs: Test result of avs_get_module_entry()
    (git-fixes).
  - ASoC: Intel: avs: Fix potential integer overflow (git-fixes).
  - ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).
  - ASoC: SOF: Intel: mtl: Implement firmware boot state check
    (git-fixes).
  - ASoC: SOF: Intel: lnl: Correct rom_status_reg (git-fixes).
  - ASoC: SOF: Intel: mtl: Correct rom_status_reg (git-fixes).
  - Revert "ASoC: SOF: Intel: hda-dai-ops: only allocate/release
    streams for first CPU DAI" (stable-fixes).
  - Revert "ASoC: SOF: Intel: hda-dai-ops: reset device count for
    SoundWire DAIs" (stable-fixes).
  - ASoC: kirkwood: Fix potential NULL dereference (git-fixes).
  - ASoC: Intel: avs: ssm4567: Do not ignore route checks
    (git-fixes).
  - ASoC: Intel: Disable route checks for Skylake boards
    (git-fixes).
  - ASoC: mediatek: Assign dummy when codec not specified for a
    DAI link (git-fixes).
  - ASoC: mediatek: mt8192: fix register configuration for tdm
    (git-fixes).
  - ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance (git-fixes).
  - ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
    (git-fixes).
  - ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim
    7 16ARHA7 (git-fixes).
  - fbdev: savage: Handle err return when savagefb_check_var failed
    (git-fixes).
  - fbdev: sh7760fb: allow modular build (git-fixes).
  - fbdev: sisfb: hide unused variables (git-fixes).
  - fbdev: shmobile: fix snprintf truncation (git-fixes).
  - drm: zynqmp_dpsub: Always register bridge (git-fixes).
  - Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
    (git-fixes).
  - drm/fbdev-generic: Do not set physical framebuffer address
    (git-fixes).
  - drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting
    fails (git-fixes).
  - drm/msm/adreno: fix CP cycles stat retrieval on a7xx
    (git-fixes).
  - drm/msm/dpu: Add callback function pointer check before its call
    (git-fixes).
  - drm/msm/dpu: Allow configuring multiple active DSC blocks
    (git-fixes).
  - drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).
  - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original
    mode pclk (git-fixes).
  - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing
    connected (git-fixes).
  - drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).
  - drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
    (git-fixes).
  - drm/mediatek: Init `ddp_comp` with devm_kcalloc() (git-fixes).
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).
  - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
    (git-fixes).
  - drm/meson: gate px_clk when setting rate (git-fixes).
  - drm/rockchip: vop2: Do not divide height twice for YUV
    (git-fixes).
  - drm/panel: simple: Add missing Innolux G121X1-L03 format,
    flags, connector (git-fixes).
  - drm/bridge: anx7625: Update audio status while detecting
    (git-fixes).
  - drm/panel: novatek-nt35950: Don't log an error when DSI host
    can't be found (git-fixes).
  - drm/bridge: dpc3433: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: tc358775: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: lt9611uxc: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: lt9611: Don't log an error when DSI host can't be
    found (git-fixes).
  - drm/bridge: lt8912b: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: icn6211: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: anx7625: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm: vc4: Fix possible null pointer dereference (git-fixes).
  - drm/arm/malidp: fix a possible null pointer dereference
    (git-fixes).
  - drm/amd/display: Remove redundant condition in
    dcn35_calc_blocks_to_gate() (git-fixes).
  - drm/amd/display: Fix potential index out of bounds in color
    transformation function (git-fixes).
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer
    dereference (git-fixes).
  - drm/meson: vclk: fix calculation of 59.94 fractional rates
    (git-fixes).
  - drm/panel: ltk050h3146w: drop duplicate commands from
    LTK050H3148W init (git-fixes).
  - drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W
    flags (git-fixes).
  - drm/lcdif: Do not disable clocks on already suspended hardware
    (git-fixes).
  - drm/omapdrm: Fix console by implementing fb_dirty (git-fixes).
  - drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer()
    (git-fixes).
  - drm/ci: update device type for volteer devices (git-fixes).
  - drm/bridge: Fix improper bridge init order with
    pre_enable_prev_first (git-fixes).
  - commit e7d2777
  - Revert "selinux: introduce an initial SID for early boot processes" (bsc#1208593)
    It caused a regression on ALP-current branch, kernel-obs-qa build failed.
  - commit 35271c3

++++ kernel-default:

  - dmaengine: idxd: move safety flag to struct ends (bsc#1223625
    CVE-2024-21823).
  - dmaengine: idxd: add a write() method for applications to
    submit work (bsc#1223625 CVE-2024-21823).
  - dmaengine: idxd: add a new security check to deal with a
    hardware erratum (bsc#1223625 CVE-2024-21823).
  - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
    (bsc#1223625 CVE-2024-21823).
  - commit 8718675
  - Update
    patches.suse/io_uring-af_unix-disable-sending-io_uring-over-socke.patch
    (bsc#1218447 CVE-2023-6531 CVE-2023-52654 bsc#1224099).
  - Update
    patches.suse/usb-aqc111-check-packet-for-fixup-for-true-limit.patch
    (git-fixes CVE-2023-52655 bsc#1217169).
  - commit 07c8bc1
  - octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
    (git-fixes).
  - commit 78ec58d
  - net/mlx5: Fix peer devlink set for SF representor devlink port
    (git-fixes).
  - commit 6a691b6
  - net/mlx5: Lag, restore buckets number to default after hash
    LAG deactivation (git-fixes).
  - commit 19da0bb
  - net: sparx5: flower: fix fragment flags handling (git-fixes).
  - commit 5fd27e9
  - net: ena: Set tx_info->xdpf value to NULL (git-fixes).
  - commit 7d1d83a
  - net: ena: Fix incorrect descriptor free behavior (git-fixes).
  - commit 69577fd
  - net: ena: Wrong missing IO completions check order (git-fixes).
  - commit fbbd86e
  - net: ena: Fix potential sign extension issue (git-fixes).
  - commit b3cc5f8
  - net: dsa: mt7530: trap link-local frames regardless of ST Port
    State (git-fixes).
  - commit 726080b
  - net: sparx5: fix wrong config being used when reconfiguring PCS
    (git-fixes).
  - commit d2d1229
  - net/mlx5e: RSS, Block XOR hash with over 128 channels
    (git-fixes).
  - commit 40b1ccb
  - net/mlx5: Restore mistakenly dropped parts in register devlink
    flow (git-fixes).
  - commit dfb4099
  - btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size (git-fixes)
  - commit a1c6e8c
  - btrfs: don't warn if discard range is not aligned to sector (git-fixes)
  - commit f239c2a
  - btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
  - commit a304971
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (git-fixes)
  - commit 81a1329
  - btrfs: do not allow non subvolume root targets for snapshot (git-fixes)
  - commit d495a4b
  - btrfs: send: ensure send_fd is writable (git-fixes)
  - commit 5055583
  - btrfs: free the allocated memory if btrfs_alloc_page_array() fails (git-fixes)
  - commit 532ad3c
  - btrfs: fix 64bit compat send ioctl arguments not initializing version member (git-fixes)
  - commit 2c30d15
  - btrfs: fix off-by-one when checking chunk map includes logical address (git-fixes)
  - commit e5842bb
  - blacklist.conf: btrfs: ref-verify not built
  - commit 701d654
  - btrfs: use u64 for buffer sizes in the tree search ioctls (git-fixes)
  - commit a1c6ed1
  - btrfs: error out when reallocating block for defrag using a stale transaction (git-fixes)
  - commit e6bb34b
  - btrfs: error when COWing block from a root that is being deleted (git-fixes)
  - commit 78a2694
  - btrfs: error out when COWing block using a stale transaction (git-fixes)
  - commit 850d86f
  - s390/cpum_cf: make crypto counters upward compatible across
    machine types (bsc#1224348).
  - commit 36c1e09
  - btrfs: always print transaction aborted messages with an error level (git-fixes)
  - commit 26fa5ae
  - net/mlx5e: Do not produce metadata freelist entries in Tx port
    ts WQE xmit (git-fixes).
  - commit 287b501
  - net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
    (git-fixes).
  - commit 0085432
  - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (git-fixes).
  - commit 01134b3
  - net/mlx5e: RSS, Block changing channels number when RXFH is
    configured (git-fixes).
  - commit c93a7d5
  - net/mlx5: Correctly compare pkt reformat ids (git-fixes).
  - commit 76a7159
  - net/mlx5: Properly link new fs rules into the tree (git-fixes).
  - commit 7272c33
  - net/mlx5: offset comp irq index in name by one (git-fixes).
  - commit 56809e4
  - net/mlx5: Register devlink first under devlink lock (git-fixes).
  - commit 3162538
  - net/mlx5: E-switch, store eswitch pointer before registering
    devlink_param (git-fixes).
  - commit d6f7fd4
  - ALSA: hda/realtek - fixed headset Mic not show (stable-fixes).
  - ALSA: hda: hda_cs_dsp_ctl: Remove notification of driver write
    (stable-fixes).
  - ALSA: Fix deadlocks with kctl removals at disconnection
    (stable-fixes).
  - ALSA: hda: clarify Copyright information (stable-fixes).
  - ALSA: hda/realtek: Add support for ASUS Zenbook 2024 HN7306W
    (stable-fixes).
  - ALSA: hda/realtek: Fix internal speakers for Legion Y9000X
    2022 IAH7 (stable-fixes).
  - ALSA: hda: Add Intel BMG PCI ID and HDMI codec vid
    (stable-fixes).
  - ALSA: hda: cs35l41: Add support for ASUS ROG 2024 Laptops
    (stable-fixes).
  - ALSA: hda: cs35l41: Ignore errors when configuring IRQs
    (stable-fixes).
  - ALSA: hda/realtek: Add quirks for Lenovo 13X (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo 13X laptop without _DSD
    (stable-fixes).
  - ALSA: hda: cs35l41: Remove redundant argument to
    cs35l41_request_firmware_file() (stable-fixes).
  - ALSA: hda: cs35l41: Update DSP1RX5/6 Sources for DSP config
    (stable-fixes).
  - ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
    (stable-fixes).
  - ALSA: hda: cs35l41: Support HP Omen models without _DSD
    (stable-fixes).
  - ALSA: hda: cs35l41: Set the max PCM Gain using tuning setting
    (stable-fixes).
  - commit bd5e5fc
  - Add cherry-picked patch references to amdgpu patches
  - commit fb4ef8e
  - ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e
    (git-fixes).
  - ASoC: tas2781: Fix a warning reported by robot kernel test
    (git-fixes).
  - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
    (git-fixes).
  - ASoC: Intel: avs: Test result of avs_get_module_entry()
    (git-fixes).
  - ASoC: Intel: avs: Fix potential integer overflow (git-fixes).
  - ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).
  - ASoC: SOF: Intel: mtl: Implement firmware boot state check
    (git-fixes).
  - ASoC: SOF: Intel: lnl: Correct rom_status_reg (git-fixes).
  - ASoC: SOF: Intel: mtl: Correct rom_status_reg (git-fixes).
  - Revert "ASoC: SOF: Intel: hda-dai-ops: only allocate/release
    streams for first CPU DAI" (stable-fixes).
  - Revert "ASoC: SOF: Intel: hda-dai-ops: reset device count for
    SoundWire DAIs" (stable-fixes).
  - ASoC: kirkwood: Fix potential NULL dereference (git-fixes).
  - ASoC: Intel: avs: ssm4567: Do not ignore route checks
    (git-fixes).
  - ASoC: Intel: Disable route checks for Skylake boards
    (git-fixes).
  - ASoC: mediatek: Assign dummy when codec not specified for a
    DAI link (git-fixes).
  - ASoC: mediatek: mt8192: fix register configuration for tdm
    (git-fixes).
  - ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance (git-fixes).
  - ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
    (git-fixes).
  - ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim
    7 16ARHA7 (git-fixes).
  - fbdev: savage: Handle err return when savagefb_check_var failed
    (git-fixes).
  - fbdev: sh7760fb: allow modular build (git-fixes).
  - fbdev: sisfb: hide unused variables (git-fixes).
  - fbdev: shmobile: fix snprintf truncation (git-fixes).
  - drm: zynqmp_dpsub: Always register bridge (git-fixes).
  - Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
    (git-fixes).
  - drm/fbdev-generic: Do not set physical framebuffer address
    (git-fixes).
  - drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting
    fails (git-fixes).
  - drm/msm/adreno: fix CP cycles stat retrieval on a7xx
    (git-fixes).
  - drm/msm/dpu: Add callback function pointer check before its call
    (git-fixes).
  - drm/msm/dpu: Allow configuring multiple active DSC blocks
    (git-fixes).
  - drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).
  - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original
    mode pclk (git-fixes).
  - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing
    connected (git-fixes).
  - drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).
  - drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
    (git-fixes).
  - drm/mediatek: Init `ddp_comp` with devm_kcalloc() (git-fixes).
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).
  - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
    (git-fixes).
  - drm/meson: gate px_clk when setting rate (git-fixes).
  - drm/rockchip: vop2: Do not divide height twice for YUV
    (git-fixes).
  - drm/panel: simple: Add missing Innolux G121X1-L03 format,
    flags, connector (git-fixes).
  - drm/bridge: anx7625: Update audio status while detecting
    (git-fixes).
  - drm/panel: novatek-nt35950: Don't log an error when DSI host
    can't be found (git-fixes).
  - drm/bridge: dpc3433: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: tc358775: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: lt9611uxc: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: lt9611: Don't log an error when DSI host can't be
    found (git-fixes).
  - drm/bridge: lt8912b: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: icn6211: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: anx7625: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm: vc4: Fix possible null pointer dereference (git-fixes).
  - drm/arm/malidp: fix a possible null pointer dereference
    (git-fixes).
  - drm/amd/display: Remove redundant condition in
    dcn35_calc_blocks_to_gate() (git-fixes).
  - drm/amd/display: Fix potential index out of bounds in color
    transformation function (git-fixes).
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer
    dereference (git-fixes).
  - drm/meson: vclk: fix calculation of 59.94 fractional rates
    (git-fixes).
  - drm/panel: ltk050h3146w: drop duplicate commands from
    LTK050H3148W init (git-fixes).
  - drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W
    flags (git-fixes).
  - drm/lcdif: Do not disable clocks on already suspended hardware
    (git-fixes).
  - drm/omapdrm: Fix console by implementing fb_dirty (git-fixes).
  - drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer()
    (git-fixes).
  - drm/ci: update device type for volteer devices (git-fixes).
  - drm/bridge: Fix improper bridge init order with
    pre_enable_prev_first (git-fixes).
  - commit e7d2777
  - Revert "selinux: introduce an initial SID for early boot processes" (bsc#1208593)
    It caused a regression on ALP-current branch, kernel-obs-qa build failed.
  - commit 35271c3

++++ kernel-default:

  - dmaengine: idxd: move safety flag to struct ends (bsc#1223625
    CVE-2024-21823).
  - dmaengine: idxd: add a write() method for applications to
    submit work (bsc#1223625 CVE-2024-21823).
  - dmaengine: idxd: add a new security check to deal with a
    hardware erratum (bsc#1223625 CVE-2024-21823).
  - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist
    (bsc#1223625 CVE-2024-21823).
  - commit 8718675
  - Update
    patches.suse/io_uring-af_unix-disable-sending-io_uring-over-socke.patch
    (bsc#1218447 CVE-2023-6531 CVE-2023-52654 bsc#1224099).
  - Update
    patches.suse/usb-aqc111-check-packet-for-fixup-for-true-limit.patch
    (git-fixes CVE-2023-52655 bsc#1217169).
  - commit 07c8bc1
  - octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
    (git-fixes).
  - commit 78ec58d
  - net/mlx5: Fix peer devlink set for SF representor devlink port
    (git-fixes).
  - commit 6a691b6
  - net/mlx5: Lag, restore buckets number to default after hash
    LAG deactivation (git-fixes).
  - commit 19da0bb
  - net: sparx5: flower: fix fragment flags handling (git-fixes).
  - commit 5fd27e9
  - net: ena: Set tx_info->xdpf value to NULL (git-fixes).
  - commit 7d1d83a
  - net: ena: Fix incorrect descriptor free behavior (git-fixes).
  - commit 69577fd
  - net: ena: Wrong missing IO completions check order (git-fixes).
  - commit fbbd86e
  - net: ena: Fix potential sign extension issue (git-fixes).
  - commit b3cc5f8
  - net: dsa: mt7530: trap link-local frames regardless of ST Port
    State (git-fixes).
  - commit 726080b
  - net: sparx5: fix wrong config being used when reconfiguring PCS
    (git-fixes).
  - commit d2d1229
  - net/mlx5e: RSS, Block XOR hash with over 128 channels
    (git-fixes).
  - commit 40b1ccb
  - net/mlx5: Restore mistakenly dropped parts in register devlink
    flow (git-fixes).
  - commit dfb4099
  - btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size (git-fixes)
  - commit a1c6e8c
  - btrfs: don't warn if discard range is not aligned to sector (git-fixes)
  - commit f239c2a
  - btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
  - commit a304971
  - btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (git-fixes)
  - commit 81a1329
  - btrfs: do not allow non subvolume root targets for snapshot (git-fixes)
  - commit d495a4b
  - btrfs: send: ensure send_fd is writable (git-fixes)
  - commit 5055583
  - btrfs: free the allocated memory if btrfs_alloc_page_array() fails (git-fixes)
  - commit 532ad3c
  - btrfs: fix 64bit compat send ioctl arguments not initializing version member (git-fixes)
  - commit 2c30d15
  - btrfs: fix off-by-one when checking chunk map includes logical address (git-fixes)
  - commit e5842bb
  - blacklist.conf: btrfs: ref-verify not built
  - commit 701d654
  - btrfs: use u64 for buffer sizes in the tree search ioctls (git-fixes)
  - commit a1c6ed1
  - btrfs: error out when reallocating block for defrag using a stale transaction (git-fixes)
  - commit e6bb34b
  - btrfs: error when COWing block from a root that is being deleted (git-fixes)
  - commit 78a2694
  - btrfs: error out when COWing block using a stale transaction (git-fixes)
  - commit 850d86f
  - s390/cpum_cf: make crypto counters upward compatible across
    machine types (bsc#1224348).
  - commit 36c1e09
  - btrfs: always print transaction aborted messages with an error level (git-fixes)
  - commit 26fa5ae
  - net/mlx5e: Do not produce metadata freelist entries in Tx port
    ts WQE xmit (git-fixes).
  - commit 287b501
  - net/mlx5e: HTB, Fix inconsistencies with QoS SQs number
    (git-fixes).
  - commit 0085432
  - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (git-fixes).
  - commit 01134b3
  - net/mlx5e: RSS, Block changing channels number when RXFH is
    configured (git-fixes).
  - commit c93a7d5
  - net/mlx5: Correctly compare pkt reformat ids (git-fixes).
  - commit 76a7159
  - net/mlx5: Properly link new fs rules into the tree (git-fixes).
  - commit 7272c33
  - net/mlx5: offset comp irq index in name by one (git-fixes).
  - commit 56809e4
  - net/mlx5: Register devlink first under devlink lock (git-fixes).
  - commit 3162538
  - net/mlx5: E-switch, store eswitch pointer before registering
    devlink_param (git-fixes).
  - commit d6f7fd4
  - ALSA: hda/realtek - fixed headset Mic not show (stable-fixes).
  - ALSA: hda: hda_cs_dsp_ctl: Remove notification of driver write
    (stable-fixes).
  - ALSA: Fix deadlocks with kctl removals at disconnection
    (stable-fixes).
  - ALSA: hda: clarify Copyright information (stable-fixes).
  - ALSA: hda/realtek: Add support for ASUS Zenbook 2024 HN7306W
    (stable-fixes).
  - ALSA: hda/realtek: Fix internal speakers for Legion Y9000X
    2022 IAH7 (stable-fixes).
  - ALSA: hda: Add Intel BMG PCI ID and HDMI codec vid
    (stable-fixes).
  - ALSA: hda: cs35l41: Add support for ASUS ROG 2024 Laptops
    (stable-fixes).
  - ALSA: hda: cs35l41: Ignore errors when configuring IRQs
    (stable-fixes).
  - ALSA: hda/realtek: Add quirks for Lenovo 13X (stable-fixes).
  - ALSA: hda: cs35l41: Support Lenovo 13X laptop without _DSD
    (stable-fixes).
  - ALSA: hda: cs35l41: Remove redundant argument to
    cs35l41_request_firmware_file() (stable-fixes).
  - ALSA: hda: cs35l41: Update DSP1RX5/6 Sources for DSP config
    (stable-fixes).
  - ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41
    (stable-fixes).
  - ALSA: hda: cs35l41: Support HP Omen models without _DSD
    (stable-fixes).
  - ALSA: hda: cs35l41: Set the max PCM Gain using tuning setting
    (stable-fixes).
  - commit bd5e5fc
  - Add cherry-picked patch references to amdgpu patches
  - commit fb4ef8e
  - ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e
    (git-fixes).
  - ASoC: tas2781: Fix a warning reported by robot kernel test
    (git-fixes).
  - ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value
    (git-fixes).
  - ASoC: Intel: avs: Test result of avs_get_module_entry()
    (git-fixes).
  - ASoC: Intel: avs: Fix potential integer overflow (git-fixes).
  - ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).
  - ASoC: SOF: Intel: mtl: Implement firmware boot state check
    (git-fixes).
  - ASoC: SOF: Intel: lnl: Correct rom_status_reg (git-fixes).
  - ASoC: SOF: Intel: mtl: Correct rom_status_reg (git-fixes).
  - Revert "ASoC: SOF: Intel: hda-dai-ops: only allocate/release
    streams for first CPU DAI" (stable-fixes).
  - Revert "ASoC: SOF: Intel: hda-dai-ops: reset device count for
    SoundWire DAIs" (stable-fixes).
  - ASoC: kirkwood: Fix potential NULL dereference (git-fixes).
  - ASoC: Intel: avs: ssm4567: Do not ignore route checks
    (git-fixes).
  - ASoC: Intel: Disable route checks for Skylake boards
    (git-fixes).
  - ASoC: mediatek: Assign dummy when codec not specified for a
    DAI link (git-fixes).
  - ASoC: mediatek: mt8192: fix register configuration for tdm
    (git-fixes).
  - ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance (git-fixes).
  - ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
    (git-fixes).
  - ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim
    7 16ARHA7 (git-fixes).
  - fbdev: savage: Handle err return when savagefb_check_var failed
    (git-fixes).
  - fbdev: sh7760fb: allow modular build (git-fixes).
  - fbdev: sisfb: hide unused variables (git-fixes).
  - fbdev: shmobile: fix snprintf truncation (git-fixes).
  - drm: zynqmp_dpsub: Always register bridge (git-fixes).
  - Revert "drm/bridge: ti-sn65dsi83: Fix enable error path"
    (git-fixes).
  - drm/fbdev-generic: Do not set physical framebuffer address
    (git-fixes).
  - drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting
    fails (git-fixes).
  - drm/msm/adreno: fix CP cycles stat retrieval on a7xx
    (git-fixes).
  - drm/msm/dpu: Add callback function pointer check before its call
    (git-fixes).
  - drm/msm/dpu: Allow configuring multiple active DSC blocks
    (git-fixes).
  - drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).
  - drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original
    mode pclk (git-fixes).
  - drm/msm/dp: Avoid a long timeout for AUX transfer if nothing
    connected (git-fixes).
  - drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).
  - drm/mediatek: dp: Fix mtk_dp_aux_transfer return value
    (git-fixes).
  - drm/mediatek: Init `ddp_comp` with devm_kcalloc() (git-fixes).
  - drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).
  - drm/bridge: tc358775: fix support for jeida-18 and jeida-24
    (git-fixes).
  - drm/meson: gate px_clk when setting rate (git-fixes).
  - drm/rockchip: vop2: Do not divide height twice for YUV
    (git-fixes).
  - drm/panel: simple: Add missing Innolux G121X1-L03 format,
    flags, connector (git-fixes).
  - drm/bridge: anx7625: Update audio status while detecting
    (git-fixes).
  - drm/panel: novatek-nt35950: Don't log an error when DSI host
    can't be found (git-fixes).
  - drm/bridge: dpc3433: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: tc358775: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: lt9611uxc: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: lt9611: Don't log an error when DSI host can't be
    found (git-fixes).
  - drm/bridge: lt8912b: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: icn6211: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm/bridge: anx7625: Don't log an error when DSI host can't
    be found (git-fixes).
  - drm: vc4: Fix possible null pointer dereference (git-fixes).
  - drm/arm/malidp: fix a possible null pointer dereference
    (git-fixes).
  - drm/amd/display: Remove redundant condition in
    dcn35_calc_blocks_to_gate() (git-fixes).
  - drm/amd/display: Fix potential index out of bounds in color
    transformation function (git-fixes).
  - drm: bridge: cdns-mhdp8546: Fix possible null pointer
    dereference (git-fixes).
  - drm/meson: vclk: fix calculation of 59.94 fractional rates
    (git-fixes).
  - drm/panel: ltk050h3146w: drop duplicate commands from
    LTK050H3148W init (git-fixes).
  - drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W
    flags (git-fixes).
  - drm/lcdif: Do not disable clocks on already suspended hardware
    (git-fixes).
  - drm/omapdrm: Fix console by implementing fb_dirty (git-fixes).
  - drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer()
    (git-fixes).
  - drm/ci: update device type for volteer devices (git-fixes).
  - drm/bridge: Fix improper bridge init order with
    pre_enable_prev_first (git-fixes).
  - commit e7d2777
  - Revert "selinux: introduce an initial SID for early boot processes" (bsc#1208593)
    It caused a regression on ALP-current branch, kernel-obs-qa build failed.
  - commit 35271c3

++++ kernel-firmware:

  - Update aliases from 6.9 TW kernels

++++ kernel-firmware:

  - Update aliases from 6.9 TW kernels

++++ kernel-firmware:

  - Update aliases from 6.9 TW kernels

++++ openSUSE-repos-LeapMicro:

  - Update to version 20240516.5431918:
    * Update README.md
    * ci: Use bash for repo_checks to not rely on shebang
    * t: Add diagnostic to leap test
    * Add ci
    * Add basic url_checker
    * repo_checks: Add handling for Leap and Leap Micro
    * Drop Leap armv7hl debug repo definitions boo#1224217
    * Use Leap source repo for Leap 15 ports
    * Fix urls for leap-ports (32 bit arm)
    * Create repo_checks.yml
    * rename url_checker to repo_checks
    * Drop leap16 definitions for now to get url_checker working

++++ qemu:

  - Update to version 8.2.4. Full changelog/backports here:
    https://lore.kernel.org/qemu-devel/1715632914.382233.1013785.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/sh4: Fix SUBV opcode
    target/sh4: Fix ADDV opcode
    hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
    hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
    hw/ufs: Fix buffer overflow bug
    tests/avocado: update sunxi kernel from armbian to 6.6.16
    target/loongarch/cpu.c: typo fix: expection
    backends/cryptodev-builtin: Fix local_error leaks
    nbd/server: Mark negotiation functions as coroutine_fn
    nbd/server: do not poll within a coroutine context
    linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY
    target/riscv/kvm: change timer regs size to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
    ...

++++ qemu:

  - Update to version 8.2.4. Full changelog/backports here:
    https://lore.kernel.org/qemu-devel/1715632914.382233.1013785.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/sh4: Fix SUBV opcode
    target/sh4: Fix ADDV opcode
    hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
    hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
    hw/ufs: Fix buffer overflow bug
    tests/avocado: update sunxi kernel from armbian to 6.6.16
    target/loongarch/cpu.c: typo fix: expection
    backends/cryptodev-builtin: Fix local_error leaks
    nbd/server: Mark negotiation functions as coroutine_fn
    nbd/server: do not poll within a coroutine context
    linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY
    target/riscv/kvm: change timer regs size to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
    ...

++++ qemu:

  - Update to version 8.2.4. Full changelog/backports here:
    https://lore.kernel.org/qemu-devel/1715632914.382233.1013785.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/sh4: Fix SUBV opcode
    target/sh4: Fix ADDV opcode
    hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
    hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
    hw/ufs: Fix buffer overflow bug
    tests/avocado: update sunxi kernel from armbian to 6.6.16
    target/loongarch/cpu.c: typo fix: expection
    backends/cryptodev-builtin: Fix local_error leaks
    nbd/server: Mark negotiation functions as coroutine_fn
    nbd/server: do not poll within a coroutine context
    linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY
    target/riscv/kvm: change timer regs size to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
    ...

++++ qemu:

  - Update to version 8.2.4. Full changelog/backports here:
    https://lore.kernel.org/qemu-devel/1715632914.382233.1013785.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/sh4: Fix SUBV opcode
    target/sh4: Fix ADDV opcode
    hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
    hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
    hw/ufs: Fix buffer overflow bug
    tests/avocado: update sunxi kernel from armbian to 6.6.16
    target/loongarch/cpu.c: typo fix: expection
    backends/cryptodev-builtin: Fix local_error leaks
    nbd/server: Mark negotiation functions as coroutine_fn
    nbd/server: do not poll within a coroutine context
    linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY
    target/riscv/kvm: change timer regs size to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
    ...

++++ qemu:

  - Update to version 8.2.4. Full changelog/backports here:
    https://lore.kernel.org/qemu-devel/1715632914.382233.1013785.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/sh4: Fix SUBV opcode
    target/sh4: Fix ADDV opcode
    hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
    hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
    hw/ufs: Fix buffer overflow bug
    tests/avocado: update sunxi kernel from armbian to 6.6.16
    target/loongarch/cpu.c: typo fix: expection
    backends/cryptodev-builtin: Fix local_error leaks
    nbd/server: Mark negotiation functions as coroutine_fn
    nbd/server: do not poll within a coroutine context
    linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY
    target/riscv/kvm: change timer regs size to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
    ...

++++ qemu:

  - Update to version 8.2.4. Full changelog/backports here:
    https://lore.kernel.org/qemu-devel/1715632914.382233.1013785.nullmailer@tls.msk.ru/
    Some of the upstream backports are:
    target/sh4: Fix SUBV opcode
    target/sh4: Fix ADDV opcode
    hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
    hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
    hw/ufs: Fix buffer overflow bug
    tests/avocado: update sunxi kernel from armbian to 6.6.16
    target/loongarch/cpu.c: typo fix: expection
    backends/cryptodev-builtin: Fix local_error leaks
    nbd/server: Mark negotiation functions as coroutine_fn
    nbd/server: do not poll within a coroutine context
    linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY
    target/riscv/kvm: change timer regs size to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
    target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32
    ...

++++ rust-keylime:

  - Update to version 0.2.5~4:
    * Fix 'unnecessary qualification' warnings
    * fix IAK template to match IDevID
    * rpm: fix COPR RPMs build for centos-stream-10
    * Build COPR RPMs for centos-stream-10

++++ rust-keylime:

  - Update to version 0.2.5~4:
    * Fix 'unnecessary qualification' warnings
    * fix IAK template to match IDevID
    * rpm: fix COPR RPMs build for centos-stream-10
    * Build COPR RPMs for centos-stream-10

++++ rust-keylime:

  - Update to version 0.2.5~4:
    * Fix 'unnecessary qualification' warnings
    * fix IAK template to match IDevID
    * rpm: fix COPR RPMs build for centos-stream-10
    * Build COPR RPMs for centos-stream-10

++++ rust-keylime:

  - Update to version 0.2.5~4:
    * Fix 'unnecessary qualification' warnings
    * fix IAK template to match IDevID
    * rpm: fix COPR RPMs build for centos-stream-10
    * Build COPR RPMs for centos-stream-10

++++ rust-keylime:

  - Update to version 0.2.5~4:
    * Fix 'unnecessary qualification' warnings
    * fix IAK template to match IDevID
    * rpm: fix COPR RPMs build for centos-stream-10
    * Build COPR RPMs for centos-stream-10

------------------------------------------------------------------
------------------  2024-5-15  -  May 15 2024  -------------------
------------------------------------------------------------------

++++ gdk-pixbuf:

  - Update to version 2.42.12:
    + Fix a build failure,
    + Fix occasional build failures,
    + ani: Reject files with multiple INA or IART chunks,
    + ani: Reject files with multiple anih chunks (CVE-2022-48622),
    + ani: validate chunk size,
    + Updated translations.
  - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed
    upstream.

++++ gdk-pixbuf:

  - Update to version 2.42.12:
    + Fix a build failure,
    + Fix occasional build failures,
    + ani: Reject files with multiple INA or IART chunks,
    + ani: Reject files with multiple anih chunks (CVE-2022-48622),
    + ani: validate chunk size,
    + Updated translations.
  - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed
    upstream.

++++ gdk-pixbuf:

  - Update to version 2.42.12:
    + Fix a build failure,
    + Fix occasional build failures,
    + ani: Reject files with multiple INA or IART chunks,
    + ani: Reject files with multiple anih chunks (CVE-2022-48622),
    + ani: validate chunk size,
    + Updated translations.
  - Drop 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: fixed
    upstream.

++++ kernel-default:

  - powerpc/eeh: Permanently disable the removed device (bsc#1223991
    ltc#205740).
  - commit b9c2f2f
  - fat: fix uninitialized field in nostale filehandles (git-fixes)
  - commit f1e1fd7
  - net: ks8851: Queue RX packets in IRQ handler instead of
    disabling BHs (git-fixes).
  - commit cc9313f
  - Move upstreamed ACPI patch into sorted section
  - commit 6c48aae
  - fs: relax mount_setattr() permission checks (git-fixes)
  - commit 3b377cf
  - bpf, arm64: Fix incorrect runtime stats (git-fixes)
  - commit c30a258
  - fast_dput(): handle underflows gracefully (git-fixes)
  - commit 7a48807
  - ecryptfs: Reject casefold directory inodes (git-fixes)
  - commit bc23622
  - fsverity: skip PKCS#7 parser when keyring is empty (git-fixes)
  - commit 97f203b
  - cifs: fix underflow in parse_server_interfaces() (CVE-2024-26828 bsc#1223084).
  - commit 40aba68
  - blacklist.conf: fs updates
  - commit 372a9be
  - octeontx2-af: Fix NIX SQ mode and BP config (git-fixes).
  - commit 6fa6e4e
  - net: ks8851: Handle softirqs at the end of IRQ thread to fix
    hang (git-fixes).
  - commit 871b504
  - net: ks8851: Inline ks8851_rx_skb() (git-fixes).
  - commit 0fafe3f
  - bnxt_en: Reset PTP tx_avail after possible firmware reset
    (git-fixes).
  - commit 9421aa8
  - bnxt_en: Fix error recovery for RoCE ulp client (git-fixes).
  - commit a747a74
  - bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
    (git-fixes).
  - commit 6a62a82
  - geneve: fix header validation in geneve[6]_xmit_skb (git-fixes).
  - commit d4d699c
  - octeontx2-pf: Fix transmit scheduler resource leak (git-fixes).
  - commit 9beffaf
  - net/mlx5: SF, Stop waiting for FW as teardown was called
    (git-fixes).
  - commit 2583247
  - mlxsw: Use refcount_t for reference counting (git-fixes).
  - commit 5be65d6
  - net: ena: Use tx_ring instead of xdp_ring for XDP channel TX
    (git-fixes).
  - commit d4b3628
  - net: ena: Pass ena_adapter instead of net_device to
    ena_xmit_common() (git-fixes).
  - commit c080c13
  - net: ena: Move XDP code to its new files (git-fixes).
  - commit 7cd4a35
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (bsc#1224098
    CVE-2024-27395).
  - commit a237c4c
  - selinux: introduce an initial SID for early boot processes
    (bsc#1208593).
  - commit a82f05c
  - mctp: perform route lookups under a RCU read-side lock
    (CVE-2023-52483 bsc#1220738).
  - commit 659b74f
  - net: gtp: Fix Use-After-Free in gtp_dellink (bsc#1224096
    CVE-2024-27396).
  - commit 7f59223
  - Move upstreamed patches into sorted section
  - commit 25085d6
  - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
    (git-fixes).
  - commit 61c5310
  - ax25: Fix reference count leak issue of net_device (git-fixes).
  - ax25: Fix reference count leak issues of ax25_dev (git-fixes).
  - net: usb: ax88179_178a: fix link status when link is set to
    down/up (git-fixes).
  - selftests: net: move amt to socat for better compatibility
    (git-fixes).
  - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
    (git-fixes).
  - net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
  - wifi: mwl8k: initialize cmd->addr[] properly (git-fixes).
  - wifi: rtw89: pci: correct TX resource checking for PCI DMA
    channel of firmware command (git-fixes).
  - wifi: ar5523: enable proper endpoint verification (git-fixes).
  - wifi: carl9170: add a proper sanity check for endpoints
    (git-fixes).
  - wifi: ath10k: populate board data for WCN3990 (git-fixes).
  - wifi: ath10k: Fix an error code problem in
    ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).
  - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
    (git-fixes).
  - wifi: carl9170: re-fix fortified-memset warning (git-fixes).
  - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
    (git-fixes).
  - wifi: mt76: mt7603: fix tx queue of loopback packets
    (git-fixes).
  - net: usb: sr9700: stop lying about skb->truesize (git-fixes).
  - usb: aqc111: stop lying about skb->truesize (git-fixes).
  - wifi: iwlwifi: mvm: init vif works only once (git-fixes).
  - net: nfc: remove inappropriate attrs check (stable-fixes).
  - wifi: ath11k: don't force enable power save on non-running vdevs
    (git-fixes).
  - wifi: ath10k: poll service ready message before failing
    (git-fixes).
  - wifi: iwlwifi: reconfigure TLC during HW restart (git-fixes).
  - wifi: iwlwifi: mvm: select STA mask only for active links
    (git-fixes).
  - wifi: iwlwifi: mvm: fix active link counting during recovery
    (git-fixes).
  - wifi: iwlwifi: mvm: allocate STA links only for active links
    (git-fixes).
  - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
    (git-fixes).
  - wifi: mt76: mt7915: workaround too long expansion sparse
    warnings (git-fixes).
  - wifi: brcmfmac: pcie: handle randbuf allocation failure
    (git-fixes).
  - bitops: add missing prototype check (git-fixes).
  - ata: pata_legacy: make legacy_exit() work again (git-fixes).
  - efi: libstub: only free priv.runtime_map when allocated
    (git-fixes).
  - HID: amd_sfh: Handle "no sensors" in PM operations (git-fixes).
  - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
    (git-fixes).
  - hwmon: (lm70) fix links in doc and comments (git-fixes).
  - spi: xilinx: Fix kernel documentation in the xilinx_spi.h
    (git-fixes).
  - ACPI: LPSS: Advertise number of chip selects via property
    (git-fixes).
  - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
    (git-fixes).
  - ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).
  - ACPI: bus: Indicate support for the Generic Event Device thru
    _OSC (git-fixes).
  - ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).
  - ACPI: disable -Wstringop-truncation (git-fixes).
  - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
    (git-fixes).
  - cppc_cpufreq: Fix possible null pointer dereference (git-fixes).
  - cpufreq: exit() callback is optional (git-fixes).
  - thermal/drivers/tsens: Fix null pointer dereference (git-fixes).
  - thermal/drivers/qcom/lmh: Check for SCM availability at probe
    (git-fixes).
  - selftests: default to host arch for LLVM builds (git-fixes).
  - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
    (git-fixes).
  - selftests/binderfs: use the Makefile's rules, not Make's
    implicit rules (git-fixes).
  - irqchip/loongson-pch-msi: Fix off-by-one on allocation error
    path (git-fixes).
  - irqchip/alpine-msi: Fix off-by-one in allocation error path
    (git-fixes).
  - commit ea6926d

++++ kernel-default:

  - powerpc/eeh: Permanently disable the removed device (bsc#1223991
    ltc#205740).
  - commit b9c2f2f
  - fat: fix uninitialized field in nostale filehandles (git-fixes)
  - commit f1e1fd7
  - net: ks8851: Queue RX packets in IRQ handler instead of
    disabling BHs (git-fixes).
  - commit cc9313f
  - Move upstreamed ACPI patch into sorted section
  - commit 6c48aae
  - fs: relax mount_setattr() permission checks (git-fixes)
  - commit 3b377cf
  - bpf, arm64: Fix incorrect runtime stats (git-fixes)
  - commit c30a258
  - fast_dput(): handle underflows gracefully (git-fixes)
  - commit 7a48807
  - ecryptfs: Reject casefold directory inodes (git-fixes)
  - commit bc23622
  - fsverity: skip PKCS#7 parser when keyring is empty (git-fixes)
  - commit 97f203b
  - cifs: fix underflow in parse_server_interfaces() (CVE-2024-26828 bsc#1223084).
  - commit 40aba68
  - blacklist.conf: fs updates
  - commit 372a9be
  - octeontx2-af: Fix NIX SQ mode and BP config (git-fixes).
  - commit 6fa6e4e
  - net: ks8851: Handle softirqs at the end of IRQ thread to fix
    hang (git-fixes).
  - commit 871b504
  - net: ks8851: Inline ks8851_rx_skb() (git-fixes).
  - commit 0fafe3f
  - bnxt_en: Reset PTP tx_avail after possible firmware reset
    (git-fixes).
  - commit 9421aa8
  - bnxt_en: Fix error recovery for RoCE ulp client (git-fixes).
  - commit a747a74
  - bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
    (git-fixes).
  - commit 6a62a82
  - geneve: fix header validation in geneve[6]_xmit_skb (git-fixes).
  - commit d4d699c
  - octeontx2-pf: Fix transmit scheduler resource leak (git-fixes).
  - commit 9beffaf
  - net/mlx5: SF, Stop waiting for FW as teardown was called
    (git-fixes).
  - commit 2583247
  - mlxsw: Use refcount_t for reference counting (git-fixes).
  - commit 5be65d6
  - net: ena: Use tx_ring instead of xdp_ring for XDP channel TX
    (git-fixes).
  - commit d4b3628
  - net: ena: Pass ena_adapter instead of net_device to
    ena_xmit_common() (git-fixes).
  - commit c080c13
  - net: ena: Move XDP code to its new files (git-fixes).
  - commit 7cd4a35
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (bsc#1224098
    CVE-2024-27395).
  - commit a237c4c
  - selinux: introduce an initial SID for early boot processes
    (bsc#1208593).
  - commit a82f05c
  - mctp: perform route lookups under a RCU read-side lock
    (CVE-2023-52483 bsc#1220738).
  - commit 659b74f
  - net: gtp: Fix Use-After-Free in gtp_dellink (bsc#1224096
    CVE-2024-27396).
  - commit 7f59223
  - Move upstreamed patches into sorted section
  - commit 25085d6
  - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
    (git-fixes).
  - commit 61c5310
  - ax25: Fix reference count leak issue of net_device (git-fixes).
  - ax25: Fix reference count leak issues of ax25_dev (git-fixes).
  - net: usb: ax88179_178a: fix link status when link is set to
    down/up (git-fixes).
  - selftests: net: move amt to socat for better compatibility
    (git-fixes).
  - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
    (git-fixes).
  - net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
  - wifi: mwl8k: initialize cmd->addr[] properly (git-fixes).
  - wifi: rtw89: pci: correct TX resource checking for PCI DMA
    channel of firmware command (git-fixes).
  - wifi: ar5523: enable proper endpoint verification (git-fixes).
  - wifi: carl9170: add a proper sanity check for endpoints
    (git-fixes).
  - wifi: ath10k: populate board data for WCN3990 (git-fixes).
  - wifi: ath10k: Fix an error code problem in
    ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).
  - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
    (git-fixes).
  - wifi: carl9170: re-fix fortified-memset warning (git-fixes).
  - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
    (git-fixes).
  - wifi: mt76: mt7603: fix tx queue of loopback packets
    (git-fixes).
  - net: usb: sr9700: stop lying about skb->truesize (git-fixes).
  - usb: aqc111: stop lying about skb->truesize (git-fixes).
  - wifi: iwlwifi: mvm: init vif works only once (git-fixes).
  - net: nfc: remove inappropriate attrs check (stable-fixes).
  - wifi: ath11k: don't force enable power save on non-running vdevs
    (git-fixes).
  - wifi: ath10k: poll service ready message before failing
    (git-fixes).
  - wifi: iwlwifi: reconfigure TLC during HW restart (git-fixes).
  - wifi: iwlwifi: mvm: select STA mask only for active links
    (git-fixes).
  - wifi: iwlwifi: mvm: fix active link counting during recovery
    (git-fixes).
  - wifi: iwlwifi: mvm: allocate STA links only for active links
    (git-fixes).
  - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
    (git-fixes).
  - wifi: mt76: mt7915: workaround too long expansion sparse
    warnings (git-fixes).
  - wifi: brcmfmac: pcie: handle randbuf allocation failure
    (git-fixes).
  - bitops: add missing prototype check (git-fixes).
  - ata: pata_legacy: make legacy_exit() work again (git-fixes).
  - efi: libstub: only free priv.runtime_map when allocated
    (git-fixes).
  - HID: amd_sfh: Handle "no sensors" in PM operations (git-fixes).
  - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
    (git-fixes).
  - hwmon: (lm70) fix links in doc and comments (git-fixes).
  - spi: xilinx: Fix kernel documentation in the xilinx_spi.h
    (git-fixes).
  - ACPI: LPSS: Advertise number of chip selects via property
    (git-fixes).
  - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
    (git-fixes).
  - ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).
  - ACPI: bus: Indicate support for the Generic Event Device thru
    _OSC (git-fixes).
  - ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).
  - ACPI: disable -Wstringop-truncation (git-fixes).
  - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
    (git-fixes).
  - cppc_cpufreq: Fix possible null pointer dereference (git-fixes).
  - cpufreq: exit() callback is optional (git-fixes).
  - thermal/drivers/tsens: Fix null pointer dereference (git-fixes).
  - thermal/drivers/qcom/lmh: Check for SCM availability at probe
    (git-fixes).
  - selftests: default to host arch for LLVM builds (git-fixes).
  - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
    (git-fixes).
  - selftests/binderfs: use the Makefile's rules, not Make's
    implicit rules (git-fixes).
  - irqchip/loongson-pch-msi: Fix off-by-one on allocation error
    path (git-fixes).
  - irqchip/alpine-msi: Fix off-by-one in allocation error path
    (git-fixes).
  - commit ea6926d

++++ kernel-default:

  - powerpc/eeh: Permanently disable the removed device (bsc#1223991
    ltc#205740).
  - commit b9c2f2f
  - fat: fix uninitialized field in nostale filehandles (git-fixes)
  - commit f1e1fd7
  - net: ks8851: Queue RX packets in IRQ handler instead of
    disabling BHs (git-fixes).
  - commit cc9313f
  - Move upstreamed ACPI patch into sorted section
  - commit 6c48aae
  - fs: relax mount_setattr() permission checks (git-fixes)
  - commit 3b377cf
  - bpf, arm64: Fix incorrect runtime stats (git-fixes)
  - commit c30a258
  - fast_dput(): handle underflows gracefully (git-fixes)
  - commit 7a48807
  - ecryptfs: Reject casefold directory inodes (git-fixes)
  - commit bc23622
  - fsverity: skip PKCS#7 parser when keyring is empty (git-fixes)
  - commit 97f203b
  - cifs: fix underflow in parse_server_interfaces() (CVE-2024-26828 bsc#1223084).
  - commit 40aba68
  - blacklist.conf: fs updates
  - commit 372a9be
  - octeontx2-af: Fix NIX SQ mode and BP config (git-fixes).
  - commit 6fa6e4e
  - net: ks8851: Handle softirqs at the end of IRQ thread to fix
    hang (git-fixes).
  - commit 871b504
  - net: ks8851: Inline ks8851_rx_skb() (git-fixes).
  - commit 0fafe3f
  - bnxt_en: Reset PTP tx_avail after possible firmware reset
    (git-fixes).
  - commit 9421aa8
  - bnxt_en: Fix error recovery for RoCE ulp client (git-fixes).
  - commit a747a74
  - bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()
    (git-fixes).
  - commit 6a62a82
  - geneve: fix header validation in geneve[6]_xmit_skb (git-fixes).
  - commit d4d699c
  - octeontx2-pf: Fix transmit scheduler resource leak (git-fixes).
  - commit 9beffaf
  - net/mlx5: SF, Stop waiting for FW as teardown was called
    (git-fixes).
  - commit 2583247
  - mlxsw: Use refcount_t for reference counting (git-fixes).
  - commit 5be65d6
  - net: ena: Use tx_ring instead of xdp_ring for XDP channel TX
    (git-fixes).
  - commit d4b3628
  - net: ena: Pass ena_adapter instead of net_device to
    ena_xmit_common() (git-fixes).
  - commit c080c13
  - net: ena: Move XDP code to its new files (git-fixes).
  - commit 7cd4a35
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (bsc#1224098
    CVE-2024-27395).
  - commit a237c4c
  - selinux: introduce an initial SID for early boot processes
    (bsc#1208593).
  - commit a82f05c
  - mctp: perform route lookups under a RCU read-side lock
    (CVE-2023-52483 bsc#1220738).
  - commit 659b74f
  - net: gtp: Fix Use-After-Free in gtp_dellink (bsc#1224096
    CVE-2024-27396).
  - commit 7f59223
  - Move upstreamed patches into sorted section
  - commit 25085d6
  - wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask
    (git-fixes).
  - commit 61c5310
  - ax25: Fix reference count leak issue of net_device (git-fixes).
  - ax25: Fix reference count leak issues of ax25_dev (git-fixes).
  - net: usb: ax88179_178a: fix link status when link is set to
    down/up (git-fixes).
  - selftests: net: move amt to socat for better compatibility
    (git-fixes).
  - Bluetooth: qca: Fix error code in qca_read_fw_build_info()
    (git-fixes).
  - net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
  - wifi: mwl8k: initialize cmd->addr[] properly (git-fixes).
  - wifi: rtw89: pci: correct TX resource checking for PCI DMA
    channel of firmware command (git-fixes).
  - wifi: ar5523: enable proper endpoint verification (git-fixes).
  - wifi: carl9170: add a proper sanity check for endpoints
    (git-fixes).
  - wifi: ath10k: populate board data for WCN3990 (git-fixes).
  - wifi: ath10k: Fix an error code problem in
    ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).
  - wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()
    (git-fixes).
  - wifi: carl9170: re-fix fortified-memset warning (git-fixes).
  - wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset
    (git-fixes).
  - wifi: mt76: mt7603: fix tx queue of loopback packets
    (git-fixes).
  - net: usb: sr9700: stop lying about skb->truesize (git-fixes).
  - usb: aqc111: stop lying about skb->truesize (git-fixes).
  - wifi: iwlwifi: mvm: init vif works only once (git-fixes).
  - net: nfc: remove inappropriate attrs check (stable-fixes).
  - wifi: ath11k: don't force enable power save on non-running vdevs
    (git-fixes).
  - wifi: ath10k: poll service ready message before failing
    (git-fixes).
  - wifi: iwlwifi: reconfigure TLC during HW restart (git-fixes).
  - wifi: iwlwifi: mvm: select STA mask only for active links
    (git-fixes).
  - wifi: iwlwifi: mvm: fix active link counting during recovery
    (git-fixes).
  - wifi: iwlwifi: mvm: allocate STA links only for active links
    (git-fixes).
  - wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok()
    (git-fixes).
  - wifi: mt76: mt7915: workaround too long expansion sparse
    warnings (git-fixes).
  - wifi: brcmfmac: pcie: handle randbuf allocation failure
    (git-fixes).
  - bitops: add missing prototype check (git-fixes).
  - ata: pata_legacy: make legacy_exit() work again (git-fixes).
  - efi: libstub: only free priv.runtime_map when allocated
    (git-fixes).
  - HID: amd_sfh: Handle "no sensors" in PM operations (git-fixes).
  - HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors
    (git-fixes).
  - hwmon: (lm70) fix links in doc and comments (git-fixes).
  - spi: xilinx: Fix kernel documentation in the xilinx_spi.h
    (git-fixes).
  - ACPI: LPSS: Advertise number of chip selects via property
    (git-fixes).
  - ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC
    (git-fixes).
  - ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).
  - ACPI: bus: Indicate support for the Generic Event Device thru
    _OSC (git-fixes).
  - ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).
  - ACPI: disable -Wstringop-truncation (git-fixes).
  - cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations
    (git-fixes).
  - cppc_cpufreq: Fix possible null pointer dereference (git-fixes).
  - cpufreq: exit() callback is optional (git-fixes).
  - thermal/drivers/tsens: Fix null pointer dereference (git-fixes).
  - thermal/drivers/qcom/lmh: Check for SCM availability at probe
    (git-fixes).
  - selftests: default to host arch for LLVM builds (git-fixes).
  - selftests/resctrl: fix clang build failure: use LOCAL_HDRS
    (git-fixes).
  - selftests/binderfs: use the Makefile's rules, not Make's
    implicit rules (git-fixes).
  - irqchip/loongson-pch-msi: Fix off-by-one on allocation error
    path (git-fixes).
  - irqchip/alpine-msi: Fix off-by-one in allocation error path
    (git-fixes).
  - commit ea6926d

------------------------------------------------------------------
------------------  2024-5-14  -  May 14 2024  -------------------
------------------------------------------------------------------

++++ git:

  - update to 2.45.1:
    * CVE-2024-32002: recursive clones on case-insensitive
    filesystems that support symbolic links are susceptible to case
    confusion (boo#1224168)
    * CVE-2024-32004: arbitrary code execution during local clones
    (boo#1224170)
    * CVE-2024-32020: file overwriting vulnerability during local
    clones (boo#1224171)
    * CVE-2024-32021: git may create hardlinks to arbitrary user-
    readable files (boo#1224172)
    * CVE-2024-32465: arbitrary code execution during clone operations
    (boo#1224173)

++++ git:

  - update to 2.45.1:
    * CVE-2024-32002: recursive clones on case-insensitive
    filesystems that support symbolic links are susceptible to case
    confusion (boo#1224168)
    * CVE-2024-32004: arbitrary code execution during local clones
    (boo#1224170)
    * CVE-2024-32020: file overwriting vulnerability during local
    clones (boo#1224171)
    * CVE-2024-32021: git may create hardlinks to arbitrary user-
    readable files (boo#1224172)
    * CVE-2024-32465: arbitrary code execution during clone operations
    (boo#1224173)

++++ git:

  - update to 2.45.1:
    * CVE-2024-32002: recursive clones on case-insensitive
    filesystems that support symbolic links are susceptible to case
    confusion (boo#1224168)
    * CVE-2024-32004: arbitrary code execution during local clones
    (boo#1224170)
    * CVE-2024-32020: file overwriting vulnerability during local
    clones (boo#1224171)
    * CVE-2024-32021: git may create hardlinks to arbitrary user-
    readable files (boo#1224172)
    * CVE-2024-32465: arbitrary code execution during clone operations
    (boo#1224173)

++++ kernel-default:

  - block: Fix iterating over an empty bio with
    bio_for_each_folio_all (bsc#1221635 CVE-2024-26632).
  - commit a419383
  - iomap: clear the per-folio dirty bits on all writeback failures (git-fixes)
  - commit cfedccd
  - x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk (git-fixes).
  - commit 431e388
  - kabi/severities: Remove mitigation-related symbols
    Those are used by the core kernel to implement CPU vulnerabilities
    mitigation and are not expected to be consumed by 3rd party users.
  - commit 8d79889
  - Update
    patches.suse/Bluetooth-hci_sync-Don-t-double-print-name-in-add-re.patch
    (bsc#1216358).
    Added bugzilla reference
  - commit 3985fb5
  - Update patches.suse/usb-ulpi-Fix-debugfs-directory-leak.patch
    (bsc#1223847 CVE-2024-26919).
    Added bugzilla ID and CVE
  - commit 44b677b
  - xfs: fix perag leak when growfs fails (git-fixes).
  - commit 111377b
  - xfs: add lock protection when remove perag from radix tree
    (git-fixes).
  - commit fdadeb0
  - xfs: force all buffers to be written during btree bulk load
    (git-fixes).
  - commit bcc67e9
  - xfs: recompute growfsrtfree transaction reservation while
    growing rt volume (git-fixes).
  - commit 0ef8d73
  - xfs: make xchk_iget safer in the presence of corrupt inode
    btrees (git-fixes).
  - commit 3312038
  - xfs: transfer recovered intent item ownership in ->iop_recover
    (git-fixes).
  - commit 9cdf2ef
  - xfs: pass the xfs_defer_pending object to iop_recover
    (git-fixes).
  - commit c4d4eda
  - xfs: use xfs_defer_pending objects to recover intent items
    (git-fixes).
  - commit 4e8f44d
  - jffs2: prevent xattr node from overflowing the eraseblock
    (git-fixes).
  - commit bb15e9c
  - x86/cpu: Add model number for Intel Arrow Lake mobile processor (git-fixes).
  - commit 7c55ce6
  - x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).
  - commit b73f38c
  - x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() (git-fixes).
  - commit 5ad2192
  - x86/nospec: Refactor UNTRAIN_RET[_*] (git-fixes).
  - commit 653bafb
  - x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (git-fixes).
  - commit 3e5de92
  - x86/srso: Disentangle rethunk-dependent options (git-fixes).
  - Refresh
    patches.suse/x86-bugs-Cache-the-value-of-MSR_IA32_ARCH_CAPABILITIES.patch.
  - commit 4761d61
  - x86/bugs: Remove default case for fully switched enums (git-fixes).
  - commit caa1a64
  - x86/srso: Remove 'pred_cmd' label (git-fixes).
  - commit d2d0e6a
  - x86/srso: Unexport untraining functions (git-fixes).
  - commit f855258
  - x86/srso: Improve i-cache locality for alias mitigation (git-fixes).
  - commit 8ffea3d
  - x86/srso: Fix unret validation dependencies (git-fixes).
  - commit 95452af
  - x86/srso: Print actual mitigation if requested mitigation isn't  possible (git-fixes).
  - Refresh
    patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch.
  - commit 3afb908
  - blacklist.conf: not applicable
  - commit 158f7dc
  - x86/coco: Require seeding RNG with RDRAND on CoCo systems (git-fixes).
  - commit 9588be6
  - x86/nmi: Fix the inverse "in NMI handler" check (git-fixes).
  - commit 3b9c9ee
  - x86/purgatory: Switch to the position-independent small code model (git-fixes).
  - commit 57ab7d5
  - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (git-fixes).
  - commit f043bca
  - Move upstreamed patches into sorted section
  - commit 96e6c4c
  - soc: qcom: pmic_glink: Make client-lock non-sleeping
    (git-fixes).
  - commit 410217d
  - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
    (git-fixes).
  - commit 2c41b82
  - crypto: qat - specify firmware files for 402xx (git-fixes).
  - crypto: qat - improve error logging to be consistent across
    features (git-fixes).
  - crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).
  - crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).
  - crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).
  - crypto: ccp - drop platform ifdef checks (git-fixes).
  - crypto: bcm - Fix pointer arithmetic (git-fixes).
  - crypto: ecdsa - Fix module auto-load on add-key (git-fixes).
  - kunit/fortify: Fix mismatched kvalloc()/vfree() usage
    (git-fixes).
  - nilfs2: fix out-of-range warning (git-fixes).
  - admin-guide/hw-vuln/core-scheduling: fix return type of
    PR_SCHED_CORE_GET (git-fixes).
  - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).
  - soc: qcom: pmic_glink: notify clients about the current state
    (git-fixes).
  - soc: qcom: pmic_glink: don't traverse clients list without a
    lock (git-fixes).
  - commit 7da1cbc

++++ kernel-default:

  - block: Fix iterating over an empty bio with
    bio_for_each_folio_all (bsc#1221635 CVE-2024-26632).
  - commit a419383
  - iomap: clear the per-folio dirty bits on all writeback failures (git-fixes)
  - commit cfedccd
  - x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk (git-fixes).
  - commit 431e388
  - kabi/severities: Remove mitigation-related symbols
    Those are used by the core kernel to implement CPU vulnerabilities
    mitigation and are not expected to be consumed by 3rd party users.
  - commit 8d79889
  - Update
    patches.suse/Bluetooth-hci_sync-Don-t-double-print-name-in-add-re.patch
    (bsc#1216358).
    Added bugzilla reference
  - commit 3985fb5
  - Update patches.suse/usb-ulpi-Fix-debugfs-directory-leak.patch
    (bsc#1223847 CVE-2024-26919).
    Added bugzilla ID and CVE
  - commit 44b677b
  - xfs: fix perag leak when growfs fails (git-fixes).
  - commit 111377b
  - xfs: add lock protection when remove perag from radix tree
    (git-fixes).
  - commit fdadeb0
  - xfs: force all buffers to be written during btree bulk load
    (git-fixes).
  - commit bcc67e9
  - xfs: recompute growfsrtfree transaction reservation while
    growing rt volume (git-fixes).
  - commit 0ef8d73
  - xfs: make xchk_iget safer in the presence of corrupt inode
    btrees (git-fixes).
  - commit 3312038
  - xfs: transfer recovered intent item ownership in ->iop_recover
    (git-fixes).
  - commit 9cdf2ef
  - xfs: pass the xfs_defer_pending object to iop_recover
    (git-fixes).
  - commit c4d4eda
  - xfs: use xfs_defer_pending objects to recover intent items
    (git-fixes).
  - commit 4e8f44d
  - jffs2: prevent xattr node from overflowing the eraseblock
    (git-fixes).
  - commit bb15e9c
  - x86/cpu: Add model number for Intel Arrow Lake mobile processor (git-fixes).
  - commit 7c55ce6
  - x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).
  - commit b73f38c
  - x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() (git-fixes).
  - commit 5ad2192
  - x86/nospec: Refactor UNTRAIN_RET[_*] (git-fixes).
  - commit 653bafb
  - x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (git-fixes).
  - commit 3e5de92
  - x86/srso: Disentangle rethunk-dependent options (git-fixes).
  - Refresh
    patches.suse/x86-bugs-Cache-the-value-of-MSR_IA32_ARCH_CAPABILITIES.patch.
  - commit 4761d61
  - x86/bugs: Remove default case for fully switched enums (git-fixes).
  - commit caa1a64
  - x86/srso: Remove 'pred_cmd' label (git-fixes).
  - commit d2d0e6a
  - x86/srso: Unexport untraining functions (git-fixes).
  - commit f855258
  - x86/srso: Improve i-cache locality for alias mitigation (git-fixes).
  - commit 8ffea3d
  - x86/srso: Fix unret validation dependencies (git-fixes).
  - commit 95452af
  - x86/srso: Print actual mitigation if requested mitigation isn't  possible (git-fixes).
  - Refresh
    patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch.
  - commit 3afb908
  - blacklist.conf: not applicable
  - commit 158f7dc
  - x86/coco: Require seeding RNG with RDRAND on CoCo systems (git-fixes).
  - commit 9588be6
  - x86/nmi: Fix the inverse "in NMI handler" check (git-fixes).
  - commit 3b9c9ee
  - x86/purgatory: Switch to the position-independent small code model (git-fixes).
  - commit 57ab7d5
  - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (git-fixes).
  - commit f043bca
  - Move upstreamed patches into sorted section
  - commit 96e6c4c
  - soc: qcom: pmic_glink: Make client-lock non-sleeping
    (git-fixes).
  - commit 410217d
  - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
    (git-fixes).
  - commit 2c41b82
  - crypto: qat - specify firmware files for 402xx (git-fixes).
  - crypto: qat - improve error logging to be consistent across
    features (git-fixes).
  - crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).
  - crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).
  - crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).
  - crypto: ccp - drop platform ifdef checks (git-fixes).
  - crypto: bcm - Fix pointer arithmetic (git-fixes).
  - crypto: ecdsa - Fix module auto-load on add-key (git-fixes).
  - kunit/fortify: Fix mismatched kvalloc()/vfree() usage
    (git-fixes).
  - nilfs2: fix out-of-range warning (git-fixes).
  - admin-guide/hw-vuln/core-scheduling: fix return type of
    PR_SCHED_CORE_GET (git-fixes).
  - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).
  - soc: qcom: pmic_glink: notify clients about the current state
    (git-fixes).
  - soc: qcom: pmic_glink: don't traverse clients list without a
    lock (git-fixes).
  - commit 7da1cbc

++++ kernel-default:

  - block: Fix iterating over an empty bio with
    bio_for_each_folio_all (bsc#1221635 CVE-2024-26632).
  - commit a419383
  - iomap: clear the per-folio dirty bits on all writeback failures (git-fixes)
  - commit cfedccd
  - x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk (git-fixes).
  - commit 431e388
  - kabi/severities: Remove mitigation-related symbols
    Those are used by the core kernel to implement CPU vulnerabilities
    mitigation and are not expected to be consumed by 3rd party users.
  - commit 8d79889
  - Update
    patches.suse/Bluetooth-hci_sync-Don-t-double-print-name-in-add-re.patch
    (bsc#1216358).
    Added bugzilla reference
  - commit 3985fb5
  - Update patches.suse/usb-ulpi-Fix-debugfs-directory-leak.patch
    (bsc#1223847 CVE-2024-26919).
    Added bugzilla ID and CVE
  - commit 44b677b
  - xfs: fix perag leak when growfs fails (git-fixes).
  - commit 111377b
  - xfs: add lock protection when remove perag from radix tree
    (git-fixes).
  - commit fdadeb0
  - xfs: force all buffers to be written during btree bulk load
    (git-fixes).
  - commit bcc67e9
  - xfs: recompute growfsrtfree transaction reservation while
    growing rt volume (git-fixes).
  - commit 0ef8d73
  - xfs: make xchk_iget safer in the presence of corrupt inode
    btrees (git-fixes).
  - commit 3312038
  - xfs: transfer recovered intent item ownership in ->iop_recover
    (git-fixes).
  - commit 9cdf2ef
  - xfs: pass the xfs_defer_pending object to iop_recover
    (git-fixes).
  - commit c4d4eda
  - xfs: use xfs_defer_pending objects to recover intent items
    (git-fixes).
  - commit 4e8f44d
  - jffs2: prevent xattr node from overflowing the eraseblock
    (git-fixes).
  - commit bb15e9c
  - x86/cpu: Add model number for Intel Arrow Lake mobile processor (git-fixes).
  - commit 7c55ce6
  - x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).
  - commit b73f38c
  - x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() (git-fixes).
  - commit 5ad2192
  - x86/nospec: Refactor UNTRAIN_RET[_*] (git-fixes).
  - commit 653bafb
  - x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (git-fixes).
  - commit 3e5de92
  - x86/srso: Disentangle rethunk-dependent options (git-fixes).
  - Refresh
    patches.suse/x86-bugs-Cache-the-value-of-MSR_IA32_ARCH_CAPABILITIES.patch.
  - commit 4761d61
  - x86/bugs: Remove default case for fully switched enums (git-fixes).
  - commit caa1a64
  - x86/srso: Remove 'pred_cmd' label (git-fixes).
  - commit d2d0e6a
  - x86/srso: Unexport untraining functions (git-fixes).
  - commit f855258
  - x86/srso: Improve i-cache locality for alias mitigation (git-fixes).
  - commit 8ffea3d
  - x86/srso: Fix unret validation dependencies (git-fixes).
  - commit 95452af
  - x86/srso: Print actual mitigation if requested mitigation isn't  possible (git-fixes).
  - Refresh
    patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch.
  - commit 3afb908
  - blacklist.conf: not applicable
  - commit 158f7dc
  - x86/coco: Require seeding RNG with RDRAND on CoCo systems (git-fixes).
  - commit 9588be6
  - x86/nmi: Fix the inverse "in NMI handler" check (git-fixes).
  - commit 3b9c9ee
  - x86/purgatory: Switch to the position-independent small code model (git-fixes).
  - commit 57ab7d5
  - x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (git-fixes).
  - commit f043bca
  - Move upstreamed patches into sorted section
  - commit 96e6c4c
  - soc: qcom: pmic_glink: Make client-lock non-sleeping
    (git-fixes).
  - commit 410217d
  - soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request
    (git-fixes).
  - commit 2c41b82
  - crypto: qat - specify firmware files for 402xx (git-fixes).
  - crypto: qat - improve error logging to be consistent across
    features (git-fixes).
  - crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).
  - crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).
  - crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).
  - crypto: ccp - drop platform ifdef checks (git-fixes).
  - crypto: bcm - Fix pointer arithmetic (git-fixes).
  - crypto: ecdsa - Fix module auto-load on add-key (git-fixes).
  - kunit/fortify: Fix mismatched kvalloc()/vfree() usage
    (git-fixes).
  - nilfs2: fix out-of-range warning (git-fixes).
  - admin-guide/hw-vuln/core-scheduling: fix return type of
    PR_SCHED_CORE_GET (git-fixes).
  - soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).
  - soc: qcom: pmic_glink: notify clients about the current state
    (git-fixes).
  - soc: qcom: pmic_glink: don't traverse clients list without a
    lock (git-fixes).
  - commit 7da1cbc

++++ libzypp:

  - don't require libproxy1 on tumbleweed, it is optional now
  - version 17.34.0 (34)
  - Fix versioning scheme

++++ libzypp:

  - don't require libproxy1 on tumbleweed, it is optional now
  - version 17.34.0 (34)
  - Fix versioning scheme

++++ libzypp:

  - don't require libproxy1 on tumbleweed, it is optional now
  - version 17.34.0 (34)
  - Fix versioning scheme

++++ libzypp:

  - don't require libproxy1 on tumbleweed, it is optional now
  - version 17.34.0 (34)
  - Fix versioning scheme

++++ libzypp:

  - don't require libproxy1 on tumbleweed, it is optional now
  - version 17.34.0 (34)
  - Fix versioning scheme

------------------------------------------------------------------
------------------  2024-5-13  -  May 13 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)
  - commit 8bc326a
  - blacklist.conf: add perf patch already known by alias commit
  - commit 706da8e
  - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() (git-fixes)
    Dropped hunk in selftests (test_case_7), 92e1229b204d6.
  - commit 8dcf7c1
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)
  - commit 622d549
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)
  - commit 84f4309
  - btrfs: reject encoded write if inode has nodatasum flag set (git-fixes)
  - commit bbc649d
  - btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)
  - commit 8ef1c53
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
  - commit a6f28a6
  - btrfs: release path before inode lookup during the ino lookup ioctl (git-fixes)
  - commit 4b7ba54
  - blacklist.conf: Add 2d6cd791e63e "btrfs: fix race between finishing block group creation and its item update"
  - commit ca673ac
  - firewire: nosy: ensure user_length is taken into account when
    fetching packet contents (CVE-2024-27401 bsc#1224181).
  - commit 5441039
  - Update
    patches.suse/usb-aqc111-check-packet-for-fixup-for-true-limit.patch
    (bsc#1217169 CVE-2023-52655).
    Added bugzilla and CVE
  - commit 20db8f9
  - btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)
  - commit 9ec1333
  - crypto: rsa - add a check for allocation failure (bsc#1222775).
  - commit 8c6c396
  - blacklist.conf: kABI
  - commit 70f199a
  - blacklist.conf: kABI
  - commit 835874a
  - kABI workaround for of driver changes (git-fixes).
  - commit ef08885
  - aoe: avoid potential deadlock at set_capacity (CVE-2024-26775,
    bsc#1222627).
  - commit fd6e05d
  - crypto: testmgr - remove unused xts4096 and xts512 algorithms
    from testmgr.c (bsc#1222769).
  - commit 0de6756
  - crypto: rsa - allow only odd e and restrict value in FIPS mode
    (bsc#1222775).
  - commit c5ca0e4
  - of: module: prevent NULL pointer dereference in vsnprintf()
    (stable-fixes).
  - of: dynamic: Synchronize of_changeset_destroy() with the
    devlink removals (git-fixes).
  - of: property: fw_devlink: Fix stupid bug in remote-endpoint
    parsing (git-fixes).
  - of: property: Add in-ports/out-ports support to
    of_graph_get_port_parent() (stable-fixes).
  - of: property: Improve finding the supplier of a remote-endpoint
    property (git-fixes).
  - of: property: Improve finding the consumer of a remote-endpoint
    property (git-fixes).
  - of: unittest: Fix compile in the non-dynamic case (git-fixes).
  - of: property: fix typo in io-channels (git-fixes).
  - commit 7743bc7
  - crypto: ecc - update ecc_gen_privkey for FIPS 186-5
    (bsc#1222782).
  - commit bcc0381
  - selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).
  - EDAC/synopsys: Fix ECC status and IRQ control race condition
    (git-fixes).
  - commit 85ce9d3
  - nfs: fix UAF in direct writes (bsc#1223653 CVE-2024-26958).
  - commit 9b53f23

++++ kernel-default:

  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)
  - commit 8bc326a
  - blacklist.conf: add perf patch already known by alias commit
  - commit 706da8e
  - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() (git-fixes)
    Dropped hunk in selftests (test_case_7), 92e1229b204d6.
  - commit 8dcf7c1
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)
  - commit 622d549
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)
  - commit 84f4309
  - btrfs: reject encoded write if inode has nodatasum flag set (git-fixes)
  - commit bbc649d
  - btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)
  - commit 8ef1c53
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
  - commit a6f28a6
  - btrfs: release path before inode lookup during the ino lookup ioctl (git-fixes)
  - commit 4b7ba54
  - blacklist.conf: Add 2d6cd791e63e "btrfs: fix race between finishing block group creation and its item update"
  - commit ca673ac
  - firewire: nosy: ensure user_length is taken into account when
    fetching packet contents (CVE-2024-27401 bsc#1224181).
  - commit 5441039
  - Update
    patches.suse/usb-aqc111-check-packet-for-fixup-for-true-limit.patch
    (bsc#1217169 CVE-2023-52655).
    Added bugzilla and CVE
  - commit 20db8f9
  - btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)
  - commit 9ec1333
  - crypto: rsa - add a check for allocation failure (bsc#1222775).
  - commit 8c6c396
  - blacklist.conf: kABI
  - commit 70f199a
  - blacklist.conf: kABI
  - commit 835874a
  - kABI workaround for of driver changes (git-fixes).
  - commit ef08885
  - aoe: avoid potential deadlock at set_capacity (CVE-2024-26775,
    bsc#1222627).
  - commit fd6e05d
  - crypto: testmgr - remove unused xts4096 and xts512 algorithms
    from testmgr.c (bsc#1222769).
  - commit 0de6756
  - crypto: rsa - allow only odd e and restrict value in FIPS mode
    (bsc#1222775).
  - commit c5ca0e4
  - of: module: prevent NULL pointer dereference in vsnprintf()
    (stable-fixes).
  - of: dynamic: Synchronize of_changeset_destroy() with the
    devlink removals (git-fixes).
  - of: property: fw_devlink: Fix stupid bug in remote-endpoint
    parsing (git-fixes).
  - of: property: Add in-ports/out-ports support to
    of_graph_get_port_parent() (stable-fixes).
  - of: property: Improve finding the supplier of a remote-endpoint
    property (git-fixes).
  - of: property: Improve finding the consumer of a remote-endpoint
    property (git-fixes).
  - of: unittest: Fix compile in the non-dynamic case (git-fixes).
  - of: property: fix typo in io-channels (git-fixes).
  - commit 7743bc7
  - crypto: ecc - update ecc_gen_privkey for FIPS 186-5
    (bsc#1222782).
  - commit bcc0381
  - selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).
  - EDAC/synopsys: Fix ECC status and IRQ control race condition
    (git-fixes).
  - commit 85ce9d3
  - nfs: fix UAF in direct writes (bsc#1223653 CVE-2024-26958).
  - commit 9b53f23

++++ kernel-default:

  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)
  - commit 8bc326a
  - blacklist.conf: add perf patch already known by alias commit
  - commit 706da8e
  - btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() (git-fixes)
    Dropped hunk in selftests (test_case_7), 92e1229b204d6.
  - commit 8dcf7c1
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)
  - commit 622d549
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)
  - commit 84f4309
  - btrfs: reject encoded write if inode has nodatasum flag set (git-fixes)
  - commit bbc649d
  - btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)
  - commit 8ef1c53
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
  - commit a6f28a6
  - btrfs: release path before inode lookup during the ino lookup ioctl (git-fixes)
  - commit 4b7ba54
  - blacklist.conf: Add 2d6cd791e63e "btrfs: fix race between finishing block group creation and its item update"
  - commit ca673ac
  - firewire: nosy: ensure user_length is taken into account when
    fetching packet contents (CVE-2024-27401 bsc#1224181).
  - commit 5441039
  - Update
    patches.suse/usb-aqc111-check-packet-for-fixup-for-true-limit.patch
    (bsc#1217169 CVE-2023-52655).
    Added bugzilla and CVE
  - commit 20db8f9
  - btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)
  - commit 9ec1333
  - crypto: rsa - add a check for allocation failure (bsc#1222775).
  - commit 8c6c396
  - blacklist.conf: kABI
  - commit 70f199a
  - blacklist.conf: kABI
  - commit 835874a
  - kABI workaround for of driver changes (git-fixes).
  - commit ef08885
  - aoe: avoid potential deadlock at set_capacity (CVE-2024-26775,
    bsc#1222627).
  - commit fd6e05d
  - crypto: testmgr - remove unused xts4096 and xts512 algorithms
    from testmgr.c (bsc#1222769).
  - commit 0de6756
  - crypto: rsa - allow only odd e and restrict value in FIPS mode
    (bsc#1222775).
  - commit c5ca0e4
  - of: module: prevent NULL pointer dereference in vsnprintf()
    (stable-fixes).
  - of: dynamic: Synchronize of_changeset_destroy() with the
    devlink removals (git-fixes).
  - of: property: fw_devlink: Fix stupid bug in remote-endpoint
    parsing (git-fixes).
  - of: property: Add in-ports/out-ports support to
    of_graph_get_port_parent() (stable-fixes).
  - of: property: Improve finding the supplier of a remote-endpoint
    property (git-fixes).
  - of: property: Improve finding the consumer of a remote-endpoint
    property (git-fixes).
  - of: unittest: Fix compile in the non-dynamic case (git-fixes).
  - of: property: fix typo in io-channels (git-fixes).
  - commit 7743bc7
  - crypto: ecc - update ecc_gen_privkey for FIPS 186-5
    (bsc#1222782).
  - commit bcc0381
  - selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).
  - EDAC/synopsys: Fix ECC status and IRQ control race condition
    (git-fixes).
  - commit 85ce9d3
  - nfs: fix UAF in direct writes (bsc#1223653 CVE-2024-26958).
  - commit 9b53f23

++++ kernel-firmware:

  - Update to version 20240510 (git commit 7c2303328d8e):
    * linux-firmware: Amphion: Update vpu firmware
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * i915: Add BMG DMC v2.06
    * linux-firmware: Add CS35L41 HDA Firmware for Asus HN7306
    * linux-firmware: Update firmware tuning for HP Consumer Laptop
    * amdgpu: DMCUB updates for various AMDGPU ASICs
    * rtl_bt: Update RTL8822C BT UART firmware to 0x0FD6_407B
    * rtl_bt: Update RTL8822C BT USB firmware to 0x0ED6_407B
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various ASUS laptops
    * linux-firmware: Add firmware and tuning for Lenovo Y770S

++++ kernel-firmware:

  - Update to version 20240510 (git commit 7c2303328d8e):
    * linux-firmware: Amphion: Update vpu firmware
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * i915: Add BMG DMC v2.06
    * linux-firmware: Add CS35L41 HDA Firmware for Asus HN7306
    * linux-firmware: Update firmware tuning for HP Consumer Laptop
    * amdgpu: DMCUB updates for various AMDGPU ASICs
    * rtl_bt: Update RTL8822C BT UART firmware to 0x0FD6_407B
    * rtl_bt: Update RTL8822C BT USB firmware to 0x0ED6_407B
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various ASUS laptops
    * linux-firmware: Add firmware and tuning for Lenovo Y770S

++++ kernel-firmware:

  - Update to version 20240510 (git commit 7c2303328d8e):
    * linux-firmware: Amphion: Update vpu firmware
    * linux-firmware: Update firmware file for Intel BlazarU core
    * linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * linux-firmware: Update firmware file for Intel Bluetooth Solar core
    * i915: Add BMG DMC v2.06
    * linux-firmware: Add CS35L41 HDA Firmware for Asus HN7306
    * linux-firmware: Update firmware tuning for HP Consumer Laptop
    * amdgpu: DMCUB updates for various AMDGPU ASICs
    * rtl_bt: Update RTL8822C BT UART firmware to 0x0FD6_407B
    * rtl_bt: Update RTL8822C BT USB firmware to 0x0ED6_407B
    * cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various ASUS laptops
    * linux-firmware: Add firmware and tuning for Lenovo Y770S

++++ libzypp:

  - version 17.33.4 (35)

++++ libzypp:

  - version 17.33.4 (35)

++++ libzypp:

  - version 17.33.4 (35)

++++ libzypp:

  - version 17.33.4 (35)

++++ libzypp:

  - version 17.33.4 (35)

------------------------------------------------------------------
------------------  2024-5-12  -  May 12 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Fix sdist upstream tarball contents
    The .virtualenv.dev-requirements.txt file is referenced by tox.ini
    but not put into the sdist tarball and therefore missing in the
    pypi upstream data.

++++ python-kiwi:

  - Fix sdist upstream tarball contents
    The .virtualenv.dev-requirements.txt file is referenced by tox.ini
    but not put into the sdist tarball and therefore missing in the
    pypi upstream data.

++++ python-kiwi:

  - Fix sdist upstream tarball contents
    The .virtualenv.dev-requirements.txt file is referenced by tox.ini
    but not put into the sdist tarball and therefore missing in the
    pypi upstream data.

------------------------------------------------------------------
------------------  2024-5-11  -  May 11 2024  -------------------
------------------------------------------------------------------

++++ kernel-default:

  - drm/connector: Add \n to message about demoting connector
    force-probes (git-fixes).
  - drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).
  - drm/meson: dw-hdmi: power up phy on device init (git-fixes).
  - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
    (git-fixes).
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large
    pages (git-fixes).
  - dm/amd/pm: Fix problems with reboot/shutdown for some SMU
    13.0.4/13.0.11 users (git-fixes).
  - drm/i915/bios: Fix parsing backlight BDB data (git-fixes).
  - drm/i915/gt: Automate CCS Mode setting during engine resets
    (git-fixes).
  - maple_tree: fix mas_empty_area_rev() null pointer dereference
    (git-fixes).
  - spi: microchip-core-qspi: fix setting spi bus clock rate
    (git-fixes).
  - regulator: core: fix debugfs creation regression (git-fixes).
  - commit 3a3ad92

++++ kernel-default:

  - drm/connector: Add \n to message about demoting connector
    force-probes (git-fixes).
  - drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).
  - drm/meson: dw-hdmi: power up phy on device init (git-fixes).
  - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
    (git-fixes).
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large
    pages (git-fixes).
  - dm/amd/pm: Fix problems with reboot/shutdown for some SMU
    13.0.4/13.0.11 users (git-fixes).
  - drm/i915/bios: Fix parsing backlight BDB data (git-fixes).
  - drm/i915/gt: Automate CCS Mode setting during engine resets
    (git-fixes).
  - maple_tree: fix mas_empty_area_rev() null pointer dereference
    (git-fixes).
  - spi: microchip-core-qspi: fix setting spi bus clock rate
    (git-fixes).
  - regulator: core: fix debugfs creation regression (git-fixes).
  - commit 3a3ad92

++++ kernel-default:

  - drm/connector: Add \n to message about demoting connector
    force-probes (git-fixes).
  - drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).
  - drm/meson: dw-hdmi: power up phy on device init (git-fixes).
  - drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible
    (git-fixes).
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large
    pages (git-fixes).
  - dm/amd/pm: Fix problems with reboot/shutdown for some SMU
    13.0.4/13.0.11 users (git-fixes).
  - drm/i915/bios: Fix parsing backlight BDB data (git-fixes).
  - drm/i915/gt: Automate CCS Mode setting during engine resets
    (git-fixes).
  - maple_tree: fix mas_empty_area_rev() null pointer dereference
    (git-fixes).
  - spi: microchip-core-qspi: fix setting spi bus clock rate
    (git-fixes).
  - regulator: core: fix debugfs creation regression (git-fixes).
  - commit 3a3ad92

------------------------------------------------------------------
------------------  2024-5-10  -  May 10 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Drop use of obsolete pkg_resources
    As documented in https://setuptools.pypa.io/en/latest/pkg_resources.html
    the use of pkg_resources is obsolete and will cause issues.
    So happened on Debian unstable. This Fixes #2548

++++ python-kiwi:

  - Drop use of obsolete pkg_resources
    As documented in https://setuptools.pypa.io/en/latest/pkg_resources.html
    the use of pkg_resources is obsolete and will cause issues.
    So happened on Debian unstable. This Fixes #2548

++++ python-kiwi:

  - Drop use of obsolete pkg_resources
    As documented in https://setuptools.pypa.io/en/latest/pkg_resources.html
    the use of pkg_resources is obsolete and will cause issues.
    So happened on Debian unstable. This Fixes #2548

++++ kernel-default:

  - netfilter: nf_tables: mark set as dead when unbinding anonymous
    set with timeout (bsc#1221829 CVE-2024-26643).
  - commit c841ee9
  - block/rnbd-srv: Check for unlikely string overflow (bsc#1221615
    CVE-2023-52618).
  - commit 3cf7eb9
  - block: bio-integrity: fix kcalloc() arguments order (bsc#1217384
    CVE-2023-6238).
  - commit 37816df
  - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
    (git-fixes).
  - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a
    spinlock (git-fixes).
  - hwmon: (corsair-cpro) Use complete_all() instead of complete()
    in ccp_raw_event() (git-fixes).
  - hwmon: (corsair-cpro) Use a separate buffer for sending commands
    (git-fixes).
  - nfc: nci: Fix kcov check in nci_rx_work() (git-fixes).
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
    (git-fixes).
  - Bluetooth: HCI: Fix potential null-ptr-deref (git-fixes).
  - Bluetooth: qca: fix info leak when fetching fw build id
    (git-fixes).
  - Bluetooth: qca: fix NVM configuration parsing (git-fixes).
  - Bluetooth: qca: add missing firmware sanity checks (git-fixes).
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
    (git-fixes).
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
    (git-fixes).
  - ARM: 9381/1: kasan: clear stale stack poison (git-fixes).
  - commit aa6a883
  - Update
    patches.suse/xen-netfront-Add-missing-skb_mark_for_recycle.patch
    (git-fixes CVE-2024-27393 bsc#1224076).
  - commit 3dacd9a

++++ kernel-default:

  - netfilter: nf_tables: mark set as dead when unbinding anonymous
    set with timeout (bsc#1221829 CVE-2024-26643).
  - commit c841ee9
  - block/rnbd-srv: Check for unlikely string overflow (bsc#1221615
    CVE-2023-52618).
  - commit 3cf7eb9
  - block: bio-integrity: fix kcalloc() arguments order (bsc#1217384
    CVE-2023-6238).
  - commit 37816df
  - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
    (git-fixes).
  - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a
    spinlock (git-fixes).
  - hwmon: (corsair-cpro) Use complete_all() instead of complete()
    in ccp_raw_event() (git-fixes).
  - hwmon: (corsair-cpro) Use a separate buffer for sending commands
    (git-fixes).
  - nfc: nci: Fix kcov check in nci_rx_work() (git-fixes).
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
    (git-fixes).
  - Bluetooth: HCI: Fix potential null-ptr-deref (git-fixes).
  - Bluetooth: qca: fix info leak when fetching fw build id
    (git-fixes).
  - Bluetooth: qca: fix NVM configuration parsing (git-fixes).
  - Bluetooth: qca: add missing firmware sanity checks (git-fixes).
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
    (git-fixes).
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
    (git-fixes).
  - ARM: 9381/1: kasan: clear stale stack poison (git-fixes).
  - commit aa6a883
  - Update
    patches.suse/xen-netfront-Add-missing-skb_mark_for_recycle.patch
    (git-fixes CVE-2024-27393 bsc#1224076).
  - commit 3dacd9a

++++ kernel-default:

  - netfilter: nf_tables: mark set as dead when unbinding anonymous
    set with timeout (bsc#1221829 CVE-2024-26643).
  - commit c841ee9
  - block/rnbd-srv: Check for unlikely string overflow (bsc#1221615
    CVE-2023-52618).
  - commit 3cf7eb9
  - block: bio-integrity: fix kcalloc() arguments order (bsc#1217384
    CVE-2023-6238).
  - commit 37816df
  - hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us
    (git-fixes).
  - hwmon: (corsair-cpro) Protect ccp->wait_input_report with a
    spinlock (git-fixes).
  - hwmon: (corsair-cpro) Use complete_all() instead of complete()
    in ccp_raw_event() (git-fixes).
  - hwmon: (corsair-cpro) Use a separate buffer for sending commands
    (git-fixes).
  - nfc: nci: Fix kcov check in nci_rx_work() (git-fixes).
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
    (git-fixes).
  - Bluetooth: HCI: Fix potential null-ptr-deref (git-fixes).
  - Bluetooth: qca: fix info leak when fetching fw build id
    (git-fixes).
  - Bluetooth: qca: fix NVM configuration parsing (git-fixes).
  - Bluetooth: qca: add missing firmware sanity checks (git-fixes).
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close()
    (git-fixes).
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
    (git-fixes).
  - ARM: 9381/1: kasan: clear stale stack poison (git-fixes).
  - commit aa6a883
  - Update
    patches.suse/xen-netfront-Add-missing-skb_mark_for_recycle.patch
    (git-fixes CVE-2024-27393 bsc#1224076).
  - commit 3dacd9a

++++ gcc13:

  - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
  - Removed gcc13-pr111731.patch now included upstream

++++ gcc13:

  - Update to gcc-13 branch head, b7a2697733d19a093cbdd0e200, git8761
  - Removed gcc13-pr111731.patch now included upstream

++++ openSUSE-repos-LeapMicro:

  - Update to version 20240510.6bfa644:
    * Update nvidia-leap-repoindex.xml
    * Leap add missing slash after distsub
    * Update README.md

------------------------------------------------------------------
------------------  2024-5-9  -  May 9 2024  -------------------
------------------------------------------------------------------

++++ cloud-regionsrv-client:

  - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
    + In addition to logging, write message to stderr when registration fails
    + Detect transactional-update system with read only setup and use
    the transactional-update command to register
    + Handle operation in a different target root directory for credentials
    checking

++++ cloud-regionsrv-client:

  - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
    + In addition to logging, write message to stderr when registration fails
    + Detect transactional-update system with read only setup and use
    the transactional-update command to register
    + Handle operation in a different target root directory for credentials
    checking

++++ cloud-regionsrv-client:

  - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
    + In addition to logging, write message to stderr when registration fails
    + Detect transactional-update system with read only setup and use
    the transactional-update command to register
    + Handle operation in a different target root directory for credentials
    checking

++++ cloud-regionsrv-client:

  - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
    + In addition to logging, write message to stderr when registration fails
    + Detect transactional-update system with read only setup and use
    the transactional-update command to register
    + Handle operation in a different target root directory for credentials
    checking

++++ cloud-regionsrv-client:

  - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
    + In addition to logging, write message to stderr when registration fails
    + Detect transactional-update system with read only setup and use
    the transactional-update command to register
    + Handle operation in a different target root directory for credentials
    checking

++++ cloud-regionsrv-client:

  - Update to version 10.2.0 (bsc#1223571, bsc#1224014, bsc#1224016)
    + In addition to logging, write message to stderr when registration fails
    + Detect transactional-update system with read only setup and use
    the transactional-update command to register
    + Handle operation in a different target root directory for credentials
    checking

++++ python-kiwi:

  - RepositoryDnf5: correct defaults, set system_cachedir
    The "defaults" in `use_default_location` here are the dnf4
    defaults, not the dnf5 defaults, so let's update them. Also, for
    dnf5, we need to set `system_cachedir` instead of `cachedir` -
    see https://dnf5.readthedocs.io/en/latest/misc/caching.7.html ,
    `system_cachedir` is the cache location used when running as
    root, `cachedir` is the cache location used when running as a
    regular user.
    Signed-off-by: Adam Williamson <awilliam@redhat.com>

++++ python-kiwi:

  - RepositoryDnf5: correct defaults, set system_cachedir
    The "defaults" in `use_default_location` here are the dnf4
    defaults, not the dnf5 defaults, so let's update them. Also, for
    dnf5, we need to set `system_cachedir` instead of `cachedir` -
    see https://dnf5.readthedocs.io/en/latest/misc/caching.7.html ,
    `system_cachedir` is the cache location used when running as
    root, `cachedir` is the cache location used when running as a
    regular user.
    Signed-off-by: Adam Williamson <awilliam@redhat.com>

++++ python-kiwi:

  - RepositoryDnf5: correct defaults, set system_cachedir
    The "defaults" in `use_default_location` here are the dnf4
    defaults, not the dnf5 defaults, so let's update them. Also, for
    dnf5, we need to set `system_cachedir` instead of `cachedir` -
    see https://dnf5.readthedocs.io/en/latest/misc/caching.7.html ,
    `system_cachedir` is the cache location used when running as
    root, `cachedir` is the cache location used when running as a
    regular user.
    Signed-off-by: Adam Williamson <awilliam@redhat.com>

++++ kernel-default:

  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe
    address (CVE-2024-26946 bsc#1223669).
  - commit c3ef9f9
  - Move upstreamed powerpc patches into sorted section
  - commit de7fc3a

++++ kernel-default:

  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe
    address (CVE-2024-26946 bsc#1223669).
  - commit c3ef9f9
  - Move upstreamed powerpc patches into sorted section
  - commit de7fc3a

++++ kernel-default:

  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe
    address (CVE-2024-26946 bsc#1223669).
  - commit c3ef9f9
  - Move upstreamed powerpc patches into sorted section
  - commit de7fc3a

++++ libzypp:

  - add one more missing export for libyui-qt-pkg

++++ libzypp:

  - add one more missing export for libyui-qt-pkg

++++ libzypp:

  - add one more missing export for libyui-qt-pkg

++++ libzypp:

  - add one more missing export for libyui-qt-pkg

++++ libzypp:

  - add one more missing export for libyui-qt-pkg

++++ regionServiceClientConfigAzure:

  - Update to version 2.1.0 (bsc#1217537)
    + Replace certs 23.100.36.229.pem and 40.121.202.140.pem (4096 length):
    rgnsrv-azure-westus -> 23.100.36.229.pem expires 9 years
    rgnsrv-azure-eastus  -> 40.121.202.140.pem expires 10 years

++++ regionServiceClientConfigAzure:

  - Update to version 2.1.0 (bsc#1217537)
    + Replace certs 23.100.36.229.pem and 40.121.202.140.pem (4096 length):
    rgnsrv-azure-westus -> 23.100.36.229.pem expires 9 years
    rgnsrv-azure-eastus  -> 40.121.202.140.pem expires 10 years

++++ regionServiceClientConfigEC2:

  - Version 4.2.0
    Replace certs (length 4096):
    rgnsrv-ec2-cn-north1  -> 54.223.148.145 expires in 8 years
    rgnsrv-ec2-us-west2-2 -> 54.245.101.47  expires in 9 years
    Sidenote: We have one server with a short cert (2048) left;
    34.197.223.242 expires in 2027

++++ regionServiceClientConfigEC2:

  - Version 4.2.0
    Replace certs (length 4096):
    rgnsrv-ec2-cn-north1  -> 54.223.148.145 expires in 8 years
    rgnsrv-ec2-us-west2-2 -> 54.245.101.47  expires in 9 years
    Sidenote: We have one server with a short cert (2048) left;
    34.197.223.242 expires in 2027

++++ regionServiceClientConfigGCE:

  - Update to version 4.1.0 (bsc#1217538)
    + Replace 162.222.182.90 and 35.187.193.56 (length 4096):
    rgnsrv-gce-asia-northeast1 -> 162.222.182.90 expires in 9 years
    rgnsrv-gce-us-central1 -> 35.187.193.56 expires in 10 years

++++ regionServiceClientConfigGCE:

  - Update to version 4.1.0 (bsc#1217538)
    + Replace 162.222.182.90 and 35.187.193.56 (length 4096):
    rgnsrv-gce-asia-northeast1 -> 162.222.182.90 expires in 9 years
    rgnsrv-gce-us-central1 -> 35.187.193.56 expires in 10 years

++++ regionServiceClientConfigGCE:

  - Update to version 4.1.0 (bsc#1217538)
    + Replace 162.222.182.90 and 35.187.193.56 (length 4096):
    rgnsrv-gce-asia-northeast1 -> 162.222.182.90 expires in 9 years
    rgnsrv-gce-us-central1 -> 35.187.193.56 expires in 10 years

------------------------------------------------------------------
------------------  2024-5-8  -  May 8 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.0.15 → 10.0.16
  - poetry build doesn't like symlinks
    The sdist tarball produced by poetry build does not include
    all files and skipped symlinks in test/data. This caused the
    unit test run to fail if called from within that sources
  - Fix spec file
    Require docopt-ng for Fedora 41+

++++ python-kiwi:

  - Bump version: 10.0.15 → 10.0.16
  - poetry build doesn't like symlinks
    The sdist tarball produced by poetry build does not include
    all files and skipped symlinks in test/data. This caused the
    unit test run to fail if called from within that sources
  - Fix spec file
    Require docopt-ng for Fedora 41+

++++ python-kiwi:

  - Bump version: 10.0.15 → 10.0.16
  - poetry build doesn't like symlinks
    The sdist tarball produced by poetry build does not include
    all files and skipped symlinks in test/data. This caused the
    unit test run to fail if called from within that sources
  - Fix spec file
    Require docopt-ng for Fedora 41+

++++ glibc:

  - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue
    for _start routine (bsc#1221940)

++++ glibc:

  - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue
    for _start routine (bsc#1221940)

++++ glibc:

  - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue
    for _start routine (bsc#1221940)

++++ glibc:

  - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue
    for _start routine (bsc#1221940)

++++ glibc:

  - ulp-prologue-into-asm-functions.patch: Avoid creating ULP prologue
    for _start routine (bsc#1221940)

++++ kernel-default:

  - io_uring: kabi cookie remove (bsc#1217384).
  - commit 6174cfd
  - Update
    patches.suse/USB-core-Fix-deadlock-in-port-disable-sysfs-attribut.patch
    (bsc#1223670 CVE-2024-26933).
    Added CVE and bugzilla ID
  - commit 2932a82
  - crypto: iaa - Fix nr_cpus < nr_iaa case (bsc#1223732
    CVE-2024-26945).
  - commit d4480a0
  - supported.conf: support tcp_dctcp module (jsc#PED-8111)
  - commit 84b1f91
  - Update
    patches.suse/crypto-lib-mpi-Fix-unexpected-pointer-access-in-mpi_.patch
    (git-fixes CVE-2023-52616 bsc#1221612).
  - commit 0f801e9
  - Update "drm/vmwgfx: Fix possible null pointer derefence with invalid contexts" (CVE-2024-26979 bsc#1223628)
  - commit 562486d

++++ kernel-default:

  - io_uring: kabi cookie remove (bsc#1217384).
  - commit 6174cfd
  - Update
    patches.suse/USB-core-Fix-deadlock-in-port-disable-sysfs-attribut.patch
    (bsc#1223670 CVE-2024-26933).
    Added CVE and bugzilla ID
  - commit 2932a82
  - crypto: iaa - Fix nr_cpus < nr_iaa case (bsc#1223732
    CVE-2024-26945).
  - commit d4480a0
  - supported.conf: support tcp_dctcp module (jsc#PED-8111)
  - commit 84b1f91
  - Update
    patches.suse/crypto-lib-mpi-Fix-unexpected-pointer-access-in-mpi_.patch
    (git-fixes CVE-2023-52616 bsc#1221612).
  - commit 0f801e9
  - Update "drm/vmwgfx: Fix possible null pointer derefence with invalid contexts" (CVE-2024-26979 bsc#1223628)
  - commit 562486d

++++ kernel-default:

  - io_uring: kabi cookie remove (bsc#1217384).
  - commit 6174cfd
  - Update
    patches.suse/USB-core-Fix-deadlock-in-port-disable-sysfs-attribut.patch
    (bsc#1223670 CVE-2024-26933).
    Added CVE and bugzilla ID
  - commit 2932a82
  - crypto: iaa - Fix nr_cpus < nr_iaa case (bsc#1223732
    CVE-2024-26945).
  - commit d4480a0
  - supported.conf: support tcp_dctcp module (jsc#PED-8111)
  - commit 84b1f91
  - Update
    patches.suse/crypto-lib-mpi-Fix-unexpected-pointer-access-in-mpi_.patch
    (git-fixes CVE-2023-52616 bsc#1221612).
  - commit 0f801e9
  - Update "drm/vmwgfx: Fix possible null pointer derefence with invalid contexts" (CVE-2024-26979 bsc#1223628)
  - commit 562486d

++++ unbound:

  - Update to 1.20.0:
    Features:
    * The config for discard-timeout, wait-limit, wait-limit-cookie,
    wait-limit-netblock and wait-limit-cookie-netblock was added,
    for the fix to the DNSBomb issue.
    * Merge GH#1027: Introduce 'cache-min-negative-ttl' option.
    * Merge GH#1043 from xiaoxiaoafeifei: Add loongarch support;
    updates config.guess(2024-01-01) and config.sub(2024-01-01),
    verified with upstream.
    * Implement cachedb-check-when-serve-expired: yes option, default
    is enabled. When serve expired is enabled with cachedb, it
    first checks cachedb before serving the expired response.
    * Fix GH#876: [FR] can unbound-checkconf be silenced when
    configuration is valid?
    Bug Fixes:
    * Fix for the DNSBomb vulnerability CVE-2024-33655. Thanks to
    Xiang Li from the Network and Information Security Lab of
    Tsinghua University for reporting it.
    * Update doc/unbound.doxygen with 'doxygen -u'. Fixes option
    deprecation warnings and updates with newer defaults.
    * Remove unused portion from iter_dname_ttl unit test.
    * Fix validator classification of qtype DNAME for positive and
    redirection answers, and fix validator signature routine for
    dealing with the synthesized CNAME for a DNAME without
    previously encountering it and also for when the qtype is
    DNAME.
    * Fix qname minimisation for reply with a DNAME for qtype CNAME
    that answers it.
    * Fix doc test so it ignores but outputs unsupported doxygen
    options.
    * Fix GH#1021 Inconsistent Behavior with Changing
    rpz-cname-override and doing a unbound-control reload.
    * Merge GH#1028: Clearer documentation for tcp-idle-timeout and
    edns-tcp-keepalive-timeout.
    * Fix GH#1029: rpz trigger clientip and action rpz-passthru not
    working as expected.
    * Fix rpz that the rpz override is taken in case of clientip
    triggers. Fix that the clientip passthru action is logged. Fix
    that the clientip localdata action is logged. Fix rpz override
    action cname for the clientip trigger.
    * Fix to unify codepath for local alias for rpz cname action
    override.
    * Fix rpz for cname override action after nsdname and nsip
    triggers.
    * Fix that addrinfo is not kept around but copied and freed, so
    that log-destaddr uses a copy of the information, much like NSD
    does.
    * Merge GH#1030: Persist the openssl and expat directories for
    repeated Windows builds.
    * Fix that rpz CNAME content is limited to the max number of
    cnames.
    * Fix rpz, it follows iterator CNAMEs for nsip and nsdname and
    sets the reply query_info values, that is better for debug
    logging.
    * Fix rpz that copies the cname override completely to the temp
    region, so there are no references to the rpz region.
    * Add rpz unit test for nsip action override.
    * Fix rpz for qtype CNAME after nameserver trigger.
    * Fix rpz so that rpz CNAME can apply after rpz CNAME. And fix
    that clientip and nsip can give a CNAME.
    * Fix localdata and rpz localdata to match CNAME only if no
    direct type match is available.
    * Merge GH#831 from Pierre4012: Improve Windows NSIS installer
    script (setup.nsi).
    * For GH#831: Format text, use exclamation icon and explicit label
    names.
    * Fix name of unit test for subnet cache response.
    * Fix GH#1032: The size of subnet_msg_cache calculation mistake
    cause memory usage increased beyond expectations.
    * Fix for GH#1032, add safeguard to make table space positive.
    * Fix comment in lruhash space function.
    * Fix to add unit test for lruhash space that exercises the
    routines.
    * Fix that when the server truncates the pidfile, it does not
    follow symbolic links.
    * Fix that the server does not chown the pidfile.
    * Fix GH#1034: DoT forward-zone via unbound-control.
    * Fix for crypto related failures to have a better error string.
    * Fix GH#1035: Potential Bug while parsing port from the
    "stub-host" string; also affected forward-zones and
    remote-control host directives.
    * Fix GH#369: dnstap showing extra responses; for client responses
    right from the cache when replying with expired data or
    prefetching.
    * Fix GH#1040: fix heap-buffer-overflow issue in function
    cfg_mark_ports of file util/config_file.c.
    * For GH#1040: adjust error text and disallow negative ports in
    other parts of cfg_mark_ports.
    * Fix comment syntax for view function views_find_view.
    * Fix GH#595: unbound-anchor cannot deal with full disk; it will
    now first write out to a temp file before replacing the
    original one, like Unbound already does for
    auto-trust-anchor-file.
    * Fixup compile without cachedb.
    * Add test for cachedb serve expired.
    * Extended test for cachedb serve expired.
    * Fix makefile dependencies for fake_event.c.
    * Fix cachedb for serve-expired with serve-expired-reply-ttl.
    * Fix to not reply serve expired unless enabled for cachedb.
    * Fix cachedb for serve-expired with
    serve-expired-client-timeout.
    * Fixup unit test for cachedb server expired client timeout with
    a check if response if from upstream or from cachedb.
    * Fixup cachedb to not refetch when serve-expired-client-timeout
    is used.
    * Merge GH#1049 from Petr Menšík: Py_NoSiteFlag is not needed since
    Python 3.8
    * Fix GH#1048: Update ax_pkg_swig.m4 and ax_pthread.m4.
    * Fix configure, autoconf for GH#1048.
    * Add checklock feature verbose_locking to trace locks and
    unlocks.
    * Fix edns subnet to sort rrset references when storing messages
    in the cache. This fixes a race condition in the rrset locks.
    * Merge GH#1053: Remove child delegations from cache when
    grandchild delegations are returned from parent.
    * Fix ci workflow for macos for moved install locations.
    * Fix configure flto check error, by finding grep for it.
    * Merge GH#1041: Stub and Forward unshare. This has one structure
    for them and fixes GH#1038: fatal error: Could not initialize
    thread / error: reading root hints.
    * Fix to disable fragmentation on systems with IP_DONTFRAG, with
    a nonzero value for the socket option argument.
    * Fix doc unit test for out of directory build.
    * Fix cachedb with serve-expired-client-timeout disabled. The
    edns subnet module deletes global cache and cachedb cache when
    it stores a result, and serve-expired is enabled, so that the
    global reply, that is older than the ecs reply, does not return
    after the ecs reply expires.
    * Add unit tests for cachedb and subnet cache expired data.
    * Man page entry for unbound-checkconf -q.
    * Cleanup unnecessary strdup calls for EDE strings.
    * Fix doxygen comment for errinf_to_str_bogus.

++++ unbound:

  - Update to 1.20.0:
    Features:
    * The config for discard-timeout, wait-limit, wait-limit-cookie,
    wait-limit-netblock and wait-limit-cookie-netblock was added,
    for the fix to the DNSBomb issue.
    * Merge GH#1027: Introduce 'cache-min-negative-ttl' option.
    * Merge GH#1043 from xiaoxiaoafeifei: Add loongarch support;
    updates config.guess(2024-01-01) and config.sub(2024-01-01),
    verified with upstream.
    * Implement cachedb-check-when-serve-expired: yes option, default
    is enabled. When serve expired is enabled with cachedb, it
    first checks cachedb before serving the expired response.
    * Fix GH#876: [FR] can unbound-checkconf be silenced when
    configuration is valid?
    Bug Fixes:
    * Fix for the DNSBomb vulnerability CVE-2024-33655. Thanks to
    Xiang Li from the Network and Information Security Lab of
    Tsinghua University for reporting it.
    * Update doc/unbound.doxygen with 'doxygen -u'. Fixes option
    deprecation warnings and updates with newer defaults.
    * Remove unused portion from iter_dname_ttl unit test.
    * Fix validator classification of qtype DNAME for positive and
    redirection answers, and fix validator signature routine for
    dealing with the synthesized CNAME for a DNAME without
    previously encountering it and also for when the qtype is
    DNAME.
    * Fix qname minimisation for reply with a DNAME for qtype CNAME
    that answers it.
    * Fix doc test so it ignores but outputs unsupported doxygen
    options.
    * Fix GH#1021 Inconsistent Behavior with Changing
    rpz-cname-override and doing a unbound-control reload.
    * Merge GH#1028: Clearer documentation for tcp-idle-timeout and
    edns-tcp-keepalive-timeout.
    * Fix GH#1029: rpz trigger clientip and action rpz-passthru not
    working as expected.
    * Fix rpz that the rpz override is taken in case of clientip
    triggers. Fix that the clientip passthru action is logged. Fix
    that the clientip localdata action is logged. Fix rpz override
    action cname for the clientip trigger.
    * Fix to unify codepath for local alias for rpz cname action
    override.
    * Fix rpz for cname override action after nsdname and nsip
    triggers.
    * Fix that addrinfo is not kept around but copied and freed, so
    that log-destaddr uses a copy of the information, much like NSD
    does.
    * Merge GH#1030: Persist the openssl and expat directories for
    repeated Windows builds.
    * Fix that rpz CNAME content is limited to the max number of
    cnames.
    * Fix rpz, it follows iterator CNAMEs for nsip and nsdname and
    sets the reply query_info values, that is better for debug
    logging.
    * Fix rpz that copies the cname override completely to the temp
    region, so there are no references to the rpz region.
    * Add rpz unit test for nsip action override.
    * Fix rpz for qtype CNAME after nameserver trigger.
    * Fix rpz so that rpz CNAME can apply after rpz CNAME. And fix
    that clientip and nsip can give a CNAME.
    * Fix localdata and rpz localdata to match CNAME only if no
    direct type match is available.
    * Merge GH#831 from Pierre4012: Improve Windows NSIS installer
    script (setup.nsi).
    * For GH#831: Format text, use exclamation icon and explicit label
    names.
    * Fix name of unit test for subnet cache response.
    * Fix GH#1032: The size of subnet_msg_cache calculation mistake
    cause memory usage increased beyond expectations.
    * Fix for GH#1032, add safeguard to make table space positive.
    * Fix comment in lruhash space function.
    * Fix to add unit test for lruhash space that exercises the
    routines.
    * Fix that when the server truncates the pidfile, it does not
    follow symbolic links.
    * Fix that the server does not chown the pidfile.
    * Fix GH#1034: DoT forward-zone via unbound-control.
    * Fix for crypto related failures to have a better error string.
    * Fix GH#1035: Potential Bug while parsing port from the
    "stub-host" string; also affected forward-zones and
    remote-control host directives.
    * Fix GH#369: dnstap showing extra responses; for client responses
    right from the cache when replying with expired data or
    prefetching.
    * Fix GH#1040: fix heap-buffer-overflow issue in function
    cfg_mark_ports of file util/config_file.c.
    * For GH#1040: adjust error text and disallow negative ports in
    other parts of cfg_mark_ports.
    * Fix comment syntax for view function views_find_view.
    * Fix GH#595: unbound-anchor cannot deal with full disk; it will
    now first write out to a temp file before replacing the
    original one, like Unbound already does for
    auto-trust-anchor-file.
    * Fixup compile without cachedb.
    * Add test for cachedb serve expired.
    * Extended test for cachedb serve expired.
    * Fix makefile dependencies for fake_event.c.
    * Fix cachedb for serve-expired with serve-expired-reply-ttl.
    * Fix to not reply serve expired unless enabled for cachedb.
    * Fix cachedb for serve-expired with
    serve-expired-client-timeout.
    * Fixup unit test for cachedb server expired client timeout with
    a check if response if from upstream or from cachedb.
    * Fixup cachedb to not refetch when serve-expired-client-timeout
    is used.
    * Merge GH#1049 from Petr Menšík: Py_NoSiteFlag is not needed since
    Python 3.8
    * Fix GH#1048: Update ax_pkg_swig.m4 and ax_pthread.m4.
    * Fix configure, autoconf for GH#1048.
    * Add checklock feature verbose_locking to trace locks and
    unlocks.
    * Fix edns subnet to sort rrset references when storing messages
    in the cache. This fixes a race condition in the rrset locks.
    * Merge GH#1053: Remove child delegations from cache when
    grandchild delegations are returned from parent.
    * Fix ci workflow for macos for moved install locations.
    * Fix configure flto check error, by finding grep for it.
    * Merge GH#1041: Stub and Forward unshare. This has one structure
    for them and fixes GH#1038: fatal error: Could not initialize
    thread / error: reading root hints.
    * Fix to disable fragmentation on systems with IP_DONTFRAG, with
    a nonzero value for the socket option argument.
    * Fix doc unit test for out of directory build.
    * Fix cachedb with serve-expired-client-timeout disabled. The
    edns subnet module deletes global cache and cachedb cache when
    it stores a result, and serve-expired is enabled, so that the
    global reply, that is older than the ecs reply, does not return
    after the ecs reply expires.
    * Add unit tests for cachedb and subnet cache expired data.
    * Man page entry for unbound-checkconf -q.
    * Cleanup unnecessary strdup calls for EDE strings.
    * Fix doxygen comment for errinf_to_str_bogus.

++++ unbound:

  - Update to 1.20.0:
    Features:
    * The config for discard-timeout, wait-limit, wait-limit-cookie,
    wait-limit-netblock and wait-limit-cookie-netblock was added,
    for the fix to the DNSBomb issue.
    * Merge GH#1027: Introduce 'cache-min-negative-ttl' option.
    * Merge GH#1043 from xiaoxiaoafeifei: Add loongarch support;
    updates config.guess(2024-01-01) and config.sub(2024-01-01),
    verified with upstream.
    * Implement cachedb-check-when-serve-expired: yes option, default
    is enabled. When serve expired is enabled with cachedb, it
    first checks cachedb before serving the expired response.
    * Fix GH#876: [FR] can unbound-checkconf be silenced when
    configuration is valid?
    Bug Fixes:
    * Fix for the DNSBomb vulnerability CVE-2024-33655. Thanks to
    Xiang Li from the Network and Information Security Lab of
    Tsinghua University for reporting it.
    * Update doc/unbound.doxygen with 'doxygen -u'. Fixes option
    deprecation warnings and updates with newer defaults.
    * Remove unused portion from iter_dname_ttl unit test.
    * Fix validator classification of qtype DNAME for positive and
    redirection answers, and fix validator signature routine for
    dealing with the synthesized CNAME for a DNAME without
    previously encountering it and also for when the qtype is
    DNAME.
    * Fix qname minimisation for reply with a DNAME for qtype CNAME
    that answers it.
    * Fix doc test so it ignores but outputs unsupported doxygen
    options.
    * Fix GH#1021 Inconsistent Behavior with Changing
    rpz-cname-override and doing a unbound-control reload.
    * Merge GH#1028: Clearer documentation for tcp-idle-timeout and
    edns-tcp-keepalive-timeout.
    * Fix GH#1029: rpz trigger clientip and action rpz-passthru not
    working as expected.
    * Fix rpz that the rpz override is taken in case of clientip
    triggers. Fix that the clientip passthru action is logged. Fix
    that the clientip localdata action is logged. Fix rpz override
    action cname for the clientip trigger.
    * Fix to unify codepath for local alias for rpz cname action
    override.
    * Fix rpz for cname override action after nsdname and nsip
    triggers.
    * Fix that addrinfo is not kept around but copied and freed, so
    that log-destaddr uses a copy of the information, much like NSD
    does.
    * Merge GH#1030: Persist the openssl and expat directories for
    repeated Windows builds.
    * Fix that rpz CNAME content is limited to the max number of
    cnames.
    * Fix rpz, it follows iterator CNAMEs for nsip and nsdname and
    sets the reply query_info values, that is better for debug
    logging.
    * Fix rpz that copies the cname override completely to the temp
    region, so there are no references to the rpz region.
    * Add rpz unit test for nsip action override.
    * Fix rpz for qtype CNAME after nameserver trigger.
    * Fix rpz so that rpz CNAME can apply after rpz CNAME. And fix
    that clientip and nsip can give a CNAME.
    * Fix localdata and rpz localdata to match CNAME only if no
    direct type match is available.
    * Merge GH#831 from Pierre4012: Improve Windows NSIS installer
    script (setup.nsi).
    * For GH#831: Format text, use exclamation icon and explicit label
    names.
    * Fix name of unit test for subnet cache response.
    * Fix GH#1032: The size of subnet_msg_cache calculation mistake
    cause memory usage increased beyond expectations.
    * Fix for GH#1032, add safeguard to make table space positive.
    * Fix comment in lruhash space function.
    * Fix to add unit test for lruhash space that exercises the
    routines.
    * Fix that when the server truncates the pidfile, it does not
    follow symbolic links.
    * Fix that the server does not chown the pidfile.
    * Fix GH#1034: DoT forward-zone via unbound-control.
    * Fix for crypto related failures to have a better error string.
    * Fix GH#1035: Potential Bug while parsing port from the
    "stub-host" string; also affected forward-zones and
    remote-control host directives.
    * Fix GH#369: dnstap showing extra responses; for client responses
    right from the cache when replying with expired data or
    prefetching.
    * Fix GH#1040: fix heap-buffer-overflow issue in function
    cfg_mark_ports of file util/config_file.c.
    * For GH#1040: adjust error text and disallow negative ports in
    other parts of cfg_mark_ports.
    * Fix comment syntax for view function views_find_view.
    * Fix GH#595: unbound-anchor cannot deal with full disk; it will
    now first write out to a temp file before replacing the
    original one, like Unbound already does for
    auto-trust-anchor-file.
    * Fixup compile without cachedb.
    * Add test for cachedb serve expired.
    * Extended test for cachedb serve expired.
    * Fix makefile dependencies for fake_event.c.
    * Fix cachedb for serve-expired with serve-expired-reply-ttl.
    * Fix to not reply serve expired unless enabled for cachedb.
    * Fix cachedb for serve-expired with
    serve-expired-client-timeout.
    * Fixup unit test for cachedb server expired client timeout with
    a check if response if from upstream or from cachedb.
    * Fixup cachedb to not refetch when serve-expired-client-timeout
    is used.
    * Merge GH#1049 from Petr Menšík: Py_NoSiteFlag is not needed since
    Python 3.8
    * Fix GH#1048: Update ax_pkg_swig.m4 and ax_pthread.m4.
    * Fix configure, autoconf for GH#1048.
    * Add checklock feature verbose_locking to trace locks and
    unlocks.
    * Fix edns subnet to sort rrset references when storing messages
    in the cache. This fixes a race condition in the rrset locks.
    * Merge GH#1053: Remove child delegations from cache when
    grandchild delegations are returned from parent.
    * Fix ci workflow for macos for moved install locations.
    * Fix configure flto check error, by finding grep for it.
    * Merge GH#1041: Stub and Forward unshare. This has one structure
    for them and fixes GH#1038: fatal error: Could not initialize
    thread / error: reading root hints.
    * Fix to disable fragmentation on systems with IP_DONTFRAG, with
    a nonzero value for the socket option argument.
    * Fix doc unit test for out of directory build.
    * Fix cachedb with serve-expired-client-timeout disabled. The
    edns subnet module deletes global cache and cachedb cache when
    it stores a result, and serve-expired is enabled, so that the
    global reply, that is older than the ecs reply, does not return
    after the ecs reply expires.
    * Add unit tests for cachedb and subnet cache expired data.
    * Man page entry for unbound-checkconf -q.
    * Cleanup unnecessary strdup calls for EDE strings.
    * Fix doxygen comment for errinf_to_str_bogus.

++++ libvirt:

  - CVE-2024-4418: rpc: ensure temporary GSource is removed from
    client event loop
    bsc#1223849
  - libxl: Fix domxml-to-native conversion
    bsc#1222584

++++ libvirt:

  - CVE-2024-4418: rpc: ensure temporary GSource is removed from
    client event loop
    bsc#1223849
  - libxl: Fix domxml-to-native conversion
    bsc#1222584

++++ libzypp:

  - Revert eintrSafeCall behavior to setting errno to 0.
  - version 17.33.3 (34)

++++ libzypp:

  - Revert eintrSafeCall behavior to setting errno to 0.
  - version 17.33.3 (34)

++++ libzypp:

  - Revert eintrSafeCall behavior to setting errno to 0.
  - version 17.33.3 (34)

++++ libzypp:

  - Revert eintrSafeCall behavior to setting errno to 0.
  - version 17.33.3 (34)

++++ libzypp:

  - Revert eintrSafeCall behavior to setting errno to 0.
  - version 17.33.3 (34)

++++ qemu:

  - Fixes:
    * [openSUSE][RPM] Prioritize PA over PipeWire in SLE (bsc#1222218)
    * [openSUSE][RPM] Hostname normalization (for repr. build ) done properly (boo#1084909)

++++ qemu:

  - Fixes:
    * [openSUSE][RPM] Prioritize PA over PipeWire in SLE (bsc#1222218)
    * [openSUSE][RPM] Hostname normalization (for repr. build ) done properly (boo#1084909)

++++ qemu:

  - Fixes:
    * [openSUSE][RPM] Prioritize PA over PipeWire in SLE (bsc#1222218)
    * [openSUSE][RPM] Hostname normalization (for repr. build ) done properly (boo#1084909)

++++ qemu:

  - Fixes:
    * [openSUSE][RPM] Prioritize PA over PipeWire in SLE (bsc#1222218)
    * [openSUSE][RPM] Hostname normalization (for repr. build ) done properly (boo#1084909)

++++ qemu:

  - Fixes:
    * [openSUSE][RPM] Prioritize PA over PipeWire in SLE (bsc#1222218)
    * [openSUSE][RPM] Hostname normalization (for repr. build ) done properly (boo#1084909)

++++ qemu:

  - Fixes:
    * [openSUSE][RPM] Prioritize PA over PipeWire in SLE (bsc#1222218)
    * [openSUSE][RPM] Hostname normalization (for repr. build ) done properly (boo#1084909)

------------------------------------------------------------------
------------------  2024-5-7  -  May 7 2024  -------------------
------------------------------------------------------------------

++++ python-kiwi:

  - Bump version: 10.0.14 → 10.0.15
  - REview runtime_configuration.rst
  - Review repository_setup.rst

++++ python-kiwi:

  - Bump version: 10.0.14 → 10.0.15
  - REview runtime_configuration.rst
  - Review repository_setup.rst

++++ python-kiwi:

  - Bump version: 10.0.14 → 10.0.15
  - REview runtime_configuration.rst
  - Review repository_setup.rst

++++ transactional-update:

  - Version 4.6.8
  - tukit: Properly handle overlay syncing failures: If the system
    would not be rebooted and several snapshots accumulated in the
    meantime, it was possible that the previous base snapshot -
    required for /etc syncing - was deleted already. In that case
    changes in /etc might have been reset.
    [gh#openSUSE/transactional-update#116]
    [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287]
  - soft-reboot: Log requested reboot type
  - soft-reboot: Don't force hard reboot on version change only

++++ transactional-update:

  - Version 4.6.8
  - tukit: Properly handle overlay syncing failures: If the system
    would not be rebooted and several snapshots accumulated in the
    meantime, it was possible that the previous base snapshot -
    required for /etc syncing - was deleted already. In that case
    changes in /etc might have been reset.
    [gh#openSUSE/transactional-update#116]
    [gh#kube-hetzner/terraform-hcloud-kube-hetzner#1287]
  - soft-reboot: Log requested reboot type
  - soft-reboot: Don't force hard reboot on version change only

++++ fde-tools:

  - Add fde-tools-bsc1223771-firstboot-make-Pass-phrase-mandatory.patch
    to make "pass" mandatory during firstboot (bsc#1223771)

++++ glibc:

  - nscd-netgroup-cache-timeout.patch: Use time_t for return type of
    addgetnetgrentX (CVE-2024-33602, bsc#1223425)
  - Also add libc_nonshared.a workaround to 32-bit x86 compat package
    (bsc#1221482)

++++ glibc:

  - nscd-netgroup-cache-timeout.patch: Use time_t for return type of
    addgetnetgrentX (CVE-2024-33602, bsc#1223425)
  - Also add libc_nonshared.a workaround to 32-bit x86 compat package
    (bsc#1221482)

++++ glibc:

  - nscd-netgroup-cache-timeout.patch: Use time_t for return type of
    addgetnetgrentX (CVE-2024-33602, bsc#1223425)
  - Also add libc_nonshared.a workaround to 32-bit x86 compat package
    (bsc#1221482)

++++ glibc:

  - nscd-netgroup-cache-timeout.patch: Use time_t for return type of
    addgetnetgrentX (CVE-2024-33602, bsc#1223425)
  - Also add libc_nonshared.a workaround to 32-bit x86 compat package
    (bsc#1221482)

++++ glibc:

  - nscd-netgroup-cache-timeout.patch: Use time_t for return type of
    addgetnetgrentX (CVE-2024-33602, bsc#1223425)
  - Also add libc_nonshared.a workaround to 32-bit x86 compat package
    (bsc#1221482)

++++ kernel-default:

  - btrfs: fix race when detecting delalloc ranges during fiemap
    (bsc#1223285).
  - commit b4449a9
  - btrfs: ensure fiemap doesn't race with writes when
    FIEMAP_FLAG_SYNC is given (bsc#1223285).
  - commit e1d5456
  - btrfs: fix race between ordered extent completion and fiemap
    (bsc#1223285).
  - commit b2ade77
  - btrfs: fix deadlock with fiemap and extent locking
    (bsc#1223285).
  - commit 032df64
  - btrfs: send: don't issue unnecessary zero writes for trailing
    hole (bsc#1222459).
  - commit 79ef069
  - inet: read sk->sk_family once in inet_recv_error() (bsc#1222385
    CVE-2024-26679).
  - commit cb5e75a
  - Move upstreamed HD-audio patch into sorted section
  - commit d615f15
  - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
    (bsc#1217750).
  - commit 9e75dfd
  - btrfs: dev-replace: properly validate device names (CVE-2024-26791 bsc#1222793)
  - commit 0244362
  - fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() (CVE-2023-52641 bsc#1222303)
  - commit 3195e8d
  - fix patch references (CVE-2024-26739 bsc#1222559):
  - patches.suse/net-sched-act_mirred-Create-function-tcf_mirred_to_d.patch
  - patches.suse/net-sched-act_mirred-don-t-override-retval-if-we-alr.patch
  - commit af4b677
  - usb: dwc3: core: Prevent phy suspend during init (Git-fixes).
  - commit 0feb823
  - netfilter: nft_ct: fix l3num expectations with inet pseudo
    family (git-fixes).
  - commit e0fbf15
  - drm/i915/vma: Fix UAF on destroy against retire race (CVE-2024-26939 bsc#1223679).
  - commit 0c69759
  - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes).
  - commit 2bd2798
  - rds: tcp: Fix use-after-free of net in reqsk_timer_handler()
    (CVE-2024-26865 bsc#1223062).
  - commit 4df5c35

++++ kernel-default:

  - btrfs: fix race when detecting delalloc ranges during fiemap
    (bsc#1223285).
  - commit b4449a9
  - btrfs: ensure fiemap doesn't race with writes when
    FIEMAP_FLAG_SYNC is given (bsc#1223285).
  - commit e1d5456
  - btrfs: fix race between ordered extent completion and fiemap
    (bsc#1223285).
  - commit b2ade77
  - btrfs: fix deadlock with fiemap and extent locking
    (bsc#1223285).
  - commit 032df64
  - btrfs: send: don't issue unnecessary zero writes for trailing
    hole (bsc#1222459).
  - commit 79ef069
  - inet: read sk->sk_family once in inet_recv_error() (bsc#1222385
    CVE-2024-26679).
  - commit cb5e75a
  - Move upstreamed HD-audio patch into sorted section
  - commit d615f15
  - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
    (bsc#1217750).
  - commit 9e75dfd
  - btrfs: dev-replace: properly validate device names (CVE-2024-26791 bsc#1222793)
  - commit 0244362
  - fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() (CVE-2023-52641 bsc#1222303)
  - commit 3195e8d
  - fix patch references (CVE-2024-26739 bsc#1222559):
  - patches.suse/net-sched-act_mirred-Create-function-tcf_mirred_to_d.patch
  - patches.suse/net-sched-act_mirred-don-t-override-retval-if-we-alr.patch
  - commit af4b677
  - usb: dwc3: core: Prevent phy suspend during init (Git-fixes).
  - commit 0feb823
  - netfilter: nft_ct: fix l3num expectations with inet pseudo
    family (git-fixes).
  - commit e0fbf15
  - drm/i915/vma: Fix UAF on destroy against retire race (CVE-2024-26939 bsc#1223679).
  - commit 0c69759
  - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes).
  - commit 2bd2798
  - rds: tcp: Fix use-after-free of net in reqsk_timer_handler()
    (CVE-2024-26865 bsc#1223062).
  - commit 4df5c35

++++ kernel-default:

  - btrfs: fix race when detecting delalloc ranges during fiemap
    (bsc#1223285).
  - commit b4449a9
  - btrfs: ensure fiemap doesn't race with writes when
    FIEMAP_FLAG_SYNC is given (bsc#1223285).
  - commit e1d5456
  - btrfs: fix race between ordered extent completion and fiemap
    (bsc#1223285).
  - commit b2ade77
  - btrfs: fix deadlock with fiemap and extent locking
    (bsc#1223285).
  - commit 032df64
  - btrfs: send: don't issue unnecessary zero writes for trailing
    hole (bsc#1222459).
  - commit 79ef069
  - inet: read sk->sk_family once in inet_recv_error() (bsc#1222385
    CVE-2024-26679).
  - commit cb5e75a
  - Move upstreamed HD-audio patch into sorted section
  - commit d615f15
  - ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7
    (bsc#1217750).
  - commit 9e75dfd
  - btrfs: dev-replace: properly validate device names (CVE-2024-26791 bsc#1222793)
  - commit 0244362
  - fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() (CVE-2023-52641 bsc#1222303)
  - commit 3195e8d
  - fix patch references (CVE-2024-26739 bsc#1222559):
  - patches.suse/net-sched-act_mirred-Create-function-tcf_mirred_to_d.patch
  - patches.suse/net-sched-act_mirred-don-t-override-retval-if-we-alr.patch
  - commit af4b677
  - usb: dwc3: core: Prevent phy suspend during init (Git-fixes).
  - commit 0feb823
  - netfilter: nft_ct: fix l3num expectations with inet pseudo
    family (git-fixes).
  - commit e0fbf15
  - drm/i915/vma: Fix UAF on destroy against retire race (CVE-2024-26939 bsc#1223679).
  - commit 0c69759
  - Reapply "drm/qxl: simplify qxl_fence_wait" (stable-fixes).
  - commit 2bd2798
  - rds: tcp: Fix use-after-free of net in reqsk_timer_handler()
    (CVE-2024-26865 bsc#1223062).
  - commit 4df5c35

++++ patterns-micro:

  - Use registries-conf-default on Leap Micro

++++ suseconnect-ng:

  - Update to version 1.9.0
    * Fix certificate import for Yast when using a registration proxy with
    self-signed SSL certificate (bsc#1223107)

++++ suseconnect-ng:

  - Update to version 1.9.0
    * Fix certificate import for Yast when using a registration proxy with
    self-signed SSL certificate (bsc#1223107)

++++ suseconnect-ng:

  - Update to version 1.9.0
    * Fix certificate import for Yast when using a registration proxy with
    self-signed SSL certificate (bsc#1223107)

++++ suseconnect-ng:

  - Update to version 1.9.0
    * Fix certificate import for Yast when using a registration proxy with
    self-signed SSL certificate (bsc#1223107)

++++ suseconnect-ng:

  - Update to version 1.9.0
    * Fix certificate import for Yast when using a registration proxy with
    self-signed SSL certificate (bsc#1223107)

------------------------------------------------------------------
------------------  2024-5-6  -  May 6 2024  -------------------
------------------------------------------------------------------

++++ container-selinux:

  - Update to version 2.231.0:
    * Allow container domains to communicate with spc_t unix_stream_sockets
    * Move to %posttrans to ensure selinux-policy got updated before
    the commands run (bsc#1221720)

++++ gdk-pixbuf:

  - Pass -Dothers=enabled to meson: enable other image loaders (most
    notably beeded seems xpm,xbm). This is in line with upstreams
    recommendation for now, but won't be working past version 2.43.x.
    The loaders will likely be split out into a separate repo.
    (boo#1223903, glgo#GNOME/gdk-pixbuf!169).
  - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test
    suite with other loaders enabled.

++++ gdk-pixbuf:

  - Pass -Dothers=enabled to meson: enable other image loaders (most
    notably beeded seems xpm,xbm). This is in line with upstreams
    recommendation for now, but won't be working past version 2.43.x.
    The loaders will likely be split out into a separate repo.
    (boo#1223903, glgo#GNOME/gdk-pixbuf!169).
  - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test
    suite with other loaders enabled.

++++ gdk-pixbuf:

  - Pass -Dothers=enabled to meson: enable other image loaders (most
    notably beeded seems xpm,xbm). This is in line with upstreams
    recommendation for now, but won't be working past version 2.43.x.
    The loaders will likely be split out into a separate repo.
    (boo#1223903, glgo#GNOME/gdk-pixbuf!169).
  - Add 238893d8cd6f9c2616a05ab521a29651a17a38c2.patch: Fix test
    suite with other loaders enabled.

++++ kernel-default:

  - packet: annotate data-races around ignore_outgoing
    (CVE-2024-26862 bsc#1223111).
  - commit 50ec7e9
  - Update
    patches.suse/sctp-fix-potential-deadlock-on-net-sctp.addr_wq.patch
    references (add CVE-2024-0639 bsc#1218917).
  - commit 61e4bcd
  - fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame() (CVE-2023-52641 bsc#1222303)
  - commit 45e1211
  - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in
    custom expectations (bsc#1222368 CVE-2024-26673).
  - commit bffaac0
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693)
  - commit b75cd2c
  - btrfs: don't drop extent_map for free space inode on write error (CVE-2024-26726 bsc#1222532)
  - commit 60707c9
  - ring-buffer: Only update pages_touched when a new page is
    touched (git-fixes).
  - commit f2292de
  - kprobes: Fix possible use-after-free issue on kprobe
    registration (git-fixes).
  - commit 3121e4a
  - Update
    patches.suse/0001-s390-cio-fix-race-condition-during-online-processing.patch
    (bsc#1219485 bsc#1219451 git-fixes CVE-2024-27009 bsc#1223699).
  - Update
    patches.suse/Bluetooth-btnxpuart-Fix-btnxpuart_close.patch
    (git-fixes CVE-2024-26959 bsc#1223667).
  - Update
    patches.suse/USB-usb-storage-Prevent-divide-by-0-error-in-isd200_.patch
    (git-fixes CVE-2024-27059 bsc#1223738).
  - Update
    patches.suse/backlight-hx8357-Fix-potential-NULL-pointer-derefere.patch
    (git-fixes CVE-2024-27071 bsc#1223734).
  - Update patches.suse/clk-Fix-clk_core_get-NULL-dereference.patch
    (git-fixes CVE-2024-27038 bsc#1223816).
  - Update
    patches.suse/clk-hisilicon-hi3559a-Fix-an-erroneous-devm_kfree.patch
    (git-fixes CVE-2024-27039 bsc#1223821).
  - Update
    patches.suse/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26970 bsc#1223644).
  - Update
    patches.suse/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26969 bsc#1223645).
  - Update
    patches.suse/clk-qcom-gcc-ipq9574-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26968 bsc#1223642).
  - Update
    patches.suse/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch
    (git-fixes CVE-2024-26966 bsc#1223646).
  - Update
    patches.suse/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch
    (git-fixes CVE-2024-26965 bsc#1223648).
  - Update
    patches.suse/clk-zynq-Prevent-null-pointer-dereference-caused-by-.patch
    (git-fixes CVE-2024-27037 bsc#1223717).
  - Update
    patches.suse/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
    (git-fixes CVE-2024-27051 bsc#1223769).
  - Update
    patches.suse/crypto-qat-resolve-race-condition-during-AER-recover.patch
    (git-fixes CVE-2024-26974 bsc#1223638).
  - Update
    patches.suse/drm-amd-display-Add-replay-NULL-check-in-edp_set_rep.patch
    (git-fixes CVE-2024-27040 bsc#1223711).
  - Update
    patches.suse/drm-amd-display-Fix-a-potential-buffer-overflow-in-d.patch
    (git-fixes CVE-2024-27045 bsc#1223826).
  - Update
    patches.suse/drm-amd-display-Fix-potential-NULL-pointer-dereferen.patch
    (git-fixes CVE-2024-27044 bsc#1223723).
  - Update
    patches.suse/drm-amd-display-fix-NULL-checks-for-adev-dm.dc-in-am.patch
    (git-fixes CVE-2024-27041 bsc#1223714).
  - Update
    patches.suse/drm-amdgpu-Fix-potential-out-of-bounds-access-in-amd.patch
    (git-fixes CVE-2024-27042 bsc#1223823).
  - Update
    patches.suse/drm-vmwgfx-Fix-possible-null-pointer-derefence-with-.patch
    (git-fixes CVE-2024-26979 bsc#1223628).
  - Update
    patches.suse/md-Fix-missing-release-of-active_io-for-flush-8556.patch
    (jsc#PED-7542 CVE-2024-27023 bsc#1223776).
  - Update
    patches.suse/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
    (git-fixes CVE-2024-27075 bsc#1223842).
  - Update patches.suse/media-edia-dvbdev-fix-a-use-after-free.patch
    (git-fixes CVE-2024-27043 bsc#1223824).
  - Update
    patches.suse/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
    (git-fixes CVE-2024-27074 bsc#1223844).
  - Update
    patches.suse/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
    (git-fixes CVE-2024-27076 bsc#1223779).
  - Update
    patches.suse/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
    (git-fixes CVE-2024-27073 bsc#1223843).
  - Update
    patches.suse/media-usbtv-Remove-useless-locks-in-usbtv_video_free.patch
    (git-fixes CVE-2024-27072 bsc#1223837).
  - Update
    patches.suse/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
    (git-fixes CVE-2024-27077 bsc#1223780).
  - Update
    patches.suse/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
    (git-fixes CVE-2024-27078 bsc#1223781).
  - Update
    patches.suse/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
    (git-fixes CVE-2024-27047 bsc#1223828).
  - Update
    patches.suse/nilfs2-fix-failure-to-detect-DAT-corruption-in-btree.patch
    (git-fixes CVE-2024-26956 bsc#1223663).
  - Update
    patches.suse/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch
    (git-fixes CVE-2024-26955 bsc#1223657).
  - Update patches.suse/pci_iounmap-Fix-MMIO-mapping-leak.patch
    (git-fixes CVE-2024-26977 bsc#1223631).
  - Update
    patches.suse/powercap-intel_rapl-Fix-a-NULL-pointer-dereference.patch
    (git-fixes CVE-2024-26975 bsc#1223632).
  - Update
    patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
    (bsc#1141539 git-fixes CVE-2024-27054 bsc#1223819).
  - Update
    patches.suse/scsi-qla2xxx-Fix-command-flush-on-cable-pull.patch
    (bsc#1221816 CVE-2024-26931 bsc#1223627).
  - Update patches.suse/scsi-qla2xxx-Fix-double-free-of-fcport.patch
    (bsc#1221816 CVE-2024-26929 bsc#1223715).
  - Update
    patches.suse/scsi-qla2xxx-Fix-double-free-of-the-ha-vp_map-pointe.patch
    (bsc#1221816 CVE-2024-26930 bsc#1223626).
  - Update
    patches.suse/thermal-drivers-mediatek-lvts_thermal-Fix-a-memory-l.patch
    (git-fixes CVE-2024-27068 bsc#1223808).
  - Update
    patches.suse/thunderbolt-Fix-NULL-pointer-dereference-in-tb_port_.patch
    (git-fixes CVE-2024-27060 bsc#1223725).
  - Update patches.suse/usb-ulpi-Fix-debugfs-directory-leak.patch
    (git-fixes CVE-2024-26919 bsc#1223847).
  - Update
    patches.suse/wifi-brcm80211-handle-pmk_op-allocation-failure.patch
    (git-fixes CVE-2024-27048 bsc#1223760).
  - Update
    patches.suse/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
    (git-fixes CVE-2024-27052 bsc#1223829).
  - Update
    patches.suse/wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch
    (git-fixes CVE-2024-27391 bsc#1223709).
  - Update
    patches.suse/wifi-wilc1000-fix-RCU-usage-in-connect-path.patch
    (git-fixes CVE-2024-27053 bsc#1223737).
  - commit 9296e40
  - Update
    patches.suse/drm-tegra-dsi-Add-missing-check-for-of_find_device_b.patch
    (git-fixes CVE-2023-52650 bsc#1223770).
  - Update
    patches.suse/drm-vkms-Avoid-reading-beyond-LUT-array.patch
    (git-fixes CVE-2023-52649 bsc#1223768).
  - Update
    patches.suse/drm-vmwgfx-Unmap-the-surface-before-resetting-it-on-.patch
    (git-fixes CVE-2023-52648 bsc#1223765).
  - Update
    patches.suse/media-nxp-imx8-isi-Check-whether-crossbar-pad-is-non.patch
    (git-fixes CVE-2023-52647 bsc#1223764).
  - commit f67398e
  - Update
    patches.suse/powerpc-pseries-Fix-potential-memleak-in-papr_get_at.patch
    (bsc#1215199 CVE-2022-48669 bsc#1223756).
  - commit e9a7939
  - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page
    in concurrent environment (git-fixes).
  - commit 8f1aa4c
  - Delete
    patches.suse/iommufd-iova_bitmap-Move-symbols-to-IOMMUFD-namespace.
    (bsc#1222654)
  - commit dc5c22e
  - fuse: don't unhash root (bsc#1223946).
  - fuse: fix root lookup with nonzero generation (bsc#1223945).
  - virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal
    (bsc#1223944).
  - commit 5171d01
  - tun: limit printing rate when illegal packet received by tun
    dev (bsc#1223745 CVE-2024-27013).
  - net/mlx5e: Prevent deadlock while disabling aRFS (bsc#1223735
    CVE-2024-27014).
  - commit d039d3b
  - drm/amd/display: Add a dc_state NULL check in dc_state_release (CVE-2024-26948 bsc#1223664)
  - commit adac21d
  - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
    (git-fixes).
  - iio:imu: adis16475: Fix sync mode setting (git-fixes).
  - iio: accel: mxc4005: Interrupt handling fixes (git-fixes).
  - iio: pressure: Fixes BME280 SPI driver data (git-fixes).
  - usb: typec: tcpm: Check for port partner validity before
    consuming it (git-fixes).
  - usb: typec: tcpm: unregister existing source caps before
    re-registration (git-fixes).
  - usb: typec: tcpm: clear pd_event queue in PORT_RESET
    (git-fixes).
  - usb: ohci: Prevent missed ohci interrupts (git-fixes).
  - usb: gadget: f_fs: Fix a race condition when processing setup
    packets (git-fixes).
  - USB: core: Fix access violation during port device removal
    (git-fixes).
  - usb: gadget: uvc: use correct buffer size when parsing configfs
    lists (git-fixes).
  - usb: gadget: composite: fix OS descriptors w_value logic
    (git-fixes).
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO
    request complete (git-fixes).
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
    (git-fixes).
  - commit 8d8f752
  - Move upstreamed USB fix into sorted section
  - commit 21751fe

++++ kernel-default:

  - packet: annotate data-races around ignore_outgoing
    (CVE-2024-26862 bsc#1223111).
  - commit 50ec7e9
  - Update
    patches.suse/sctp-fix-potential-deadlock-on-net-sctp.addr_wq.patch
    references (add CVE-2024-0639 bsc#1218917).
  - commit 61e4bcd
  - fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame() (CVE-2023-52641 bsc#1222303)
  - commit 45e1211
  - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in
    custom expectations (bsc#1222368 CVE-2024-26673).
  - commit bffaac0
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693)
  - commit b75cd2c
  - btrfs: don't drop extent_map for free space inode on write error (CVE-2024-26726 bsc#1222532)
  - commit 60707c9
  - ring-buffer: Only update pages_touched when a new page is
    touched (git-fixes).
  - commit f2292de
  - kprobes: Fix possible use-after-free issue on kprobe
    registration (git-fixes).
  - commit 3121e4a
  - Update
    patches.suse/0001-s390-cio-fix-race-condition-during-online-processing.patch
    (bsc#1219485 bsc#1219451 git-fixes CVE-2024-27009 bsc#1223699).
  - Update
    patches.suse/Bluetooth-btnxpuart-Fix-btnxpuart_close.patch
    (git-fixes CVE-2024-26959 bsc#1223667).
  - Update
    patches.suse/USB-usb-storage-Prevent-divide-by-0-error-in-isd200_.patch
    (git-fixes CVE-2024-27059 bsc#1223738).
  - Update
    patches.suse/backlight-hx8357-Fix-potential-NULL-pointer-derefere.patch
    (git-fixes CVE-2024-27071 bsc#1223734).
  - Update patches.suse/clk-Fix-clk_core_get-NULL-dereference.patch
    (git-fixes CVE-2024-27038 bsc#1223816).
  - Update
    patches.suse/clk-hisilicon-hi3559a-Fix-an-erroneous-devm_kfree.patch
    (git-fixes CVE-2024-27039 bsc#1223821).
  - Update
    patches.suse/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26970 bsc#1223644).
  - Update
    patches.suse/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26969 bsc#1223645).
  - Update
    patches.suse/clk-qcom-gcc-ipq9574-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26968 bsc#1223642).
  - Update
    patches.suse/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch
    (git-fixes CVE-2024-26966 bsc#1223646).
  - Update
    patches.suse/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch
    (git-fixes CVE-2024-26965 bsc#1223648).
  - Update
    patches.suse/clk-zynq-Prevent-null-pointer-dereference-caused-by-.patch
    (git-fixes CVE-2024-27037 bsc#1223717).
  - Update
    patches.suse/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
    (git-fixes CVE-2024-27051 bsc#1223769).
  - Update
    patches.suse/crypto-qat-resolve-race-condition-during-AER-recover.patch
    (git-fixes CVE-2024-26974 bsc#1223638).
  - Update
    patches.suse/drm-amd-display-Add-replay-NULL-check-in-edp_set_rep.patch
    (git-fixes CVE-2024-27040 bsc#1223711).
  - Update
    patches.suse/drm-amd-display-Fix-a-potential-buffer-overflow-in-d.patch
    (git-fixes CVE-2024-27045 bsc#1223826).
  - Update
    patches.suse/drm-amd-display-Fix-potential-NULL-pointer-dereferen.patch
    (git-fixes CVE-2024-27044 bsc#1223723).
  - Update
    patches.suse/drm-amd-display-fix-NULL-checks-for-adev-dm.dc-in-am.patch
    (git-fixes CVE-2024-27041 bsc#1223714).
  - Update
    patches.suse/drm-amdgpu-Fix-potential-out-of-bounds-access-in-amd.patch
    (git-fixes CVE-2024-27042 bsc#1223823).
  - Update
    patches.suse/drm-vmwgfx-Fix-possible-null-pointer-derefence-with-.patch
    (git-fixes CVE-2024-26979 bsc#1223628).
  - Update
    patches.suse/md-Fix-missing-release-of-active_io-for-flush-8556.patch
    (jsc#PED-7542 CVE-2024-27023 bsc#1223776).
  - Update
    patches.suse/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
    (git-fixes CVE-2024-27075 bsc#1223842).
  - Update patches.suse/media-edia-dvbdev-fix-a-use-after-free.patch
    (git-fixes CVE-2024-27043 bsc#1223824).
  - Update
    patches.suse/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
    (git-fixes CVE-2024-27074 bsc#1223844).
  - Update
    patches.suse/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
    (git-fixes CVE-2024-27076 bsc#1223779).
  - Update
    patches.suse/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
    (git-fixes CVE-2024-27073 bsc#1223843).
  - Update
    patches.suse/media-usbtv-Remove-useless-locks-in-usbtv_video_free.patch
    (git-fixes CVE-2024-27072 bsc#1223837).
  - Update
    patches.suse/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
    (git-fixes CVE-2024-27077 bsc#1223780).
  - Update
    patches.suse/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
    (git-fixes CVE-2024-27078 bsc#1223781).
  - Update
    patches.suse/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
    (git-fixes CVE-2024-27047 bsc#1223828).
  - Update
    patches.suse/nilfs2-fix-failure-to-detect-DAT-corruption-in-btree.patch
    (git-fixes CVE-2024-26956 bsc#1223663).
  - Update
    patches.suse/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch
    (git-fixes CVE-2024-26955 bsc#1223657).
  - Update patches.suse/pci_iounmap-Fix-MMIO-mapping-leak.patch
    (git-fixes CVE-2024-26977 bsc#1223631).
  - Update
    patches.suse/powercap-intel_rapl-Fix-a-NULL-pointer-dereference.patch
    (git-fixes CVE-2024-26975 bsc#1223632).
  - Update
    patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
    (bsc#1141539 git-fixes CVE-2024-27054 bsc#1223819).
  - Update
    patches.suse/scsi-qla2xxx-Fix-command-flush-on-cable-pull.patch
    (bsc#1221816 CVE-2024-26931 bsc#1223627).
  - Update patches.suse/scsi-qla2xxx-Fix-double-free-of-fcport.patch
    (bsc#1221816 CVE-2024-26929 bsc#1223715).
  - Update
    patches.suse/scsi-qla2xxx-Fix-double-free-of-the-ha-vp_map-pointe.patch
    (bsc#1221816 CVE-2024-26930 bsc#1223626).
  - Update
    patches.suse/thermal-drivers-mediatek-lvts_thermal-Fix-a-memory-l.patch
    (git-fixes CVE-2024-27068 bsc#1223808).
  - Update
    patches.suse/thunderbolt-Fix-NULL-pointer-dereference-in-tb_port_.patch
    (git-fixes CVE-2024-27060 bsc#1223725).
  - Update patches.suse/usb-ulpi-Fix-debugfs-directory-leak.patch
    (git-fixes CVE-2024-26919 bsc#1223847).
  - Update
    patches.suse/wifi-brcm80211-handle-pmk_op-allocation-failure.patch
    (git-fixes CVE-2024-27048 bsc#1223760).
  - Update
    patches.suse/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
    (git-fixes CVE-2024-27052 bsc#1223829).
  - Update
    patches.suse/wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch
    (git-fixes CVE-2024-27391 bsc#1223709).
  - Update
    patches.suse/wifi-wilc1000-fix-RCU-usage-in-connect-path.patch
    (git-fixes CVE-2024-27053 bsc#1223737).
  - commit 9296e40
  - Update
    patches.suse/drm-tegra-dsi-Add-missing-check-for-of_find_device_b.patch
    (git-fixes CVE-2023-52650 bsc#1223770).
  - Update
    patches.suse/drm-vkms-Avoid-reading-beyond-LUT-array.patch
    (git-fixes CVE-2023-52649 bsc#1223768).
  - Update
    patches.suse/drm-vmwgfx-Unmap-the-surface-before-resetting-it-on-.patch
    (git-fixes CVE-2023-52648 bsc#1223765).
  - Update
    patches.suse/media-nxp-imx8-isi-Check-whether-crossbar-pad-is-non.patch
    (git-fixes CVE-2023-52647 bsc#1223764).
  - commit f67398e
  - Update
    patches.suse/powerpc-pseries-Fix-potential-memleak-in-papr_get_at.patch
    (bsc#1215199 CVE-2022-48669 bsc#1223756).
  - commit e9a7939
  - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page
    in concurrent environment (git-fixes).
  - commit 8f1aa4c
  - Delete
    patches.suse/iommufd-iova_bitmap-Move-symbols-to-IOMMUFD-namespace.
    (bsc#1222654)
  - commit dc5c22e
  - fuse: don't unhash root (bsc#1223946).
  - fuse: fix root lookup with nonzero generation (bsc#1223945).
  - virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal
    (bsc#1223944).
  - commit 5171d01
  - tun: limit printing rate when illegal packet received by tun
    dev (bsc#1223745 CVE-2024-27013).
  - net/mlx5e: Prevent deadlock while disabling aRFS (bsc#1223735
    CVE-2024-27014).
  - commit d039d3b
  - drm/amd/display: Add a dc_state NULL check in dc_state_release (CVE-2024-26948 bsc#1223664)
  - commit adac21d
  - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
    (git-fixes).
  - iio:imu: adis16475: Fix sync mode setting (git-fixes).
  - iio: accel: mxc4005: Interrupt handling fixes (git-fixes).
  - iio: pressure: Fixes BME280 SPI driver data (git-fixes).
  - usb: typec: tcpm: Check for port partner validity before
    consuming it (git-fixes).
  - usb: typec: tcpm: unregister existing source caps before
    re-registration (git-fixes).
  - usb: typec: tcpm: clear pd_event queue in PORT_RESET
    (git-fixes).
  - usb: ohci: Prevent missed ohci interrupts (git-fixes).
  - usb: gadget: f_fs: Fix a race condition when processing setup
    packets (git-fixes).
  - USB: core: Fix access violation during port device removal
    (git-fixes).
  - usb: gadget: uvc: use correct buffer size when parsing configfs
    lists (git-fixes).
  - usb: gadget: composite: fix OS descriptors w_value logic
    (git-fixes).
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO
    request complete (git-fixes).
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
    (git-fixes).
  - commit 8d8f752
  - Move upstreamed USB fix into sorted section
  - commit 21751fe

++++ kernel-default:

  - packet: annotate data-races around ignore_outgoing
    (CVE-2024-26862 bsc#1223111).
  - commit 50ec7e9
  - Update
    patches.suse/sctp-fix-potential-deadlock-on-net-sctp.addr_wq.patch
    references (add CVE-2024-0639 bsc#1218917).
  - commit 61e4bcd
  - fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame() (CVE-2023-52641 bsc#1222303)
  - commit 45e1211
  - netfilter: nft_ct: sanitize layer 3 and 4 protocol number in
    custom expectations (bsc#1222368 CVE-2024-26673).
  - commit bffaac0
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693)
  - commit b75cd2c
  - btrfs: don't drop extent_map for free space inode on write error (CVE-2024-26726 bsc#1222532)
  - commit 60707c9
  - ring-buffer: Only update pages_touched when a new page is
    touched (git-fixes).
  - commit f2292de
  - kprobes: Fix possible use-after-free issue on kprobe
    registration (git-fixes).
  - commit 3121e4a
  - Update
    patches.suse/0001-s390-cio-fix-race-condition-during-online-processing.patch
    (bsc#1219485 bsc#1219451 git-fixes CVE-2024-27009 bsc#1223699).
  - Update
    patches.suse/Bluetooth-btnxpuart-Fix-btnxpuart_close.patch
    (git-fixes CVE-2024-26959 bsc#1223667).
  - Update
    patches.suse/USB-usb-storage-Prevent-divide-by-0-error-in-isd200_.patch
    (git-fixes CVE-2024-27059 bsc#1223738).
  - Update
    patches.suse/backlight-hx8357-Fix-potential-NULL-pointer-derefere.patch
    (git-fixes CVE-2024-27071 bsc#1223734).
  - Update patches.suse/clk-Fix-clk_core_get-NULL-dereference.patch
    (git-fixes CVE-2024-27038 bsc#1223816).
  - Update
    patches.suse/clk-hisilicon-hi3559a-Fix-an-erroneous-devm_kfree.patch
    (git-fixes CVE-2024-27039 bsc#1223821).
  - Update
    patches.suse/clk-qcom-gcc-ipq6018-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26970 bsc#1223644).
  - Update
    patches.suse/clk-qcom-gcc-ipq8074-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26969 bsc#1223645).
  - Update
    patches.suse/clk-qcom-gcc-ipq9574-fix-terminating-of-frequency-ta.patch
    (git-fixes CVE-2024-26968 bsc#1223642).
  - Update
    patches.suse/clk-qcom-mmcc-apq8084-fix-terminating-of-frequency-t.patch
    (git-fixes CVE-2024-26966 bsc#1223646).
  - Update
    patches.suse/clk-qcom-mmcc-msm8974-fix-terminating-of-frequency-t.patch
    (git-fixes CVE-2024-26965 bsc#1223648).
  - Update
    patches.suse/clk-zynq-Prevent-null-pointer-dereference-caused-by-.patch
    (git-fixes CVE-2024-27037 bsc#1223717).
  - Update
    patches.suse/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
    (git-fixes CVE-2024-27051 bsc#1223769).
  - Update
    patches.suse/crypto-qat-resolve-race-condition-during-AER-recover.patch
    (git-fixes CVE-2024-26974 bsc#1223638).
  - Update
    patches.suse/drm-amd-display-Add-replay-NULL-check-in-edp_set_rep.patch
    (git-fixes CVE-2024-27040 bsc#1223711).
  - Update
    patches.suse/drm-amd-display-Fix-a-potential-buffer-overflow-in-d.patch
    (git-fixes CVE-2024-27045 bsc#1223826).
  - Update
    patches.suse/drm-amd-display-Fix-potential-NULL-pointer-dereferen.patch
    (git-fixes CVE-2024-27044 bsc#1223723).
  - Update
    patches.suse/drm-amd-display-fix-NULL-checks-for-adev-dm.dc-in-am.patch
    (git-fixes CVE-2024-27041 bsc#1223714).
  - Update
    patches.suse/drm-amdgpu-Fix-potential-out-of-bounds-access-in-amd.patch
    (git-fixes CVE-2024-27042 bsc#1223823).
  - Update
    patches.suse/drm-vmwgfx-Fix-possible-null-pointer-derefence-with-.patch
    (git-fixes CVE-2024-26979 bsc#1223628).
  - Update
    patches.suse/md-Fix-missing-release-of-active_io-for-flush-8556.patch
    (jsc#PED-7542 CVE-2024-27023 bsc#1223776).
  - Update
    patches.suse/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
    (git-fixes CVE-2024-27075 bsc#1223842).
  - Update patches.suse/media-edia-dvbdev-fix-a-use-after-free.patch
    (git-fixes CVE-2024-27043 bsc#1223824).
  - Update
    patches.suse/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
    (git-fixes CVE-2024-27074 bsc#1223844).
  - Update
    patches.suse/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
    (git-fixes CVE-2024-27076 bsc#1223779).
  - Update
    patches.suse/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
    (git-fixes CVE-2024-27073 bsc#1223843).
  - Update
    patches.suse/media-usbtv-Remove-useless-locks-in-usbtv_video_free.patch
    (git-fixes CVE-2024-27072 bsc#1223837).
  - Update
    patches.suse/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
    (git-fixes CVE-2024-27077 bsc#1223780).
  - Update
    patches.suse/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
    (git-fixes CVE-2024-27078 bsc#1223781).
  - Update
    patches.suse/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
    (git-fixes CVE-2024-27047 bsc#1223828).
  - Update
    patches.suse/nilfs2-fix-failure-to-detect-DAT-corruption-in-btree.patch
    (git-fixes CVE-2024-26956 bsc#1223663).
  - Update
    patches.suse/nilfs2-prevent-kernel-bug-at-submit_bh_wbc.patch
    (git-fixes CVE-2024-26955 bsc#1223657).
  - Update patches.suse/pci_iounmap-Fix-MMIO-mapping-leak.patch
    (git-fixes CVE-2024-26977 bsc#1223631).
  - Update
    patches.suse/powercap-intel_rapl-Fix-a-NULL-pointer-dereference.patch
    (git-fixes CVE-2024-26975 bsc#1223632).
  - Update
    patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
    (bsc#1141539 git-fixes CVE-2024-27054 bsc#1223819).
  - Update
    patches.suse/scsi-qla2xxx-Fix-command-flush-on-cable-pull.patch
    (bsc#1221816 CVE-2024-26931 bsc#1223627).
  - Update patches.suse/scsi-qla2xxx-Fix-double-free-of-fcport.patch
    (bsc#1221816 CVE-2024-26929 bsc#1223715).
  - Update
    patches.suse/scsi-qla2xxx-Fix-double-free-of-the-ha-vp_map-pointe.patch
    (bsc#1221816 CVE-2024-26930 bsc#1223626).
  - Update
    patches.suse/thermal-drivers-mediatek-lvts_thermal-Fix-a-memory-l.patch
    (git-fixes CVE-2024-27068 bsc#1223808).
  - Update
    patches.suse/thunderbolt-Fix-NULL-pointer-dereference-in-tb_port_.patch
    (git-fixes CVE-2024-27060 bsc#1223725).
  - Update patches.suse/usb-ulpi-Fix-debugfs-directory-leak.patch
    (git-fixes CVE-2024-26919 bsc#1223847).
  - Update
    patches.suse/wifi-brcm80211-handle-pmk_op-allocation-failure.patch
    (git-fixes CVE-2024-27048 bsc#1223760).
  - Update
    patches.suse/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
    (git-fixes CVE-2024-27052 bsc#1223829).
  - Update
    patches.suse/wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch
    (git-fixes CVE-2024-27391 bsc#1223709).
  - Update
    patches.suse/wifi-wilc1000-fix-RCU-usage-in-connect-path.patch
    (git-fixes CVE-2024-27053 bsc#1223737).
  - commit 9296e40
  - Update
    patches.suse/drm-tegra-dsi-Add-missing-check-for-of_find_device_b.patch
    (git-fixes CVE-2023-52650 bsc#1223770).
  - Update
    patches.suse/drm-vkms-Avoid-reading-beyond-LUT-array.patch
    (git-fixes CVE-2023-52649 bsc#1223768).
  - Update
    patches.suse/drm-vmwgfx-Unmap-the-surface-before-resetting-it-on-.patch
    (git-fixes CVE-2023-52648 bsc#1223765).
  - Update
    patches.suse/media-nxp-imx8-isi-Check-whether-crossbar-pad-is-non.patch
    (git-fixes CVE-2023-52647 bsc#1223764).
  - commit f67398e
  - Update
    patches.suse/powerpc-pseries-Fix-potential-memleak-in-papr_get_at.patch
    (bsc#1215199 CVE-2022-48669 bsc#1223756).
  - commit e9a7939
  - ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page
    in concurrent environment (git-fixes).
  - commit 8f1aa4c
  - Delete
    patches.suse/iommufd-iova_bitmap-Move-symbols-to-IOMMUFD-namespace.
    (bsc#1222654)
  - commit dc5c22e
  - fuse: don't unhash root (bsc#1223946).
  - fuse: fix root lookup with nonzero generation (bsc#1223945).
  - virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal
    (bsc#1223944).
  - commit 5171d01
  - tun: limit printing rate when illegal packet received by tun
    dev (bsc#1223745 CVE-2024-27013).
  - net/mlx5e: Prevent deadlock while disabling aRFS (bsc#1223735
    CVE-2024-27014).
  - commit d039d3b
  - drm/amd/display: Add a dc_state NULL check in dc_state_release (CVE-2024-26948 bsc#1223664)
  - commit adac21d
  - slimbus: qcom-ngd-ctrl: Add timeout for wait operation
    (git-fixes).
  - iio:imu: adis16475: Fix sync mode setting (git-fixes).
  - iio: accel: mxc4005: Interrupt handling fixes (git-fixes).
  - iio: pressure: Fixes BME280 SPI driver data (git-fixes).
  - usb: typec: tcpm: Check for port partner validity before
    consuming it (git-fixes).
  - usb: typec: tcpm: unregister existing source caps before
    re-registration (git-fixes).
  - usb: typec: tcpm: clear pd_event queue in PORT_RESET
    (git-fixes).
  - usb: ohci: Prevent missed ohci interrupts (git-fixes).
  - usb: gadget: f_fs: Fix a race condition when processing setup
    packets (git-fixes).
  - USB: core: Fix access violation during port device removal
    (git-fixes).
  - usb: gadget: uvc: use correct buffer size when parsing configfs
    lists (git-fixes).
  - usb: gadget: composite: fix OS descriptors w_value logic
    (git-fixes).
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO
    request complete (git-fixes).
  - clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
    (git-fixes).
  - commit 8d8f752
  - Move upstreamed USB fix into sorted section
  - commit 21751fe

++++ util-linux:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch

++++ util-linux:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch

++++ util-linux:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch

++++ util-linux:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ openssl-3:

  - Security fix: [bsc#1222548, CVE-2024-2511]
    * Fix unconstrained session cache growth in TLSv1.3
    * Add openssl-CVE-2024-2511.patch

++++ libzypp:

  - fix up requires_eq usage for libsolv-tools-base
  - add one more missing export for PackageKit
  - version 17.33.2

++++ libzypp:

  - fix up requires_eq usage for libsolv-tools-base
  - add one more missing export for PackageKit
  - version 17.33.2

++++ libzypp:

  - fix up requires_eq usage for libsolv-tools-base
  - add one more missing export for PackageKit
  - version 17.33.2

++++ libzypp:

  - fix up requires_eq usage for libsolv-tools-base
  - add one more missing export for PackageKit
  - version 17.33.2

++++ libzypp:

  - fix up requires_eq usage for libsolv-tools-base
  - add one more missing export for PackageKit
  - version 17.33.2

++++ util-linux-systemd:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch

++++ util-linux-systemd:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch

++++ util-linux-systemd:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch

++++ util-linux-systemd:

  - bsc#1220117: Processes not cleaned up after failed SSH session are using up 100% CPU
    + util-linux-more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch