Packages changed:
  GraphicsMagick (1.3.47 -> 1.3.48)
  Mesa (26.1.5 -> 26.1.6)
  Mesa-drivers (26.1.5 -> 26.1.6)
  MozillaFirefox (153.0 -> 153.0.1)
  NetworkManager
  apache2-mod_php8 (8.5.8 -> 8.5.9)
  apparmor (5.0.1 -> 5.0.2)
  chrony
  gcc16 (16.1.1+git9423 -> 16.1.1+git9481)
  gd
  glib2 (2.88.2 -> 2.88.3)
  grub2
  hwinfo (25.4 -> 25.5)
  libapparmor (5.0.1 -> 5.0.2)
  libheif (1.23.0 -> 1.23.1)
  libxmlb (0.3.27 -> 0.3.29)
  microos-tools (4.0+git26 -> 4.0+git28)
  nghttp2 (1.69.0 -> 1.70.0)
  nghttp3 (1.15.0 -> 1.18.0)
  nvme-cli (3.0~b.3 -> 3.0~b.4)
  openSUSE-release (20260731 -> 20260802)
  pam (1.7.2+git12 -> 1.7.2+git48)
  pam-full-src (1.7.2+git12 -> 1.7.2+git48)
  permissions (1699_20260723 -> 1699_20260728)
  php8 (8.5.8 -> 8.5.9)
  python-certifi (2026.5.20 -> 2026.7.22)
  qemu (11.0.2 -> 11.0.3)
  qgpgme (2.1.0 -> 2.2.0)
  rsyslog
  salt
  samba (4.24.3+git.475.629de6765b9 -> 4.24.5+git.481.dba78dbdea)
  shared-mime-info (2.4 -> 2.5.1)
  tar
  tigervnc
  tumbler (4.20.1 -> 4.20.2)
  update-bootloader (1.27 -> 1.28)
  vim
  wpa_supplicant
  wtmpdb (0.75.0+git20251130.0d8fe7a -> 0.76.0+git20260730.89c0861)
  xfce4-panel (4.20.7 -> 4.20.8)
  xfce4-power-manager (4.20.0 -> 4.20.1)
  xfce4-settings (4.20.4 -> 4.20.5)
  yast2-auth-server (5.0.0 -> 5.0.1)
  zoo

=== Details ===

==== GraphicsMagick ====
Version update (1.3.47 -> 1.3.48)
Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config

- added patches
  CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files [bsc#1268878]
  * GraphicsMagick-CVE-2026-56379.patch
- version update 1.3.48
  * Address ImageMagick CVE CVE-2026-42050, ImageMagick security
    advisory GHSA-7mxf-ff4f-jj7p, which is related to an X11 display
    buffer overflow.  This is really a minor issue since it requires X11
    keyboard input and causes no harm.
  * DCM: In RLE decoder, detect and report end of input. Reported-by:
    Tristan Madani.
  * DCM: Convert from ASCII numeric value to unsigned value, with error
    detection. Avoid problems caused by negative values. Reported-by:
    Tristan Madani.
  * display: Correct bounds checking for 'filename' length. Thanks to
    Petr Gajdos for a heads-up regarding the disparity.
  * GradientImage(): Fix 'pixel_packets' and 'indexes' addressing logic
    for NorthGravity.  Addresses "[security] GraphicsMagick
    GradientImage: heap-buffer-overflow READ in NorthGravity branch
    reached from gm convert (magick/gradient.c:284)" from David
    Korczynski. Credit to Anthropic Claude and Ada Logics.
  * ImageToBlob(): Fix memory leak which may occur if WriteImage() fails.
  * LOCALE: Bound the length passed to strncpy() and string
    terminator. Addresses "[security] GraphicsMagick LOCALE coder:
    stack-buffer-overflow WRITE in ReadConfigureFile reached from gm
    convert (coders/locale.c:257)" from David Korczynski. Credit to
    Anthropic Claude and Ada Logics.
  * META/IPTC: Prevent reading past the end of a truncated/short IPTC
    profile.
  * MIFF: Correct scope of 'values' reallocation error
    handling. Addresses "[security] GraphicsMagick MIFF reader:
    heap-use-after-free WRITE via stale cursor on values-buffer realloc
    failure (coders/miff.c:1048)" from David Korczynski. Credit to
    Anthropic Claude and Ada Logics.
  * MSL: Properly log warnings and errors using LogMagickEventList()
    given a va_list. Reported-by: Tristan Madani.
  * PCD: Over-provision the per-channel Huffman decode buffers and
    detect any attempt to overflow them. Discovered and reported by
    Cipher - Causal Security (https://causalsecurity.com/).
  * PCX: If image has more than 256 colors, save as a DirectClass
    type. Addresses "[security] GraphicsMagick PCX writer:
  * PNG: Use only values from GetImageCharacteristics() since
    IsMonochromeImage() and IsGrayImage() may produce different
    answers. Addresses "[security] GraphicsMagick MNG re-encode:
    heap-buffer-overflow WRITE in ExportGrayAlphaQuantumType reached
    from gm convert (magick/export.c:1105)" as reported by David
    Korczynski via email on May 28, 2026. Credit to Anthropic Claude and
    Ada Logics.
  * SVG: Properly log warnings and errors using LogMagickEventList()
    given a va_list. Reported-by: Tristan Madani.
  * TIFF: Add many more validations and safeguards to EXIF in TIFF
    writer. Addresses "[security] GraphicsMagick TIFF writer:
    heap-buffer-overflow WRITE in AddIFDExifFields via 32-bit count*2
    wrap on EXIF SHORT array (coders/tiff.c)" from David
    Korczynski. Credit to Anthropic Claude and Ada Logics.
  * TIFF: If EXIF profile string is not already NUL terminated, assure
    that it is NUL terminated before passing it to libtiff. Reported-by:
    Tristan Madani.
  * TIFF: In AddIFDExifFields(), address possible out of bounds read (2
    bytes) beyond the end of the allocated profile buffer. Reported-by:
    Tristan Madani.
  * VIFF: Memory leak fix (ImageMagick CVE-2026-61870).
  * configure.ac: Fixes so Freetype and zlib may be detected if
    pkg-config is not available.
  * PICT: Remove the attempt to intuit byteCount must be a word because
    the approach used does not work reliably. This means that defective
    PICT files previously written by ImageMagick or GraphicsMagick may
    fail to be read.
  * VIFF: Fixes so remaining Khoros VIFF sample files sample files from
    the Encyclopedia Of Graphics File Formats which are based on integer
    data storage types read correctly.
- deleted patches
  * GraphicsMagick-CVE-2026-13606.patch (upstreamed)
  * GraphicsMagick-CVE-2026-42050.patch (upstreamed)
  * GraphicsMagick-CVE-2026-61870.patch (upstreamed)
- added patches
  CVE-2026-61464: Heap Buffer Over-Write in X11 import with crafted window title [bsc#1271496]
  * GraphicsMagick-CVE-2026-61464.patch

==== Mesa ====
Version update (26.1.5 -> 26.1.6)
Subpackages: Mesa-libEGL1 Mesa-libGL1 libgbm1

- Update to 26.1.6 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.6

==== Mesa-drivers ====
Version update (26.1.5 -> 26.1.6)
Subpackages: Mesa-dri Mesa-libva Mesa-vulkan-device-select libvulkan_lvp

- Update to 26.1.6 bugfix release
  - -> https://docs.mesa3d.org/relnotes/26.1.6

==== MozillaFirefox ====
Version update (153.0 -> 153.0.1)
Subpackages: MozillaFirefox-branding-upstream MozillaFirefox-translations-common

- Mozilla Firefox 153.0.1
  https://www.firefox.com/en-US/firefox/153.0.1/releasenotes/
  * Fix audio playing silently on some music and audio streaming
    sites after pausing and resuming playback (bmo#2053586)
  * Fix the New Tab page background flashing a few seconds after
    the page loaded when a custom wallpaper was in use
    (bmo#2056650)
  * Fix a crash that could occur when a page loaded a frame using a
    javascript: address (bmo#2054485)
  * Fix a crash that could occur while typing text in an editable
    area of a page (bmo#2053867)
  * Fix a search engine you had already installed yourself being
    labeled as "New" when Firefox later started offering the same
    engine (bmo#2053710)
  * Improve pointer lock, used by games and other immersive web
    content, so that the mouse pointer is less likely to escape the
    Firefox window (bmo#1255338, bmo#2040628)
  * Fix an issue in the Inspector's Rules view where pseudo-
    elements could only be expanded once per selected element
    (bmo#2054525)
  * Fix View Page Source failing to load blob: documents
    (bmo#2054428)
  * Fix View Page Source timing out on documents that inherit their
    origin, such as frames using the srcdoc attribute (bmo#2054487)

==== NetworkManager ====
Subpackages: NetworkManager-bluetooth NetworkManager-lang NetworkManager-tui NetworkManager-wwan libnm0 typelib-1_0-NM-1_0

- Add 2462.patch: nm-initrd-generator: set parent for NBFT
  vlan connection
  (bsc#1259025, glfd#NetworkManager/NetworkManager!2462).
- Add NetworkManager-initrd-generator-ip-hcn.patch: handle "ip=hcn"
  option in nm-initrd-generator, it generates an empty connection
  (PED-14534).

==== apache2-mod_php8 ====
Version update (8.5.8 -> 8.5.9)

- version update to 8.5.9
    Core:
    Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL).
    Fixed bug GH-22206 (missing return in global register detection).
    Lock unmodified readonly properties for modification after clone-with.
    BCMath:
    Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)
    Calendar:
    Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).
    Date:
    Update timelib to 2022.17.
    Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
    Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
    Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).
    DBA:
    Fixed OOB read on malformed length field in dba flatfile handler.
    DOM:
    Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).
    Fixed getElementsByClassName() item() returning the wrong element on random access.
    Exif:
    Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).
    GD:
    Upgrade libgd. (CVE-2026-9672)
    Hash:
    Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).
    ODBC:
    Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).
    Opcache:
    Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls).
    Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an undereferenced run_time_cache map_ptr offset).
    Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait).
    OpenSSL:
    Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.
    Intl:
    Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
    Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
    Fixed memory leak when calling IntlListFormatter::__construct() twice.
    Fixed IntlChar methods leaving stale global error state after successful calls.
    PDO_ODBC:
    Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
    Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
    Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).
    Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).
    PGSQL:
    Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)
    Phar:
    Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
    Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
    PHPDBG:
    Fixed bug GH-17387 (Trivial crash in phpdbg lexer).
    Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
    Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.
    Reflection:
    Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()).
    Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).
    Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output).
    Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions).
    Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
    Session:
    Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).
    SPL:
    Fix class_parents for classes with leading slash in non-autoload mode.
    Ignore leading back-slash in class_parents(), class_implements(), and class_uses().
    Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults).
    Standard:
    Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
    Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).
    URI:
    Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque hosts.
    Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed).
    Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo).
    Zip:
    Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).
    Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).
- modified patches
  * php-build-reproducible-phar.patch (refreshed)
  * php-systzdata-v24.patch (refreshed)
- fixes CVE-2026-17543 [bsc#1273075]
    CVE-2026-17544 [bsc#1273076]
    CVE-2026-7260 [bsc#1273077]
    CVE-2026-9672 [bsc#1273078]

==== apparmor ====
Version update (5.0.1 -> 5.0.2)
Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-parser-lang apparmor-profiles apparmor-utils apparmor-utils-lang python3-apparmor

- update to AppArmor 5.0.2
  - several fixes in utils, parser and some profiles
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_5.0.2
    for the upstream changelog
- remove upstreamed patches:
  - curl.diff
  - lsblk-mr2147.diff
- add nslookup.diff to fix nslookup output

==== chrony ====
Subpackages: chrony-pool-openSUSE

- Potential incompatibility!
  Extend UsrEtc (/usr/etc) support to the main configuration:
  * Ship the vendor chrony.conf and the chrony.d pool defaults
    under /usr/etc instead of /etc.
  * chronyd.service now uses /etc/chrony.conf when it exists and
    falls back to /usr/etc/chrony.conf otherwise
    (chrony-usretc-service.patch)
  * Use the confdir directive for chrony.d so that files in
    /etc/chrony.d override same-named vendor files in /usr/etc/chrony.d
  * Preserve admin-modified /etc/chrony.conf and /etc/chrony.d/pool.conf
    across the upgrade via the standard .rpmsave migration scriptlets.
  * chrony.keys stays in /etc.
  * To add the new chrony.d overlay/fallback mechanism to existing
    configurations the "include" line at the end of /etc/chrony.conf
    needs to be replaced by the "confdir" line from the new
    /usr/etc/chrony.conf file.

==== gcc16 ====
Version update (16.1.1+git9423 -> 16.1.1+git9481)
Subpackages: cpp16 gcc16-locale libasan8 libatomic1 libgcc_s1 libgcc_s1-32bit libgccjit0 libgfortran5 libgomp1 libhwasan0 libitm1 liblsan0 libobjc4 libquadmath0 libstdc++6 libstdc++6-32bit libstdc++6-locale libstdc++6-pp libstdc++6-pp-32bit libtsan2 libubsan1

- Update to gcc-16.1.1+git9481, GCC 16.2 RC1

==== gd ====
Subpackages: libgd3

- added patches
  CVE-2026-9672: upgrade gd [bsc#1273101]
  * gd-CVE-2026-9672.patch

==== glib2 ====
Version update (2.88.2 -> 2.88.3)
Subpackages: glib2-lang glib2-tools libgio-2_0-0 libgirepository-2_0-0 libglib-2_0-0 libglib-2_0-0-32bit libgmodule-2_0-0 libgobject-2_0-0 libgthread-2_0-0 typelib-1_0-GIRepository-3_0 typelib-1_0-GLib-2_0 typelib-1_0-GLibUnix-2_0 typelib-1_0-GModule-2_0 typelib-1_0-GObject-2_0 typelib-1_0-Gio-2_0

- Update to version 2.88.3 (CVE-2026-15588):
  + Fix potential miscompilation with GCC 17 with `G_GNUC_CONST` on
    `get_type()` functions
  + Bugs fixed:
  - G_GNUC_CONST vs get_type comes home to roost
  - (CVE-2026-15588) Security report: GDBusServer
    pre-authentication DoS via unbounded SASL line buffering
  - Drop G_GNUC_CONST for *_get_type
  - gdbusauth: Limit length of lines read from client
  - gdbusauth: Unmark a new string as translatable
  - Several Meson/gcc fixes

==== grub2 ====
Subpackages: grub2-common grub2-i386-pc grub2-snapper-plugin grub2-systemd-sleep-plugin grub2-x86_64-efi grub2-x86_64-efi-bls

- Fix KVM and Xen VM images taking too long to boot (bsc#1266384)
  * 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch
  * 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch
  * 0003-disk-reduce-cache-slot-thrashing.patch
- Replace patch with upstreamed version
  * 0001-test-Fix-f-test-on-files-over-network.patch
  * 0002-http-Return-HTTP-status-code-in-http_establish.patch
  * 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch
  * 0004-tftp-Fix-hang-when-file-is-a-directory.patch

==== hwinfo ====
Version update (25.4 -> 25.5)
Subpackages: libhd25

- merge gh#openSUSE/hwinfo#187
- small adjustments to bash-completion, update spec file
- 25.5
- merge gh#openSUSE/hwinfo#183
- add bash completion script for hwinfo
- merge gh#openSUSE/hwinfo#186
- serial driver file name changed in /proc in current kernel,
  adjusting code (bsc#1271724)

==== libapparmor ====
Version update (5.0.1 -> 5.0.2)

- update to AppArmor 5.0.2
  - several fixes in utils, parser and some profiles
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_5.0.2
    for the upstream changelog
- remove upstreamed patches:
  - curl.diff
  - lsblk-mr2147.diff
- add nslookup.diff to fix nslookup output

==== libheif ====
Version update (1.23.0 -> 1.23.1)
Subpackages: gdk-pixbuf-loader-libheif libheif-aom libheif-dav1d libheif-ffmpeg libheif-jpeg libheif-openh264 libheif-openjpeg libheif-rav1e libheif-svtenc libheif1

- Update to version 1.23.1:
  + FFmpeg decoder plugin gains AV1, VVC, JPEG, and JPEG 2000/HTJ2K
    decoding
  + SVT-AV1 encoder: new tune=iq and ms-ssim tune parameters
  + C++ API: added getters/setters for the CLLI and MDCV HDR
    metadata boxes
  + Sequence decoder now scales the alpha auxiliary track to the
    main image size
  + Fixed pixi box writing for multi-channel images
  + Corrected the placement of the TAI clock_type field into the
    top 2 bits
  + Empty/unset plugin directory is no longer scanned
  + CVE-2026-62289 (GHSA-jc8f-p23p-5hjg) Integer underflow in
    Fraction constructor via double clap transform application
  + CVE-2026-62291 (GHSA-xpw3-9rhw-482x) Heap out of bounds write in
    libheif uncompressed encoder when writing images with mismatched
    auxiliary alpha dimensions
  + CVE-2026-62292 (GHSA-73p7-m7gg-w2jv) Out-of-bounds read in
    uncompressed unci tile range slicing
  + CVE-2026-62377 (GHSA-9ww4-9v47-m7pj) Reachable assertion in
    HeifContext::get_track() aborts on a valid-but-empty HEIF
    sequence file
  + (GHSA-46rp-pcq2-rpmr) Heap out-of-bounds write in the
    uncompressed encoder for RRGGBB images with interleaved
    bit-depth ≤ 8

==== libxmlb ====
Version update (0.3.27 -> 0.3.29)
Subpackages: libxmlb2 libxmlb2-x86-64-v3

- Update to version 0.3.29:
  + Bugfixes:
  - Avoid stale query indexes when reloading the silo
  - Clear the query cache when reloading the silo
  - Correctly mark the silo as invalid when re-loading malformed
    data
  - Fix building the silo when shared-mime-info is installed
- Changes from version 0.3.28:
  + New Features:
  - Automatically add system locales when using native-langs
  - Lower the Meson and GLib deps for RHEL-8
  + Bugfixes:
  - Lazy clear opcode tokens for a ~2% speedup
  - Speed up negative queries by 11% by defer creating the
    results objects
  - Speed up predicates with no bindings by 9%
  - Speed up the no-results query by 2.5% by using a constant
    error

==== microos-tools ====
Version update (4.0+git26 -> 4.0+git28)

- Update to version 4.0+git28:
  * Use zypp.conf.d dropin for ZYPP_SINGLE_RPMTRANS=1
- Update to version 4.0+git27:
  * Remove obsolete stuff (locale-check, salt-tmpdir)

==== nghttp2 ====
Version update (1.69.0 -> 1.70.0)

- Require the versions configure actually checks for: libnghttp3 >= 1.17.0
  and libngtcp2 >= 1.23.0. Without them OBS starts the build and lets it
  fail in configure, instead of holding the package unresolvable until
  nghttp3 is in place
- Update to 1.70.0:
  * nghttpx: add separate frontend and backend stream timeouts, plus an
    HTTP/2 stream write timeout
  * nghttpx: drop HTTP/2 and HTTP/3 connections whose frontend write
    rate is too low, so a peer can no longer hold a connection open by
    reading slowly
  * Rework HTTP header validation, and add the value check that was
    missing for the priority header field
  * Fix an out-of-bounds read in the base64 decoder
  * get_socket_error() now reports the errno of getsockopt() when that
    call itself fails, instead of a stale value
  * Update the bundled llhttp to 9.4.2 and mruby to 4.0.0, and refresh
    the bundled ngtcp2, neverbleed and sfparse
  * Large internal rework: nghttpx now carries its error paths in
    std::expected rather than out-parameters
- Drop 0001-nghttpx-Tighten-up-CONNECT-and-HTTP-Upgrade-handling.patch,
  the fix is part of this release (CVE-2026-58055, bsc#1269489)
- Mark the doc subpackage noarch, it ships documentation only and
  rpmlint rightly flagged it with no-binary
- Run spec-cleaner: drop the Group tags and sort the build
  dependencies

==== nghttp3 ====
Version update (1.15.0 -> 1.18.0)

- Update to 1.18.0:
  * Added nghttp3_conn_close_stream2 and the nghttp3_stream_close2
    callback
  * Validate the header length against the estimated uncompressed
    length
  * Fix a build error with gcc-16
- Changes from 1.17.0:
  * Added nghttp3_conn_stream_flushed and public API to encode and
    decode variable-length integers
  * Fix header name validation
- Changes from 1.16.0:
  * Added nghttp3_conn_get_stream_user_data
  * Call the nghttp3_stream_close callback for all streams
  * Fix a memory leak on the failure path
  * Ignore content-length for the extended CONNECT
  * Reject HTTP status codes with a leading zero
  * Optimize huffman decode length estimation
- The library soname is unchanged at 9

==== nvme-cli ====
Version update (3.0~b.3 -> 3.0~b.4)
Subpackages: libnvme3-1 nvme-cli-bash-completion

- Update to version 3.0~b.4:
  * Release v3.0-b.4
  * doc: Regenerate all docs for v3.0-b.4
  * libnvme/config: add epcsd supporting
  * libnvme/config: add support for persistent
  * libnvme/fabrics: remove pdc-enabled build time config
  * plugins/config: add create command
  * libnvme/config-emit: ensure config dir exists
  * shared/fs-util: add missing windows implementation
  * shared/fs-util: add sh_mkdir_from_fname and shr_dirname
  * shared: split platform parts into separate files
  * shared: update prefix for compiler attributes
  * doc: remove nvme-config.txt
  * plugins: invoke the arg parser for the remaining commands
  * discoverd: rename discoverd.conf to nvme-discoverd.conf
  * ocp: add NULL checks after memory allocation
  * ocp: fix __le64 usage in C9 log reading
  * ocp: fix use after free and memory leak related to C9 log page reads
  * ocp: use libnvme_alloc and libnvme_free for log buffer allocations
  * ocp: read telemetry log with maximum transfer size
  * innogrit: fix resource leak in innogrit_vsc_getcdump()
  * scaleflux: clamp code_type before array access in nvme_parse_evtlog()
  * wdc: fix out-of-bounds access in wdc_show_cloud_smart_log_normal()
  * micron: clean up and fix micron telemetry log reading
  * nbft: ensure transport buffer is null terminated in read_ssns() and read_hfi()
  * nvme-models: fix stream EOF state errors in __nvme_product_name and pull_class_info
  * ibm: fix missing break in show_ibm_smart_log() case 0x00f5
  * nvme-rpmb: fix out-of-bounds allocation in read_rpmb_key()
  * tests: align config-convert expectation with preserved legacy json
  * plugins/ymtc: fix additional smart info display for YMTC PE511
  * utils: check asprintf return value
  * util: fix memory leak in read_binary_file()
  * util: fix memory leak in read_binary_file()
  * utils: add crash handlers for option capture
  * nvme: avoid stale pointer in get_log_offset()
  * fabrics: avoid double free in build_options()
  * fabrics: avoid reduntant libnvmf_context_set_crypto() call
  * fabrics: avoid mem leak in libnvmf_context_set_crypto()
  * fabrics: accept fabrics arguments for disconnect
  * nvme: add arg parser to gen/show hostnqn
  * plugins/keys: report line number 1 based
  * plugins/keys: show error when missing trailing colon
  * plugins/keys: update help text for gen-tls
  * fabrics: add --kxchap-* arguments
  * nvme: add compat tls/chap key management commands
  * libnvme: rename DH-HMAC- prefix with KX-HMAC-
  * tests: add nvme keys tests cases
  * nvme: split keyring insert out of keys check-tls/check-dhchap
  * nvme: move key commands into new keys plugin
  * shared: add more test coverage
  * libnvme: return libnvmf_tid_parse{,_strict}() as int, not a pointer
  * libnvme/nbft: tests: Regenerate reference NBFT table dumps
  * nvme: preserve legacy json config for rollbacks
  * libnvme: reuse heap reader for NBFT security lists
  * libnvme: fix comments that still describe removed JSON config support
  * libnvme/nbft: Add sample synthetic NBFT tables
  * shared: move init unit test
  * shared: move compiler-attributes to common code
  * libnvme: return libnvmf_tid_from_fields() as int, not a pointer
  * nvme: fix to check sanitize status error
  * nbft-plugin: fix resource leak in show_nbft()
  * discoverd: parse discoverd.conf with the shared ini parser
  * libnvme: parse NBFT Security Profile descriptors
  * doc: add nvme-discoverd(8) and the design README
  * meson: make nvmf-autoconnect independently toggleable
  * discoverd: add the nvme-discoverd daemon
  * libnvme: harden NBFT interface references
  * libnvme: validate NBFT descriptor ranges
  * libnvme: drop test/ioctl's own freep(), use shared/cleanup.h
  * shared: add README
  * shared: add test coverage for array-util, base64, crc32
  * shared: rename everything to the shr_ namespace
  * shared: add PTRARRAY_DEFINE() for type-checked ptrarray wrappers
  * shared: dedup cleanup.h boilerplate
  * shared: move base64, crc32, and misc utility functions
  * shared: fix mkdir_p() silently truncating long paths
  * shared: relicense to LGPL-2.1-or-later
  * sfx-nvme: fix resource leak in sfx_status()
  * nbft: fix resource leak of ssns->hfis in read_ssns()
  * sndk plugin: Fix vs-smart-add-log for NVMe OF
  * nvme: add utils dump-command-metadata command
  * memblaze: fix stack overflow in perf-stats-print-x
  * nvme: add global options config file
  * shared: move ini parser to common code
  * nvme: move args into separate header
  * nvme: do not include libnvme-mi on global level
  * nvme: change verbosity type
  * util/json: use stdint types
  * shared: add a small static utility library
  * wdc: free dssd_specific_ver when smart_log_ver < 3
  * virtium: remove erroneous (float) cast in vt_save_smart_to_vtview_log()
  * nvme-print: print address instead of traddr
  * nvme: replace argconfig_parse with parse_args
  * nvme-cli: resolve hostnqn/hostid on ctx creation
  * libnvme/tree: free hnqn/hid in error path
  * sfx-nvme: fix dead assignment in sfx_dump_evtlog()
  * exclusion: fix uninitialized argument in libnvmf_exclusion_read()
  * nvme: Fix get-log xfer-len parameter handling
  * libnvme: generate the trivial libnvme_global_ctx bool accessors
    ... changelog too long, skipping 105 lines ...
  unpackaged files.

==== openSUSE-release ====
Version update (20260731 -> 20260802)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== pam ====
Version update (1.7.2+git12 -> 1.7.2+git48)
Subpackages: pam-32bit

- Update to version 1.7.2+git48:
  * pam_unix: make SHA512 the default
  * po: update translations using Weblate (Hebrew)
  * po: update translations using Weblate (Russian)
  * po: update translations using Weblate (Greek)
  * po: update translations using Weblate (Norwegian Nynorsk)
  * po: update translations using Weblate (Chinese (Simplified) (zh_CN))
  * po: update translations using Weblate (Serbian)
  * po: update translations using Weblate (Polish)
  * po: update translations using Weblate (Chinese (Simplified) (zh_CN))
  * po: update translations using Weblate (Hungarian)
  * po: add translation using Weblate (Kabyle)
  * po: update translations using Weblate (Indonesian)
  * po: update translations using Weblate (Lithuanian)
  * po: update translations using Weblate (Italian)
  * po: update translations using Weblate (Finnish)
  * po: update translations using Weblate (Slovenian)
  * po: update translations using Weblate (Spanish)
  * po: update translations using Weblate (Punjabi)
  * po: update translations using Weblate (Kazakh)
  * po: update translations using Weblate (Swedish)
  * po: update translations using Weblate (Ukrainian)
  * po: update translations using Weblate (Portuguese (Brazil))
  * po: update translations using Weblate (Turkish)
  * po: update translations using Weblate (Georgian)
  * po: update translations using Weblate (Romanian)
  * po: update translations using Weblate (Czech)
  * po: update translations using Weblate (Korean)
  * Update translation files
  * pam_userdb: fix password comparison timing leak
  * meson: use an empty array for link args instead of an empty string
  * pam_succeed_if: prevent logging unknown user names in plaintext
  * pam_limits: improve 'wrong limit value' log message
  * pam_pwhistory: allow earlier passwords when remember count is reduced
  * pam_namespace: fix error handling in secure_opendir()
  * pam_rhosts: fix typos in pam_rhosts(8) man page
  * .github: add gcc-15 jobs
- Obsoletes pam_userdb-fix-password-comparison-timing-leak.patch

==== pam-full-src ====
Version update (1.7.2+git12 -> 1.7.2+git48)
Subpackages: pam-extra pam-manpages

- Update to version 1.7.2+git48:
  * pam_unix: make SHA512 the default
  * po: update translations using Weblate (Hebrew)
  * po: update translations using Weblate (Russian)
  * po: update translations using Weblate (Greek)
  * po: update translations using Weblate (Norwegian Nynorsk)
  * po: update translations using Weblate (Chinese (Simplified) (zh_CN))
  * po: update translations using Weblate (Serbian)
  * po: update translations using Weblate (Polish)
  * po: update translations using Weblate (Chinese (Simplified) (zh_CN))
  * po: update translations using Weblate (Hungarian)
  * po: add translation using Weblate (Kabyle)
  * po: update translations using Weblate (Indonesian)
  * po: update translations using Weblate (Lithuanian)
  * po: update translations using Weblate (Italian)
  * po: update translations using Weblate (Finnish)
  * po: update translations using Weblate (Slovenian)
  * po: update translations using Weblate (Spanish)
  * po: update translations using Weblate (Punjabi)
  * po: update translations using Weblate (Kazakh)
  * po: update translations using Weblate (Swedish)
  * po: update translations using Weblate (Ukrainian)
  * po: update translations using Weblate (Portuguese (Brazil))
  * po: update translations using Weblate (Turkish)
  * po: update translations using Weblate (Georgian)
  * po: update translations using Weblate (Romanian)
  * po: update translations using Weblate (Czech)
  * po: update translations using Weblate (Korean)
  * Update translation files
  * pam_userdb: fix password comparison timing leak
  * meson: use an empty array for link args instead of an empty string
  * pam_succeed_if: prevent logging unknown user names in plaintext
  * pam_limits: improve 'wrong limit value' log message
  * pam_pwhistory: allow earlier passwords when remember count is reduced
  * pam_namespace: fix error handling in secure_opendir()
  * pam_rhosts: fix typos in pam_rhosts(8) man page
  * .github: add gcc-15 jobs
- Obsoletes pam_userdb-fix-password-comparison-timing-leak.patch

==== permissions ====
Version update (1699_20260723 -> 1699_20260728)
Subpackages: permctl permissions-config

- Update to version 1699_20260728:
  * profiles: whitelist selinux-sandbox seunshare (bsc#1268256)
  * profiles: drop netcfg /etc/exports

==== php8 ====
Version update (8.5.8 -> 8.5.9)
Subpackages: php8-ctype php8-dom php8-iconv php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter

- version update to 8.5.9
    Core:
    Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL).
    Fixed bug GH-22206 (missing return in global register detection).
    Lock unmodified readonly properties for modification after clone-with.
    BCMath:
    Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)
    Calendar:
    Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).
    Date:
    Update timelib to 2022.17.
    Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
    Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
    Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).
    DBA:
    Fixed OOB read on malformed length field in dba flatfile handler.
    DOM:
    Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).
    Fixed getElementsByClassName() item() returning the wrong element on random access.
    Exif:
    Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).
    GD:
    Upgrade libgd. (CVE-2026-9672)
    Hash:
    Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).
    ODBC:
    Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).
    Opcache:
    Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls).
    Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an undereferenced run_time_cache map_ptr offset).
    Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait).
    OpenSSL:
    Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.
    Intl:
    Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
    Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
    Fixed memory leak when calling IntlListFormatter::__construct() twice.
    Fixed IntlChar methods leaving stale global error state after successful calls.
    PDO_ODBC:
    Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
    Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
    Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).
    Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).
    PGSQL:
    Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)
    Phar:
    Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
    Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
    PHPDBG:
    Fixed bug GH-17387 (Trivial crash in phpdbg lexer).
    Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
    Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.
    Reflection:
    Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()).
    Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).
    Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output).
    Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions).
    Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
    Session:
    Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).
    SPL:
    Fix class_parents for classes with leading slash in non-autoload mode.
    Ignore leading back-slash in class_parents(), class_implements(), and class_uses().
    Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults).
    Standard:
    Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
    Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).
    URI:
    Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque hosts.
    Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed).
    Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo).
    Zip:
    Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).
    Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).
- modified patches
  * php-build-reproducible-phar.patch (refreshed)
  * php-systzdata-v24.patch (refreshed)
- fixes CVE-2026-17543 [bsc#1273075]
    CVE-2026-17544 [bsc#1273076]
    CVE-2026-7260 [bsc#1273077]
    CVE-2026-9672 [bsc#1273078]

==== python-certifi ====
Version update (2026.5.20 -> 2026.7.22)

- Update to 2026.7.22:
  - fix: update Requests docs link to canonical URL
  - Include tests in the source distribution

==== qemu ====
Version update (11.0.2 -> 11.0.3)
Subpackages: qemu-audio-spice qemu-block-curl qemu-block-nfs qemu-block-rbd qemu-chardev-spice qemu-guest-agent qemu-hw-display-qxl qemu-hw-display-virtio-gpu qemu-hw-display-virtio-gpu-pci qemu-hw-display-virtio-vga qemu-hw-usb-host qemu-hw-usb-redirect qemu-hw-usb-smartcard qemu-img qemu-ksm qemu-lang qemu-microvm qemu-pr-helper qemu-seabios qemu-tools qemu-ui-curses qemu-ui-gtk qemu-ui-opengl qemu-ui-spice-app qemu-ui-spice-core qemu-vgabios qemu-vmsr-helper qemu-x86

- (Properly, this time for real) fix bsc#1268245:
  * [openSUSE][RPM] spec: properly fix bsc#1268245 (this time for real!)
- Update to latest stable release (11.0.3)
  Full backport list here:
  https://lore.kernel.org/qemu-devel/20260725052155.1228635-1-mjt@tls.msk.ru/
  A selection of them is reported here below:
  target/arm: do not clear halting reason in has_work helper
  target/arm: teach arm_cpu_has_work about halting reasons
  hw/audio/intel-hda: restrict all DMA engine paths to memories
  hw/net/cadence: Return current Cadence GEM queue pointers
  hw/misc/applesmc: Fix a typo setting MSSD key
  replay: fix use of uninitialized pointer on error
  hw/display/qxl: validate monitors_config heads[] in phys2virt
  net: Correct padding check in qemu_receive_packet()
  hw/net/xilinx_axienet: Fix PHY register 17 link status reporting
  hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise()
  hw/usb/hcd-xhci: Fix guest-triggerable assert() in xhci_find_stream()
  usbredir: fix infinite loop and SIGFPE with zero max_packet_size
  usbredir: fix use-after-free on buffered bulk packet overflow
  tests/qtest: add xhci-pci unplug finalize regression test
  hw/usb/hcd-xhci-pci: break host link cycle so device_finalize() runs on unplug
  hw/usb/xhci: clamp interval exponent to avoid UB shift in xhci_init_epctx()
  accel/tcg: move jit thread manipulation into do_tb_phys_invalidate
  hw/display/virtio-gpu: Check pixman_image_create_bits() results
  hw/display/virtio-gpu: handle migration iov allocation failure
  hw/display/virtio-gpu: cap submit_3d command buffer allocation
  ui/vnc: validate SetPixelFormat field ranges
  ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
  ui/gtk: Narrow DMA-BUF critical section
  ui/input-barrier: fix off-by-one in keycode bounds check
  ui/vnc: validate color shifts in SetPixelFormat
  ui/vnc: fix OOB write in vnc_refresh_lossy_rect
  net: only advertise passt in netdev help when CONFIG_PASST
  hw/usb/hcd-xhci: Turn guest-triggerable abort() into qemu_log_mask()
  hw/usb/hcd-ohci: Make sure that ohci_service_ed_list() cannot loop forever
  hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
  hw/scsi/vmw_pvscsi: add a comment to explain the endianness
  hw/scsi/vmw_pvscsi: translate data endianness
  hw/sparc64/niagara: use int64_t for vdisk size to avoid truncation
  hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
  hw/misc/ivshmem: clear chardev handlers before freeing peers
  linux-user/alpha: populate AT_HWCAP from env->amask
  linux-user/alpha: add coredump support
  s390x/css: firm up handling of chained TIC CCWs
  s390x/sclpcpi: check event length field before reading from buffer
  s390x/sclp: prevent re-reading the sclp header
  hw/misc/stm32_rcc: Correct offset-to-irq calculation
  hw/display/sm501: Don't allow guest to set ram size larger than it is
  hw/display/sm501: Avoid overflow problems in bounds check calculations
  hw/display/sm501: Catch bad coordinates for RTL operations
  ...
- Fix bsc#1273022:
  * hw/i386/pc: xen: reinstate the "xenfv" machine alias (bsc#1273022)

==== qgpgme ====
Version update (2.1.0 -> 2.2.0)

- Update to 2.2.0:
  * Add job for querying Active Directory
  * Don't start dirmngr for WKD lookup if it is disabled for gpg

==== rsyslog ====

- fix specfile for dtls module

==== salt ====
Subpackages: python313-salt salt-master salt-minion

- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch

==== samba ====
Version update (4.24.3+git.475.629de6765b9 -> 4.24.5+git.481.dba78dbdea)
Subpackages: libldb2 libldb2-32bit python3-ldb samba-ad-dc-libs samba-ad-dc-libs-32bit samba-client samba-client-32bit samba-client-lang samba-client-libs samba-client-libs-32bit samba-dcerpc samba-gpupdate samba-ldb-ldap samba-libs samba-libs-32bit samba-libs-python3 samba-python3 samba-winbind samba-winbind-libs samba-winbind-libs-32bit samba-winbind-libs-lang

- Update to 4.24.5
  * CVE-2026-6949: TSIG packet with crafted name compression can
    crash internal DNS server; (bso#16083);(bsc#1271672).
  * CVE-2026-58224: CTDB: heap OOB read via unchecked packet
    length fields;(bso#16085);(bsc#1271673).
  * CVE-2026-58216: kpasswd service: 6-byte heap OOB read in
    packet parser;(bso#16087);(bsc#1271674).
  * CVE-2026-58218: DNS TKEY negotiation stores unauthenticated
    GSS contexts in a fixed FIFO before authentication
    completes;(bso#16115);(bsc#1271675).
  * CVE-2026-58221: authenticated LDAP access to internal LDB
    special DNs permits domain takeover;(bso#16147);(bsc#1271676).
  * CVE-2026-58222: LDAP Compare filter injection and
    trusted-request confusion disclose protected attributes;
    (bso#16148);(bsc#1271677).
- Update to 4.24.4
  * Use-after-free in handling acls with claims and conditions;
    (bso#16095).
  * Compilers may ignore overflow checks - Fix tautological-
    compare warnings; (bso#16092).
  * restrict anonymous = 2 breaks RODC functionality;
    (bso#14638).
  * warning: assignment discards 'const' qualifier from pointer
    target type [-Wdiscarded-qualifiers]; (bso#16006).
  * Require NTLMv2 session security on Windows makes trusts to
    Samba unusable; (bso#16067).
  * winbindd stuck in init_dc_connection_rpc() returning
    NT_STATUS_TRUSTED_DOMAIN_FAILURE; (bso#16151).
  * domain\user not split when provided as username in
    smbc_set_credentials_with_fallback(); (bso#16149).

==== shared-mime-info ====
Version update (2.4 -> 2.5.1)
Subpackages: shared-mime-info-lang

- Update to version 2.5.1:
  + Updated translations.
- Changes from version 2.5:
  + Add type for Git repository bundles
  + Add application/vnd.ms-pki.seccat
  + Add binary magic to PKCS#7 types
  + Add common file extensions to PKCS and PKIX types
  + Add PEM identifiers from RFC 7468
  + Make application/x-x509-ca-cert a subclass of
    application/pkix-cert
  + DOS batch/cmd files: add magic, tests, and *.cmd extension
  + Add application/x-hwpx
  + Add Android App Bundles
  + Fix APNG detection using non-fixed acTL chunk location; add
    APNG test cases
  + Add Farbfeld image support and fix its mime
  + Add type for LRC lyrics
  + Add text/vnd.plantuml
  + Add text/n3
  + Add text/x-gradle-kts (and remove subclass for Gradle)
  + Add text/x-sed ("Sed script")
  + Add application/x-coff
  + Add application/vnd.ipld.car
  + Add application/x-brotli and fix brotli magic bytes
  + Add Playstation graphics (TIM) support
  + Add text/scriptlet
  + image/x-flic: fix and improve magic, add alias and generic icon
  + Add image/x-aseprite (LibreSprite/Aseprite image) and improve
    magic
  + Give CSV and TSV files the spreadsheet icon
  + application/texinfo: use IANA registered type
  + application/vnd.adobe.flash.movie: add ZWS magic
  + /matroska: use IANA registered non-x types
  + application/vnd.bzip3: use IANA registered type
  + Add PICO-8 (.p8/.p8.rom), TIC-80, Lowres NX, and CHIP-8
    source/carts
  + Add RWL (Leica RW2) and more RAW image mime types; fix MOS mime
  + Add RVZ & WIA disc image files for GameCube & Wii
  + AWK family: recognise GNU and New AWK; awk scripts now
    text/x-awk
  + Shell scripts now text/*, like file/libmagic
  + Add MP4 Base Media v[2-5] alongside v1
  + Add Slint language (text/slint) with magic and test
  + Assign video icon to application/vnd.ms-asf
  + Add ZX Spectrum & clone emulation formats
  + Add Commodore emulation file support
  + Add Nero Burning ROM NRG format
  + Add application/x-lx-executable
  + Add matches and test cases for .nds/.gba
  + application/vnd.nintendo.nitro.rom: use IANA registered type
  + Split audio/x-mod into correct formats; add audio/x-dsp and
    audio/x-ult test
  + Add text/x-nsis
  + Add support for Alpine Linux packages (.apk)
  + text/x-vala: add executable subclass and shebang magic support
  + application/x-ruby: add text/x-ruby alias
  + Add AMF 3D model mime-type
  + Add mimetypes for Simple File Format Family (SF3) files
  + Add mimetype for Microsoft Developer Studio files
  + Add HTTP Archive (HAR) json type
  + Add application/vnd.cyclonedx+xml and
    application/vnd.cyclonedx+json
  + Add text/spdx and application/spdx+json
  + Add OpenCL C and C++ for OpenCL types
  + image/vnd.radiance: add image/x-hdr alias; add Radiance HDR
    image format
  + Add application/x-pcapng and *.scap glob
  + Add mimetype for AVCI image
  + Detect OpenSSH public key and private key files
  + Add Proxy Auto-Configuration (PAC)
  + Add application/buildstream+yaml
  + Add text/x-dockerfile
  + Update mimetype for Typst source files
  + Add Portable HalfMap images
  + Update nushell mime type alias to text/x-nushell
  + Clean up matches for OLE/CFB based Word files
  + Add Apple Wallet passes bundle type
    application/vnd.apple.pkpasses
  + Add application/typescript; recognize *.cjs as text/javascript
  + Add comment and keyword magic to C-like source code
  + Move magic from text/x-csrc and text/x-objcsrc to
    text/x-objc++src
  + Add *.LRF glob to MPEG-4 videos
  + Add PFM, PXR and SCT image formats
  + Recognize *.sfs, *.sqfs, and *.squashfs as
    application/vnd.squashfs
  + Remove the relationship between AppImage and SquashFS
  + Remove redundant "MZ" magic from application/x-executable
  + Remove the office document icon from application/x-object
  + Recognize *.lib as application/x-archive
  + Rename back legacy OOoXML file formats
  + text/calendar: add *.ifb and *.icalendar globs and the calendar
    icon
  + Add text/x-nix
  + Add text/x-asm
  + Add image/x-kiss-cel
  + Prefer image/vnd.fpx over image/x-fpx and improve its detection
  + Remove text/htmlh
  + Add text/x-python2 and separate text/x-cython from
    ... changelog too long, skipping 48 lines ...
- Switch to source service for tarball, and add new sub-module.

==== tar ====
Subpackages: tar-lang tar-rmt

- Add tar-assume-dir-size-0.patch
  * Fixes tar incorrectly skipping members in certain archives containing
    dirs with non-zero sizes (bsc#1271272)

==== tigervnc ====
Subpackages: libXvnc1 tigervnc-selinux xorg-x11-Xvnc xorg-x11-Xvnc-module

- Add nettle4 compatibility [b434432] (bsc#1257934)
  * Add tigervnc-nettle4-compat-b434432b.patch

==== tumbler ====
Version update (4.20.1 -> 4.20.2)
Subpackages: libtumbler-1-0 tumbler-folder-thumbnailer tumbler-lang tumbler-webp-thumbnailer

- Update to version 4.20.2:
  * Update copyright year
  * Support new matroska mime types
  * Remove G_GNUC_CONST
  * Add missing chain up to parent class
  * Handle cases where there are no plugins gracefully
  * desktop-thumbnailer: Don't use GIOStream to get thumbnail pixbuf
- Remove obsolete "bcond_with git" stuff

==== update-bootloader ====
Version update (1.27 -> 1.28)

- merge gh#openSUSE/update-bootloader#197
- fix test suite
- adjust two tests
- updated test results
- fix command line parser (bsc#1271602)
- add test case
- update test result
- fix and reenable ksh tests: ksh uses alts now
- update ksh test results
- 1.28

==== vim ====
Subpackages: vim-data vim-data-common xxd

- Guard suse.vimrc against missing syntax without vim-data

==== wpa_supplicant ====

- Add mesh-Reject-AMPE-MIC-element-with-length-AES_BLOCK_S.patch
  https://w1.fi/security/2026-4/

==== wtmpdb ====
Version update (0.75.0+git20251130.0d8fe7a -> 0.76.0+git20260730.89c0861)
Subpackages: libwtmpdb0

- Update to version 0.76.0+git20260730.89c0861:
  * Release version 0.76.0
  * CI: get rid of obsolete actions
  * Use _cleanup_, adjust formating
  * rotate: keep open entries after last boot
  * wtmpdb: use different variable for (const) char *
  * Update mkdir_p to fix error code for last call
  * ignore absence of systemd
  * ignore absense of dbus

==== xfce4-panel ====
Version update (4.20.7 -> 4.20.8)
Subpackages: libxfce4panel-2_0-4 xfce4-panel-lang xfce4-panel-restore-defaults

- Update to version 4.20.8
  * wayland: Set layer-shell namespace
  * wayland: Restart panel when gtk-layer-shell is in unrecoverable state
  * Use XfwMonitor to match monitor by name
  * Refactor XfwScreen management a bit
  * clock: Deduce update interval from date and time formats
  * Fix autotools build
  * Set translation domain for plugins
  * Remove G_GNUC_CONST (complement)
  * Remove G_GNUC_CONST
  * libxfce4panel: Do not emit signals if construct() has not been called
  * I18n: Update po/LINGUAS list
  * Fix -Wdiscarded-qualifiers compiler warning for autotools builds
  * build: Replace wrong define guard with libxfce4ui version check
  * panel: Use same code to cleanup plugin config everywhere
  * icons: Fix non-zero page opacity
  * panel: Set itembar clip when allocating window
  * I18n: Update po/LINGUAS list
  * actions: Fix variable used out of scope
  * pager: Fix workspace switch for Compiz when scrolling over pager
  * build: Do not display full path in generated headers
  * Translation Updates

==== xfce4-power-manager ====
Version update (4.20.0 -> 4.20.1)
Subpackages: xfce4-power-manager-lang xfce4-power-manager-plugin

- Update to version 4.20.1:
  * Update copyright year
  * Remove undesired 'n' in logs
  * settings: Update sleep mode allowed values
  * settings: Remove sleep mode combobox tooltips
  * settings: Add shutdown as sleep mode when inactive
  * backlight-helper: Fix brightness control device selection logic
  * Translation Updates
- Remove obsolete 0001-relax-x11-version.patch

==== xfce4-settings ====
Version update (4.20.4 -> 4.20.5)
Subpackages: xfce4-settings-color xfce4-settings-lang

- Update to version 4.20.5:
  * Fix -Wdiscarded-qualifiers compiler warning
  * Remove G_GNUC_CONST
  * wayland: Set mode dimensions to 1x1 if width or height <= 0
  * Revert "dialogs/display-settings: Fix possible arithmetic exception"
  * dialogs/display-settings: Fix possible arithmetic exception
  * Add missing chain up to parent class
  * display-settings: Release main object early to avoid use-after-free
  * display-settings: Handle source memory management
  * I18n: Update po/LINGUAS list
  * wayland: display-settings: Fall back to output name when EDID is
    duplicated
  * xfsettingsd: Add some debug traces to gtk-settings helper
  * gtk-settings-module: handle g_value_transform() failures
  * Special-case gtk-xft-hintstyle
  * Include an allowlist of xfconf props to sync to GtkSettings
  * Fix incorrect TitleCase to kebab-case in gtk-settings-module.c
  * Translation Updates

==== yast2-auth-server ====
Version update (5.0.0 -> 5.0.1)

- jsc#PED-14507
  - Removed reference to update-desktop-files from spec file
  - 5.0.1

==== zoo ====

- Add zoo-64bit-header-check.patch, taken from Debian, to fix the
  archive header consistency check on 64-bit platforms:
  * zoo_start and zoo_minus are a 32-bit value and its two's
    complement, so they stopped cancelling out once long became
    64 bits wide and the check misfired on valid archives
  * extracting or packing an archive printed a spurious "Archive
    header failed consistency check" warning
  * deleting a member from an archive treated the same check as
    fatal and aborted, making zoo D unusable on 64-bit