Packages changed: emacs-vterm freetype2 fwupd (2.1.8 -> 2.1.9) krb5 llvm23 (23.1.3 -> 23.1.4) openSUSE-release (20261026 -> 20261027) patterns-base patterns-desktop patterns-media patterns-server pipewire (1.6.9 -> 1.6.10) publicsuffix (20260921 -> 20261022) python-Brotli (1.2.0 -> 1.2.1) python-certifi (2026.10.19 -> 2026.10.23) python-pip (26.2.1 -> 26.2.2) python-pycares (5.0.1 -> 5.2.1) python-pycparser (3.0 -> 3.12) python-pypdf (6.19.0 -> 6.21.2) sdbootutil (1+git20261007.53bc127 -> 1+git20261026.4e266f0) yast2-trans (84.87.20261004.92ae53d41b -> 84.87.20261025.1609796e9d) === Details === ==== emacs-vterm ==== - Avoid lexical binding warning on Emacs 31.1+ boo#1277717 ==== freetype2 ==== - fix description ==== fwupd ==== Version update (2.1.8 -> 2.1.9) Subpackages: fwupd-bash-completion fwupd-lang libfwupd3 typelib-1_0-Fwupd-2_0 - Update to version 2.1.9: * This release adds the following features: + Add an instance ID for each Redfish HPE device class and target pair + Include if the machine is a container or hypervisor in the report data + Require libusb 1.0.27 when building the daemon * This release fixes the following bugs: + Add After=local-fs.target to fwupd.service to fix a CoreOS mount issue + Create a dbx device with version 0 when the variable is missing + Delete the efi helper when using fwupdtool reboot-cleanup + Do not show GPIO devices in the fwupdmgr emulation-tag device list + Do not truncate 64-bit values when exporting firmware as XML + Fix a small memory leak when installing dell-kestrel firmware + Fix the DFU footer size check + Ignore parent battery reports when updating the Jabra GNP child + Process all releases to set the version on a 2023-only dbx + Remove command aliases from bash-completion + Use absolute paths when sending the filename hint * This release adds support for the following hardware: Pixart PID 38CA - Update version dependencies according to meson.build. ==== krb5 ==== Subpackages: krb5-32bit krb5-client - Prevent denial of Service via crafted forwarded credentials * CVE-2026-107778, bsc#1284816 - Prevent denial of Service via malformed PAC in S4U2Proxy * CVE-2026-107778, bsc#1284817 - Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch ==== llvm23 ==== Version update (23.1.3 -> 23.1.4) Subpackages: clang-tools clang23 libLLVM23 libclang-cpp23 libclang13 libclang_rt23 llvm23-gold - Update to version 23.1.4. * This release contains bug-fixes for the LLVM 23.1.0 release. This release is API and ABI compatible with 23.1.0. - Build all targets on ppc64le. - Build SPIRV target also on ARMv6/7 and s390x. - Cleanup parts specific to ppc and ppc64, because we don't build them anymore. - Increase memory for compile jobs to avoid OOM. - Build compiler-rt builtins for wasm32-wasip1 as part of the runtimes build (LLVM_BUILTIN_TARGETS) and ship them in clang23, so that clang can link wasm32-wasip1 binaries with a WASI sysroot. ==== openSUSE-release ==== Version update (20261026 -> 20261027) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== patterns-base ==== Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-x11 patterns-base-x11_enhanced - Modernise the core patterns: * base: drop the Suggests on openssl-1_1: the package was dropped from Factory, and the comment above it still claimed 1.1 was the default openssl, two major versions out of date * console: drop the Suggests on cnetworkmanager: the Python-2-era NetworkManager CLI no longer exists in Factory * console: suggest plocate instead of mlocate: mlocate was dropped from Factory and plocate is its designated successor (it Provides and Obsoletes mlocate); no pattern named plocate before * enhanced_base: drop the Suggests on kerneloops: the package is gone from Factory and the crash submission service it reported to is defunct * x11_enhanced: drop the Suggests on xorg-x11-driver-video-radeonhd and xorg-x11-driver-video-unichrome: both drivers were removed from Factory years ago * enhanced_base: recommend iw and wireless-regdb instead of wireless-tools: wireless-tools is the stalled 30.pre9 pre-release driving the deprecated Wireless Extensions API and iw is its nl80211 successor; wireless-regdb was not pulled in by any installing pattern before, so default installs ran on the kernel's built-in world regulatory domain * enhanced_base: use the current package names update-bootloader and kmod instead of the compat aliases perl-Bootloader and kmod-compat: the alias packages no longer exist and only resolve via the Provides of their successors, so the lines would silently rot if those compat Provides were ever dropped * enhanced_base: drop the Recommends on klogd on openSUSE: journald captures the kernel messages, and the pattern already goes for the journal on Tumbleweed (boo#1143144) * enhanced_base: drop the Recommends on deltarpm: Tumbleweed repositories publish no deltainfo, so the repository infrastructure deltarpm serves no longer exists there * enhanced_base: drop the Recommends on net-snmp: a full SNMP stack does not belong in every default install * enhanced_base: drop the Recommends on mpt-status: it is the status tool for the LSI 1030, a 2002-era SCSI RAID chip * enhanced_base: drop the Recommends on gpart: the 1999-era lost-partition guessing tool * enhanced_base: drop the Recommends on zisofs-tools: tools for the zisofs compressed-ISO extension * enhanced_base: drop the Recommends on procmail: the sendmail-era local delivery agent, upstream dormant since 2001 * pattern-definition-32bit.txt: mirror the enhanced_base changes for the enhanced_base-32bit pattern * enhanced_base: correct the comment above the openSUSE-only block: it claimed the block lists packages missing from SLE-15, but the block is guarded by is_opensuse, so SLE of any version does not get these packages from this pattern ==== patterns-desktop ==== Subpackages: patterns-desktop-books patterns-desktop-imaging patterns-desktop-mobile patterns-desktop-multimedia - books: drop the Recommends on opensuse-manuals_en and opensuse-startup_en-pdf and the Suggests on opensuse-manuals_de, opensuse-manuals_hu, opensuse-manuals_ru, opensuse-startup_de-pdf and opensuse-startup_ru-pdf. The opensuse-manuals source no longer builds any binary into the Tumbleweed repo, so the lines were silently inert. - books: drop the Suggests on gcc46-info (the GCC 4.6 info pages are long gone; gcc-info remains), kiwi-doc, nfs-doc, php-doc, python-doc, python-doc-pdf, python3-doc-pdf, texlive-doc and yast2-devel-doc. None of these names resolves to a binary, a Provides or an Obsoletes in the current repository; the kiwi documentation moved online and the texlive-doc meta package was removed (per-collection *-doc packages remain). - books: rename apache2-doc to apache2-manual and selinux-doc to selinux-policy-doc. The documentation ships under the new names; the old ones survive only as compat Provides/Obsoletes. - imaging: drop the Recommends on gimp-help and the Suggests on gimp-ufraw and ufraw. GIMP 3 no longer ships a help subpackage or the ufraw plugin, and ufraw itself is unmaintained upstream with its pattern role gone with the plugin. - mobile: drop the Suggests on irda (IrDA support was removed from the distribution) and rename smbios-utils-python to python3-smbios-utils, the current package name. - multimedia: drop the Suggests on vdr and xawtv; both packages were dropped from the distribution. - technical_writing: drop the Recommends on docbook-xml-website and susedoc (both dropped from the distribution) and the Suggests on texlive-doc; rename mxml to libmxml1 and saxon to saxon10, the current package names; drop sablot, an XSLT processor dormant upstream for two decades whose role is covered by saxon10 and libxslt; remove the duplicated texlive-omega and texlive-xetex Suggests. ==== patterns-media ==== Subpackages: patterns-media-rest_cd_core patterns-media-rest_dvd - Drop the dhcp server pattern from the DVD. ==== patterns-server ==== Subpackages: patterns-server-directory_server patterns-server-file_server patterns-server-kvm_server patterns-server-lamp_server patterns-server-mail_server patterns-server-printing - dhcp_dns_server: build the DHCP half on Kea on openSUSE too, as the SLE branch of this pattern already does; ISC dhcp is end-of-life since December 2022 and 4.4.3.P1 was its final release. Drop bind-chrootenv, which the bind package no longer ships. - gateway_server: drop quagga, ipsec-tools and rarpd, none of which exists in openSUSE Factory anymore; recommend frr, the FRRouting successor of quagga that the SLE branch of this pattern already names, on openSUSE as well. Also drop calamaris and wondershaper, and arptables: the patterns' firewall is firewalld, recommended by patterns-base, and its backend is nftables, so the legacy ARP packet filtering tool is superseded on both counts. - mail_server: drop cyrus-imapd, whose source package was removed from Factory, and inn, the NNTP news server left over from the mail-and-news era. Recommend postfix and dovecot, so the pattern has a mail centre again: postfix is the distribution's default MTA (boo#1136078) and dovecot is the remaining full IMAP server in Factory. - lamp_server: drop apache2-mod_python (mod_python is Python 2 era and the package was removed from Factory) and apache2-example-pages (no longer built); recommend libapr1-0/libapr-util1-0 and apache2-manual under their current names instead of libapr1/libapr-util1 and apache2-doc, which no longer exist as packages. - directory_server: drop yast2-ldap-server, which no longer exists in Factory. - printing: drop cups-filters-foomatic-rip and cups-filters-ghostscript; both were folded into cups-filters, which this pattern already recommends. Recommend hplip-driver-hpcups instead of the retired hplip-hpijs name. - Drop all remaining yast2-* recommendations, as patterns do not carry YaST modules: yast2-ftp-server, yast2-nfs-server, yast2-samba-server and yast2-tftp-server in file_server; yast2-control-center, yast2-ncurses, yast2-ncurses-pkg and yast2-vm in kvm_tools and xen_tools; and the yast2-*-32bit mirrors in pattern-definition-32bit.txt. - file_server: drop the nfsidmap recommendation entirely rather than renaming it to libnfsidmap1: the idmapping library is pulled in by the NFS client packages themselves and has no place named in a pattern. - kvm_tools, xen_tools: recommend xauth under its current name instead of xorg-x11-xauth. - Mirror the changed entries in pattern-definition-32bit.txt, including the inn-32bit removal in mail_server. - gateway_server: recommend wireshark unconditionally. The SLE branch of this pattern also requires it, while the openSUSE branch named it nowhere and nothing in the file explains the difference; the recommended strength matches the pattern's other analysis tooling. ==== pipewire ==== Version update (1.6.9 -> 1.6.10) Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-jack pipewire-lang pipewire-libjack-0_3 pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools - Update to version 1.6.10: * This is a bugfix release that is API and ABI compatible with the previous 1.6.x releases. * Highlights - Fix some potential crashes in the JACK layer. - Fix a regression in the PSD rear delay upmixing code. - Avoid pops and clicks when playing unsigned formats. - More small fixes and backports. * PipeWire - Initialize the error location in all cases when parsing properties. - Don't try to unlink ports without a node. (#5540 (closed)) * Modules - Fix a potential crash in the X11 module because error handlers can be called twice. * SPA - Fix a regression in the PSD rear delay upmixing code. A delay of 0 was not working and would result in a big delay instead. (#5490 (closed)) - Use per audio format clear function to avoid pops when draining on unsigned formats. (#5531 (closed)) * Pulse-server - Avoid queueing an unlimited amount of REQUEST commands for paused clients in some cases. (#5541 (closed)) * Bluetooth - Remove some old deprecated functions. - cancel RegisterApplication calls when adapter goes away. (#5096 (closed)) * JACK - Add locking around the port array and mixer list. (#5499 (closed)) - Avoid possible infinite loop. - Free port and buffers before disconnect. (#5455) * GStreamer - Set the plane strides and offsets correctly. - Avoid setting invalid max resolution values. * ALSA Plugin - Handle the XRUN case better. (#5524 (closed)) * Tools - Support more output formats by letting sndfile choose the byte order. ==== publicsuffix ==== Version update (20260921 -> 20261022) - Update to version 20261022: * Add *.ztna-dingtalk.com to the PRIVATE section (#3196) * Remove `oya.to` (domain expired & drop-caught) (#3432) * Remove GCom Internet entries: aliases121.com (#3435) * Remove gitapp.si form the list (#3421) * util: gTLD data autopull updates (#3414, #3338, #3331) * AWS Submissions to the Public Suffix List - Q3 2026 (#3044) * Remove knightpoint.systems and perspecta.cloud (#3070) * Add NAVER Cloud (Ncloud Storage) domains to the PRIVATE section (#3340) * Replace explicit replit.dev entries with wildcard rules (#3251) * AWS Submissions to the Public Suffix List Q2 2026 (#2771) * Add retool.app (Retool) to PRIVATE section (#3283) * Add glideos.app (Glide) (#3200) * Add site prefixes to Combell domains (#3282) * Add iqhs.pl (IQHost) to PRIVATE section (#3264) ==== python-Brotli ==== Version update (1.2.0 -> 1.2.1) - update to 1.2.1 (bsc#1287779, CVE-2026-111497): * Brotli decoder out-of-bounds write permits remote code execution ==== python-certifi ==== Version update (2026.10.19 -> 2026.10.23) - update to 2026.10.23 (bsc#1286261, bsc#1287723): * drop eMudhra Inc root CA ==== python-pip ==== Version update (26.2.1 -> 26.2.2) - update to 26.2.2: * Upgrade certifi to 2026.10.19 ==== python-pycares ==== Version update (5.0.1 -> 5.2.1) - update to 5.2.1: * Bump c-ares to version 1.34.9 - update to 5.1.0: * Update Python 3.14 version * cleanup code extract_record_data with new _extract* system * Fix decoding of CAA records * enable uploading pycares wheels to the release page * reinstate a couple of skipped tests * Fix handle leak in c-ares submission methods * Defer ares_destroy to __del__ to fix close()/submit use- after-free * Fix handle leaks if callback raises exception * Make all Channel methods thread-safe * Drop support for Python 3.9 * Fix Channel.timeout() returning 0.0 when no queries are pending * Fix double-free of dnsrec in Channel.search() * Fix local IPv6 and device binding * build(deps): bump pypa/cibuildwheel from 3.4.1 to 4.2.0 ==== python-pycparser ==== Version update (3.0 -> 3.12) - update to 3.12: * Emit one type definition for declarators that share it * raise ParseError for _Atomic applied to array or function type * Fix code generation for the _Pragma operator * Parse GNU statement expressions as primary expressions * Fix shared type declarations in switch cases * raise ParseError for typedef in a parameter declaration * Scope for loop init declarations to the loop * Enhanced C11 support * Drop an unneeded direct build depndency on wheel * fix: handle integer suffix in #line directive without crashing * Update default branch to main * fix: raise ParseError instead of AssertionError on unmatched '}' * Add support for Python 3.15 * Fix empty compound literal (type){} raising ParseError * Fix compound literal statements in C generator * Keep the contents of adjacent u8 string literals ==== python-pypdf ==== Version update (6.19.0 -> 6.21.2) - Update to 6.21.2 * SEC: Avoid repeated full file loads * SEC: Limit size of standard xref table * Decode UniGB-UTF16 CMaps as UTF-16BE 6.21.1 (CVE-2026-113786, bsc#1286632) * SEC: Only open /DCTDecode image data with the Pillow JPEG plugin 6.21.0 (CVE-2026-113789, bsc#1286633, CVE-2026-113790, bsc#1286634, CVE-2026-113791, bsc#1286635) * SEC: Improve performance and limit field work * SEC: Limit stream parsing work * Allow custom fit modes for named destinations * Treat NUL as whitespace in ArrayObject 6.20.1 (CVE-2026-113792, bsc#1286636, CVE-2026-113793, bsc#1286637) * SEC: Prevent cyclic tree handling 6.20.0 (CVE-2026-113795, bsc#1286639, CVE-2026-113794, bsc#1286638) * SEC: Limit work per stream (filter count, accumulated decoding work) * Add support for BrotliDecode filter * Performance improvements * Declare official support for Python 3.15 ==== sdbootutil ==== Version update (1+git20261007.53bc127 -> 1+git20261026.4e266f0) Subpackages: sdbootutil-bash-completion sdbootutil-dracut-measure-pcr sdbootutil-snapper - Update to version 1+git20261026.4e266f0: * Add --version parameter * Do not propagate umount to the host * Do not add duplicate cmdline.d entries ==== yast2-trans ==== Version update (84.87.20261004.92ae53d41b -> 84.87.20261025.1609796e9d) Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sl yast2-trans-sr yast2-trans-sv yast2-trans-ta yast2-trans-th yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu - Update to version 84.87.20261025.1609796e9d: * Translated using Weblate (Greek) * Translated using Weblate (Indonesian) * Translated using Weblate (Indonesian) * Translated using Weblate (German) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (Swedish) * Translated using Weblate (German) * Translated using Weblate (German)