September 2024 - openSUSE Factory - openSUSE Mailing Lists

New Tumbleweed snapshot 20240919 released!
by Dominique Leuenberger 20 Sep '24

20 Sep '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: apr (1.7.4 -> 1.7.5) libeconf (0.7.2 -> 0.7.3) patterns-media shim-leap tiff (4.6.0 -> 4.7.0) virt-manager yast2-kdump (5.0.1 -> 5.0.2) === Details === ==== apr ==== Version update (1.7.4 -> 1.7.5) - version update to 1.7.5 [bsc#1229783] CVE-2023-49582 * ) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()" and "classic mmap" shared memory implementations. [Joe Orton, Ruediger Pluem] * ) Fix missing ';' for XML/HTML hex entities from apr_escape_entity(). [Yann Ylavic] * ) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner. [Yann Ylavic] * ) Improve platform detection by updating config.guess and config.sub. [Rainer Jung] * ) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov] * ) CMake: Enable support for MSVC runtime library selection by abstraction. [Ivan Zhakov] * ) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1) to apr:: namespace. [Ivan Zhakov] - modified patches % apr-visibility.patch (refreshed) % reproducible.patch (refreshed) ==== libeconf ==== Version update (0.7.2 -> 0.7.3) Subpackages: libeconf0 libeconf0-32bit - Update to version 0.7.3: * Groups handled in an own list (#218) * Add econftool as dependency of its tests * Simplify snprintf call * Remove unused functions and reduce variable visibility (#213) * Fix typos (#212) ==== patterns-media ==== Subpackages: patterns-media-rest_cd_core patterns-media-rest_dvd - pam-extra needs to be present for upgraders, as pam_limits.so moved from pam to pam-extra. Ensure it's added to the DVD. ==== shim-leap ==== - RelEng emergency fix: fux source number to install shim-install. - Update shim version for aarch64 to shim-15.8-lp155.8.8.aarch64.rpm coming from openSUSE secure-boot 15.5 + To avoid failure check by robot, SOURCEs in spec file are redefined. + Version: 15.8, "Jan 23 2024" + Include the bug fixes for bsc#1215099,bsc#1215098,bsc#1215100,bsc#1215101, bsc#1215102, and bsc#1215103. ==== tiff ==== Version update (4.6.0 -> 4.7.0) - Update to 4.7.0: * This version restores in the default build the availability of the tools that had been dropped in v4.6.0 See https://libtiff.gitlab.io/libtiff/rfcs/rfc2_restoring_needed_tools.html#rfc… * Software configuration changes: + autoconf build: configure.ac: avoid -Werror passed to CFLAGS to interfere with feature detection + autoconf build: fix error when running make clean (fixes issue #630) + autoconf build: back off the minimum required automake version to 1.11 + autoconf.ac: fix detection of windows.h for mingw (fixes issue #605) + libtiff-4.pc: Fix Requires.private missing Lerc. It provides a .pc file starting from version 4 (in autoconf builds, we assume that liblerc is at least version 4) + CMake: Fix TIFF_INCLUDE_DIRS + CMake: MinGW compilers don't need a .def file for shared library + CMake: move libdeflate and Lerc to Requires.private + CMake: enable resource compilation on all Windows. * Library changes: + Add TIFFOpenOptionsSetMaxCumulatedMemAlloc(). This function complements TIFFOpenOptionsSetMaxSingleMemAlloc() to define the maximum cumulated memory allocations in byte, for a given TIFF handle, that libtiff internal memory allocation functions are allowed. + TIFFWriteDirectory(): Avoid overwriting following data if an IFD is enlarged. + TIFFXYZToRGB: avoid integer overflow (fixes issue #644) + uv_decode() and uv_encode(): avoid potential out-of-bounds array index (fixes issue #645) + Fix cases where tif_curdir is set incorrectly. Fix cases where the current directory number (tif_curdir) is set inconsistently or incorrectly, depending on the previous history. + TIFFRead[Scanline/EncodedStrip/EncodeTile]: 0-initialize output buffer if setupdecode fails ; most codecs: zero-initialize (not-yet-written parts of) output buffer if failure (fixes issue #375) + OJPEG: reset subsampling_convert_state=0 in OJPEGPreDecode (fixes issue #183) + ThunderRLE: fix failure when decoding last run. Bug seen with GhostPDL + LERC codec: deal with issues with multi-band PlanarConfig=Contig and NaN values + tif_fax3.c: error out after a number of times end-of-file has been reached (fixes issue #583) + LZW: avoid warning about misaligned address with UBSAN (fixes issue #616) + TIFFReadRGBAStrip/TIFFReadRGBATile: add more validation of col/row (fixes issue #622, CVE-2023-52356) + tif_dirread.c: only issue TIFFGetFileSize() for large enough RAM requests + Avoid FPEs (division by zero) in tif_getimage.c. + Avoiding FPE (division by zero) for TIFFhowmany_32() and TIFFhowmany_64() macros by checking for denominator not zero before macros are executed. (fixes issue #628) + Add non-zero check before division in TIFFComputeStrip() + Fix wrong return of TIFFIsBigTIFF() in case byte-swapping is active + Setting the TIFFFieldInfo field set_field_type should consider field_writecount not field_readcount + Avoid memory leaks when using TIFFCreateDirectory() by releasing the allocated memory in the tif-structure. + For non-terminated ASCII arrays, the buffer is first enlarged before a NULL is set at the end to avoid deleting the last character. (fixes issue #579) + Check return value of _TIFFCreateAnonField(). (fixes issue #624, CVE-2024-7006) + Prevent some out-of-memory attacks (https://gitlab.com/libtiff/libtiff/-/issues/614#note_1602683857) + Ensure absolute seeking is forced independent of TIFFReadDirectory success. (fixes issue #618) + tif_dirinfo.c: re-enable TIFFTAG_EP_CFAREPEATPATTERNDIM and TIFFTAG_EP_CFAPATTERN tags (fixes issue #608) + Fix warnings with GCC 14 + tif_dir.c: Log source file, line number, and input tif for directory count error (fixes issue #627) + Last usage of get_field_type of TIFFField structure at TIFFWriteDirectorySec() changed to using set_field_type. + tif_jpeg.c/tif_ojpeg.c: remove likely ifdef tricks related to old compilers or unusual setups + Remove _TIFFUInt64ToFloat() and _TIFFUInt64ToDouble() + Remove support for _MSC_VER < 1500. + Use #ifdef _WIN32 to test for Windows, and tiffio.h: remove definition of __WIN32__ * Documentation: + Amend manpages for changes in current directory index behaviour + Note on using TIFFFlush() before TIFFClose() to check that the data has been successfully written to the file. (fixes issue #506) + Update TIFF documentation about TIFFOpenOptions.rst and TIFFOpenOptionsSetMaxSingleMemAlloc() usage and some other small fixes (relates to CVE-2024-7006) * Re-added tools: + fax2ps + fax2tiff + pal2rgb + ppm2tiff + raw2tiff + rgb2ycbcr (not installed) + thumbnail (not installed) + tiff2bw + tiff2rgba + tiffcmp + tiffcrop + tiffdither + tiffgt + tiffmedian + tiff2ps + tiff2pdf * New/improved functionality: + tiff2rgba: Add background gradient option for alpha compositing + tiffcp: -i flag restored * Bug fixes for tools: + tiffcrop: address Coverity scan issues 1605444, 1605445, and 16054 + tiffcrop: Apply "Fix heap-buffer-overflow in function extractImageSection" + tiffcrop: fix buffer overflows, use after free (fixes issue #542, issue #550, issue #552) + tiff2pdf: address Coverity scan issues + tiff2pdf: fix inconsistent PLANARCONFIG value for the input and output TIFF + tiff2pdf: fix issue with JPEG restart-interval marker when converting from JPEG-compressed files (fixes issue #539) + tiff2pdf: red and blue were being swapped for RGBA decoding (fixes issue #253) + tiff2pdf: fixes issue #596 + thumbnail: address Coverity scan issues + tiffcp: Add check for limitMalloc return to fix Coverity 1603334 + tiffcp: preserve TIFFTAG_REFERENCEBLACKWHITE when doing YCbCr JPEG -> YCbCr JPEG + tiffcp: replace PHOTOMETRIC_YCBCR with PHOTOMETRIC_RGB when outputing to compression != JPEG (refs issue #571) + tiffcp: do not copy tags YCBCRCOEFFICIENTS, YCBCRSUBSAMPLING, YCBCRPOSITIONING, REFERENCEBLACKWHITE. Only set YCBCRSUBSAMPLING when generating YCbCr JPEG + tiffcp: Check also codec of input image, not only from output image (fixes issue #606) + Add some basic sanity checks for tiffcp and tiffcrop RGB->YCbCr JPEG conversions. + fax2ps and fax2tiff: memory leak fixes (fixes issue #476) + tiffmedian: memory leak fixes (fixes issue #599) + fax2tiff: fix EOFB interpretation (fixes issue #191) + fax2tiff: fix issue with unreasonable width input (fixes issue #249) + tiffcp and tiffcrop: fixes issue #228 ... changelog too long, skipping 10 lines ... - Tools are not built for now due to test failure: `FAIL: tiffcp-32bpp-None-jpeg.sh` ==== virt-manager ==== Subpackages: virt-install virt-manager-common - Fix SUSE SL Micro detection virtinst-add-slem60-detection-support.patch - Solve bsc#1228384 --dry-run creating pools in a different way virtinst-dont-create-storage-pool-for-dryrun.patch - Upstream bug fixes (bsc#1027942) (jsc#PED-8910) 094-uitests-handle-newer-libvirt-test-driver-UpdateDevice-support.patch 095-uitests-force-internal-snapshots-in-test_snapshot.py.patch ==== yast2-kdump ==== Version update (5.0.1 -> 5.0.2) - Don't write empty fadump="" kernel parameter (bsc#1230359) - 5.0.2

1 0

What is the proper way to get package maintainers attention
by mhurron 20 Sep '24

20 Sep '24

I have had a request to update a package open for 25 days and the automated reminders and posting to the request has not elicited any feedback from the package maintainers. I would prefer not to be pestering people if there is a better way to contact them, so what is the proper way to get attention on a package request? https://build.opensuse.org/request/show/1195957

2 1

New Slowroll update 20240920T1519 released!
by bernhardout＠lsmod.de 20 Sep '24

20 Sep '24

Please note that this mail was generated by a script. A collection of maintenance updates was released for Slowroll. Released 149 packages: * Mesa * accessibility-inspector * akonadi * akonadi-calendar * akonadi-calendar-tools * akonadi-contacts * akonadi-import-wizard * akonadi-mime * akonadi-notes * akonadi-search * akonadiconsole * akregator * alligator * analitza * angelfish * apr * arianna * ark * audex * audiotube * baloo-widgets * blinken * bomber * bovo * calendarsupport * calindori * colord-kde * dolphin * dolphin-plugins * dracut * dragonplayer * elisa * erofs-utils * eventviews * falkon * ffmpegthumbs * filelight * francis * ghostwriter * granatier * grantlee-editor * grantleetheme * gwenview * incidenceeditor * itinerary * juk * k3b * kaccounts-integration * kaccounts-providers * kaddressbook * kajongg * kalarm * kalgebra * kalk * kalm * kalzium * kamera * kanagram * kapman * kapptemplate * kasts * kate * katomic * kbackup * kblackbox * kblocks * kbounce * kbreakout * kbruch * kcachegrind * kcalc * kcalutils * kcharselect * kclock * kcolorchooser * kcron * kde-dev-utils * kde-inotify-survey * kdebugsettings * kdeedu-data * kdegraphics-mobipocket * kdegraphics-thumbnailers * kdenetwork-filesharing * kdenlive * kdepim-addons * kdepim-runtime * kdesdk-kioslaves * kdesdk-scripts * kdesdk-thumbnailers * kdevelop * kdevelop-plugin-php * kdevelop-plugin-python3 * kdf * kdialog * kdiamond * kdnssd * keditbookmarks * keysmith * kfind * kfourinline * kgeography * kget * kgoldrunner * kgpg * kgraphviewer * khangman * khealthcertificate * khelpcenter * kidentitymanagement * kigo * killbots * kimagemapeditor * kimap * kio-extras * kio-gdrive * kio_audiocd * kirigami-gallery * kiriki * kiten * kitinerary * kjournald * kjumpingcube * kldap * kleopatra * klettres * klickety * klines * kmag * kmahjongg * kmail * kmail-account-wizard * kmailtransport * kmbox * kmime * kmines * kmousetool * kmouth * kmplot * knavalbattle * knetwalk * knights * koko * kolf * kollision * kolourpaint * kompare * kongress * konqueror * konquest

1 0

Cannot find include file for the unit 'qt6'
by Larry Len Rainey 20 Sep '24

20 Sep '24

1 0

Tumbleweed - Review of the week 2024/38
by Dominique Leuenberger 20 Sep '24

20 Sep '24

Dear Tumbleweed users and hackers, The main task completed this week was bisecting/testing Mesa 24.1.7 together with Stefan Dirsch. Getting things tested was a bit nasty, but at least we managed to work through it and update Tumbleweed to Mesa 24.1.7 as part of snapshot 0915. Of course, that’s only one update picked out and it’s not the biggest one, just the one that consumed the most attention. In total, we have released six snapshots during this week (0912, 0913, 0915, 0916, 0917, and 0918). The most relevant changes were: * cURL 8.10.0 * KDE Gear 24.08.1 * Bluez 5.78 * Boost 1.86.0 * LibreOffice 24.8.1.2 * Qemu 9.1.0 * KDE Frameworks 6.6.0 * Mesa 24.1.7 * strace 6.11, linux-glibc-devel 6.11 * Python Numpy 2.1.1 * Python Sphinx 8.0.2 * GTK 4.16.1 * GNOME Shell & mutter 46.5 Based on the currently staged submit requests, we know that these items are being worked on at the moment: * Linux kernel 6.10.11 (no 6.11 just yet) * timezone 2024b: postgresql16 currently fails the test suite * PostgreSQL 17 as new default * Audit 4.0 **grub2 change: Introduces a new package, grub2-x86_64-efi-bls; some scenarios do not install the proper branding package * Python Sphinx 8.0.2 * Change of the default LSM (opted in at installation) to SELinux. AppArmor is still an option, just not the default. This change only impacts new installations * perl-Bootloader will be renamed to update-bootloader: it’s been a while since there was no Perl code. Some openQA tests need to be adjusted for this (https://progress.opensuse.org/issues/165686) * Mesa 24.2.x: identified an issue with ‘wrong’ colors (https://gitlab.freedesktop.org/mesa/mesa/-/issues/11840) Cheers, Dominique

1 0

How do I fix this OBS problem - for VirtualBox
by Larry Len Rainey 20 Sep '24

20 Sep '24

2 3

New Tumbleweed snapshot 20240918 released!
by Dominique Leuenberger 20 Sep '24

20 Sep '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: emacs ffmpeg-4 gnome-online-accounts (3.50.4 -> 3.50.5) gnome-shell (46.4 -> 46.5) gnome-software (46.4 -> 46.5) groff groff-full gvfs (1.54.2 -> 1.54.3) kexec-tools kwallet libadwaita (1.5.3 -> 1.5.4) librsvg (2.58.3 -> 2.58.4) mc (4.8.31 -> 4.8.32) mutter (46.4 -> 46.5) openSUSE-release (20240917 -> 20240918) ovmf pam pam-config (2.11+git.20240906 -> 2.11+git.20240911) pam-full-src polari (46.0 -> 46.0+18) poppler poppler-qt6 python-cryptography python311 (3.11.9 -> 3.11.10) python311-core (3.11.9 -> 3.11.10) wayland (1.23.0 -> 1.23.1) === Details === ==== emacs ==== Subpackages: emacs-el emacs-eln emacs-info emacs-nox etags - Add patch emacs-gcc14.patch to make flymake-tests work even with gcc14 (backport from upstream master) ==== ffmpeg-4 ==== Subpackages: libavcodec58_134 libavformat58_76 libavutil56_70 libpostproc55_9 libswresample3_9 libswscale5_9 - Add ffmpeg-4-CVE-2024-7055.patch: Backporting 3faadbe2 from upstream, Use 64bit for input size check, Fixes: out of array read, Fixes: poc3. (CVE-2024-7055, bsc#1229026) ==== gnome-online-accounts ==== Version update (3.50.4 -> 3.50.5) Subpackages: gnome-online-accounts-lang libgoa-1_0-0 libgoa-backend-1_0-2 - Update to version 3.50.5: + goaimapsmtpprovider: quick fix for yahoo auto-detect + Updated translations. ==== gnome-shell ==== Version update (46.4 -> 46.5) Subpackages: gnome-extensions gnome-shell-calendar gnome-shell-lang - Update to version 46.5: + Fix smartcard logins + Fix glitch when quick settings menu animation is interrupted + Fix new wifi connections for restricted users + Do not disable required animations + Fix showing pending PAM messages on login screen + Plugged leak + Misc. bug fixes and cleanups + Updated translations. - Drop gnome-shell-private-connection.patch: Should not be needed anymore after changes upstream. ==== gnome-software ==== Version update (46.4 -> 46.5) Subpackages: gnome-software-lang gnome-software-plugin-packagekit - Update to version 46.5: + Reduce power usage when the main window is closed. + Updated translations. ==== groff ==== - Add groff-restore-hyphen-minus.patch (bsc#1226153) ==== groff-full ==== Subpackages: gxditview - Add groff-restore-hyphen-minus.patch (bsc#1226153) ==== gvfs ==== Version update (1.54.2 -> 1.54.3) Subpackages: gvfs-backend-afc gvfs-backend-goa gvfs-backend-samba gvfs-backends gvfs-fuse gvfs-lang - Update to version 1.54.3: + onedrive: - Set name of drive root - Handle multiple drives with same IDs - Guess mime type locally if not set by the server + Updated translations. ==== kexec-tools ==== - To create rckexec-reload, the service binary is required at build time. This binary is provided by aaa_base. Make sure this package is available during build. ==== kwallet ==== Subpackages: kwallet-tools kwallet-tools-lang kwalletd5 kwalletd5-lang libKF5Wallet5 libkwalletbackend5-5 - Use the %lang_package macro for kwallet-tools-lang (boo#1230570) ==== libadwaita ==== Version update (1.5.3 -> 1.5.4) Subpackages: libadwaita-1-0 libadwaita-lang typelib-1_0-Adw-1 - Update to version 1.5.4: + AdwAboutDialog/Window: Support non-deprecated GPL-2/3.0-only SPDX IDs + AdwHeaderBar: Fix back button menu picking up phantom pages in some situations + AdwTabBar/Overview: Fix 2 crashes with drag-n-drop + Stylesheet: Fix scroll undershoot in dropdowns and emoji picker + Updated translations. ==== librsvg ==== Version update (2.58.3 -> 2.58.4) Subpackages: gdk-pixbuf-loader-rsvg librsvg-2-2 rsvg-thumbnailer typelib-1_0-Rsvg-2_0 - Update to version 2.58.4: + Fix regression when using an SVG inside a feImage element. ==== mc ==== Version update (4.8.31 -> 4.8.32) Subpackages: mc-lang - Update to 4.8.32: - Core - Tell the current directory to the terminal using OSC 7 sequence (so it can open new tabs there) (#3088) - Preserve ext2fs attributes on copy/move operations (#4532) - Change name of temporary directory: make it unique for each run (#4535) - Hide password in file operation progress dialog (#4541) - Support reget in file move operation (#4563) - Implement nanosecond precision timestamps on non-Linux (macOS, BSD, AIX, Solaris) (#4563) - Remove remaining mmap code to simplify maintenance (#3960) - VFS - extfs: support unrar-7 (#4518) - Editor - Improve syntax highlighting: - C and C++ (MidnightCommander?/mc#195, #4556) - Viewer - Diff viewer - Add man page mcdiff.1 (#4224) - Misc - Code cleanup (#4524) - New skins - xoria256-thin, xoria256root-thin (#4530) - modarcon16-defbg-thin, modarcon16-thin, modarcon16root-defbg-thin, modarcon16root-thin (#4530) - modarin256-defbg-thin, modarin256-thin, modarin256root-defbg-thin, modarin256root-thin (#4530) - julia256root (#4536) - mc.ext.ini: clarify escaping of spaces and parenthesis (#4502) - Fixes - External editor does not work with arguments in $EDITOR (#4533) - fish shell: strings " cd (printf '%b' ... " in history (#4521) - Redundant back slashes for autocomplete (#4292) - subshell: call execl with argv[0] that is not an actual path to Bash (#4549) - mcedit: php.syntax: comment highlight from start of light only (#4519) - mcedit: wrong replacement using regular expressions with begin or end of line (#4525, #4526) - mcedit: losing column position when navigating up/down (MidnightCommander?/mc#194) - mcedit: macro deletes text (#4540) - mcedit: macros are applied to the pasted text (#4562) - extfs: iso9660: xorriso is slow to open an ISO image (#3570, #4567) - extfs: u7z: wrong add of nested directories to archive (#4559) - extfs: segfault on enter to deleted archive (#4560) - tar: segfault on copy files from archive (#4561) - man: typo (#4550) - Remove mc-extfs-iso9660-xorriso.patch patch which doesn't apply anymore. - Other patches reapplied. ==== mutter ==== Version update (46.4 -> 46.5) Subpackages: mutter-lang - Update to version 45.5: + Fix drag and drop between X11 and wayland clients + Fix drag and drop from grabbing popups + Fix EGLDevice support + Fix frozen cursor on some hybrid machines + Fix touch window dragging with pointer lock enabled + Fix propagating tablet device removals to clients + Fix tablet input in maximized windows + Reduce damage on window movement + Fix frozen cursor after suspend + Fix using modifiers on multi-GPU setups + Fixed crashes + Misc. bug fixes and cleanups + Updated translations. ==== openSUSE-release ==== Version update (20240917 -> 20240918) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== ovmf ==== Subpackages: qemu-ovmf-x86_64 - Add ovmf-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in (bsc#1230587) ==== pam ==== Subpackages: pam-32bit - baselibs.conf: add pam-userdb - pam_limits-systemd.patch: update to final PR - Add systemd-logind support to pam_limits (pam_limits-systemd.patch) - Remove /usr/etc/pam.d, everything should be migrated - Remove pam_limits from default common-sessions* files. pam_limits is now part of pam-extra and not in our default generated config. - pam_issue-systemd.patch: only count class user sessions ==== pam-config ==== Version update (2.11+git.20240906 -> 2.11+git.20240911) - Add PreRequires for pam-extra, several other packages depend on that pam_limits is installed and enabled by default - Update to version 2.11+git.20240911: * Only add pam_limits if available ==== pam-full-src ==== - baselibs.conf: add pam-userdb - pam_limits-systemd.patch: update to final PR - Add systemd-logind support to pam_limits (pam_limits-systemd.patch) - Remove /usr/etc/pam.d, everything should be migrated - Remove pam_limits from default common-sessions* files. pam_limits is now part of pam-extra and not in our default generated config. - pam_issue-systemd.patch: only count class user sessions ==== polari ==== Version update (46.0 -> 46.0+18) Subpackages: polari-lang - Update to version 46.0+18: + joinDialog: Fix closing the dialog. + Updated translations. ==== poppler ==== Subpackages: libpoppler-cpp1 libpoppler-glib8 libpoppler139 poppler-tools - Poppler can load ghostscript fonts (n022003l.pfb and the like) so the package now recommends the ghostscript-fonts-std package (boo#1230636). ==== poppler-qt6 ==== - Poppler can load ghostscript fonts (n022003l.pfb and the like) so the package now recommends the ghostscript-fonts-std package (boo#1230636). ==== python-cryptography ==== - Fix building on SLE based distributions ==== python311 ==== Version update (3.11.9 -> 3.11.10) Subpackages: python311-curses python311-dbm python311-x86-64-v3 - Update to 3.11.10: - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for ``python -i``, as well as for ``python -m asyncio``. The event in question is ``cpython.run_stdin``. - gh-122133: Authenticate the socket connection for the ``socket.socketpair()`` fallback on platforms where ``AF_UNIX`` is not available like Windows. Patch by Gregory P. Smith <greg(a)krypto.org> and Seth Larson <seth(a)python.org>. Reported by Ellie <el(a)horse64.org> - gh-121285: Remove backtracking from tarfile header parsing for ``hdrcharset``, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:`os.mkdir` on Windows now accepts * mode* of ``0o700`` to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary directory is more permissive than the default. - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123270: Applied a more surgical fix for malformed payloads in :class:`zipfile.Path` causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088). - gh-123067: Fix quadratic complexity in parsing ``"``-quoted cookie values with backslashes by :mod:`http.cookies` (bsc#1229596, CVE-2024-7592). - gh-122905: :class:`zipfile.Path` objects now sanitize names from the zipfile. - gh-121650: :mod:`email` headers with embedded newlines are now quoted on output. The :mod:`~email.generator` will now refuse to serialize (write) headers that are unsafely folded or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:`121650`; CVE-2024-6923, bsc#1228780). - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method breaks internal buffer when the method is called again during flushing internal buffer. - gh-118643: Fix an AttributeError in the :mod:`email` module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list. - gh-113171: Fixed various false positives and false negatives in * :attr:`ipaddress.IPv4Address.is_private` (see these docs for details) * :attr:`ipaddress.IPv4Address.is_global` * :attr:`ipaddress.IPv6Address.is_private` * :attr:`ipaddress.IPv6Address.is_global` Also in the corresponding :class:`ipaddress.IPv4Network` and :class:`ipaddress.IPv6Network` attributes. Fixes bsc#1226448 (CVE-2024-4032). - gh-102988: :func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now return ``('', '')`` 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional *strict* parameter to these two functions: use ``strict=False`` to get the old behavior, accept malformed inputs. ``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check if the *strict* paramater is available. Patch by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix (bsc#1210638). - gh-67693: Fix :func:`urllib.parse.urlunparse` and :func:`urllib.parse.urlunsplit` for URIs with path starting with multiple slashes and no authority. Based on patch by Ashwin Ramaswami. - Core and Builtins - gh-112275: A deadlock involving ``pystate.c``'s ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now fixed. Patch by ChuBoning based on previous Python 3.12 fix by Victor Stinner. - gh-109120: Added handle of incorrect star expressions, e.g ``f(3, *)``. Patch by Grigoryev Semyon - Removed upstreamed patches: - CVE-2023-27043-email-parsing-errors.patch - CVE-2024-4032-private-IP-addrs.patch - CVE-2024-6923-email-hdr-inject.patch - CVE-2024-8088-inf-loop-zipfile_Path.patch - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227). ==== python311-core ==== Version update (3.11.9 -> 3.11.10) Subpackages: libpython3_11-1_0 libpython3_11-1_0-x86-64-v3 python311-base python311-base-x86-64-v3 - Update to 3.11.10: - Security - gh-123678: Upgrade libexpat to 2.6.3 - gh-121957: Fixed missing audit events around interactive use of Python, now also properly firing for ``python -i``, as well as for ``python -m asyncio``. The event in question is ``cpython.run_stdin``. - gh-122133: Authenticate the socket connection for the ``socket.socketpair()`` fallback on platforms where ``AF_UNIX`` is not available like Windows. Patch by Gregory P. Smith <greg(a)krypto.org> and Seth Larson <seth(a)python.org>. Reported by Ellie <el(a)horse64.org> - gh-121285: Remove backtracking from tarfile header parsing for ``hdrcharset``, PAX, and GNU sparse headers (bsc#1230227, CVE-2024-6232). - gh-118486: :func:`os.mkdir` on Windows now accepts * mode* of ``0o700`` to restrict the new directory to the current user. This fixes CVE-2024-4030 affecting :func:`tempfile.mkdtemp` in scenarios where the base temporary directory is more permissive than the default. - gh-116741: Update bundled libexpat to 2.6.2 - Library - gh-123270: Applied a more surgical fix for malformed payloads in :class:`zipfile.Path` causing infinite loops (gh-122905) without breaking contents using legitimate characters (bsc#1229704, CVE-2024-8088). - gh-123067: Fix quadratic complexity in parsing ``"``-quoted cookie values with backslashes by :mod:`http.cookies` (bsc#1229596, CVE-2024-7592). - gh-122905: :class:`zipfile.Path` objects now sanitize names from the zipfile. - gh-121650: :mod:`email` headers with embedded newlines are now quoted on output. The :mod:`~email.generator` will now refuse to serialize (write) headers that are unsafely folded or delimited; see :attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas Bloemsaat and Petr Viktorin in :gh:`121650`; CVE-2024-6923, bsc#1228780). - gh-119506: Fix :meth:`!io.TextIOWrapper.write` method breaks internal buffer when the method is called again during flushing internal buffer. - gh-118643: Fix an AttributeError in the :mod:`email` module when re-fold a long address list. Also fix more cases of incorrect encoding of the address separator in the address list. - gh-113171: Fixed various false positives and false negatives in * :attr:`ipaddress.IPv4Address.is_private` (see these docs for details) * :attr:`ipaddress.IPv4Address.is_global` * :attr:`ipaddress.IPv6Address.is_private` * :attr:`ipaddress.IPv6Address.is_global` Also in the corresponding :class:`ipaddress.IPv4Network` and :class:`ipaddress.IPv6Network` attributes. Fixes bsc#1226448 (CVE-2024-4032). - gh-102988: :func:`email.utils.getaddresses` and :func:`email.utils.parseaddr` now return ``('', '')`` 2-tuples in more situations where invalid email addresses are encountered instead of potentially inaccurate values. Add optional *strict* parameter to these two functions: use ``strict=False`` to get the old behavior, accept malformed inputs. ``getattr(email.utils, 'supports_strict_parsing', False)`` can be use to check if the *strict* paramater is available. Patch by Thomas Dwyer and Victor Stinner to improve the CVE-2023-27043 fix (bsc#1210638). - gh-67693: Fix :func:`urllib.parse.urlunparse` and :func:`urllib.parse.urlunsplit` for URIs with path starting with multiple slashes and no authority. Based on patch by Ashwin Ramaswami. - Core and Builtins - gh-112275: A deadlock involving ``pystate.c``'s ``HEAD_LOCK`` in ``posixmodule.c`` at fork is now fixed. Patch by ChuBoning based on previous Python 3.12 fix by Victor Stinner. - gh-109120: Added handle of incorrect star expressions, e.g ``f(3, *)``. Patch by Grigoryev Semyon - Removed upstreamed patches: - CVE-2023-27043-email-parsing-errors.patch - CVE-2024-4032-private-IP-addrs.patch - CVE-2024-6923-email-hdr-inject.patch - CVE-2024-8088-inf-loop-zipfile_Path.patch - Add gh120226-fix-sendfile-test-kernel-610.patch to avoid failing test_sendfile_close_peer_in_the_middle_of_receiving tests on Linux >= 6.10 (GH-120227). ==== wayland ==== Version update (1.23.0 -> 1.23.1) Subpackages: libwayland-client0 libwayland-cursor0 libwayland-egl1 libwayland-server0 - Update to release 1.23.1: * meson: Fix use of install_data() without specifying install_dir * Put WL_DEPRECATED in front of the function declarations * client: Handle proxies with no queue * scanner: extract validator function emission to helper function * scanner: fix validator for bitfields * tests: add enum bitfield test

1 0

New Slowroll update 20240919T2153 released!
by bernhardout＠lsmod.de 19 Sep '24

19 Sep '24

Please note that this mail was generated by a script. A collection of maintenance updates was released for Slowroll. Released 36 packages: * argocd-cli * asar * ccache * cherrytree * chezmoi * element-desktop * element-web * etckeeper * fcitx5 * ffmpeg-4 * ffmpeg-6 * gap-toric * golang-github-lusitaniae-apache_exporter * libbpf * libzypp * perf * polybar * postgresql * python-azure-mgmt-sql * python-httpx * python-influxdb * python-mocket * python-poetry-dynamic-versioning * python-pypdf * python310 * python311 * reproc * ripgrep * sile * trinity * tuba * urlscan * werf * wget * xpenguins * zypper

1 0

Tumbleweed: Nvidia (proprietary) driver 560 when? Any ETA?
by a3a6k8rqo＠mozmail.com 19 Sep '24

19 Sep '24

Hello, I was told on the forum, that I should use mailing list for my topic so here I go. I’m eagerly awaiting the release of the Nvidia driver 560. It appears that Fedora has been using it for several months, while openSUSE is still on version 550. As a result, we’re unable to fully take advantage of Plasma’s explicit synchronization feature under Wayland, which was introduced with Plasma 6.1 a few months ago. Could you please let me know when Nvidia driver 560 will be available in Tumbleweed’s official Nvidia repository, so that we can update it easily via a simple zypper dup? Thank you for your time and assistance! Best regards, Kai

9 20

Re: How do I fix this OBS problem - for VirtualBox
by Mihai Moldovan 19 Sep '24

19 Sep '24

* On 9/19/24 20:06, Larry Len Rainey wrote: > This failed and I have no idea how to fix it - I suspect I need something in the > virtualbox.spec file to fix this. Yes, the spec file still builds against Qt 5, but VirtualBox nowadays searches for Qt 6 by default. You'll either have to find out if there is a configure switch to force Qt 5, or, alternatively, change build dependencies to their Qt 6 versions, which might not be a 1:1 mapping. Note that Qt 5's lifecycle is pretty much at its end, and it makes more sense to make the switch to Qt 6, especially for TW. Mihai

1 0