Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&version=Tumbleweed&build=20211211 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: MozillaFirefox (94.0.2 -> 95.0) SDL2 (2.0.16 -> 2.0.18) colord cppcheck (2.5 -> 2.6.2) eog (41.0 -> 41.1) evolution (3.42.1 -> 3.42.2) evolution-data-server (3.42.1 -> 3.42.2) gdb gdm glib-networking (2.70.0 -> 2.70.1) glib2 (2.70.1 -> 2.70.2) gnome-calculator (41.0 -> 41.1) gnome-control-center (41.1 -> 41.2) gnome-desktop (41.1 -> 41.2) gnome-maps (41.1 -> 41.2) gnome-software (41.1 -> 41.2) gnome-terminal (3.42.1 -> 3.42.2) gnome-user-docs (41.0 -> 41.1) gupnp (1.4.0 -> 1.4.1) hwdata (0.353 -> 0.354) hxtools (20210928 -> 20211204) libX11 (1.7.2 -> 1.7.3.1) libgexiv2 libreoffice (7.2.3.2 -> 7.2.4.1) mozjs78 (78.14.0 -> 78.15.0) nodejs16 (16.13.0 -> 16.13.1) polkit (0.118 -> 0.120) polkit-gnome python-ldap (3.3.1 -> 3.4.0) system-config-printer tracker-miners udisks2 (2.9.2 -> 2.9.4) vte (0.66.1 -> 0.66.2) yast2-installation (4.4.26 -> 4.4.28) yelp (41.1 -> 41.2) yelp-xsl (41.0 -> 41.1) === Details === ==== MozillaFirefox ==== Version update (94.0.2 -> 95.0) Subpackages: MozillaFirefox-translations-common - Mozilla Firefox 95.0 * You can now move the Picture-in-Picture toggle button to the opposite side of the video. Simply look for the new context menu option Move Picture-in-Picture Toggle to Left (Right) Side. * To better protect Firefox users against side-channel attacks such as Spectre, Site Isolation is now enabled for all Firefox 95 users. * https://www.mozilla.org/en-US/firefox/95.0/releasenotes MFSA 2021-52 (bsc#1193485) * CVE-2021-43536 (bmo#1730120) URL leakage when navigating while executing asynchronous function * CVE-2021-43537 (bmo#1738237) Heap buffer overflow when using structured clone * CVE-2021-43538 (bmo#1739091) Missing fullscreen and pointer lock notification when requesting both * CVE-2021-43539 (bmo#1739683) GC rooting failure when calling wasm instance methods * MOZ-2021-0010 (bmo#1735852) Use-after-free in fullscreen objects on MacOS * CVE-2021-43540 (bmo#1636629) WebExtensions could have installed persistent ServiceWorkers * CVE-2021-43541 (bmo#1696685) External protocol handler parameters were unescaped * CVE-2021-43542 (bmo#1723281) XMLHttpRequest error codes could have leaked the existence of an external protocol handler * CVE-2021-43543 (bmo#1738418) Bypass of CSP sandbox directive when embedding * CVE-2021-43544 (bmo#1739934) Receiving a malicious URL as text through a SEND intent could have led to XSS * CVE-2021-43545 (bmo#1720926) Denial of Service when using the Location API in a loop * CVE-2021-43546 (bmo#1737751) Cursor spoofing could overlay user interface when native cursor is zoomed * MOZ-2021-0009 (bmo#1393362, bmo#1736046, bmo#1736751, bmo#1737009, bmo#1739372, bmo#1739421) Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 - requires NSS >= 3.72 - remove x-scheme-handler/ftp from firefox.desktop boo#1193321 - Drop unused libidl-devel BuildRequires. ==== SDL2 ==== Version update (2.0.16 -> 2.0.18) - Update to release 2.0.18 * Added SDL_RenderGeometry() and SDL_RenderGeometryRaw() to allow rendering of arbitrary shapes using the SDL 2D render API. * Added SDL_SetTextureUserData() and SDL_GetTextureUserData() to associate application data with an SDL texture. * Added SDL_RenderWindowToLogical() and SDL_RenderLogicalToWindow() to convert between window coordinates and logical render coordinates. * Added SDL_RenderSetVSync() to change whether a renderer present is synchronized with vblank at runtime. * Added SDL_PremultiplyAlpha() to premultiply alpha on a block of SDL_PIXELFORMAT_ARGB8888 pixels. * Added a window event SDL_WINDOWEVENT_DISPLAY_CHANGED which is sent when a window changes what display it is centered on. * Added SDL_GetWindowICCProfile() to query a window's ICC profile, and a window event SDL_WINDOWEVENT_ICCPROF_CHANGED that is sent when it changes. * Added the hint SDL_HINT_VIDEO_EGL_ALLOW_TRANSPARENCY to allow EGL windows to be transparent instead of opaque. * Added SDL_SetWindowMouseRect() and SDL_GetWindowMouseRect() to confine the mouse cursor to an area of a window. * You can now read precise mouse wheel motion using 'preciseX' and 'preciseY' event fields. * Added SDL_GameControllerHasRumble() and SDL_GameControllerHasRumbleTriggers() to query whether a game controller supports rumble. * Added SDL_JoystickHasRumble() and SDL_JoystickHasRumbleTriggers() to query whether a joystick supports rumble. * SDL's hidapi implementation is now available as a public API in SDL_hidapi.h. - Drop SDL2-endian.patch (inapplicable), sdl2-fix-wayland-fullscreen.patch (merged), audio-Support-pulse-as-an-alias-for-pulseaudio.patch (merged) ==== colord ==== Subpackages: colord-color-profiles colord-lang libcolord2 libcolorhug2 - Change to systemd-sysusers ==== cppcheck ==== Version update (2.5 -> 2.6.2) - update to 2.6.2: * New checks in core cppcheck: * missing return in function * writing overlapping data, detect undefined behavior * compared value is out of possible type range * Copy elision optimization can't be applied for return std::move(local) * file can not be opened for read and write access at the same time on different streams * Various improvements - drop 0001-Fix-compilation-with-recent-glibc-where-SIGSTKSZ-is-.patch (upstream) ==== eog ==== Version update (41.0 -> 41.1) Subpackages: eog-lang - Update to version 41.1: + Bugs fixed: - Accessibility: add proper mnemonic relations and labelling - Remove incorrect arg for i18n.merge_file - Saving image fails with GVFS SFTP backend + Updated translations. ==== evolution ==== Version update (3.42.1 -> 3.42.2) Subpackages: evolution-lang evolution-plugin-bogofilter evolution-plugin-pst-import evolution-plugin-spamassassin evolution-plugin-text-highlight - Update to version 3.42.2: + Misc: Generate appdata <releases/> from the NEWS file + news-to-appdata: Escape text exported to XML + flatpak: Update build manifests + Calendar: - Cannot always remove custom reminder message - Not all task lists included in the task panel + Composer: Don't show blockquote indicators on both sides for 6th+ level + Load JavaScript plugins for message preview and WebKit editor + icalendar-importer: Can show incorrect time in imported data preview. + Bugs fixed: glgo#GNOME/evolution#1679, glgo#GNOME/evolution#1696, glgo#GNOME/evolution#1697, glgo#GNOME/evolution#1708, glgo#GNOME/evolution#1712, glgo#GNOME/evolution#1714, glgo#GNOME/evolution#1715, glgo#GNOME/evolution#1717, glgo#GNOME/evolution#1721. + Updated translations. ==== evolution-data-server ==== Version update (3.42.1 -> 3.42.2) Subpackages: evolution-data-server-lang libcamel-1_2-63 libebackend-1_2-10 libebook-1_2-20 libebook-contacts-1_2-3 libecal-2_0-1 libedata-book-1_2-26 libedata-cal-2_0-1 libedataserver-1_2-26 libedataserverui-1_2-3 - Update to version 3.42.2: + Bugs Fixed: glgo#GNOME/evolution-data-server#364, glgo#GNOME/evolution-data-server#365, glgo#GNOME/evolution-data-server#366. + Updated translations. ==== gdb ==== - Patches added (swo#28323): gdb-ada-fix-assert-in-ada_is_unconstrained_packed_array_type.patch ==== gdm ==== Subpackages: gdm-lang gdmflexiserver libgdm1 typelib-1_0-Gdm-1_0 - Add gdm-restart-greeter-session-after-crash.patch: When active vt is gdm initial vt, restart greeter session. Avoiding the blank screen when greeter session crashed (bsc#1190230 glgo#GNOME/gdm#735). - Update gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch: With GDM_DISABLE_USER_DISPLAY_SERVER=1 environment variable, make X server logging to /var/log/Xorg.*.log and journal log (bsc#1192177). ==== glib-networking ==== Version update (2.70.0 -> 2.70.1) Subpackages: glib-networking-lang - Update to version 2.70.1: + Fix crashes when handshake is cancelled + OpenSSL: fix spurious certificate expired verification errors + GnuTLS: - Fix tests on 32-bit systems - Fix crash when invalid priority string is forced - Add check section and run meson_test macro during build. ==== glib2 ==== Version update (2.70.1 -> 2.70.2) Subpackages: glib2-lang glib2-tools libgio-2_0-0 libgio-2_0-0-32bit libglib-2_0-0 libglib-2_0-0-32bit libgmodule-2_0-0 libgmodule-2_0-0-32bit libgobject-2_0-0 libgobject-2_0-0-32bit libgthread-2_0-0 libgthread-2_0-0-32bit - Update to version 2.70.2: + Fix use of the default log writer with journald namespaces + Fix hang in `dbus-daemon` under `GTestDBus` when `G_MESSAGES_DEBUG=all` is set + Speed up `g_canonicalize_filename()` to avoid pathogenic cases with `..` + Fix URI for pcre subproject as it?s moved upstream + Fix storing GSettings dictionaries on macOS + Speed up ?remove dot segments? algorithm in `GUri` to avoid pathogenic cases with `..` + Fix infinite loops in D-Bus message parsing for truncated inputs + Improve correctness of version information returned by `g_get_os_info()` for Windows 10/Server 2019+ + Bugs fixed: glgo#GNOME/GLib#2400, glgo#GNOME/GLib#2426, glgo#GNOME/GLib#2528, glgo#GNOME/GLib#2530, glgo#GNOME/GLib#2537, glgo#GNOME/GLib#2541, glgo#GNOME/GLib!2312, glgo#GNOME/GLib!2313, glgo#GNOME/GLib!2314, glgo#GNOME/GLib!2316, glgo#GNOME/GLib!2320, glgo#GNOME/GLib!2335, glgo#GNOME/GLib!2337, glgo#GNOME/GLib!2340, glgo#GNOME/GLib!2344, glgo#GNOME/GLib!2356, glgo#GNOME/GLib!2359, glgo#GNOME/GLib!2361, glgo#GNOME/GLib!2363, glgo#GNOME/GLib!2366, glgo#GNOME/GLib!2375, glgo#GNOME/GLib!2383. + Updated translations. - Stop passing fam=true to meson and drop gamin-devel BuildRequires, following upstream default. Following this, drop libgio-fam sub-package. ==== gnome-calculator ==== Version update (41.0 -> 41.1) Subpackages: gnome-calculator-lang gnome-shell-search-provider-gnome-calculator - Update to version 41.1: + Do not force width for basic mode. + Updated translations. ==== gnome-control-center ==== Version update (41.1 -> 41.2) Subpackages: gnome-control-center-color gnome-control-center-goa gnome-control-center-lang gnome-control-center-user-faces - Update to version 41.2: + Updated translations. ==== gnome-desktop ==== Version update (41.1 -> 41.2) Subpackages: gnome-desktop-lang gnome-version libgnome-desktop-3-19 libgnome-desktop-3_0-common typelib-1_0-GnomeDesktop-3_0 - Update to version 41.2: + No changes, version bump only. ==== gnome-maps ==== Version update (41.1 -> 41.2) Subpackages: gnome-maps-lang - Update to version 41.2: + Updated translations. ==== gnome-software ==== Version update (41.1 -> 41.2) Subpackages: gnome-software-lang - Update to version 41.2: + Fix a crash when processing age ratings + Reload application details only when not installing/removing the application + Do not follow symlinks when calculating disk size usage + Fix addons section, which could show addons for different application + Updated translations. ==== gnome-terminal ==== Version update (3.42.1 -> 3.42.2) Subpackages: gnome-shell-search-provider-gnome-terminal gnome-terminal-lang nautilus-extension-terminal - Update to version 3.42.2: + Updated translations. ==== gnome-user-docs ==== Version update (41.0 -> 41.1) - Update to version 41.1: + Various updates. + Updated translations. ==== gupnp ==== Version update (1.4.0 -> 1.4.1) - Update to version 1.4.1: + Fix regression in async deprecated API. + Fix context creation not failing if the HTTP server fails to bind. ==== hwdata ==== Version update (0.353 -> 0.354) - Update to version 0.354: + Updated pci, usb and vendor ids. ==== hxtools ==== Version update (20210928 -> 20211204) Subpackages: fd0ssh ofl - Update to release 20211204 * vfontas: add a -move operation * Documentation updates ==== libX11 ==== Version update (1.7.2 -> 1.7.3.1) Subpackages: libX11-6 libX11-6-32bit libX11-data libX11-devel libX11-xcb1 - Update to version 1.7.3.1 * This release of libX11 corrects a packaging problem in 1.7.3 which caused the m4 files needed for autoreconf to not be included in the tarballs. * As a bonus, this release also includes one tiny typo fix in the XIM specs. - Update to version 1.7.3 * This release includes a number of bug fixes and adds support for the _EVDEVK keysyms added in xorgproto 2021.2. ==== libgexiv2 ==== - Set pythons python3 define, only build for python 3, following this, drop conditional sub-package python-gexiv2 and bcond_without macros. Use plain py3-*devel BuildRequires instead of python modules. ==== libreoffice ==== Version update (7.2.3.2 -> 7.2.4.1) Subpackages: libreoffice-base libreoffice-calc libreoffice-draw libreoffice-filters-optional libreoffice-gnome libreoffice-gtk3 libreoffice-icon-themes libreoffice-impress libreoffice-l10n-cs libreoffice-l10n-da libreoffice-l10n-de libreoffice-l10n-el libreoffice-l10n-en libreoffice-l10n-en_GB libreoffice-l10n-es libreoffice-l10n-fr libreoffice-l10n-hu libreoffice-l10n-it libreoffice-l10n-ja libreoffice-l10n-pl libreoffice-l10n-pt_BR libreoffice-l10n-ru libreoffice-l10n-zh_CN libreoffice-l10n-zh_TW libreoffice-mailmerge libreoffice-math libreoffice-pyuno libreoffice-qt5 libreoffice-writer libreofficekit - Update to 7.2.4.1 ==== mozjs78 ==== Version update (78.14.0 -> 78.15.0) - Update to version 78.15.0esr. ==== nodejs16 ==== Version update (16.13.0 -> 16.13.1) Subpackages: npm16 - Update to 16.13.1: * deps: upgrade npm to 8.1.2 * lib: fix regular expression to detect `/` and `\` - 40670.patch: upstreamed - fix_ci_tests.patch: refreshed - Fix CXXFLAGS in Tumbleweed - boo#1192824 ==== polkit ==== Version update (0.118 -> 0.120) Subpackages: libpolkit-agent-1-0 libpolkit-gobject-1-0 typelib-1_0-Polkit-1_0 - update to 0.120: * transition from Intltool to gettext * several tarball, meson and pipeline fixups * Portuguese translation * Romanian translation * meson build system added * CVE-2021-3560 mitigation * properties in text listener * typos fixups * Update Hungarian translation - drop CVE-2021-3560.patch (upstream) ==== polkit-gnome ==== Subpackages: polkit-gnome-lang - Add NotShowIn for Budgie desktop, it has budgie-polkit ==== python-ldap ==== Version update (3.3.1 -> 3.4.0) - skip Python 2 builds - set PATH when running tests - update to upstream release 3.4.0 * Security fixes: - Fix inefficient regular expression which allows denial-of-service attacks - when parsing specially-crafted LDAP schema. - (GHSL-2021-117) * Changes: - On MacOS, remove option to make LDAP connections from a file descriptor - when built with the system libldap (which lacks the underlying function, - ldap_init_fd) - Attribute values of the post read control are now bytes - instead of ISO8859-1 decoded str - LDAPUrl now treats urlscheme as case-insensitive - Several OpenLDAP options are now supported: - OPT_X_TLS_REQUIRE_SAN - OPT_X_SASL_SSF_EXTERNAL - OPT_X_TLS_PEERCERT * Fixes: - The copy() method of cidict was added back. It was unintentionally - removed in 3.3.0 - Fixed getting/setting SASL options on big endian platforms - Unknown LDAP result code are now converted to LDAPexception, - rather than raising a SystemError. * slapdtest: - Show stderr of slapd -Ttest - SlapdObject uses directory-based configuration of slapd - SlapdObject startup is now faster ==== system-config-printer ==== Subpackages: python3-cupshelpers system-config-printer-applet system-config-printer-common system-config-printer-common-lang system-config-printer-dbus-service udev-configure-printer - Fix icons yet again, this time what sizes are available. - Drop post(un) handling, this is done automatically now. ==== tracker-miners ==== Subpackages: tracker-miner-files tracker-miners-lang - Add tracker-miners-drop-syscalls-in-seccomp.patch: Revert upstream commit 595560c, 30b24e9 and 550ea1b since Leap 15.4 and SLE 15-SP4 do not have them (bsc#1192567). ==== udisks2 ==== Version update (2.9.2 -> 2.9.4) Subpackages: libudisks2-0 libudisks2-0_btrfs udisks2-lang - Update to version 2.9.4: + Many fixes, improvements, and additions to the code. + Mount options: - Always use errors=remount-ro for ext filesystems; - Add ntfs3 kernel driver options. + Build: Remove warnings unknown to clang. + Tests: Adapt to clang differences when causing a segfault. - Changes from version 2.9.3: + Many fixes, improvements, and additions to the code and test. - Add "%tmpfiles_create %{_tmpfilesdir}/udisks2.conf" call in %post section to make sure /run/media will be created right after the instalation of udisks2. ==== vte ==== Version update (0.66.1 -> 0.66.2) Subpackages: libvte-2_91-0 vte-lang - Update to version 0.66.2: + parser: Fix some control codes + emulation: - ECMA modes should not be saved by DECSC - Use correct range for DECRQCRA ==== yast2-installation ==== Version update (4.4.26 -> 4.4.28) - Improve the self-update process, do not read the products from the installation medium (bsc#1193536) - Adde more /etc/os-release replacements in the self-update URL - 4.4.28 - Display the correct title in the welcome screen depending on its content (related to bsc#1193223 and bsc#1192230). - 4.4.27 ==== yelp ==== Version update (41.1 -> 41.2) Subpackages: libyelp0 yelp-lang - Update to version 41.2: + Fixed regression when opening documents with ghelp URIs + Updated translations. - Refresh yelp-lang-bundle.patch with quilt. - Use autosetup macro. - Use ldconfig_scriptlets for post(un) handling. ==== yelp-xsl ==== Version update (41.0 -> 41.1) - Update to version 41.1: + Updated translations. - Drop yelp-xsl-lang Obsoletes, we have had this since version 3.3.1, so it is pretty safe to assume everyone have updated since that version (10 years ago). - Add yelp-xsl-rpmlintrc file, filter out warning about devel file in non-devel package (.pc file).