Please note that this mail was generated by a script.
The described changes are computed based on the x86_64 DVD.
The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading:
https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&version=Tumbleweed&build=20220223
Please do not reply to this email to report issues, rather file a bug
on bugzilla.opensuse.org. For more information on filing bugs please
see https://en.opensuse.org/openSUSE:Submitting_bug_reports
Packages changed:
NetworkManager
adwaita-icon-theme
apr
at (3.2.2 -> 3.2.4)
autoyast2 (4.4.30 -> 4.4.31)
expat (2.4.4 -> 2.4.6)
flatpak (1.12.5 -> 1.12.6)
git
libnvme (1.0~3 -> 1.0~4)
libsecret (0.20.4 -> 0.20.5)
mariadb (10.6.5 -> 10.7.3)
ncurses (6.3.20220129 -> 6.3.20220212)
nvme-cli (2.0~3 -> 2.0~4)
okteta (0.26.6 -> 0.26.7)
perl
polkit
python-Twisted
python-pbr (5.8.0 -> 5.8.1)
python-pyspnego (0.3.1 -> 0.4.0)
python38
python38-core
sil-charis-fonts (6.001 -> 6.101)
systemd (249.9 -> 249.10)
update-alternatives (1.20.9 -> 1.21.1)
xfce4-notifyd (0.6.2 -> 0.6.3)
xorg-x11-server
yast2-installation (4.4.42 -> 4.4.44)
yast2-network (4.4.39 -> 4.4.40)
yast2-security (4.4.11 -> 4.4.12)
zip
=== Details ===
==== NetworkManager ====
Subpackages: NetworkManager-lang NetworkManager-pppoe libnm0 typelib-1_0-NM-1_0
- Add upstream bug fix patches:
+ 4685651e7671e064b911a3a05f096908e5ef0580.patch: glib-aux: fix
nm_ref_string_equal_str() Fix comparison with a NULL string
+ 6329f1db5ac75ee3b7d2f7ce062e951a598625fe.patch: libnm/tests:
fix maybe-uninitialized warning in "test-setting"
+ aadf0fb64f491f94b2771058621dc140c562b62b.patch: libnm/tests:
fix maybe-uninitialized warning in "test-libnmc-setting"
+ 471e987add98b36520ece72ee493176fc7bc863c.patch: device:
initialize nm_auto variable in _ethtool_features_reset()
+ 634e023e72d4729788a022ea1fae665af28d1b0f.patch: glib-aux:
workaround maybe-uninitialized warning with LTO in
nm_uuid_generate_from_string_str()
==== adwaita-icon-theme ====
- Replace Requires(post): gtk3-tools with the 2 following:
+ Requires(post): (gtk3-tools if libgtk-3-0)
+ Requires(post): (gtk4-tools if libgtk-4-1)
Do this as we want gtk3-tools when building and installing a gtk3
based package, and gtk4-tools when building and installing a gtk4
based package.
==== apr ====
- deleted patches
- apr-CVE-2021-3594.patch (renamed)
- added patches
+ apr-CVE-2021-35940.patch (correct name)
==== at ====
Version update (3.2.2 -> 3.2.4)
- Update to version 3.2.4:
* Upstream SUSE patches
- Update to version 3.2.3:
* Fix two typos on documentation
* Upstream SUSE patches
* Various improvements to the code and the build system
- Refresh patches:
* at-3.1.16-handle_malformed_jobs.patch
* at-3.2.2.patch
* at-backport-old-privs.patch
* harden_atd.service.patch
- Drop upstreamed patches:
* at-3.1.13-leak-fix.patch
* at-3.1.13-massive_batch.patch
* at-3.1.14-joblist.patch
* at-3.1.14-usePOSIXtimers.patch
* at-3.1.8-jobdir-mtime.patch
* at-atq-timeformat.patch
* at-secure_getenv.patch
==== autoyast2 ====
Version update (4.4.30 -> 4.4.31)
Subpackages: autoyast2-installation
- Modified init-scripts service dependencies fixing a root login
systemd timeout when installing with ssh (bsc#1195059)
- 4.4.31
==== expat ====
Version update (2.4.4 -> 2.4.6)
Subpackages: libexpat-devel libexpat1 libexpat1-32bit
- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
* Bug fixes:
- Fix a regression introduced by the fix for CVE-2022-25313
in release 2.4.5 that affects applications that (1)
call function XML_SetElementDeclHandler and (2) are
parsing XML that contains nested element declarations
(e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>").
- Version info bumped from 9:5:8 to 9:6:8;
see https://verbump.de/ for what these numbers do.
- update to 2.4.5 (bsc#1196171, bsc#1196169, bsc#1196168,
bsc#1196026, bsc#1196025):
* Security fixes:
- CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
sequences (e.g. from start tag names) to the XML
processing application on top of Expat can cause
arbitrary damage (e.g. code execution) depending
on how invalid UTF-8 is handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
- CVE-2022-25236 -- Passing (one or more) namespace separator
characters in "xmlns[:prefix]" attribute values
made Expat send malformed tag names to the XML
processor on top of Expat which can cause
arbitrary damage (e.g. code execution) depending
on such unexpectable cases are handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
- CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
that could be triggered by e.g. a 2 megabytes
file with a large number of opening braces.
Expected impact is denial of service or potentially
arbitrary code execution.
- CVE-2022-25314 -- Fix integer overflow in function copyString;
only affects the encoding name parameter at parser creation
time which is often hardcoded (rather than user input),
takes a value in the gigabytes to trigger, and a 64-bit
machine. Expected impact is denial of service.
- CVE-2022-25315 -- Fix integer overflow in function storeRawNames;
needs input in the gigabytes and a 64-bit machine.
Expected impact is denial of service or potentially
arbitrary code execution.
* Other changes:
- Version info bumped from 9:4:8 to 9:5:8;
see https://verbump.de/ for what these numbers do
==== flatpak ====
Version update (1.12.5 -> 1.12.6)
Subpackages: libflatpak0 system-user-flatpak
- Update to version 1.12.6:
+ Fix a bug that sometimes caused repo corruption in case
downloads are interrupted or canceled, necessitating a
"flatpak repair" to recover
+ More reliably detect the GTK theme
+ Fix history command unit test in some edge cases
+ Updated translations.
==== git ====
Subpackages: git-core git-cvs git-email git-gui git-svn git-web gitk perl-Git
- "Downgrade" git-gui and gitk Recommends to Suggests.
==== libnvme ====
Version update (1.0~3 -> 1.0~4)
- Update to version 1.0-rc4:
* fabrics: add default port number for NVMe/TCP I/O controllers
* linux: Update size when telemetry controller initiated data is unavailable
* add cdw13 for set_feature_args structure
* Add support for TP8010
* Documentation cleanups
==== libsecret ====
Version update (0.20.4 -> 0.20.5)
Subpackages: libsecret-1-0 libsecret-lang typelib-1_0-Secret-1
- Update to version 0.20.5:
+ Drop autotools-based build
+ Use G_GNUC_NULL_TERMINATED where appropriate
+ collection, methods, prompt: Port to GTask
+ Detect local storage in snaps in the same way as flatpaks
+ Add bash-completion for secret-tool
+ secret-tool: Add locking capabilities to secret tool
+ secret-file-backend: Avoid closing the same file descriptor
twice
+ Add support for TPM2 based secret storage
+ Create default collection after DBus.Error.UnknownObject
+ Port documentation to gi-docgen
+ GI annotation and documentation fixes
+ Build fixes
+ Updated translations.
- Replace gtk-doc with pkgconfig(gi-docgen) BuildRequires following
upstreams port.
- Drop patch fixed upstream: libsecret-handle-UnknownObject.patch
==== mariadb ====
Version update (10.6.5 -> 10.7.3)
Subpackages: libmariadbd19 mariadb-client mariadb-errormessages
- Update to 10.7.3 (bsc#1196016):
* release notes and changelog:
https://mariadb.com/kb/en/library/mariadb-1073-release-notes
https://mariadb.com/kb/en/library/mariadb-1073-changelog
https://mariadb.com/kb/en/library/mariadb-1072-release-notes
https://mariadb.com/kb/en/library/mariadb-1072-changelog
https://mariadb.com/kb/en/library/mariadb-1071-release-notes
https://mariadb.com/kb/en/library/mariadb-1071-changelog
https://mariadb.com/kb/en/library/mariadb-1070-release-notes
https://mariadb.com/kb/en/library/mariadb-1070-changelog
* fixes for the following security vulnerabilities:
10.7.3: CVE-2021-46665
CVE-2021-46664
CVE-2021-46661
CVE-2021-46668
CVE-2021-46663
10.7.2: CVE-2022-24052
CVE-2022-24051
CVE-2022-24050
CVE-2022-24048
CVE-2021-46659, bsc#1195339
10.7.1: none
10.7.0: none
- Remove upstreamed patches:
* mariadb-10.0.15-logrotate-su.patch
* mariadb-10.1.1-mysqld_multi-features.patch
- Refresh mariadb-10.2.4-logrotate.patch
- Update list of skipped tests
- Add bsc1194828.patch to fix build with GCC12, fixes bsc#1194828
- The following issues have already been fixed in this package but weren't
previously mentioned in the changes file:
CVE-2021-46658, bsc#1195334
CVE-2021-46657, bsc#1195325
==== ncurses ====
Version update (6.3.20220129 -> 6.3.20220212)
Subpackages: libncurses6 ncurses-utils terminfo terminfo-base terminfo-iterm terminfo-screen
- Add ncurses patch 20220212
+ improve font-formatting in other manpages, for consistency.
+ correct/improve font-formatting in curs_wgetch.3x (patch by Benno
Schulenberg).
- Add ncurses patch 20220205
+ workaround in test/picsmap.c for use of floating point for rgb values
by ImageMagick 6.9.11, which appears to use the wrong upper limit.
+ improve use of "trap" in shell scripts, using "fixup-trap".
==== nvme-cli ====
Version update (2.0~3 -> 2.0~4)
Subpackages: nvme-cli-bash-completion nvme-cli-zsh-completion
- Update to version 2.0-rc4:
* netapp-nvme: free the nsdescs pointer after use
* netapp-nvme: fix ontapdevices segfault in json output
* nvme-print: fix 'nvme list -o json' segfault
* nvme: get_ns_id command fails on nvme device
* wdc: updated products list for telemetry (--type) argument
* docs: fix typo in Data Set Management section
* Fix ctrlist for attach-ns and detach-ns
* netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
* wdc: Fix use-after-free access of cbs_data
* Fixed regression with 'open namespace exclusive' (bsc#1195945)
==== okteta ====
Version update (0.26.6 -> 0.26.7)
Subpackages: libKasten4 libOkteta3 libkasten-lang libokteta-lang okteta-data okteta-lang
- Update to 0.26.7
* Improved: translations
* Fixed: crash in string extraction tool with marked strings from
closed view (kde#444405)
* Fixed: in JIS X 0201 codec properly map ASCII control char
subset
* Fixed: use own IBM874 codec, given Qt with ICU maps it to
TIS-620
* Changed: a context menu now available with the view area (incl.
tabs)
* Changed: tabs of views can now be reordered (inside a single
tab area)
* Changed: empty documents can be created by LMB double-clicks
in empty areas
* Changed: remember used settings of tools across app restarts
* Changed: remember used settings of data generators across app
restarts
* Changed: remember used settings of data encoders across app
restarts
- Add signature file and keyring
- Update URL.
==== perl ====
Subpackages: perl-base perl-doc
- Add multibuild flavor to split the testsuite out of the main package
build time. The testsuite dominates the build time and having perl
in the bootstrap cycle, we better seperate it. The testsuite flavor
rebuilds the same package the same way, but runs the check section
==== polkit ====
Subpackages: libpolkit-agent-1-0 libpolkit-gobject-1-0 typelib-1_0-Polkit-1_0
- Fixed denial of service via file descriptor leak (bsc#1195542 CVE-2021-4115)
0001-CVE-2021-4115-GHSL-2021-077-fix.patch
==== python-Twisted ====
- Add patch skip-namespacewithwhitespace.patch:
* Skip a failing test with Expat 2.4.5.
==== python-pbr ====
Version update (5.8.0 -> 5.8.1)
- update to 5.8.1:
* Add release note about missing pbr.json fix
* Avoid recursive calls into SetupTools entrypoint
* remove explicit mock
* Don't test with setuptools local distutils
* Use context blocks for open() calls in packaging
- remove remove_mock.patch (upstream)
==== python-pyspnego ====
Version update (0.3.1 -> 0.4.0)
- update to 0.4.0:
* Add `usage` argument for `tls.default_tls_context` to control whether the
context is for a initiator or acceptor
* Add type annotations and include `py.typed` in the package for downstream
library use
* Expose the `ContextProxy` class for type annotation use
* Added `get_extra_info` to `ContextProxy` to expose a common way to retrieve
context specific information, this is currently used by CredSSP to retrieve
* `client_credential`: The delegated client credential for acceptors
once the context is complete
* `sslcontext`: The SSL context used to create the TLS object
* `ssl_object`: The TLS object used during the CredSSP exchange
* The `client_credential` property on `CredSSP` has been removed in
favour of `context.get_extra_info('client_credential')
* Added support for custom credential types
* Can be used to for things like NTLM authentication with NT/LM hashes,
Kerberos with a keytab or from an explicit CCache, etc
* Support calling SSPI through `pyspnego`'s Negotiate proxy context
* This allows users on Windows to still use Negotiate auth but with a
complex set of credentials
* Also opens up the ability to use Negotiate but only with Kerberos auth
* The `username` and `password` property on the auth context object are
deprecated and will return `None` until it is removed in a future release
==== python38 ====
Subpackages: python38-curses python38-dbm python38-tk
- Add patch support-expat-245.patch:
* Support Expat >= 2.4.5
==== python38-core ====
Subpackages: libpython3_8-1_0 python38-base
- Add patch support-expat-245.patch:
* Support Expat >= 2.4.5
==== sil-charis-fonts ====
Version update (6.001 -> 6.101)
- Update to 6.101:
* Maintenance release
==== systemd ====
Version update (249.9 -> 249.10)
Subpackages: libsystemd0 libsystemd0-32bit libudev1 libudev1-32bit systemd-32bit systemd-container systemd-devel systemd-lang udev
- Import commit 0bb1977021be2fc9ebfae10d766dff0b1a457f88 (merge of v249.10)
For a complete list of changes, visit:
https://github.com/openSUSE/systemd/compare/b9b83c5d11e686178ddd545862a00b33...
- Import commit b9b83c5d11e686178ddd545862a00b33c6fdfabb
8973cb2462 systemd-coredump: allow setting external core size to infinity (bsc#1195899 jsc#SLE-23866)
- Fix build if %_distconfdir is not defined (see bsc#1195679)
==== update-alternatives ====
Version update (1.20.9 -> 1.21.1)
- rebase patches:
* update-alternatives.changes
* update-alternatives.spec
* update-alternatives-suse.patch
- New upstream release 1.21.1
dpkg (1.21.1) unstable; urgency=medium
[ Guillem Jover ]
* dpkg-buildpackage: Remove duplicate command print for dpkg-genchanges.
* dpkg-buildpackage: Fix build description due to improper multiline match.
* dpkg-realpath: Remove spurious heading space from --help output.
* update-alternatives: When initializing admindir from DPKG_ADMINDIR append
"/alternatives". Closes: #1001198
* Code internals:
- Remove