Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&version=Tumbleweed&build=20221018 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: bash busybox gpg2 (2.3.7 -> 2.3.8) kernel-source (6.0.1 -> 6.0.2) libXpresent (1.0.0 -> 1.0.1) libffi libksba (1.6.1 -> 1.6.2) libsoup (3.2.0 -> 3.2.1) libxcrypt (4.4.27 -> 4.4.28) libxml2 (2.10.2 -> 2.10.3) libxml2-python (2.10.2 -> 2.10.3) libzypp (17.31.3 -> 17.31.4) netcfg nodejs18 (18.10.0 -> 18.11.0) plasma5-workspace postfix (3.7.2 -> 3.7.3) python-incremental (21.3.0 -> 22.10.0) python-pytz (2022.2.1 -> 2022.4) qalculate (4.2.0 -> 4.3.0) seahorse (42.0 -> 43.0) tcpd tiff timezone (2022d -> 2022e) timezone-java (2022d -> 2022e) xdg-user-dirs-gtk (0.10+13 -> 0.11) xf86-input-vmmouse (13.1.0 -> 13.2.0) yast2-network (4.5.8 -> 4.5.9) yast2-trans (84.87.20221009.3d63202666 -> 84.87.20221016.284cfa770d) zenity === Details === ==== bash ==== Subpackages: bash-doc bash-lang bash-sh - Don't strip binaries - Work around a signal mask issue with qemu linux-user emulation - Remove backup of patched tests ==== busybox ==== Subpackages: busybox-static - Annotate CVEs already fixed in upstream, but not mentioned in .changes: * CVE-2014-9645 (bsc#914660): strips of / in module names that can lead to loading unwanted modules ==== gpg2 ==== Version update (2.3.7 -> 2.3.8) Subpackages: dirmngr gpg2-lang - GnuPG 2.3.8: * gpg: Do not consider unknown public keys as non-compliant while decrypting. * gpg: Avoid to emit a compliance mode line if Libgcrypt is non-compliant. * gpg: Improve --edit-key setpref command to ease c+p. * gpg: Emit an ERROR status if --quick-set-primary-uid fails and allow to pass the user ID by hash. * gpg: Actually show symmetric+pubkey encrypted data as de-vs compliant. Add extra compliance checks for symkey_enc packets. * gpg: In de-vs mode use SHA-256 instead of SHA-1 as implicit preference. * gpgsm: Fix reporting of bad passphrase error during PKCS#11 import. * agent: Fix a regression in "READKEY --format=ssh". * agent: New option --need-attr for KEYINFO. * agent: New attribute "Remote-list" for use by KEYINFO. * scd: Fix problem with Yubikey 5.4 firmware. * dirmngr: Fix CRL Distribution Point fallback to other schemes. * dirmngr: New LDAP server flag "areconly" (A-record-only). * dirmngr: Fix upload of multiple keys for an LDAP server specified using the colon format. * dirmngr: Use LDAP schema v2 when a Base DN is specified. * dirmngr: Avoid caching expired certificates. * wkd: Fix path traversal attack in gpg-wks-server. Add the mail address to the pending request data. * wkd: New command --mirror for gpg-wks-client. * gpg-auth: New tool for authentication. * New common.conf option no-autostart. * Silence warnings from AllowSetForegroundWindow unless GNUPG_EXEC_DEBUG_FLAGS is used. * Rebase gnupg-detect_FIPS_mode.patch * Remove patch upstream: - gnupg-2.3.7-scd-openpgp-Fix-workaround-for-Yubikey-heuristics.patch ==== kernel-source ==== Version update (6.0.1 -> 6.0.2) - Linux 6.0.2 (bsc#1012628). - nilfs2: fix NULL pointer dereference at nilfs_bmap_lookup_at_level() (bsc#1012628). - nilfs2: fix use-after-free bug of struct nilfs_root (bsc#1012628). - nilfs2: fix leak of nilfs_root in case of writer thread creation failure (bsc#1012628). - nilfs2: replace WARN_ONs by nilfs_error for checkpoint acquisition failure (bsc#1012628). - nvme-pci: set min_align_mask before calculating max_hw_sectors (bsc#1012628). - random: restore O_NONBLOCK support (bsc#1012628). - random: clamp credited irq bits to maximum mixed (bsc#1012628). - ALSA: hda: Fix position reporting on Poulsbo (bsc#1012628). - efi: Correct Macmini DMI match in uefi cert quirk (bsc#1012628). - scsi: qla2xxx: Revert "scsi: qla2xxx: Fix response queue handler reading stale packets" (bsc#1012628). - scsi: qla2xxx: Fix response queue handler reading stale packets (bsc#1012628). - scsi: stex: Properly zero out the passthrough command structure (bsc#1012628). - USB: serial: qcserial: add new usb-id for Dell branded EM7455 (bsc#1012628). - Revert "USB: fixup for merge issue with "usb: dwc3: Don't switch OTG -> peripheral if extcon is present"" (bsc#1012628). - Revert "usb: dwc3: Don't switch OTG -> peripheral if extcon is present" (bsc#1012628). - Revert "powerpc/rtas: Implement reentrant rtas call" (bsc#1012628). - Revert "crypto: qat - reduce size of mapped region" (bsc#1012628). - random: avoid reading two cache lines on irq randomness (bsc#1012628). - random: use expired timer rather than wq for mixing fast pool (bsc#1012628). - wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() (bsc#1012628). - wifi: cfg80211/mac80211: reject bad MBSSID elements (bsc#1012628). - wifi: mac80211: fix MBSSID parsing use-after-free (bsc#1012628). - wifi: cfg80211: ensure length byte is present before access (bsc#1012628). - wifi: cfg80211: fix BSS refcounting bugs (bsc#1012628). - wifi: cfg80211: avoid nontransmitted BSS list corruption (bsc#1012628). - wifi: mac80211_hwsim: avoid mac80211 warning on bad rate (bsc#1012628). - wifi: mac80211: fix crash in beacon protection for P2P-device (bsc#1012628). - wifi: cfg80211: update hidden BSSes to avoid WARN_ON (bsc#1012628). - mctp: prevent double key removal and unref (bsc#1012628). - Input: xpad - add supported devices as contributed on github (bsc#1012628). - Input: xpad - fix wireless 360 controller breaking after suspend (bsc#1012628). - misc: pci_endpoint_test: Aggregate params checking for xfer (bsc#1012628). - misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic (bsc#1012628). - commit 7fb6561 - Refresh patches.suse/ACPI-resource-Add-ASUS-model-S5402ZA-to-quirks.patch. - Refresh patches.suse/ACPI-resource-Skip-IRQ-override-on-Asus-Vivobook-K34.patch. Update upstream status. They were merged already. - commit 098c340 - ACPI: resource: do IRQ override on LENOVO IdeaPad (bsc#1203794). - ACPI: resource: Add ASUS model S5402ZA to quirks (bsc#1203794). - ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA (bsc#1203794). - commit c7a2f55 ==== libXpresent ==== Version update (1.0.0 -> 1.0.1) - Update to version 1.0.1 * autogen: use exec instead of waiting for configure to finish * autogen: add default patch prefix * configure, xpresent.pc: require xext, xfixes and xrandr * autogen: use quoted string variables * autogen: Implement GNOME Build API * Update README for gitlab migration * Update configure.ac bug URL for gitlab migration * Build xz tarballs instead of bzip2 * Fix spelling/wording issues * configure: Drop AM_MAINTAINER_MODE * Add man pages for libXpresent ==== libffi ==== Subpackages: libffi8 libffi8-32bit - add riscv64-handle-big-structures.patch ==== libksba ==== Version update (1.6.1 -> 1.6.2) - libksba 1.6.2: [bsc#1204357, CVE-2022-3515] * Fix integer overflow in the CRL parser. ==== libsoup ==== Version update (3.2.0 -> 3.2.1) Subpackages: libsoup-3_0-0 libsoup-lang typelib-1_0-Soup-3_0 - Update to version 3.2.1: + When built against nghttp2 1.50.0+ be relaxed about header whitespace. + Fix possible crash when cancelling an HTTP/2 message. + Fix regresion where soup_server_message_get_socket() could return NULL. + Fix minor memory leak. - Disable tests on 32-bit while waiting for https://gitlab.gnome.org/GNOME/libsoup/-/issues/309 ==== libxcrypt ==== Version update (4.4.27 -> 4.4.28) Subpackages: libcrypt1 libcrypt1-32bit libxcrypt-devel - update to 4.4.28: * Add glibc-on-or1k (OpenRISC 1000) entry to libcrypt.minver. This was added in GNU libc 2.35. ==== libxml2 ==== Version update (2.10.2 -> 2.10.3) Subpackages: libxml2-2 libxml2-2-32bit libxml2-tools - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. ==== libxml2-python ==== Version update (2.10.2 -> 2.10.3) - Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304): + Security: - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE - Fix overflow check in SAX2.c + Build system: cmake: Set SOVERSION - Rebase patches with quilt. ==== libzypp ==== Version update (17.31.3 -> 17.31.4) - Do not clean up MediaSetAccess before using the geoip file (fixes #424) - version 17.31.4 (22) ==== netcfg ==== - Remove hosts.allow and hosts.deny config files as they are only used by tcpd, which is not installed by default, bsc#1099755 ==== nodejs18 ==== Version update (18.10.0 -> 18.11.0) Subpackages: npm18 - Update to NodeJS 18.11.0: * added experimental watch mode -- running in 'watch' mode using node --watch restarts the process when an imported file is changed * fs: add FileHandle.prototype.readLines * http: add writeEarlyHints function to ServerResponse * http2: make early hints generic * lib: refactor transferable AbortSignal * src: add detailed embedder process initialization API * util: add default value option to parsearg - legacy_python.patch, versioned.patch: updated ==== plasma5-workspace ==== Subpackages: gmenudbusmenuproxy plasma5-session plasma5-session-wayland plasma5-workspace-lang plasma5-workspace-libs xembedsniproxy - Use appmenu-gtk-module instead of unity-gtk-module on Leap 15.2+ (boo#1108846) ==== postfix ==== Version update (3.7.2 -> 3.7.3) - update to 3.7.3 * Fixed a bug where some messages were not delivered after "warning: Unexpected record type 'X'. * Workaround: in a TLS server disable Postfix's 1-element internal session cache, to work around an OpenSSL 3.0 regression that broke TLS handshakes. * Code health: the fix for milter_header_checks (3.7.1, 3.6.6, 3.5.16, 3.4.26) introduced a missing msg_panic() argument (in code that never executes). * Code health: Postfix 3.3.0 introduced an uninitialized verify_append() request status in case of a null original recipient address. * Postfix 3.5.0 introduced debug logging noise in map_search_create(). - own /var/spool/mail (boo#1179574) ==== python-incremental ==== Version update (21.3.0 -> 22.10.0) - update to 22.10.0: * Incremental now supports type-checking with Mypy (#69) ==== python-pytz ==== Version update (2022.2.1 -> 2022.4) - update to 2022.4 ==== qalculate ==== Version update (4.2.0 -> 4.3.0) Subpackages: libqalculate22 qalculate-data - Update to 4.3.0: * Fix handling of Unicode powers for units in denominator, with adaptive parsing enabled (e.g. parse 10m/s² the same as 10m/s^2) * Fix "+" ignored after "E" in number bases where "E" is a digit * Fix scientific E notation with sign in argument when function is used without parentheses * Fix lambertw() for values very close to zero * Fix a à b^x + cx = d when a and c have different signs and d is non-zero * Fix a^x à b^x = c when a and b is negative, and c is positive * Fix segfaults in some corner cases * Fix potential issues in handling of leap seconds (e.g. during subtraction of seconds from date) * var=a syntax for variable assignment with calculated expression * Replace ounce with fluid ounce during conversion to volume unit * Solve a^x + b^x + ⦠= c in more cases * Improve remainder/modulus for numerators with large exponents * Truncate number in output of parsed expression and end with ellipsis if unable to display all decimals * Improved floating point calculation and output speed, particularly for simple expressions with very high precision * New functions: clip(), qFormat(), qError() * "clear history" command and option to clear (not save) history on exit (CLI) * Replace selection (instead of wrap in parentheses) on operator input if selection ends with operator (GTK, Qt) * Act as if two arguments are required when applying base-N logarithm to expression (GTK, Qt) * When applying function to expression, exclude to/where expression and place cursor before closing parenthesis if operator is last in selection (GTK) * Show padlock (or "[P]") after protected expression (Qt) * Fix name field not working in argument edit dialog (Qt) * Minor bug fixes and feature enhancements ==== seahorse ==== Version update (42.0 -> 43.0) Subpackages: gnome-shell-search-provider-seahorse seahorse-lang - Update to version 43.0: + When showing an empty page, there's now a button to add a new item directly. + Fixed some warnings related to .authorized_keys or .other_keys not existing on the system. + Keysharing over DNS-SD is now disabled by default. + Port to libsoup3. + Updated translations. - Drop ab2f253c.patch: Fixed upstream. - Add desktop-file-utils BuildRequires: New dependency. - Add appstream-glib BuildRequires: Optional BuildRequires for validation of appdata during meson_test. ==== tcpd ==== - Add hosts.allow and hosts.deny config files from the netcfg package, as they are tcpd specific, bsc#1099755 ==== tiff ==== Subpackages: libtiff5 libtiff5-32bit - security update: * CVE-2022-2519 [bsc#1202968] * CVE-2022-2520 [bsc#1202973] * CVE-2022-2521 [bsc#1202971] + tiff-CVE-2022-2519,CVE-2022-2520,CVE-2022-2521.patch ==== timezone ==== Version update (2022d -> 2022e) - timezone update 2022e: * Jordan and Syria switch from +02/+03 with DST to year-round +03 ==== timezone-java ==== Version update (2022d -> 2022e) - timezone update 2022e: * Jordan and Syria switch from +02/+03 with DST to year-round +03 ==== xdg-user-dirs-gtk ==== Version update (0.10+13 -> 0.11) Subpackages: xdg-user-dirs-gtk-lang - Update to version 0.11: + Updated translations. ==== xf86-input-vmmouse ==== Version update (13.1.0 -> 13.2.0) - xf86-input-vmmouse 13.2.0: * Update "See Also" list in vmmouse_detect man page * Update configure.ac bug URL for gitlab migration * gitlab CI: add a basic build test * autogen.sh: Implement GNOME Build API * autogen.sh: use quoted string variables * tools: Fix declaration of xf86EnableIO() * autogen: add default patch prefix * Drop maintainer mode from autogen.sh * autogen.sh: use exec instead of waiting for configure to finish * Replace unportable test(1) operator. * Add NetBSD/amd64 support for iopl calls. ==== yast2-network ==== Version update (4.5.8 -> 4.5.9) - Do not assume wicked will be installed by default anymore and return the needed packages by the selected backend when them are not installed (bsc#1201235, bsc#1201435) - 4.5.9 ==== yast2-trans ==== Version update (84.87.20221009.3d63202666 -> 84.87.20221016.284cfa770d) Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sl yast2-trans-sr yast2-trans-sv yast2-trans-ta yast2-trans-th yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu - Update to version 84.87.20221016.284cfa770d: * Translated using Weblate (Russian) * Translated using Weblate (Italian) * Translated using Weblate (Italian) * Translated using Weblate (Italian) * Translated using Weblate (Italian) * Translated using Weblate (Italian) * Translated using Weblate (Italian) ==== zenity ==== Subpackages: zenity-lang - Drop pkgconfig(libnotify) and pkgconfig(webkit2gtk-4.1) BuildRequires: Upstream disabled building of libnotify and html support by default more than a year ago, and we have not been building that support in this time, so lets drop the unused dependencies.