Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=kubic&groupid=1&version=Tumbleweed&build=20210502 https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&component=Kubic&query_format=advanced&resolution=--- Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: autofs (5.1.6 -> 5.1.7) coreutils haproxy (2.3.9+git1.afb63bc04 -> 2.3.10+git0.4764f0e4e) iproute2 (5.11 -> 5.12) kernel-source libzypp (17.25.9 -> 17.25.10) open-iscsi python38 (3.8.8 -> 3.8.9) python38-core (3.8.8 -> 3.8.9) snapper yomi-formula (0.0.1+git.1604593202.a2c22bf -> 0.0.1+git.1619170188.fa52819) zypper (1.14.43 -> 1.14.44) === Details === ==== autofs ==== Version update (5.1.6 -> 5.1.7) - Upgrade to 5.1.7 - make bind mounts propagation slave by default. - update ldap READMEs and schema definitions. - fix program map multi-mount lookup after mount fail. - fix browse dir not re-created on symlink expire. - fix a regression with map instance lookup. - correct fsf address. - samples: fix Makefile targets' directory dependencies - remove intr hosts map mount option. - fix trailing dollar sun entry expansion. - initialize struct addrinfo for getaddrinfo() calls. - fix quoted string length calc in expandsunent(). - fix autofs mount options construction. - mount_nfs.c fix local rdma share not mounting. - configure.in: Remove unneeded second call to PKG_PROG_PKG_CONFIG. - configure.in: Do not append parentheses to PKG_PROG_PKG_CONFIG. - Use PKG_CHECK_MODULES to detect the libxml2 library. - fix ldap sasl reconnect problem. - samples/ldap.schema fix. - fix configure force shutdown check. - fix crash in sun_mount(). - fix lookup_nss_read_master() nsswicth check return. - fix typo in open_sss_lib(). - fix sss_master_map_wait timing. - add sss ECONREFUSED return handling. - use mapname in sss context for setautomntent(). - add support for new sss autofs proto version call. - fix retries check in setautomntent_wait(). - refactor sss setautomntent(). - improve sss setautomntent() error handling. - refactor sss getautomntent(). - improve sss getautomntent() error handling. - sss introduce calculate_retry_count() function. - move readall into struct master. - sss introduce a flag to indicate map being read. - update sss timeout documentation. - refactor sss getautomntbyname(). - improve sss getautomntbyname() error handling. - use a valid timeout in lookup_prune_one_cache(). - dont prune offset map entries. - simplify sss source stale check. - include linux/nfs.h directly in rpc_subs.h. - fix typo in daemon/automount.c. - fix direct mount unlink_mount_tree() path. - fix unlink mounts umount order. - fix incorrect logical compare in unlink_mount_tree(). - use bit flag for force unlink mounts. - improve force unlink option description. - remove command fifo on autofs mount fail. - add force unlink mounts and exit option. - cleanup stale logpri fifo pipes on unlink and exit. - fix incorrect systemctl command syntax in autofs(8). - update list.h. - add hashtable implementation. - change mountpoint to mp in struct ext_mount. - make external mounts independent of amd_entry. - make external mounts use simpler hashtable. - add a hash index to mnt_list. - use mnt_list for submounts. - use mnt_list for amdmounts. - make umount_autofs() static. - remove force parameter from umount_all(). - fix remount expire. - fix stale offset directories disable mount. - use struct mnt_list to track mounted mounts. - use struct mnt_list mounted list for expire. - remove unused function tree_get_mnt_list(). - only add expre alarm for active mounts. - move submount check into conditional_alarm_add(). - move lib/master.c to daemon/master.c. - use master_list_empty() for list empty check. - add helper to construct mount point path. - check defaults_read_config() return. - move AUTOFS_LIB to end of build rule lines. - make autofs.a a shared library. - make lookup_file.c nss map read status return handling consistent. - fix empty mounts list return from unlink_mount_tree(). - Refreshed autofs-5.1.1-dbus-udisks-monitor.patch - Replaced automount-fix-master-wait.patch with upstream patch autofs-5.1.7-Fix-option-for-master_read_wait.patch ==== coreutils ==== - Use new packageand format - coreutils-tests-fix-FP-in-ls-stat-free-color.patch: Add upstream patch to avoid FP in testsuite. - coreutils.spec: - Reference the above patch. - Change keyring URL to new GNU coreutils Group Release Keyring. - coreutils.keyring: Update with the Group Release Keyring. ==== haproxy ==== Version update (2.3.9+git1.afb63bc04 -> 2.3.10+git0.4764f0e4e) - Update to version 2.3.10+git0.4764f0e4e: * [RELEASE] Released version 2.3.10 * BUG/MEDIUM: peers: re-work refcnt on table to protect against flush * BUG/MEDIUM: peers: re-work connection to new process during reload. * BUG/MINOR: peers: remove useless table check if initial resync is finished * BUG/MEDIUM: mux-h2: Properly handle shutdowns when received with data * BUG/MINOR: mworker: don't use oldpids[] anymore for reload * BUG/MINOR: mworker/init: don't reset nb_oldpids in non-mworker cases * BUG/MEDIUM: config: fix cpu-map notation with both process and threads * BUG/MEDIUM: mux-h2: Fix dfl calculation when merging CONTINUATION frames * BUG/MAJOR: mux-h2: Properly detect too large frames when decoding headers * BUG/MINOR: server: free srv.lb_nodes in free_server * BUG/MINOR: mux-h1: Release idle server H1 connection if data are received * BUG/MINOR: logs: Report the true number of retries if there was no connection * BUG/MINOR: http_htx: Remove BUG_ON() from http_get_stline() function * BUG/MINOR: http-fetch: Make method smp safe if headers were already forwarded * BUG/MINOR: ssl-samples: Fix ssl_bc_* samples when called from a health-check * MINOR: connection: Make bc_http_major compatible with tcp-checks * BUG/MINOR: connection: Fix fc_http_major and bc_http_major for TCP connections * MINOR: logs: Add support of checks as session origin to format lf strings * BUG/MINOR: checks: Set missing id to the dummy checks frontend * BUG/MEDIUM: threads: Ignore current thread to end its harmless period * DOC: ssl: Certificate hot update only works on fronted certificates * BUG/MEDIUM: sample: Fix adjusting size in field converter * MINOR: No longer rely on deprecated sample fetches for predefined ACLs * DOC: clarify that compression works for HTTP/2 * BUG/MINOR: tools: fix parsing "us" unit for timers * CONTRIB: halog: fix issue with array of type char * REGTESTS: ssl: mark set_ssl_cert_bundle.vtc as broken * DOC: Explicitly state only IPv4 are supported by forwardfor/originalto options * REGTESTS: ssl: "set ssl cert" and multi-certificates bundle * BUG/MINOR: ssl: Add missing free on SSL_CTX in ckch_inst_free * BUG/MINOR: http_fetch: make hdr_ip() resistant to empty fields * BUG/MINOR: ssl: Prevent removal of crt-list line if the instance is a default one * BUG/MINOR: ssl: Fix update of default certificate * BUILD: tcp: use IPPROTO_IPV6 instead of SOL_IPV6 on FreeBSD/MacOS * BUG/MINOR: tcp: fix silent-drop workaround for IPv6 ==== iproute2 ==== Version update (5.11 -> 5.12) - Update to release 5.12 * devlink: Use library provided string processing APIs * utils: Introduce helper routines for generic socket recv * q_cake: Fix incorrect printing of signed values in class statistics * json_print: Add print_tv() * nexthop: Add support for nexthop buckets * nexthop: Add support for resilient nexthop groups * ip: xfrm: add support for tfcpad * tc: e_bpf: fix memory leak in parse_bpf() * lib: bpf_legacy: treat 0 as a valid file descriptor * ip: drop 2-char command assumption * bridge: vlan: dump port only if there are any vlans ==== kernel-source ==== - rpm/constraints.in: remove aarch64 disk size exception obs://Kernel:stable/kernel-default/ARM/aarch64 currrently fails: installing package kernel-default-livepatch-devel-5.12.0-3.1.g6208a83.aarch64 needs 3MB more space on the / filesystem The stats say: Maximal used disk space: 31799 Mbyte By default, we require 35G. For aarch64 we had an exception to lower this limit to 30G there. Drop this exception as it is obviously no longer valid. - commit ee00b50 - series.conf: cleanup - fix Patch-mainline tag and move to "almost mainline" section: patches.suse/crypto-ccp-Annotate-SEV-Firmware-file-names.patch - commit 3a48ed8 - crypto: ccp: Annotate SEV Firmware file names (bsc#1185282). - commit 66154b6 ==== libzypp ==== Version update (17.25.9 -> 17.25.10) - Properly handle permission denied when providing optional files (bsc#1185239) - Fix sevice detection with cgroupv2 (bsc#1184997) - version 17.25.10 (22) ==== open-iscsi ==== Subpackages: iscsiuio libopeniscsiusr0_2_0 - Local (SUSE) change: update iscsi.service so that it tries to logon to any "onboot" and firmware targets, in case a target was offline when booted but back up when the service is started. (bsc#1153806) - Merged with latest from upstream, which contains these fixes: * Add "no wait" option to iscsiadm firmware login * Check for ISCSI_ERR_ISCSID_NOTCONN in iscsistart * Log proper error message when AUTH failure occurs ==== python38 ==== Version update (3.8.8 -> 3.8.9) - Update to 3.8.9: - bpo#42988 (bsc#1183374) CVE-2021-3426: Remove the getfile feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords. Vulnerability reported by David Schwörer. - bpo-43285: ftplib no longer trusts the IP address value returned from the server in response to the PASV command by default. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network. - Code that requires the former vulnerable behavior may set a trust_server_pasv_ipv4_address attribute on their ftplib.FTP instances to True to re-enable it. - bpo-43439: Add audit hooks for gc.get_objects(), gc.get_referrers() and gc.get_referents(). Patch by Pablo Galindo. - bpo-43660: Fix crash that happens when replacing sys.stderr with a callable that can remove the object while an exception is being printed. Patch by Pablo Galindo. - bpo-35883: Python no longer fails at startup with a fatal error if a command line argument contains an invalid Unicode character. The Py_DecodeLocale() function now escapes byte sequences which would be decoded as Unicode characters outside the [U+0000; U+10ffff] range. - bpo-43406: Fix a possible race condition where PyErr_CheckSignals tries to execute a non-Python signal handler. - bpo-35930: Raising an exception raised in a ?future? instance will create reference cycles. - bpo-43577: Fix deadlock when using ssl.SSLContext debug callback with ssl.SSLContext.sni_callback(). - bpo-43423: subprocess.communicate() no longer raises an IndexError when there is an empty stdout or stderr IO buffer during a timeout on Windows. - bpo-27820: Fixed long-standing bug of smtplib.SMTP where doing AUTH LOGIN with initial_response_ok=False will fail. The cause is that SMTP.auth_login _always_ returns a password if provided with a challenge string, thus non-compliant with the standard for AUTH LOGIN. Also fixes bug with the test for smtpd. - bpo-43399: Fix ElementTree.extend not working on iterators when using the Python implementation - bpo-43316: The python -m gzip command line application now properly fails when detecting an unsupported extension. It exits with a non-zero exit code and prints an error message to stderr. - bpo-43260: Fix TextIOWrapper can not flush internal buffer forever after very large text is written. - bpo-42782: Fail fast in shutil.move() to avoid creating destination directories on failure. - bpo-37193: Fixed memory leak in socketserver.ThreadingMixIn introduced in Python 3.7. - bpo-43199: Answer ?Why is there no goto?? in the Design and History FAQ. - bpo-43407: Clarified that a result from time.monotonic(), time.perf_counter(), time.process_time(), or time.thread_time() can be compared with the result from any following call to the same function - not just the next immediate call. - bpo-27646: Clarify that ?yield from <expr>? works with any iterable, not just iterators. - bpo-36346: Update some deprecated unicode APIs which are documented as ?will be removed in 4.0? to ?3.12?. See PEP 623 for detail. - bpo-37945: Fix test_getsetlocale_issue1813() of test_locale: skip the test if setlocale() fails. Patch by Victor Stinner. - bpo-41561: Add workaround for Ubuntu?s custom OpenSSL security level policy. - bpo-43631: Update macOS, Windows, and CI to OpenSSL 1.1.1k. - bpo-43617: Improve configure.ac: Check for presence of autoconf-archive package and remove our copies of M4 macros. - bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. - bpo-42225: Document that IDLE can fail on Unix either from misconfigured IP masquerage rules or failure displaying complex colored (non-ascii) characters. - bpo-43283: Document why printing to IDLE?s Shell is often slower than printing to a system terminal and that it can be made faster by pre-formatting a single string before printing. ==== python38-core ==== Version update (3.8.8 -> 3.8.9) Subpackages: libpython3_8-1_0 python38-base - Update to 3.8.9: - bpo#42988 (bsc#1183374) CVE-2021-3426: Remove the getfile feature of the pydoc module which could be abused to read arbitrary files on the disk (directory traversal vulnerability). Moreover, even source code of Python modules can contain sensitive data like passwords. Vulnerability reported by David Schwörer. - bpo-43285: ftplib no longer trusts the IP address value returned from the server in response to the PASV command by default. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network. - Code that requires the former vulnerable behavior may set a trust_server_pasv_ipv4_address attribute on their ftplib.FTP instances to True to re-enable it. - bpo-43439: Add audit hooks for gc.get_objects(), gc.get_referrers() and gc.get_referents(). Patch by Pablo Galindo. - bpo-43660: Fix crash that happens when replacing sys.stderr with a callable that can remove the object while an exception is being printed. Patch by Pablo Galindo. - bpo-35883: Python no longer fails at startup with a fatal error if a command line argument contains an invalid Unicode character. The Py_DecodeLocale() function now escapes byte sequences which would be decoded as Unicode characters outside the [U+0000; U+10ffff] range. - bpo-43406: Fix a possible race condition where PyErr_CheckSignals tries to execute a non-Python signal handler. - bpo-35930: Raising an exception raised in a ?future? instance will create reference cycles. - bpo-43577: Fix deadlock when using ssl.SSLContext debug callback with ssl.SSLContext.sni_callback(). - bpo-43423: subprocess.communicate() no longer raises an IndexError when there is an empty stdout or stderr IO buffer during a timeout on Windows. - bpo-27820: Fixed long-standing bug of smtplib.SMTP where doing AUTH LOGIN with initial_response_ok=False will fail. The cause is that SMTP.auth_login _always_ returns a password if provided with a challenge string, thus non-compliant with the standard for AUTH LOGIN. Also fixes bug with the test for smtpd. - bpo-43399: Fix ElementTree.extend not working on iterators when using the Python implementation - bpo-43316: The python -m gzip command line application now properly fails when detecting an unsupported extension. It exits with a non-zero exit code and prints an error message to stderr. - bpo-43260: Fix TextIOWrapper can not flush internal buffer forever after very large text is written. - bpo-42782: Fail fast in shutil.move() to avoid creating destination directories on failure. - bpo-37193: Fixed memory leak in socketserver.ThreadingMixIn introduced in Python 3.7. - bpo-43199: Answer ?Why is there no goto?? in the Design and History FAQ. - bpo-43407: Clarified that a result from time.monotonic(), time.perf_counter(), time.process_time(), or time.thread_time() can be compared with the result from any following call to the same function - not just the next immediate call. - bpo-27646: Clarify that ?yield from <expr>? works with any iterable, not just iterators. - bpo-36346: Update some deprecated unicode APIs which are documented as ?will be removed in 4.0? to ?3.12?. See PEP 623 for detail. - bpo-37945: Fix test_getsetlocale_issue1813() of test_locale: skip the test if setlocale() fails. Patch by Victor Stinner. - bpo-41561: Add workaround for Ubuntu?s custom OpenSSL security level policy. - bpo-43631: Update macOS, Windows, and CI to OpenSSL 1.1.1k. - bpo-43617: Improve configure.ac: Check for presence of autoconf-archive package and remove our copies of M4 macros. - bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. - bpo-42225: Document that IDLE can fail on Unix either from misconfigured IP masquerage rules or failure displaying complex colored (non-ascii) characters. - bpo-43283: Document why printing to IDLE?s Shell is often slower than printing to a system terminal and that it can be made faster by pre-formatting a single string before printing. ==== snapper ==== Subpackages: libsnapper5 - added systemd sandboxing for services ==== yomi-formula ==== Version update (0.0.1+git.1604593202.a2c22bf -> 0.0.1+git.1619170188.fa52819) - Update to version 0.0.1+git.1619170188.fa52819: * README: document ym.sshd parameter - Update to version 0.0.1+git.1614275707.786435e: * pillar: update to SLE-15-SP2 * fstab: do not mount while registering * devices: fix documentation * Adding a TOC * software: add recreatedb.sls for rpmdb migration * repository: workaround for boo#1178910 * software: separate repository.sls * network: generate persistent-net.rules ==== zypper ==== Version update (1.14.43 -> 1.14.44) Subpackages: zypper-needs-restarting - Rephrase needs-rebooting help and messages. Try to point out that the need to reboot was not necessarily triggered by the current transaction. - man page: Recommend the needs-rebooting command to test whether a system reboot is suggested. - patch: Let a patch's reboot-needed flag overrule included packages (bsc#1183268) - Quickfix setting "openSUSE_Tumbleweed" as default platform for "MicroOS" (bsc#1153687) This fixes the guessed platform for "obs://<project>/" URLs. - Protect against strict/relaxed user umask via sudo (bsc#1183589) - zypper-log: protect against thread name indicators in a log. - xml summary: add solvables repository alias (bsc#1182372) - version 1.14.44