Packages changed: MicroOS-release (20261102 -> 20261103) SVT-AV1 (4.2.0 -> 4.3.0) curl expat (2.9.0 -> 2.10.0) lcms2 (2.19.1 -> 2.20) libdeflate (1.25 -> 1.26) libheif (1.23.6 -> 1.23.7) libjpeg-turbo libnfs libopenmpt (0.8.9 -> 0.8.10) ngtcp2 (1.25.0 -> 1.26.0) openexr (3.5.2 -> 3.5.3) python-maturin (1.15.0 -> 1.16.0) selinux-policy (20261019 -> 20261030) xterm (411 -> 412) === Details === ==== MicroOS-release ==== Version update (20261102 -> 20261103) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== SVT-AV1 ==== Version update (4.2.0 -> 4.3.0) - Update to release 4.3.0 * Improvedd the quality vs. speed tradeoffs across all presets: * ~5-8% improvement in cycle efficiency at similar quality levels * ~10-11% run time reduction in multi-threaded mode * Speed optimizations in MD pruning, RDOQ and coefficient cost, MV cost and subpel search, loop filter parameter derivation, and block copies * Now runs anti-aliasing-aware screen content detection only on I-frames in multi-threaded mode * Added low-delay tile parallelism * Added opt-in CBR pre-encode frame skipping * Added screen content tools for RTC: IntraBC on I-frames and palette on intra blocks of inter frames ==== curl ==== Subpackages: libcurl4 - Make the wcurl subpackage noarch: it ships a single shell script wrapper, so the architecture-specific build was flagged by no-binary; also capitalise its summary - Drop the obsolete Group tags from the fish and zsh completion subpackages ==== expat ==== Version update (2.9.0 -> 2.10.0) - update to 2.10.0: * Security fixes: * CVE-2026-113351, bsc#1286599: denial of service with use of XML_ParserReset * CVE-2026-115506, bsc#1287856: detect billion laughs attacks quicker and more of its variations * CVE-2026-117610, bsc#1288868: fix initial non-final empty subparser parse calls, was segfaulting * CVE-2026-118370, bsc#1288849: protect attIndex and nPrefixes in storeAtts from signed integer overflow * Bug fixes: * Initialize m_parsingStatus.finalBuffer in parserInit * Improve XML_Parse for XML_CONTEXT_BYTES == 0 * Use C99 length modifiers for ptrdiff_t and size_t * Check isCalledFromInsideHandler first in XML_Parse * Add missing check for a character handler reset * Library version bumped from 14:0:13 to 14:1:13 ==== lcms2 ==== Version update (2.19.1 -> 2.20) - Update to version 2.20 * Added a plug-in type for profile header parsing. * Fixed premultiplied alpha on planar 16 bit and optimized matrix-shaper transforms. * Fixed planar half float and Lab double formatters, and planar strides in fast_float. * Fixed gamut checking with two profiles and a possible crash with malformed profiles. * Recovered neutrality correction in black point detection. * Made cmsCreateLab2Profile white point handling consistent with cmsCreateLab4Profile. * Fixed UTF8 buffer size calculation. * CGATS parser is now more permissive on certain properties. * Fixed callback type mismatch in resampled CLUT evaluation. * Fixed a crash in PostScript CSA generation. * Fixed memory leaks in black preserving intents and .cube loading. * cmsChangeBuffersFormat now correctly rejects format changes on floating point transforms. ==== libdeflate ==== Version update (1.25 -> 1.26) - update to 1.26: * Added support for compression level -1 as an alias for the default compression level (6). * libdeflate now requires a C11 compiler. * Fixed build failures with clang 18 specifically (clang 19+ unaffected). * Fixed build failure with glibc 2.43 and later. * Enabled unaligned access optimizations on all PowerPC variants. * Improved CRC-32 performance on Arm Neoverse V-Series processors by selecting a faster CRC-32 implementation for these processors. * The CMakeLists.txt now supports the user overriding `CMAKE_C_FLAGS_RELEASE`. * The CMakeLists.txt no longer runs installation commands when it is built as a subproject. ==== libheif ==== Version update (1.23.6 -> 1.23.7) - update to 1.23.7: * CVE-2026-XXXXX (GHSA-xwcv-cp39-m2w4) Out-of-bounds read in the OpenH264 decoder plugin. An AVC SPS that libheif's coded- size check could not parse was skipped and still passed to OpenH264, which accepts cropping offsets whose sum wraps around and returns plane pointers far outside of its frame buffer. An SPS that cannot be parsed is now an error, also in subset SPS NAL units. The VVC SPS check had the same pattern and fails closed as well. Introduced with the coded-size check of v1.23.5. (high) * CVE-2026-XXXXX (GHSA-jx54-6rm6-2cgj) The AV1 coded-size check of v1.23.5 could be bypassed with libaom through an OBU without a size field. libheif stopped scanning at that OBU, while libaom continued and decoded a later, larger sequence header and frame. The last OBU of a sample is now given an explicit size before the data is scanned and decoded, so that both see the same framing. (high) * CVE-2026-XXXXX (GHSA-fpr5-xpfr-vcq3) The AV1 coded-size check of v1.23.5 could be bypassed with libaom. `num_ticks_per_picture_minus_1` was read with a UVLC reader that stops after 20 leading zero bits, although AV1 allows 31, and the error was ignored. The sequence header was then skipped, or scanned from the middle of the code where it could yield a small decoy size, and libaom allocated the real, much larger frame. The AV1 UVLC reader now follows the AV1 specification, and a sequence header that cannot be scanned completely is rejected. (high) * CVE-2026-XXXXX (GHSA-35mc-3887-rr37) Heap use-after-free when grid tiles are decoded in parallel. Several derived tiles (`iovl`, `iden` or `grid`) can share one coded input image. Their bit-depth queries read the decoder data of that input while another tile thread replaced it during decoding. A crafted file could crash the application or corrupt the heap with default options. The bit-depth queries now lock the decode mutex of the queried item. Only v1.23.6 is affected. (high) * CVE-2026-XXXXX (GHSA-hpg4-g2gc-pq42) Heap buffer overflow when padding an image to a size that is larger in one dimension and smaller in the other. `heif_image_extend_padding_to_size()` could be reached with such a size by re-encoding a sequence whose frames have different sizes with the x265 or x264 sequence encoder. Padding now refuses a size below the image or any of its planes, checks all planes before changing them, and the sequence encoders refuse a frame whose size differs from the first frame. (high) * CVE-2026-XXXXX (GHSA-9rpf-2x22-78m9) `heif_context_encode_thumbnail()` returned success without setting the output handle when the image already fits into the bounding box. Callers that released the handle, among them `heif-enc -t` and the C++ wrapper, freed an uninitialized or stale pointer (use-after-free, double free). The handle is now set to NULL in that case, as the API documentation says. (high) * CVE-2026-XXXXX (GHSA-48p4-gj45-w9v6) CPU exhaustion through derived images that decode a large image again and again and use only a few pixels of it, for example a grid of 1x1 tiles that are each a `clap` crop of an 8192x8192 overlay. A 2.6 kB file took 26 seconds to decode. Each decode now has a pixel budget of twice the size of the distinct images it uses (at least 2048x2048, at most `max_image_size_pixels`), single- tile decodes get their share of it, an exceeded security limit in a grid tile is an error also without strict decoding, and grid tiles outside of the image are not decoded. (high) * CVE-2026-XXXXX (GHSA-2g6j-vhr6-6wrj) CPU exhaustion through many coded pictures in one image item or sequence sample. The decoder decoded all of them, although only one image is returned: a 16 kB file with 1000 hidden HEVC pictures of 4096x4096 took 14 seconds. More than eight coded pictures per decode are now refused. HEVC, AVC and VVC count picture starts, AV1 counts frame OBUs, and AVC data with embedded start codes is refused. (high) * CVE-2026-XXXXX (GHSA-7qm8-hj35-269r) CPU exhaustion through repeated transformations. An item could carry many associations of the same `irot`, `imir` or `clap` property, and `iden` chains multiplied them: a 28 kB file took 73 seconds to decode. An item may now have at most one association of each of these properties, as HEIF requires, and at most 32 transformations are applied along a decode path. (high) * CVE-2026-XXXXX (GHSA-hhg3-fxg7-3gxw) CPU exhaustion while opening a file whose images have many `colr` associations. Reading the file regenerated and compared a colour profile property for every association. Reading and encoding now store colour profiles separately, so that opening a file does not create properties. (high) * CVE-2026-XXXXX (GHSA-73j7-gvm9-x8q6) CPU exhaustion in sequence decoding through samples that produce no output, for example when an edit list repeats a sample that the decoder does not display. One call of `heif_track_decode_next_image()` could run for minutes, also with `ignore_sequence_editlist`. The number of samples that are decoded without returning frames is now limited per codec, and `ignore_sequence_editlist` stops after the original samples. (high) * CVE-2026-XXXXX (GHSA-74mj-m37q-h3q9) Quadratic CPU time when opening a file with a `moov` box. The `stsc` entry of every chunk was looked up by a linear scan, so a file with many ... changelog too long, skipping 56 lines ... 16-bit grayscale images with alpha ==== libjpeg-turbo ==== - update to 3.2.1: * Fixed a regression that broke Unix builds where position-independent code was disabled for static libraries. Workaround: set CMAKE_POSITION_INDEPENDENT_CODE or use a toolchain that enables PIC automatically. * Sped up RGB-to-baseline JPEG compression by 10-17% with the accurate integer DCT algorithm on RISC-V Vector (RVV) hardware, using strided segment load and multiply-accumulate intrinsics. * Hid symbols of the in-tree zlib and libspng implementations and renamed the zlib symbols, so static TurboJPEG API users do not expose or call them by accident. * Fixed an integer overflow and buffer overrun in tj3LoadImage12() and tj3LoadImage16() when a 32-bit build loads a packed-pixel image with more than 2^31 components. * Fixed a division by zero (CVE-2026-75466) when loading a non-grayscale indexed-color PNG image with TJPF_UNKNOWN pixel format. * Fixed wrong chrominance from tj3DecompressToYUV*() for 4:2:0, 4:1:0 and 2:4 images with the fast IDCT and 1/2 scaling. * Fixed a buffer overrun and segfault when partially decompressing a crafted 4:2:0 image with merged upsampling, SIMD disabled and a crop that leaves 1-2 samples per component plane. * Hardened the libjpeg API against 12-bit full-color decompression with one-pass quantization and RGB565 conversion enabled. * Fixed jpeg*_skip_scanlines() with non-fancy upsampling: wrong scanline count, or skipped scanlines returned later. * Hardened the TurboJPEG API against an ignored fatal error from tj3DecompressHeader() followed by a retry with a valid image. This could report wrong dimensions and cause a too-small output buffer. * Made tj3DecompressHeader() always drop a previously extracted ICC profile, so tj3GetICCProfile() and tj3TransformBufSize() no longer see stale data. * Made tj3TransformBufSize() account for all extra markers copied to the destination: comments, JFIF thumbnails and Exif data. ==== libnfs ==== - Add libnfs-CVE-2026-108985.patch: ZDR: enforce the maxsize bound (bsc#1284986, CVE-2026-108985). ==== libopenmpt ==== Version update (0.8.9 -> 0.8.10) - Update to version 0.8.10 * [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx * [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615). ==== ngtcp2 ==== Version update (1.25.0 -> 1.26.0) Subpackages: libngtcp2-16 libngtcp2_crypto_gnutls8 libngtcp2_crypto_ossl0 - Update to 1.26.0: * New API: ngtcp2_conn_tx_strmq_push_if_not and an extend_max_data callback * Receiving STOP_SENDING no longer closes the stream; a STREAM_LIMIT error is returned on STREAMS_BLOCKED violations * STREAM_DATA_BLOCKED and DATA_BLOCKED are now sent only when data is actually blocked * CUBIC congestion control fixes: CWND increment, undo state reset on confirmed loss, slow-start pacing gain * Hardened connection ID handling, path validation and client migration, plus 0RTT and token handling fixes * 32-bit platform fixes and a fixed heap overrun on targets with 4-byte aligned malloc - Rebase curl-impersonate.patch and ngtcp2-boringssl-shared.patch for the new sources - Spec cleanup: use pkgconfig() interdependencies between the - devel subpackages and tag the carried patches ==== openexr ==== Version update (3.5.2 -> 3.5.3) Subpackages: libIex-3_5-34 libIlmThread-3_5-34 libOpenEXR-3_5-34 libOpenEXRCore-3_5-34 - Update to version 3.5.3: * Add support for Python 3.15 * Several diagnostic/correctness fixes across the utility tools (exrmetrics, exrmultipart, exrcheck) and core decompression paths (courtesy of @ssoj13/Alex Khal) * Address several long-standing build errors and test failures on i686 (32-bit linux) and s390x (big-endian) hosts. * Fix build issues on macOS < 10.15 * Fix build issues on powerpc * Fix for absolute paths for libm in OpenEXRTargets.cmake * Fix for running on Windows 7 involving CreateFile2 ==== python-maturin ==== Version update (1.15.0 -> 1.16.0) - Update to 1.16.0 * Update version mapping for GraalPy 3.13 gh#PyO3/maturin#3297 * properly normalize / validate abiflags and include in environment signature gh#PyO3/maturin#3299 * Fix MinGW stable ABI library names in generated PyO3 config gh#PyO3/maturin#3298 * fix: lossy-decode external command output in interpreter discovery gh#PyO3/maturin#3302 * build(deps): update rustls for RUSTSEC-2026-0285 gh#PyO3/maturin#3308 * Include SOABI_PLATFORM in Python 3.15 stable ABI extension filenames gh#PyO3/maturin#3305 * Sort compressed tag sets gh#PyO3/maturin#3315 * Update manylinux/musllinux policies to the latest main gh#PyO3/maturin#3322 * docs: recommend declaring the Rust MSRV gh#PyO3/maturin#3317 * Emit a WASI platform tag for non-bin extension wheels gh#PyO3/maturin#3321 * Don't include the cargo target directory or cache directories in wheels built from sdists gh#PyO3/maturin#3320 * fix: avoid global uv fallback in pixi environments gh#PyO3/maturin#3306 * Fix the cargo-deny advisories that fail Lint gh#PyO3/maturin#3328 * Update pyo3-introspection to 0.30 gh#PyO3/maturin#3329 * Ignore unreachable zip extract advisories in cargo deny gh#PyO3/maturin#3334 * Normalize Provides-Extra names from project.optional-dependencies gh#PyO3/maturin#3333 * Join a multi-line description into a single-line Summary gh#PyO3/maturin#3332 * Update https cert bundle for the eMudhra CA compromise gh#PyO3/maturin#3337 * fix: use the toolchain pyodide-build expects gh#PyO3/maturin#3338 * feat: upload emscripten wheels to pypi gh#PyO3/maturin#3340 * use system ca certificates instead of ureq's WebPki when building with native-tls gh#PyO3/maturin#3341 * Put all License-File entries at the sdist root gh#PyO3/maturin#3331 * Pass macosx_deployment_target to zigbuild gh#PyO3/maturin#3313 * Use the pp80 ABI tag for PyPy 3.12 in the bundled sysconfig gh#PyO3/maturin#3343 * feat: add configurable PGO dependency group gh#PyO3/maturin#3310 gh#PyO3/maturin#3278 * fix: update rustix to 1.1.5 gh#PyO3/maturin#3344 ==== selinux-policy ==== Version update (20261019 -> 20261030) Subpackages: selinux-policy-targeted - Update to version 20261030: * Allow rebootmgr to initialize reboot and soft-reboot (bsc#1287746) * Allow httpd map its private runtime files * Allow qatlib get attributes of a hugetlbfs filesystem * Allow rhsmcertd list insights-client config dirs * Allow svirt_tcg_t to use the passt user-mode networking backend * Allow sshd_session_t to forward connections to a container runtime socket * Allow systemd-oomd the kill capability in the user namespace * Allow systemd-oomd signull all domains * Revert "Allow systemd-oomd signull systemd-resolved" * Update the nvme block devices regex in file context specification * Allow keepalived getpgid of its unconfined scripts * Allow init mounton system dbus pid socket files * Allow systemd-oomd signull systemd-resolved * Allow login_userdomain watch localization files for changes * Allow login_userdomain mounton gnome generic data home dirs * Revert Allow sdbootutil_t write access to /var/lib/sdbootutil (bsc#1281087) * Label /run/gnome-remote-desktop with gnome_remote_desktop_var_run_t * Allow systemd_nsresourced_t setuid/setgid inside a userns (bsc#1285095) * Allow access to systemd-nsresourced runtime socket (bsc#1284651) * Allow smbd watch public directories used for file transfer services * Allow sshd-session read systemd-nsresourced runtime socket file * Allow chrome_sandbox_t map its private tmpfs files * Allow sysadm_t to create iSCSI netlink sockets * Allow ktlshd connect to pcscd over a unix stream socket * Add iptables_dontaudit_read_var_run_dirs() interface * Allow polkit-auth read systemd-nsresourced runtime socket file * Allow systemd-nsresourced the sys_admin capability * Label /var/cache/boomaga with cupsd_rw_etc_t * Allow dirsrv to read filesystem sysctls * Allow cupsd create bluetooth sockets * Allow gnome-remote-desktop handle kerberos replay cache files * Allow multiple domains read systemd-nsresourced runtime socket file * Update mount_nnp_domtrans() with nosuid_transition * Label /run/systemd/coredump socket with systemd_coredump_var_run_t - Syncing with upstream rawhide selinux-policy up to: * 8a22f4474f77c7cb32cd6d18e3da75eaef8696de ==== xterm ==== Version update (411 -> 412) Subpackages: xterm-bin xterm-resize - update to 412: * improve fix for regex-selection of a wrapped line * correct limits for a partial screen clear operation * amend DECRQM 1046 response to return set when titeInhibit is set * update wcwidth tables to Unicode 18.0.0 * update config.guess and config.sub - Spec cleanup: drop obsolete Group tags, use macros for fonts dir and man extension, use pkgconfig(ncursesw) for the wide-curses dependency