Packages changed:
  MicroOS-release (20261108 -> 20261109)
  gstreamer (1.28.8 -> 1.28.9)
  gstreamer-plugins-bad (1.28.8 -> 1.28.9)
  gstreamer-plugins-base (1.28.8 -> 1.28.9)
  harfbuzz (15.0.0 -> 15.1.0)
  kernel-source (7.3.1 -> 7.3.3)
  kirigami-addons6 (1.16.0 -> 1.16.1)
  libplist (2.8.0 -> 2.8.1)
  pipewire
  qt6-declarative

=== Details ===

==== MicroOS-release ====
Version update (20261108 -> 20261109)
Subpackages: MicroOS-release-appliance MicroOS-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== gstreamer ====
Version update (1.28.8 -> 1.28.9)
Subpackages: libgstreamer-1_0-0

- Update to version 1.28.9:
  * Highlighted bugfixes:
    + Various security fixes and playback fixes
    + decodebin3, playbin3: fix assertion that would crash music players with
    certain files and sources
    + qtdemux: fix seeking beyond the end of file in push mode
    + flvdemux: don't prematurely EOS on AVC/audio sequence end
    + rtspsrc: Reuse non-compliant URL fallback across tracks
    + H.264 and H.265 RTP depayloader header extension tracking fixes
    + level: Add 24 bits support
    + gtk4paintablesink: Mark EGL display as foreign to not terminate it
    + amfcodec: fix rate_control (H.265, AV1) and gop_size (H.265) properties
    + asio: fix stopping asio element causing crashes
    + cuda: Correctly save alpha and blend on property change
    + HLS: fix awss3hlssink EXT-X-PROGRAM-DATE-TIME moving at twice the speed
    of the target duration
    + hlssink3: Fix stream writing regression for CMAF and WebVTT sinks
    + isobmff: Fix NTP seconds roll-over past 2036
    + Fix gap event regression in MPEG-PS demuxer with certain subtitle streams
    + qsv, d3d11, d3d12: Build fixes on latest msys2 environment
    + va: do not advertise unsupported formats in encoder caps
    + v4l2 video decoder fixes including delay negotiation for H.264 and H.265
    for better decodebin2 compatibility
    + wayland: output hotplug fixes
    + webrtcsink: add support of mpph264enc encoder (rockchip)
    + Rust plugins: enable cross-compilation with sysroot in Meson build
    + cerbero: update ca-certificates and pip, and fix issue with rolling
    distro versions
    + Various bug fixes, build fixes, memory leak fixes, and other stability
    and reliability improvements
  * gstreamer:
    + paramspecs: Fix GType name mess with GstParamSpecArray/Fraction
    + taglist: don't critical when parsing random strings
    + value: Skip the caps attempt when a bracketed value can't be caps
    + value: unset the GValue when parsing a value token fails
    + value: validate int/double/fraction ranges when parsing
    + doc: Passing size=-1 to gst_buffer_extract_dup() returns all data
    + baseparse: Don't dereference frame->buffer after a zero-sized
    finish_frame() and explicitly forbid negative skip values from
    handle_frame()
    + base: Avoid memcpy()/memset() with NULL pointers and zero size
    + ptp: Make sure the ptp-helper tests are compiled and running unless tests
    are disabled

==== gstreamer-plugins-bad ====
Version update (1.28.8 -> 1.28.9)
Subpackages: libgstphotography-1_0-0 libgstplay-1_0-0

- Update to version 1.28.9:
  * amfcodec: fix rate_control(h265, av1) and gop_size (h265) properties
  * analyticsoverlay: Remove Visualization classifier
  * androidmedia: Fix drain deadlock when the srcpad loop stops
  * asfmux: Fix header size calculation for non-BMP characters in string tags
  * asfmux: Minor fixes
  * asio: fix stopping asio element causing crashes
  * codecparsers, videoparsers: Fix OOB accesses and undefined behaviour found
    by fuzzing
  * codecparsers: Fix undefined shift in nal_reader_get_ue
  * codecparsers: h265: Do not overflow conformance window size
  * codecparsers: h265: Free SEI payload when parsing fails
  * codecparsers: h26x: Reject NALs with forbidden_zero_bit set
  * codecparsers: vp9: Do not read past the end of the frame data
  * cuda: Correctly save alpha and blend on property change
  * cudaipc: Release Unix socket server resources on teardown
  * d3d12h264enc: Various fixes and enhancement
  * eagl and vulkan: Remove internal_view from the superview when finalizing
  * faac: support faac >= 2.0 (faac_* API)
  * festival: check read return value
  * h26*parse: Reject malformed NALs with forbidden_zero_bit set
  * h264 parsing : UB fixes
  * h264decoder: Fix division by zero on bogus SPS dimensions
  * h264parse: Don't finish a zero-sized frame when no start code follows
  * h265parse: only extrapolate duration for vcl nal
  * h265parse: Fix use of uninitialized HRD parameters
  * h265parser: Handle oversized SEI payloads
  * h266parser: Fix infinite loop parsing picture timing SEI
  * h266parser: Fix out-of-bounds write when parsing DCI
  * h266parser: Validate that rectangular slices fit into the tile grid
  * hlsdemux: Validate PKCS7 padding before unpadding decrypted fragments
  * ivfparse: Reject frame sizes that overflow the size check
  * mpeg4videoparse: Clamp VOS length when no terminating start code
  * mpegdemux: compare to segment position for sending gap updates
  * mpegts: Various OOB reads and similar
  * mpegts: Various fixes
  * mxf: Fix metadata creation by using g_object_new, not
    g_type_create_instance
  * mxfdemux: fix a typo and improve log
  * mxfdemux: fix out-of-bounds read when looking up delta entry by delta_id
  * qsv,d3d11,d3d12: Build fixes on latest msys2 environment
  * rfbsrc: Various fixes
  * tensordecoders: fix leaks in classifiertensordec
  * tsdemux: Check AC-3 descriptor length before reading its fields
  * unixfdsink: Fix race when starting and stopping quickly
  * v4l2codecs: h264, h265: negotiate with the first picture
  * v4l2codecs: vp9: Minimize memory allocation
  * va: do not advertise unsupported formats in encoder caps
  * va: {vp8,vp9,av1}enc: check the result of gst_va_encode_picture_new()
  * vc1parser: Zero-initialize parsed structures
  * video: fix undefined behaviour on empty unregistered user data meta
  * videoconvertscale: Don't scale in the padding described by GstVideoMeta
  * vmnc: Drop colour cursor on pixel format change and various other crash
    fixes
  * vmnc: Render the correct cursor part when clipped & don't produce invalid
    RGB shift masks
  * vulkan: fix memory leaks in decoders
  * vulkanh265dec: pass sps_scaling_list_data_present_flag from the SPS
  * wayland: output hotplug fixes
  * wpe2: Fix mouse pointer buttons mismatch

==== gstreamer-plugins-base ====
Version update (1.28.8 -> 1.28.9)
Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0

- Update to version 1.28.9:
  * appsink: keep queued sticky events across a flush
  * eagl and vulkan: Remove internal_view from the superview when finalizing
  * decodebin3 aborts on giostreamsrc + parsebin with ID3-tagged MP3
  * decodebin3: Crash in GstPad playing a MP3 file
  * decodebin3: mq_slot_handle_stream_start: assertion failed: (collection)
  * decodebin3: Null-deref crash in gst_decodebin_input_link_to_slot with
    Strawberry player
  * discoverer: Fix use-after-free when a stream reuses its parent
  * parsebin: Handle lazy stream-id generation
  * qsv,d3d11,d3d12: Build fixes on latest msys2 environment
  * samiparse: Drop already parsed text from the HTML context buffer
  * samiparse: Fix when encountering unclosed tags to prevent slowdown
  * udmabuf: Allow disabling via env var
  * video: fix undefined behaviour on empty unregistered user data meta
  * video: vbi: reject pixel widths narrower than one conversion group
  * videoconvertscale: Don't scale in the padding described by GstVideoMeta

==== harfbuzz ====
Version update (15.0.0 -> 15.1.0)
Subpackages: libharfbuzz-gobject0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0

- Update to version 15.1.0:
  * Add buffer deserialization APIs that report progress as a byte offset, for
    use from introspection bindings.
  * Fix Indic shaping of the Unicode 18 Devanagari and Bengali additions.
  * Fix Arabic fallback shaping: wrong ligatures when a component is missing
    from the font, and disappearing marks in legacy fonts.
  * Fix `COLR` glyph extents and mark positioning in fonts with empty layers.
  * Fix AAT shaping: wrong `kerx` kerning (formats 1 and 2) and mark
    positioning (format 4, a 14.3.0 regression), and ignored `kern` and `mort`
    tables with a non-first initial state.
  * Various fixes to the Graphite2 shaper.
  * Report HarfRust shaping failures through
    `hb_buffer_allocation_successful()`.
  * Fix wrong outlines in `gvar` fonts with intermediate tuples.
  * Fix `hb_face_create_or_fail()` rejecting face indices with named-instance
    bits set.
  * Fix wrong fallback metrics: the vertical descender in fonts without `vhea`,
    and the hanging baseline for some scripts.
  * Fix `hb_ot_layout_lookup_collect_glyph_alternates()` collecting garbage
    from `AlternateSubst` and `SingleSubst` format 1 lookups.
  * Speed up shaping on faces with many shape plans,
    `hb_language_from_string()`, vertical text with `hb-ft`, and `CBDT` and
    `sbix` fonts.
  * Fix crashes and deadlocks with FreeType, including `hb_ft_font_set_funcs()`
    on immutable fonts and font queries from color paint callbacks.
  * Fix crashes with NULL result pointers in
    `hb_ot_metrics_get_position_with_fallback()`,
    `hb_ot_layout_get_font_extents()`, and `hb_ot_layout_get_font_extents2()`.
  * Fix use-after-free in `hb_map_update()` when updating a map from itself.
  * Various fixes for crashes, hangs, and memory use with malformed fonts.
  * Faster subsetting of large `GSUB` and `GPOS` tables, and smaller `CFF`
    output.
  * Partially instancing or desubroutinizing `CFF2` fonts with nested blends
    now fails instead of changing the outlines.
  * Subsetting now fails if a glyph mapping assigns another glyph to glyph 0.
  * Fix `hb_subset_axis_range_from_string()` reading past the given length.
  * Fix subsetting beyond-64k variable fonts losing `HVAR` advance deltas.
  * Various subsetting and instancing fixes, mostly for `CFF`, `CFF2`, and
    `COLR`.
  * Fix rotated and skewed rectangle clips hiding their contents in the raster
    library, and out-of-bounds access when extents change during painting.
  * Fix the vector library mirroring path clips in SVG, and writing PDFs with
    wrong page bounds and misplaced or clipped `COLR` gradients.
  * Fix wrong clipping of `COLR` layers in the GPU library.
  * Various Cairo integration fixes, including a memory leak per scaled font.
  * Fix `hb-info --list-*` crashes on unusual fonts.
  * Various build and CI fixes.
  * New API: +hb_buffer_deserialize_glyphs2() +hb_buffer_deserialize_unicode2()

==== kernel-source ====
Version update (7.3.1 -> 7.3.3)

- Update
  patches.kernel.org/7.3.1-002-mm-damon-core-error-damos_commit_quota_goal-for.patch
  (bsc#1012628 CVE-2026-99240 bsc#1289193).
- Update
  patches.kernel.org/7.3.1-003-Bluetooth-L2CAP-refuse-__l2cap_chan_add-if-chan.patch
  (bsc#1012628 CVE-2026-99239 bsc#1289189).
- Update
  patches.kernel.org/7.3.1-005-tracing-Hold-trace_types_lock-when-updating-mod.patch
  (bsc#1012628 CVE-2026-99238 bsc#1289182).
- Update
  patches.kernel.org/7.3.1-006-tracing-Hold-trace_types_lock-when-resetting-la.patch
  (bsc#1012628 CVE-2026-99237 bsc#1289181).
- Update
  patches.kernel.org/7.3.1-007-tracing-Reject-incomplete-event-filter-expressi.patch
  (bsc#1012628 CVE-2026-99236 bsc#1289229).
- Update
  patches.kernel.org/7.3.1-008-tracing-Save-the-event-file-instead-of-the-comp.patch
  (bsc#1012628 CVE-2026-99235 bsc#1289218).
- Update
  patches.kernel.org/7.3.1-009-tracing-Unregister-field-variable-histograms-wh.patch
  (bsc#1012628 CVE-2026-99234 bsc#1289217).
- Update
  patches.kernel.org/7.3.1-012-tracing-histograms-Verify-event_call-identity-w.patch
  (bsc#1012628 CVE-2026-99233 bsc#1289227).
- Update
  patches.kernel.org/7.3.1-013-tracing-syscalls-Use-copy_from_user-for-the-fau.patch
  (bsc#1012628 CVE-2026-99232 bsc#1289228).
- Update
  patches.kernel.org/7.3.1-017-io_uring-waitid-prevent-cancel-reference-wrap.patch
  (bsc#1012628 CVE-2026-99227 bsc#1289219).
- Update
  patches.kernel.org/7.3.1-019-keys-Avoid-the-owner-account-dereference-in-nam.patch
  (bsc#1012628 CVE-2026-99226 bsc#1289220).
- Update
  patches.kernel.org/7.3.1-020-keys-Check-the-authorization-payload-in-process.patch
  (bsc#1012628 CVE-2026-99225 bsc#1289221).
- Update
  patches.kernel.org/7.3.1-021-keys-Protect-the-type-name-while-describing-a-k.patch
  (bsc#1012628 CVE-2026-99224 bsc#1289223).
- Update
  patches.kernel.org/7.3.1-022-keys-make-keyring-indexes-independent-of-kernel.patch
  (bsc#1012628 CVE-2026-99223 bsc#1289224).
- Update
  patches.kernel.org/7.3.1-023-keys-Protect-the-read-method-check-against-type.patch
  (bsc#1012628 CVE-2026-99222 bsc#1289209).
- Update
  patches.kernel.org/7.3.1-024-KEYS-Fix-key_reject_and_link-race-with-keyring-.patch
  (bsc#1012628 CVE-2026-99245 bsc#1289347).
- Update
  patches.kernel.org/7.3.1-026-keys-trusted_keys-return-immediately-after-TPM-.patch
  (bsc#1012628 CVE-2026-99221 bsc#1289204).
- Update
  patches.kernel.org/7.3.1-027-asymmetric_keys-reject-trust-keys-without-IDs.patch
  (bsc#1012628 CVE-2026-99220 bsc#1289225).
- Update
  patches.kernel.org/7.3.1-028-ftrace-Initialize-modname-and-offset-in-print_r.patch
  (bsc#1012628 CVE-2026-99219 bsc#1289188).
- Update
  patches.kernel.org/7.3.1-029-coredump-hold-RCU-while-releasing-parked-thread.patch
  (bsc#1012628 CVE-2026-99218 bsc#1289176).
- Update
  patches.kernel.org/7.3.1-038-pid_namespace-prevent-TIF_NOTIFY_SIGNAL-from-in.patch
  (bsc#1012628 CVE-2026-99244 bsc#1289343).
- Update
  patches.kernel.org/7.3.2-017-io_uring-waitid-own-the-request-before-clearing.patch
  (bsc#1012628 CVE-2026-99231 bsc#1289215).
- Update
  patches.kernel.org/7.3.2-018-io_uring-cmd-don-t-leave-list-poison-in-hash_no.patch
  (bsc#1012628 CVE-2026-99230 bsc#1289226).
- Update
  patches.kernel.org/7.3.2-019-io_uring-wait-don-t-spin-on-a-stuck-overflow-li.patch
  (bsc#1012628 CVE-2026-99229 bsc#1289216).
- Update
  patches.kernel.org/7.3.2-020-io_uring-io-wq-don-t-lose-the-signal-that-ends-.patch
  (bsc#1012628 CVE-2026-99228 bsc#1289222).
- Update
  patches.kernel.org/7.3.2-021-io_uring-io-wq-don-t-hide-a-link-from-cancellat.patch
  (bsc#1012628 CVE-2026-99255 bsc#1289285).
- Update
  patches.kernel.org/7.3.2-022-io_uring-don-t-flood-a-cancelling-task-with-tas.patch
  (bsc#1012628 CVE-2026-99254 bsc#1289306).
- Update
  patches.kernel.org/7.3.2-024-io_uring-cancel-rearm-local-work-wake-up-before.patch
  (bsc#1012628 CVE-2026-99253 bsc#1289298).
  suse-add-cves
- commit 69165fa
- Linux 7.3.3 (bsc#1012628).
- xen-blkback: Avoid UAF when reading I/O statistics
  (bsc#1012628).
- xen-netback: defer xenvif_mcast_addr_list_free() (bsc#1012628).
- xen-netback: Fix UAF when reading statistics data (bsc#1012628).
- commit 380c3b2
- Linux 7.3.2 (bsc#1012628).
- net: skbuff: propagate shared-frag marker in skb_zerocopy()
  (bsc#1012628).
- ksmbd: wait for negotiation before receiving another PDU
  (bsc#1012628).
- smb: smbdirect: don't wait for RDMA_CM_EVENT_DISCONNECTED in
  smbdirect_socket_destroy_sync() (bsc#1012628).
    ... changelog too long, skipping 985 lines ...
- commit 8e02181

==== kirigami-addons6 ====
Version update (1.16.0 -> 1.16.1)
Subpackages: libKirigamiAddonsComponents6 libKirigamiAddonsStatefulApp6 libKirigamiApp6

- Update to 1.16.1
  https://carlschwan.eu/2026/11/06/kirigami-addons-1.16.1/

==== libplist ====
Version update (2.8.0 -> 2.8.1)

- Update to version 2.8.1:
  * Hardening: length-based range checks for bplist object data,
    node-count limit against crafted reference expansion, geometric
    bytearray growth fixing quadratic appends on large plists
  * Fix use-after-free in plist_copy_node(), double-free in
    node_from_xml() error paths and leaks on allocation failure
    across the XML, binary and OpenStep parsers
  * Fix plist_get_date_val() rounding and sign handling so dates
    round-trip, handle out-of-range and NaN without UB
  * No SONAME or API change (libtool 12:0:0 -> 12:1:0, headers
    unchanged); libplist-2_0-12 subpackages carry over
- Spec cleanup: ldconfig scriptlets, macro-ified paths and build
  calls, reordered dependencies (no functional change)

==== pipewire ====
Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools

- Replace the patch with the upstream version from the 1.6 branch
  which includes the required #include <libcamera/version.h>
  * 0001-spa-libcamera-device-0.8-compatibility.patch
- Add patch from upstream to fix compatibility with libcamera 0.8
  * 0001-spa-libcamera-device-0.8-compatibility.patch

==== qt6-declarative ====
Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlDesignSupport6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports

- Re-add 0001-QML-engine-Correctly-compare-composites-when-multipl.patch
  (boo#1289020)