Packages changed:
  GraphicsMagick
  ImageMagick (7.1.2.34 -> 7.1.2.35)
  apparmor
  dnsmasq
  freerdp (3.32.2 -> 3.33.0)
  libapparmor
  libusb-compat
  libusbmuxd (2.1.0 -> 2.1.1)
  mokutil (0.7.2 -> 0.7.3)
  openSUSE-release (20261103 -> 20261104)
  perl-Clone (0.500.0 -> 0.510.0)
  perl-DB_File (1.860 -> 1.861)
  permissions
  salt
  xen (4.22.0_06 -> 4.22.0_08)

=== Details ===

==== GraphicsMagick ====
Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config

- modified patches
  * GraphicsMagick-CVE-2026-46523.patch (refreshed)
  * GraphicsMagick-disable-insecure-coders.patch (refreshed)

==== ImageMagick ====
Version update (7.1.2.34 -> 7.1.2.35)
Subpackages: ImageMagick-config-7-SUSE libMagickCore-7_Q16HDRI10 libMagickWand-7_Q16HDRI10

- added patches [bsc#1282560]
  https://github.com/ImageMagick/ImageMagick/issues/9095
  * ImageMagick-tiff-correct-endianess.patch
- version update to 7.1.2.35
  * Divide by alpha in LinearBurn, Screen, Exclusion and Difference compose #9074
  * stop montage directory walk at the terminating nul #9075
  * build(deps): bump the codeql-action group with 3 updates #9070
  * build(deps): bump ubuntu from f144425 to c098726 in /.devcontainer #9065
  * Reject incomplete MTV frame headers #9055
  * add cmyko quantum to GetQuantumExtent #9060
  * build(deps): bump the codeql-action group with 3 updates #9051
  * build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 #9045
  * build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 #9046
  * build(deps): bump the codeql-action group across 1 directory with 3 updates #9032
  * build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 #9028
  * build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 #9027
  * Draw SVG strokes in the internal SVG renderer again #9031
  * Draw SVG strokes in the internal SVG renderer again (#9031) #9030
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7f2w-c8wf-xvf8 b45a28c
  * building out the shuffle images framework 955901b
  * support -shuffle operator 02a8cbc
  * restore switch case that was hosed 0e6ed70
  * Fixed build error on Windows. 2dc42f2
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-wvfx-g9wq-253w 139c692
  * Removed unused function for build where the distributed cache is disabled. 0054822
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gr4q-6v79-qj3g 28c1eb3
  * add shuffle demo ea642e5
  * completing the shuffle framework b1bc241
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4 1b0cd97
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pp97-v3gv-9vh4 a28f038
  * set reasonable max profile size ed50136
  * track parse entities exceptions 93c3733
  * throw proper exception when profile exceeds maximum 7e3e1d0
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-6xcw-8jvx-wh63 58ac439
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v86v-4xf8-xjq4 3f27cc7
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v86v-4xf8-xjq4 059c7f0
  * buffer clone nexus 1ec93e4
  * https://github.com/ImageMagick/ImageMagick/pull/9042 c950f69
  * https://github.com/ImageMagick/ImageMagick/issues/9040 06f5b60
  * https://github.com/ImageMagick/ImageMagick/issues/9041 e071d8e
  * https://github.com/ImageMagick/ImageMagick/issues/9039 578d94c
  * https://github.com/ImageMagick/ImageMagick/issues/9038 e20d7a4
  * https://github.com/ImageMagick/ImageMagick/issues/9037 4eb3c67
  * https://github.com/ImageMagick/ImageMagick/issues/9036 c0ca7f4
  * Improve readability. dfb852c
  * cosmetic ef8c025
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3pf7-cjfr-3fpq 6b833ce
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2pc3-3339-3qc9 ae72b12
  * https://github.com/ImageMagick/ImageMagick/issues/9049 e84e85b
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mf84-8w53-2f2c 5ac0936
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x3j8-cjwr-m4pv 00301ef
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m9p2-wqc3-mj22 d3a850a
  * https://github.com/ImageMagick/ImageMagick/issues/9057 816368f
  * https://github.com/ImageMagick/ImageMagick/issues/9053 a0ac982
  * Fixed build. 60de283
  * revert 949237a
  * Minor optimization. 4decb21
  * Added a check for empty profiles. 2ae4e07
  * Added new security option that can be used to limit the number of profiles an image can have (GHSA-2h6m-67xh-cm4p) 11313ac
  * Set the minimum limit to 1. 8f66633
  * Correct the return value. 10baa5f
  * Revert local test. b72361b
  * Check the number of profiles that will be added against the security policy. fa6bff5
  * add max policy count 985d464
  * Apply patch from #9061 to fix reading sixel file. c2a7577
  * Added new method to sanitize filenames and use that for GHSA-2pc3-3339-3qc9. 3a9639c
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-q66g-3m63-78mh c5f2c6c
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-p58q-7cv7-7w3m b3cb8ab
  * https://github.com/ImageMagick/ImageMagick/issues/9059 62fc3c1
  * eliminate compiler exception 692124a
  * improved UI/UX a9abe84
  * improved UI/UX b77302e
  * Correct encoding with group4 compression in tiff coder (#9058). 07883df
  * Added check to test if the tiff coder is available. f333f65
  * Corrected unit test. 915af29
  * revert 9f63ebd
  * check that columns 	  	rows are not zero bdf369b
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-m2p5-qpx9-5mx6 813d6c0
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-67p3-xhc7-g797 433b039
  * https://github.com/ImageMagick/ImageMagick/issues/9069 b9d501e
  * https://github.com/ImageMagick/ImageMagick/issues/9068 88cf314
  * eliminate compiler warning 7aa7b44
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-hg5r-hf2p-g9xq 8c56a52
  * https://github.com/ImageMagick/ImageMagick/issues/9071 1ba75b6
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5jwm-r7f4-4m53 55a2d75
  * Updated configure. 6a30a28
  * Minor code cleanup. b456c0f
  * Match both slash- and backslash-separated paths and patterns during lexical and canonical path-policy evaluation on Windows (GHSA-hpjv-7vmp-f58w) 4f3be68
  * Updated the dependencies. 96abe79
  * Updated setting the values of the SBOM. 9446665
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-c764-55gw-gj6c 3fd3608
  * https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5v9f-r478-x7vx 28f6586
  * https://github.com/ImageMagick/ImageMagick/issues/9077 942e86f
  * add mix to pixel and meta content 8152030
  * discuss DPC security a9c4102
  * cosmetic 6ea6c0d
  * https://github.com/ImageMagick/ImageMagick/pull/9062 39ad88f
  * Also create a StrictReadInlineImage implementation (GHSA-h9f8-qmvx-p39m) 998773f
  * more conservative coder depth 21c25b4
  * Corrected typo. c18f444
  * Switch to macos-15. 1f1e4d5
  * Updated configure. 9ec53fd
  * Updated the dependencies. acaf7e4

==== apparmor ====
Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-parser-lang apparmor-profiles apparmor-utils apparmor-utils-lang python3-apparmor

- add transmission-2246.patch: allow transmission to lock its
  lockfile (boo#1289007)

==== dnsmasq ====

- Add upstream security fixes:
  * CVE-2026-93006, bsc#1288828: TFTP server can serve the wrong
    file contents because a recently used transfer cache is not
    invalidated when a transfer finishes
    (dnsmasq-CVE-2026-93006.patch).
  * CVE-2026-93007, bsc#1288829: TCP DNS service uses a small fixed
    pool of child processes and does not set a receive timeout on
    client connections (dnsmasq-CVE-2026-93007.patch, partial fix).
  * CVE-2026-93008, bsc#1288830: Records for the CNAME target were
    cached without checking that they belong to the responding
    server's zone (dnsmasq-CVE-2026-93008.patch).
  * CVE-2026-93009, bsc#1288831: Out-of-bounds read in the DHCPv6
    FQDN option parser (dnsmasq-CVE-2026-93009.patch).
  * CVE-2026-93011, bsc#1288833: One-byte heap overflow of a name
    buffer in the DNSSEC validator (dnsmasq-CVE-2026-93011.patch).

==== freerdp ====
Version update (3.32.2 -> 3.33.0)
Subpackages: libfreerdp3-3 librdtk0-0 libwinpr3-3

- Update to version 3.33.0:
  * What is new:
    + Webassembly support, now can run from within your browser
    + Improved SDL client RAILS
    + Experimental UDP support for direct (without gateway) RDP connections
    + Unicode keyboard input pipe now supported by all clients (on systems that
    support mkfifo unix style pipes)
    + Experimental windows shadow server support. It is back from the dead!
    + Mac OS file clipboard support without FUSE (all clients)
    + Initial support for translation of messages The influx of pull requests
    and feedback for bugs/regressions/... was huge, so we will do a patch
    release with all the papercuts and bug still in the backlog soon.
  * CVE:
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hhfh-fvm7-7w65
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pq35-c472-69w2
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v7hr-xh82-79p7
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9r9q-9r7p-4mr6
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-76c4-7552-ffhv
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j5pq-cm28-qm6v
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2hm9-2h5q-x525
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hj6g-r86h-wrcg
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fw6x-h8gw-778w
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q8p6-8mmj-j4ph
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r664-f94r-rgg6
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g67-jhpc-q5xp
    + Https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8m87-jj8p-2fqc
    + [core,nla] report NTLM rejected
    + [codec,av1] fix colours of decoded YUV444 frames
    + [core,peer] skip disconnect sequence when MCS not established
    + [client,sdl] send one wheel axis per event
    + Rail: initialize client status before deferred RemoteApp execution
    + Fix stale signature pointer in v1 cert writer
    + [client,sdl] strip the terminating \0 from text for local applications
    + [codec,dsp] only create an Opus coder for Opus formats
    + [client,x11] Send Backspace and Delete as scancodes in Unicode mode
    + [codec,channels] guard new Android MediaCodec/AAudio APIs behind their
    introduced-in level
    + Must have feature: pretend that a movie or gstreamer pipeline is your
    camera
    + [channels,rdpdr] add 64-bit, file information and volume drive APIs to
    the server
    + [codec,h264] add Apple VideoToolbox decoder
    + [client,sdl] resend the window layout to a new display channel
    + [channels,rdpsnd] allow some slack before dropping samples as overrun
    + [channels,rdpsnd,winmm] keep a little audio queued ahead
    + Kerberos realm prompter fixes
    + [client,sdl] log a failed display layout as such
    + [channels,rdpsnd,pulse] default target latency, and silence in front when
    playback restarts
    + [winpr,clipboard] fix HTML synthesizer destination format checks
    + [client,x11] add deferred alt forwarding option to prevent alt keys from
    being prematurely sent to remote
    + [client,x11] keep keyboard mappings across MappingNotify reloads
    + [core,connection] Send client messages stateless
    + [core,connection] go on after the server Monitor Layout PDU
    + [common,settings] add canary for freerdp_device_free
    + [core,gateway] clear completed RDG header state
    + [core,multitransport] client side UDP multitransport
    + [core,settings] keep desktop and device scale factors apart
    + [core,proxy] fix length of HTTP basic auth string
    + [codec,av1] decode with WebCodecs in Emscripten builds
    + [client,x11|sdl] wait the resize delay after DisplayControlCaps
    + [core,proxy] allow ignoring proxy servers
    + [core,gateway] unify rts_syntax_id_new/free
    + [channels,rdpsnd] add a Web Audio backend for Emscripten builds
    + [client,sdl] test the system configuration in TestSDLPrefs
    + [channels,rdpsnd] relink when the JavaScript library changes
    + [client,common] sso-mib: decode req_cnf as base64url
    + [codec,h264] decode with WebCodecs in Emscripten builds
    + [core,connection] detect a broker redirect
    + [core,connection] leave the active state before disconnecting
    + [client,sdl] pass the activating click to RemoteApp windows
    + [channels,audin] add a Web Audio microphone backend for Emscripten builds
    + [client,sdl] no connection dialog window in Emscripten builds
    + [winpr,sync] yield to the browser through a MessageChannel
    + [client,sdl] browser clipboard for Emscripten builds
    + [winpr,utils] abort PNG write on size wrap or realloc failure
    + [client,sdl] RemoteApp fixes and cleanups
    + [client,sdl] Emscripten: a page may split the canvas into monitors
    + [client,sdl] stop server output only when every monitor window is hidden
    + [client,sdl] add Windows support for RemoteApp
    + [client,common] stop auto-reconnect when a reconnect attempt is rejected
    + [client,sdl] fix RemoteApp popups dragged
    + [core,fastpath] discard input events before activation
    + [client,common] fill in the touch contact count
    + [client,sdl] RemoteApp window position, size and minimize fixes
    + [shadow,win] follow encoder preferred fps in capture loop
    + [codec,video] add android mediacodec support
    + [client,sdl] rail: keep popups whose SDL parent goes away; do not
    disconnect on orders for unknown windows
    + [client,x11] do not send cliprdr data on a torn down channel
    + [client,sdl] send keys as unicode with /kbd:unicode
    + [codec,h264] harden emscripten NAL parser
    + [client,sdl3] register the signal cleanup handler again
    + [client,sdl] send the physical monitor size in millimetres
    + [client,sdl] rail: never activate WS_EX_NOACTIVATE windows
    + [core,rdstls] add more failure logging
    + [core,listener] listen on a Unix socket on Windows too
    + [channels,rdpear] add workaround for older windows versions
    + Fix the reference-count imbalance in printer_android_new_printer() in…
    + [channels,rdpsnd] client: drop a wave that does not decode, keep playing
    + [channels,cliprdr] tolerate a malformed FAIL response
    + [codec,h264] VideoToolbox H.264 encoder
    + [client,sdl] move queued items out before pop()

==== libapparmor ====

- add transmission-2246.patch: allow transmission to lock its
  lockfile (boo#1289007)

==== libusb-compat ====

- Update to 0.1.9:
  * Fix memory leaks in USB bus and device cleanup: release device
    references in the exit destructor, free per-device config data,
    and plug leaks in error paths.
  * Modernize autoconf macros and detect the libusb-1.0 SONAME via
    objdump instead of ldd, which is safe for cross-compilation.
  * testlibusb: enlarge the description buffer, silencing
  - Wformat-truncation warnings.
  * Release tarball now ships a pre-generated configure script, so no
    bootstrap step is needed at build time.
- Drop Group tags, add explicit gcc and make BuildRequires, and
  version the libusb-1.0 BuildRequires floor (>= 0.9.1) to match
  upstream's configure check.

==== libusbmuxd ====
Version update (2.1.0 -> 2.1.1)

- update to 2.1.1:
  * Changes:
  * tools: Fix potential issue with select() in case the
    network fd is higher than the usbmux fd
  * Switch to better initializer strategy
  * Fix compilation on MSVC
  * iproxy: Make sure to print correct socket error messages
  * inetcat: Make sure to report correct error messages

==== mokutil ====
Version update (0.7.2 -> 0.7.3)

- Update to 0.7.3
  + show help if no args or --help even on unsupported system
  + remove unused int_to_b64()
  + on --test-key, return non-zero if test key is not enrolled
  + introduce --is-sb-enabled parameter
  + return zero in case --test-key is enrolled
  + Remove traditional des and md5 passwords
  + man: fix typo "|- X" -> "| -X"
  + PasswordCrypt: Fix an ABI issue
  + Fix bash completion (bsc#1286920)
- Move the bash completion script to mokutil-bash-completion

==== openSUSE-release ====
Version update (20261103 -> 20261104)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== perl-Clone ====
Version update (0.500.0 -> 0.510.0)

- updated to 0.510.0 (0.51)
  see /usr/share/doc/packages/perl-Clone/Changes
  0.51 2026-10-01 atoomic
  - fix: clone deep hash and mixed array/hash structures past MAX_DEPTH
    without C stack growth (GH #121, GH #146)
  - fix: support cloning Perl 5.38+ class instances (SVt_PVOBJ)
  - fix: count nesting depth, not call count, in rdepth
  - fix: honour depth==0 when rdepth exceeds MAX_DEPTH on wide structures
  - fix: preserve shared RV identity in rv_clone_iterative
  - fix: guard rv_clone_iterative against scalar-ref cycles past MAX_DEPTH
  - fix: share non-cloneable leaves in rv_clone_iterative
  - fix: preserve blessings in iterative array chain walking (GH #121)
  - fix: deep-copy leaf scalars past MAX_DEPTH instead of aliasing
  - fix: release cloned mg_obj refcount after sv_magic (memory leak)
  - fix: remove leaked Newxz buffer in magic mg_ptr cloning
  - fix: use SAVEFREESV for exception-safe hseen/weakrefs cleanup
  - fix: avoid shell in ps invocation for MacPorts / sandboxed macOS (GH #122)
  - refactor: extract magic cloning to clone_magic() helper
  - refactor: fix TRACEME debug infrastructure for 64-bit and MSVC
  - chore: update ppport.h from 3.68 to 3.73
  - test: add coverage for clone($ref, $depth), edge cases, class objects
  - docs: fix duplicate Synopsis header and update LIMITATIONS section
  - ci: add macOS, refresh Linux distro matrix, fix Windows build step

==== perl-DB_File ====
Version update (1.860 -> 1.861)

- updated to 1.861
  see /usr/share/doc/packages/perl-DB_File/Changes
  1.861 13 October 2026
  * Update to version 1.861
    Tue Oct 13 10:04:57 2026 +0100
    68d942587c4f2d40cfc94aa0d3626ba101fb3e40
  * update email address
    Fri Oct 9 17:40:19 2026 +0100
    8aad0cf864bde5f9c3b67a3cb6917dc722749389
  * Bump actions/checkout from 6 to 7
    Fri Jul 3 12:49:06 2026 +0100
    34f18f049f0f84f8cc13b36a06514fe37fd220ef
  * Bump actions/cache from 5 to 6
    Fri Jul 3 12:48:35 2026 +0100
    c740b91701fa40845463ad2476e2b346303b570d

==== permissions ====
Subpackages: permctl permissions-config

- Ship chkstat.8 man page as a symlink to permctl.8; the chkstat
  compatibility symlink had no manual page of its own
- Wrap the permissions-config description within the line length
  limit
- Remove Group tags and use pkgconfig() BuildRequires for the
  libraries the build probes: libacl, libcap and tclap (spec-cleaner)
- Keep the pkgconfig() BuildRequires in the main block and delimit
  the test suite requirements with # SECTION markers, so the two
  groups stay separate when spec-cleaner sorts the BuildRequires

==== salt ====
Subpackages: python313-salt salt-master salt-minion

- Stabilize testsuite
- Added:
  * stabilize-testsuite-791.patch

==== xen ====
Version update (4.22.0_06 -> 4.22.0_08)

- bsc#1288663 - VUL-0: CVE-2026-102703,CVE-2026-102704: xen:
  arbitrary read/write via grant copy (XSA-523)
  6ae9cd89-gnttab-complete-checking-in-gnttab_copy_buf_valid.patch
  6ae9cd89-gnttab-move-only-local-domain-may-copy-by-frame-check.patch