Packages changed:
  SDL3 (3.4.18 -> 3.4.20)
  atkmm1_6
  firewalld (2.3.2 -> 2.5.2)
  ghostscript
  glibmm2
  glibmm2_4
  glycin-loaders (2.2.5 -> 2.2.6)
  gtkmm3
  gtkmm4
  inih (62 -> 63)
  ipxe (2.0.0+git20260710.58ee55b3c -> 2.0.0+git20260914.7cd92e01d)
  kmod (34.2 -> 34.3)
  kwin6
  libglycin (2.2.5 -> 2.2.6)
  libglycin-gtk4 (2.2.5 -> 2.2.6)
  libstorage-ng (4.5.367 -> 4.5.368)
  libvirt (12.8.0 -> 12.9.0)
  nghttp2 (1.70.0 -> 1.71.0)
  nghttp3 (1.18.0 -> 1.19.0)
  openSUSE-release (20261104 -> 20261105)
  pangomm1_4
  postfix
  python-tornado6 (6.5.10 -> 6.6)
  qpdf (12.4.1 -> 12.4.2)
  qt6-base
  qt6-declarative
  qt6-qt5compat
  rav1e
  rsync (3.5.1 -> 3.5.2)
  tpm2-0-tss (4.1.3 -> 4.2.1)
  tpm2.0-tools (5.7 -> 5.8)
  usb_modeswitch (2.6.1 -> 2.6.2)

=== Details ===

==== SDL3 ====
Version update (3.4.18 -> 3.4.20)

- Update to release 3.4.20
  * Improved Wayland clipboard handling
  * Fixed color cursor alpha mask on X11
  * Fixed a crash when Vulkan texture memory binding fails
  * Fixed transparent windows using the Vulkan renderer
  * Improved handling of Nintendo Switch controller calibration
  * Fixed Nintendo Switch controllers failing because of missing
    stick and IMU calibration
  * Fixed reports stopping on the Flydigi Vader 5 Pro while the
    Flydigi Space Station service is running
  * Added support for rumble and trigger rumble on the Flydigi
    Vader 5 Pro
  * Added support for the 8BitDo Ultimate 2C Wireless controller
    via HIDAPI

==== atkmm1_6 ====

- Update version dependencies according to meson.build.
- Update URL to new home.

==== firewalld ====
Version update (2.3.2 -> 2.5.2)
Subpackages: firewalld-bash-completion firewalld-lang python313-firewall

- Update to version 2.5.2:
  * fix(nftables): prerouting cannot reliably determine egress
  * fix(ci): git: use https protocol
  * fix(runtime-to-permanent): copy empty config fields
  * fix(firewall-cmd): don't shadow config import
  * fix(firewall): prefer values() over items()
- Changes from version 2.5.1:
  * fix(check_config): do not check combined zone file name length
  * doc(firewall-cmd): remove duplicate --permanent
  * fix(firewall-cmd): avoid extra newline with empty message
  * fix(dispatch): OUTPUT and POSTROUTING should terminate with ACCEPT
- Changes from version 2.5.0:
  * feat(firewall-config): support gnome automatic dark theme
  * feat(watcher): log warning if configuration changed
  * feat(service): add Solr
- Changes from version 2.4.4 - 2.3.4: Please see
  https://github.com/firewalld/firewalld/releases
- Update to version 2.3.4:
  * This is a bug fix only release.
    + fix(firewall-config): _load_store_append(): properly get runtime zone
    + fix(check-config): check combined zones
    + fix(firewall-cmd): dbus: wait for connection
    + fix(check_config): do not check combined zone file name length
    + fix(build): dist: add missing policy xmlschema
    + fix(firewall-cmd): use config.VERSION for --version
    + fix(firewall-cmd): handle no options when not running
- Changes from version 2.3.3:
  * This is a bug fix only release.
    + fix(nftables): batch ipset elements in set_restore to avoid O(n²)
    insertion cost
    + fix(firewalld): spin trying to acquire dbus
    + fix(systemd): do not wait on dbus
    + fix(zone): forward: support timeout
    + fix(policy): support timeouts
    + fix(cli): policy: allow timeout with --ingress-zone/--egress-zone
    + fix(watcher): delete timeout before calling callback
    + fix(watcher): disable while writing configuration
    + fix(watcher): clear timeouts on reload
    + fix(service): steam-streaming: add ports for VR
    + fix(bash): add completion for --service
    + fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings}
    + fix(rpm): drop dependency on dbus-x11
- Drop 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch: fixed upstream.

==== ghostscript ====
Subpackages: ghostscript-x11

- Ghostscript version 10.08.0 also fixes the following
  security issue (cf. the below entry dated "Tue Oct 13"):
- CVE-2026-110133
  "Heap buffer overflow in Ghostscript TrueType outliner
  due to nPointsTotal integer underflow during retry rollback"
  https://bugs.ghostscript.com/show_bug.cgi?id=709573
  (bsc#1288957)

==== glibmm2 ====
Subpackages: libgiomm-2_68-1 libglibmm-2_68-1

- Update URL to new home.

==== glibmm2_4 ====
Subpackages: libgiomm-2_4-1 libglibmm-2_4-1

- Update version dependencies according to meson.build.
- Update URL to new home.

==== glycin-loaders ====
Version update (2.2.5 -> 2.2.6)

- Update to version 2.2.6:
  * This release contains the following new component versions
    + libglycin 2.2.6
    + libglycin-gtk4 2.2.6
  * Fixed: meson: Fix build configuration failing if either libglycin or
    libglycin-gtk4 option being enabled.
- Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc
  following upstream changes yet again.

==== gtkmm3 ====

- Update URL to new home.

==== gtkmm4 ====

- Update URL to new home.

==== inih ====
Version update (62 -> 63)

- Update to version 63 (CVE-2025-71450 bsc#1289163)
  * Report file read errors
  * Normalize CR LF line endings to just LF in test file
  * Fix multiline continuation names after no-value keys
  * Expose INI_MAX_SECTION and INI_MAX_NAME in ini.h
  * Assert on NULL arguments
  * Bug Fix: OOB Read in ini_parse_stream()

==== ipxe ====
Version update (2.0.0+git20260710.58ee55b3c -> 2.0.0+git20260914.7cd92e01d)

- Marke the QEMU rom subpackage noarch to deal with bsc#1288051
- Fix bsc#1271200. Patchs added:
  * virtio-Fix-MSI-X-caps-control-register-offset-in-leg.patch
  * virtio-Fix-virtio-net-PXE-boot-on-legacy-BIOS-VMs-wi.patch
- Update to version 2.0.0+git20260914.7cd92e01d:
  * [tls] Handle TLS version 1.3 client Finished
  * [tls] Do not schedule sending of unused records in TLS version 1.3
  * [tls] Ignore TLS version 1.3 NewSessionTicket
  * [tls] Handle TLS version 1.3 server Finished
  * [tls] Transition to handshake traffic keys after receiving ServerHello
  * [tls] Allow for scheduled traffic phase changes
  * [tls] Allow for variable-length verification data
  * [tls] Add support for binding via a CertificateVerify record
  * [tls] Add support for parsing TLS version 1.3 Certificate record
  * [tls] Handle inner plaintext for TLS version 1.3
  * [tls] Allow support for newer TLS versions to be optimised out
  * [tls] Discard received Change Cipher records under TLS version 1.3
  * [tls] Exclude sequence number from authentication for TLS version 1.3
  * [tls] Allow for sequential cipher initialisation vectors
  * [tls] Limit to TLS version 1.2 in transmitted record headers
  * [tls] Remove the concept of a pending cipher specification
  * [tls] Add support for the key share extension
  * [tls] Add ClientHello to transcript before selecting named group
  * [tls] Handle TLS version 1.3 session ID echoing
  * [tls] Use HKDF-based key schedule for TLS version 1.3 or later
  * [crypto] Refuse to allow zero-length ServerKeyExchange parameters
  * [crypto] Ensure TLS signable digests cover a shared secret
  * [tls] Detect version downgrade attacks
  * [tls] Add support for the supported versions extension
  * [tls] Add definitions for TLS version 1.3 cipher suites
  * [tls] Record named group rather than key exchange algorithm
  * [crypto] Add AES acceleration using the Arm Cryptographic Extensions
  * [crypto] Add support for AES-NI hardware acceleration
  * [crypto] Align AES round keys within the AES context
  * [crypto] Allow for AES hardware acceleration
  * [librm] Enable the use of SSE instructions if supported by the CPU
  * [librm] Preserve CR0 across virt_call()
  * [librm] Preserve CR4 across virt_call() if FXSR is supported
  * [librm] Skip runtime check for FXSR support in 64-bit builds
  * [librm] Remove conditionalisation of the Tivoli VMM workaround
  * [librm] Clarify layout of saved GDTR/IDTR
  * [librm] Always disable paging when switching to protected mode
  * [crypto] Treat high tag numbers as invalid
  * [test] Add Project Wycheproof RSA-PSS signature verification tests
  * [test] Add a build target for slow self-tests
  * [test] Add Project Wycheproof ECDSA signature verification tests
  * [crypto] Reject non-canonical ECDSA signature encodings
  * [crypto] Reject indefinite and unrepresentable length encodings
  * [crypto] Reject ASN.1 unsigned integers holding negative values
  * [crypto] Reject non-canonical ECDSA signature data structures
  * [test] Simplify class hierarchy for Project Wycheproof import tool
  * [test] Derive comment labels from Project Wycheproof input files
  * [test] Derive algorithm names from Project Wycheproof input files
  * [test] Use a single shared class for Project Wycheproof test flags
  * [test] Add Project Wycheproof RSA PKCS#1 signature verification tests
  * [test] Add Project Wycheproof RSA PKCS#1 signature generation tests
  * [test] Allow for invocation of individual Project Wycheproof tests
  * [crypto] Reject non-canonical RSA inputs
  * [crypto] Add OID-identified algorithms for RSA with SHA512/224 and SHA512/256
  * [test] Add Project Wycheproof RSA PKCS#1 decryption tests
  * [crypto] Add missing padding length check in RSA decryption
  * [test] Allow for public-key algorithm tests with incomplete key pairs
  * [test] Allow for per-group definition code in Project Wycheproof tests
  * [test] Add schema and count validators in Project Wycheproof tests
  * [test] Add Project Wycheproof AES-GCM tests
  * [crypto] Reject zero-length IVs for GCM ciphers
  * [test] Add ability to test for cipher key and IV failures
  * [test] Add Project Wycheproof HKDF tests
  * [test] Allow for HKDF tests without an expected PRK
  * [test] Add Project Wycheproof HMAC tests
  * [test] Allow for HMAC tests with partial expected output digest values
  * [test] Reduce duplication in Project Wycheproof import tool
  * [test] Add Project Wycheproof import tool and key exchange tests
  * [tls] Reject a duplicate ServerHelloDone
  * [crypto] Ensure that a closed channel is left with unusable ciphers
  * [crypto] Guard against mutation of certificate chain during validation
  * [tls] Add documentation to assist future code review
  * [tls] Make certificate processing visibly safe at point of use
  * [tls] Make certificate sending visibly safe at point of use
  * [tls] Treat secure channel's cipher algorithm as definitive
  * [tls] Ensure that ServerKeyExchange parsing method is always non-NULL
  * [tls] Use null key exchange algorithm as default for DHE and ECDHE
  * [tls] Ensure that broken cipher suites can never be selected
  * [tls] Remove redundant cipher suite name components in debug messages
  * [tls] Use null handshake digest algorithm for the null cipher suite
  * [tls] Use null MAC digest algorithm for AEAD ciphers
  * [tls] Guarantee that receive data buffer list is non-empty
  * [tls] Use standalone secure channel and key schedule implementations
  * [crypto] Add a standalone implementation of the TLS key schedules
  * [crypto] Add a generic implementation of a secure channel
  * [tls] Clean up session management
  * [tls] Clarify purpose of stored key exchange algorithm
  * [tls] Separate the concepts of key schedule and secure channel
  * [tls] Unify handling of ServerKeyExchange and ClientKeyExchange
  * [crypto] Avoid out-of-bounds read when using uninitialised AES context
  * [arm] Add missing condition code clobbers to inline assembly
  * [s390x] Add missing condition code clobbers to inline assembly
  * [tls] Model classic RSA key transport as a key exchange algorithm
  * [dns] Add redundant explicit check for CNAME validity
    ... changelog too long, skipping 95 lines ...
  * [hermon] Add missing write barrier after initiating reset

==== kmod ====
Version update (34.2 -> 34.3)
Subpackages: libkmod2

- Update to release 34.3
  * depmod gained an -m/--moduledir option.
  * Removed deprecated arguments for depmod:
  - -unresolved-error, --quiet, --root and --map.
  * Removed deprecated arguments for rmmod: -w.
  * Removed deprecated arguments for insmod: -p and -s.
  * Optimized index reading by lazily reading nodes on demand.

==== kwin6 ====
Subpackages: kwin6-lang libkwin6

- Add upstream change (kde#527984, boo#1289320)
  * 0001-compositor-handle-possibly-missing-render-device.patch

==== libglycin ====
Version update (2.2.5 -> 2.2.6)
Subpackages: libglycin-2-0 typelib-1_0-Gly_2

- Update to version 2.2.6:
  * This release contains the following new component versions
    + libglycin 2.2.6
    + libglycin-gtk4 2.2.6
  * Fixed: meson: Fix build configuration failing if either libglycin or
    libglycin-gtk4 option being enabled.
- Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc
  following upstream changes yet again.

==== libglycin-gtk4 ====
Version update (2.2.5 -> 2.2.6)
Subpackages: libglycin-gtk4-2-0 typelib-1_0-GlyGtk-2

- Update to version 2.2.6:
  * This release contains the following new component versions
    + libglycin 2.2.6
    + libglycin-gtk4 2.2.6
  * Fixed: meson: Fix build configuration failing if either libglycin or
    libglycin-gtk4 option being enabled.
- Stop passing libglycin=true to meson setup in glycin-loaders.spec.inc
  following upstream changes yet again.

==== libstorage-ng ====
Version update (4.5.367 -> 4.5.368)
Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1

- Translated using Weblate (Russian) (bsc#1149754)
- 4.5.368

==== libvirt ====
Version update (12.8.0 -> 12.9.0)
Subpackages: libvirt-client libvirt-daemon-common libvirt-daemon-config-network libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage libvirt-daemon-driver-storage-core libvirt-daemon-driver-storage-disk libvirt-daemon-driver-storage-iscsi libvirt-daemon-driver-storage-iscsi-direct libvirt-daemon-driver-storage-logical libvirt-daemon-driver-storage-mpath libvirt-daemon-driver-storage-rbd libvirt-daemon-driver-storage-scsi libvirt-daemon-lock libvirt-daemon-log libvirt-daemon-plugin-lockd libvirt-daemon-qemu libvirt-libs

- Update to libvirt 12.9.0
  - Many incremental improvements and bug fixes, see
    https://libvirt.org/news.html#v12-9-0-2026-11-02

==== nghttp2 ====
Version update (1.70.0 -> 1.71.0)

- Update to 1.71.0:
  * lib: add length check for CONTINUATION frames
  * lib: disallow HEADERS and PUSH_PROMISE in CONNECT streams
  * lib: fix priority update handling and update window upfront
  * lib: handle too large window size when consuming data
  * lib: fix signed integer overflow in
    nghttp2_session_get_stream_local_window_size and detect size_t
    overflow in nghttp2_nv_array_copy
  * lib: better map hasher and simplified map insertion
  * nghttpx: client TLS certificate validation based on RFC 9525
    (CertLookupTree rewrite) and refactored Router
  * nghttpx: remove server push support
  * nghttpx: fix GSO disabled on QUIC connections and check QUIC
    version
  * Add option to limit the maximum outbound queue size
- The library soname is unchanged at 14

==== nghttp3 ====
Version update (1.18.0 -> 1.19.0)

- Update to 1.19.0:
  * Extend minimum unsent bytes in anticipation of QMux
  * Clamp glitch rate-limiter burst and check priority
    field size, applying buffer limit early
  * Fix map key removal on table resize failure, improve
    map hasher and simplify insertion
  * Fix balloc alignment
  * Document NGHTTP3_ERR_INVALID_ARGUMENT for oversized
    header block submissions
  * Clean up QPACK opcode branching
  * Fix fuzzer ASAN failure
  * Extend test coverage for trailers in CONNECT streams
- The library soname is unchanged at 9

==== openSUSE-release ====
Version update (20261104 -> 20261105)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== pangomm1_4 ====

- Update URL to new home.

==== postfix ====

- config.postfix:
  * Fix timezone
  * /usr/sbin/postconf: fatal: -e, -X, or -# accepts no multi-line input
  * master.cf generation
- update patches
  * postfix-main.cf.patch
  * postfix-master.cf.patch
- rebase patch
  * postfix-vda-v14-3.0.3.patch

==== python-tornado6 ====
Version update (6.5.10 -> 6.6)

- Update to 6.6.0 (CVE-2026-115927, bsc#1289050,
    CVE-2026-116577, bsc#1289064,
    CVE-2026-116578, bsc#1289058):
  [#] General changes
  - Python 3.15 is now supported. Python 3.9 and 3.10 are no longer
    supported; 3.11 is the minimum supported version.
  - Free-threaded python interpreters are now supported; prebuilt
    wheels are available for 3.14t and 3.15t.
  - Windows on ARM is now supported and prebuilt wheels are available.
  - Prebuilt wheels are now available for ``riscv64``, ``ppc64le``,
    and ``s390x`` architectures on Linux. These architectures are
    experimental and have limited support and testing.
  - PyPy 8.0 is now supported (for both Python 3.11 and 3.12).
  - Error messages have been improved in many places.
  - Improved handling of `asyncio.CancelledError` in various parts of
    the framework.
  [#] Feature highlights
  - New feature ``cross_origin_protection`` provides a new mechanism
    for protecting against XSRF and other cross-origin attacks. This
    feature is easier to use than ``xsrf_cookies`` and is expected to
    become the default in Tornado 6.7.
  [#] Deprecation notices
  - The ``host`` argument to the `.HTTPServerRequest` constructor is
    deprecated (since Tornado 6.5.2); use ``headers["Host"]`` instead.
    It will be removed in Tornado 6.7.
  - The ``start_line`` argument to the ``HTTPServerRequest``
    constructor will become required in Tornado 6.7. The ``method``,
    ``uri``, and ``version`` arguments are deprecated and will be
    removed at the same time. All remaining arguments will become
    keyword-only. A `DeprecationWarning` is now emitted when
    ``start_line`` is not provided or when the ``host``, ``method``,
    or ``uri`` arguments are used.
  - ``tornado.auth.OpenIdMixin`` is deprecated and will be removed in
    Tornado 6.7 (this is a change in the timeline; it was previously
    scheduled for removal in Tornado 7.0).
  - ``tornado.util.TimeoutError``, ``tornado.gen.TimeoutError``, and
    ``tornado.ioloop.TimeoutError`` are deprecated. They are aliases
    for the builtin `TimeoutError`, which should be used instead.  (No
    warning is emitted when these aliases are used.)
  - Calling `.GzipDecompressor.decompress` without a ``max_length``
    argument (or with ``max_length=0``) is deprecated and emits a
    `DeprecationWarning`. In Tornado 7.0, ``max_length`` will be
    required.
  - The ``xsrf_cookies`` application setting is expected to be
    deprecated in Tornado 6.7 (with warnings) in favor of
    ``cross_origin_protection``. It will not be removed before Tornado
    7.0.
  [#] Type annotation changes
  - `tornado.gen.multi` now has overload annotations to indicate that
    its return type depends on its inputs (list vs dict).
  - `.HTTPServerRequest.method` and ``uri`` attributes are now typed
    as ``str`` instead of ``str | None``.
  [#] tornado.curl_httpclient
  - The minimum supported version of libcurl is now 7.81 (which is the
    version shipped by Ubuntu 22.04 LTS).
  - Passing a coroutine as the ``streaming_callback`` argument now
    fails with a `TypeError`.  (Coroutine streaming callbacks are only
    supported by ``simple_httpclient``.)
  [#] tornado.gen
  - `asyncio.CancelledError` is now handled correctly in coroutines,
    `.multi`, and `.chain_future`.
  - `.WaitIterator` now supports multiple copies of the same `.Future`
    object.
  - `.with_timeout` has a new ``message`` argument, which sets the
    message of the `TimeoutError`.  It may be a string or a callable
    that returns a string (which is only called if the timeout
    expires).
  [#] tornado.http1connection
  - Invalid ``Host`` headers are now logged at the INFO level instead
    of as an uncaught exception.
  - Line folding in HTTP headers is no longer supported. This was
    deprecated in Tornado 6.5 but is being removed sooner than
    originally scheduled to avoid DoS risk.
  - Reading a request or response body now yields to the event loop
    periodically, so a peer that sends a body faster than it can be
    processed (especially with many tiny chunks in chunked encoding)
    can no longer block the event loop for the duration of the body.
  - Small chunks of a body using chunked encoding are now coalesced
    before being passed to ``data_received``, so the pieces seen by
    the application no longer correspond to the HTTP chunk boundaries.
  - A chunk in a chunked body that is not followed by ``\r\n`` is now
    reported as an `.HTTPInputError` instead of raising
    ``AssertionError`` (or being silently accepted when Python is run
    with ``-O``).
  - Gzipped bodies containing multiple members are now decompressed
    correctly. Trailing garbage at the end of a body or in between
    members is now an error instead of being silently ignored, as is a
    body that is truncated partway through a member. This applies both
    to responses received by ``simple_httpclient`` and to requests
    received by a server with ``decompress_request=True``.
  [#] tornado.httputil
  - If ``start_line`` is not passed to `.HTTPServerRequest`, missing
    ``method`` and ``uri`` arguments now default to ``GET`` and ``/``
    (with a `DeprecationWarning`) instead of leaving these attributes
    as ``None``.
  - ``HTTPHeaders.__delitem__`` no longer raises `KeyError` at
    inappropriate times.
  [#] tornado.iostream
  - Fixed a socket leak when a timeout occurs during a TLS handshake,
    ... changelog too long, skipping 118 lines ...
- Drop upstreamed patch run-multi-process-in-fresh-process.patch

==== qpdf ====
Version update (12.4.1 -> 12.4.2)

- Update to version 12.4.2:
  * Enhancements
  - Improve validation of object ids and generation numbers when
    reading special objects (such as xref or hint streams) and
    during reconstruction of damaged files.
  - In –show-linearization, including a listing of all the object numbers
    that qpdf would assign to each part. Implementation of linearization
    is inconsistent across tools, so unless qpdf linearized the file,
    the computed part assignments are not likely to match what’s actually in the file.
  - Radically decrease memory usage and improve performance when linearizing certain types of files.
  * Bug fixes
  - Fix some very old, latent linearization bugs.
    These will change linearization output for some files.
  - Previous versions of qpdf incorrectly determined whether an object was shared.
    The correct behavior based on the specification and for correct performance
    is that an object is shared if it is accessed by more than one page.
    qpdf was treating it as shared if it was reachable from more than
    one starting point including non-page objects. This would cause objects
    that were referenced by both page and non-page objects to be placed in part 9,
    at the end of the file, rather than in the appropriate part based on which
    pages accessed the object. In practice, it is rare for objects to be accessed
    by both page and non-page objects, so this won’t affect the output of most files.
  - In some cases, the Pages tree was treated as a shared object and placed earlier
    in the file than necessary. This was harmless, but incorrect, and it was fixed
    as a side effect of the performance improvements.
  - If items in the Outlines dictionary are referenced by pages, the outlines hint table will be absent,
    and the outlines will appear in the groups of page objects, regardless of the document’s page mode.
  - Reject trailing characters in bounded numeric command-line option values instead of silently accepting their numeric prefixes.
    This is technically a breaking change, but if you were relying on qpdf’s behavior of accepting malformed arguments, it’s better to fix that.
  - Report a file whose only line is a PDF header as damaged instead of failing with a system error.
    Reading a line whose end-of-line run reaches the end of the file left the input source one byte
    before the start of that line, which at offset 0 is a seek to -1.
  * Build changes
  - Create binary release for additional platforms:
  - Windows arm64
  - Linux aarch64 (arm64) AppImage
  - Linux aarch64 (arm64) stand-alone binaries
  - macOS stand-alone binaries (Apple silicon and Intel). These are not signed with an Apple Developer ID
    or notarized, so you will have to remove Apple’s quarantine attribute as described in the
    top-level README.md in the source distribution.
  - Add cmake flags STATIC_JPEG and STATIC_OPENSSL which link jpeg and openssl statically.
    This is to make it easier to create binary distributions without dependencies on libraries
    that are less likely to be present on the system. On some platforms, the static libraries
    will have to be built with position-independent code, so this may not work seamlessly in all environment.
    It is used to create the macOS binaries included in qpdf releases.
  - Add cmake flag STATIC_EXTRA_LIBS to pass additional static libraries when linking qpdf.
    This is useful if you are trying to link statically with libraries that are not automatically detected as dependencies.

==== qt6-base ====
Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-platformtheme-gtk3 qt6-printsupport-cups qt6-sql-sqlite qt6-wayland

- Update qt6-waylandclient-private-devel dependencies

==== qt6-declarative ====
Subpackages: libQt6LabsAnimation6 libQt6LabsFolderListModel6 libQt6LabsPlatform6 libQt6LabsQmlModels6 libQt6LabsSettings6 libQt6LabsSharedImage6 libQt6LabsStyleKit6 libQt6LabsSynchronizer6 libQt6LabsWavefrontMesh6 libQt6Qml6 libQt6QmlCore6 libQt6QmlDesignSupport6 libQt6QmlLocalStorage6 libQt6QmlMeta6 libQt6QmlModels6 libQt6QmlNetwork6 libQt6QmlWorkerScript6 libQt6QmlXmlListModel6 libQt6Quick6 libQt6QuickControls2-6 libQt6QuickControls2Impl6 libQt6QuickDialogs2-6 libQt6QuickDialogs2QuickImpl6 libQt6QuickDialogs2Utils6 libQt6QuickEffects6 libQt6QuickLayouts6 libQt6QuickParticles6 libQt6QuickShapes6 libQt6QuickTemplates2-6 libQt6QuickTest6 libQt6QuickVectorImage6 libQt6QuickWidgets6 qt6-declarative-imports

- Add upstream change (boo#1287613, QTBUG-150769)
  * 0001-QQuickItemView-don-t-leave-dangling-entries-in-unreq.patch

==== qt6-qt5compat ====
Subpackages: libQt6Core5Compat6 qt6-qt5compat-imports

- Add upstream changes (CVE-2026-100140, boo#1289130)
  * CVE-2026-100140-qt5compat-6.12-0001.diff
  * CVE-2026-100140-qt5compat-6.12-0002.diff
  * CVE-2026-100140-qt5compat-6.12-0003.diff
  * CVE-2026-100140-qt5compat-6.12-0004.diff

==== rav1e ====

- Add rav1e-Make-object-order-deterministic.patch: Make object
  order deterministic (bsc#1289073, gh#medek/nasm-rs#47)

==== rsync ====
Version update (3.5.1 -> 3.5.2)

- Update to 3.5.2
  - Security fixes:
  - Bounded strong-checksum work when a malicious receiver
    supplies weak checksums that collide with consecutive
    rolling windows (CVE-2026-119741, bsc#1289289).
  - Bug fixes:
  - Fixed interrupted `--append` and `--inplace` transfers
    writing the final 256 KiB buffer twice. An interrupted
    destination now remains a clean prefix which the next
    transfer can resume or repair.
  - Fixed uploads through `rrsync` when the destination file
    already exists.
  - Fixed poor matching performance on large sparse and
    repeated-block files when duplicate checksum chains
    exhausted the search limit.
  - Prevented the `--inplace` matcher from advancing its
    aligned basis index beyond the available checksum entries.
    This avoids signed overflow on large source files when the
    peer supplies a small block count.
  - Recovered from failed hard-link creation without aborting
    or hanging the generator.
  - Prevented an out-of-bounds write while invalidating a
    sender checksum after a file read error when the
    negotiated checksum length is zero.
  - Fixed a daemon receiver stack overflow when queued
    deletion output reached `--max-alloc`.
  - Fixed a `--files-from` pull from a subdirectory of a daemon
    module, which read each listed file from the module root
    instead.
  - Fixed password files whose first line is empty.
  - Escaped terminal control characters in filenames and
    diagnostics written to standard output, standard error and
    log files.
  - Restored daemon startup from accepted named Unix sockets on
    standard input.
  - Fixed forward-DNS hostname entries in daemon `hosts allow`
    and `hosts deny` lists for IPv6 peers.
  - Preserved Unix symlink permissions on systems which require
    `fchmodat()` to change the mode of a symlink rather than its
    target.
  - Enhancements:
  - Added `--nice` to adjust CPU and I/O scheduling priorities
    for local and remote rsync processes.
  - Added `--delay-symlinks` to defer creating new and changed
    symlinks until other transferred files are in place. It
    implies `--no-inc-recursive` and requires protocol 29 or
    newer.

==== tpm2-0-tss ====
Version update (4.1.3 -> 4.2.1)
Subpackages: libtss2-esys0 libtss2-fapi-common libtss2-fapi1 libtss2-mu0 libtss2-rc0 libtss2-sys1 libtss2-tcti-device0 libtss2-tctildr0

- New subpackage libtss2-tcti-null0
- New subpackage libtss2-tcti-spi-ltt2go0 (add libusb-1.0 dependency)
- Update to 4.2.1
  + TEST: use SHA-256 in EVP signing integration test
  + TCTI: validate the response header length
  + TCTI: add missing size checks for response buffers
  + FAPI: fix quoting of empty event logs
  + FAPI: check the number of branches for policy lists
  + FAPI: validate key size before extracting the public key
  + FAPI: add a missing bounds check on PCR_Select deserialization
  + FAPI: check buffer size in RSASSA and RSAPSS signature conversion
  + FAPI: reject eventlog entries with an empty template value
  + FAPI: bound eventlog entry name reads by the template size
  + FAPI: verify the eventlog digest window fits the template buffer
  + FAPI: fix file leak on read error
  + FAPI: fix tests failing with physical TPMs
  + ESYS: fix compilation without SM4 support
  + ESYS: fix OpenSSL 3.X engine context handling for internal crypto
  + FAPI: fix buffer overflow in ifapi_set_auth_primary
  + SYS: harden the response size checks
  + SYS: validate the length of no-session responses
  + SYS: validate the length of encrypted parameter responses
  + SYS: validate the length of response authorization parameters
  + SYS: use response size instead of buffer size during unmarshalling
  + MU: bound subtype unmarshalling to the TPM2B size field
  + IO: retry poll calls on EINTR and EAGAIN
  + CI: allow CI runs from different repositories
  + CI: preserve existing LD_LIBRARY_PATH
  + CI: update container images
- Update to 4.2.0
  + Fixed
  * Fix: In some calloc calls the parameters number of elements and
    size were swapped.
  * configure.ac: Fix test of == to = to be POSIX compliant
  * FAPI: Add check whether auth values exist for hierarchies.
  * Fixed headers given iwyu output
  * Remove use of which in favor of command -v
  * TCTI: Fix leak if Tss2_TctiLdr_Initialize fails.
  * FAPI: Fix usage of imported external PEM keys for
    PolicyAuthorize.
  * test: skip tcti-spidev on 32bit architectures with 64bit time_t
  * TCTI: fix incomplete teardown in tcti-mssim.
  * FAPI: Fix Fapi_GetPlatformCertificates without certificates.
  * test: Fix incomplete teardown in error cased.
  * configure: install tmpfiles.d and sysusers.d in libdir
  * FAPI: Fixed leak in Fapi_Sign
  * FAPI: Fix Fapi_GetPlatformCertificates without certificates does
    not return TSS2_FAPI_RC_NO_CERT.
  * FAPI: Fix instantiation of policyduplication select when object
    name or public data is used.
  * FAPI: Fix nv object authorization for policy authorize nv.
  * TCTI: Fixed possible “Resource temporarily unavailable” (EAGAIN)
    errors
  * TESTS: Fixed use of PCR16
  * TCTI: Separate namespaces for internal struct
  * ESYS: Fix variable usage in logging message
  * Fix CodeQL complaints
  * ESYS: Fix usage of handles in Esys_AC_Send
  * FAPI: Fix segmentation fault in policy callbacks.
  * FAPI: Add proper OOM handling for profile realloc.
  * FAPI: add missing NULL check after malloc in encode_ek_public.
  * FAPI: memset zero is called in the async functions for the
    command state to ensure the correct cleanup in error cases.
  * tests: Switch to latest cmocka layout
  * FAPI: Fix get_booleal_from_json
  * ESYS: Fix handling of TPM_RH_NULL handles with sessions
  + Added
  * Add clang-format to CI
  * Add clang-tidy to CI
  * Add a .clang-tidy file and applied changes to all source code
  * Add udev rules to create tcm device
  * FAPI: Support storing EK Certificate chains in NVRAM.
  * FAPI: KDF scheme KDF2 added.
  * tcti: add interface config option for spi-ftdi.
  * Complete license information (including non-code) with REUSE
  * Add REUSE tool to CI
  * FAPI: Add new profiles for high range EKs
  * FAPI: Create FAPI NV objects for existing NV indexes
  * Enable ARM64 build on Windows
  * FAPI: Allow usage of restricted keys in Fapi_Sign .
  * FAPI: Nuvoton certificates added.
  * MU: add TPM2_ST_ATTEST_NV_DIGEST attestation type support
  * OpenSSL 4.0 compatible macro usage

==== tpm2.0-tools ====
Version update (5.7 -> 5.8)

- Spec cleanup:
  + Drop unneeded BuildRequires: tpm2.0-abrmd-devel, libuuid-devel,
    gcc-c++ and libtool
  + Simplify the test bcond and run the test suite sequentially
  + Remove the dead pandoc block, fix URL and keyring comment
- Update to 5.8:
  + CVE-2026-75504, CVE-2026-73991, CVE-2026-75503
  + Fixed
  * tpm2_makecredential: fix wrong tcg ek templates
  * tpm2_checkquote: Fix memory leaks, malloced buffer not always
    freed
  * tpm2_checkquote: Fix missing error checking
  * tpm2_getekcertificate: Fix curl_easy_setopt type warnings
  * tpm2_makecredential: Fix usage of name parameter.
  * tpm2_quote/checkquote: Fix usage of little endian serialization.
  * tpm2_eventlog: parse vendor_db as EFI_SIGNATURE_DATA
  * tpm2_eventlog: Fix parsing on big-endian systems
  * tpm2_clockrateadjust: Fix segfault.
  * tpm2_policy: Do not overflow list of policy digests
  * tpm2_eventlog: Fix pretty print for efivar 39
  * tpm2_encode: Fix setting emptyAuth in generated pem file.
  * tpm2_eventlog_yaml.c Fix output of BlobDescription.
  * tpm2_getrandom: Fix --force parameter
  * tpm2_getekcertificate: fix impl to prioritize low range
    certificate
  * Options: Add option to allow usage of password session.
  * tpm2_createpolicy: flush session for trial policy.
  * tpm2_evictcontrol.c: Fix segfault for output of handle
    ESYS_TR_NONE
  * pcr commands: Fix session leaks
  * tools, test: Fix several missing NULL checks after malloc
  * tpm2_util: fix buffer overflow in string validation checks.
  * tpm2_getekcertificate: ensure curl buffer grows to required
    size.
  * tpm2_getekcertificate: fix heap buffer overflow.
  + Added
  * tpm2_quote/checkquote: Add new serialization format is added (-F
    marshaled).
  * tpm2_loadexternal: Add option rsa_exponent_zero
  * tpm2_createek: Add high range templates for rsa20248 and eccp256
  * tpm2_certify: Add parameter qualifying-data.
  * pcr commands: session support added.
  * tpm2_getekcertificate: add option --x509-trunc
  * tpm2_getekcertificate: Provide option -u for certs in NV ram.
  * tpm2_gettestresult: Fix handling of test result.
  * tpm2_checkquote: Fix usage of more than 7 PCRs
  * tpm2_send: Validate command_size before computing data_size.
  * tpm2_send: Avoid unintended stdio closing a file
  * tpm2_util: Allow file names with whitspace characters.
  * tools: fix out-of-bounds write with too many aux sessions.
  * tss2_sign: Add new parameter from which the digest is computed.
  * OpenSSL use 4.0 compatible macros

==== usb_modeswitch ====
Version update (2.6.1 -> 2.6.2)
Subpackages: usb_modeswitch-data

- Update to version 2.6.2:
  * Fixed C code bug breaking build with gcc 15
- Drop usb_modeswitch-c23.patch: fixed upstream
- Spec cleanup: drop obsolete Group tags