Packages changed:
  MicroOS-release (20261031 -> 20261101)
  busybox
  bzip2
  cpio
  efivar (38 -> 39)
  gnutls
  iproute2 (7.2 -> 7.3)
  kernel-source (7.3.0 -> 7.3.1)
  kirigami-addons6 (1.14.0 -> 1.16.0)
  libostree (2026.5 -> 2026.6)
  libupnp (22.1.8 -> 22.1.10)
  live555 (2026.10.24 -> 2026.10.29)
  lvm2
  lvm2-device-mapper
  qt6-base
  tesseract-ocr (5.5.3 -> 5.5.4)
  wireplumber (0.5.18 -> 0.5.19)
  xkeyboard-config

=== Details ===

==== MicroOS-release ====
Version update (20261031 -> 20261101)
Subpackages: MicroOS-release-appliance MicroOS-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== busybox ====

- Note we are not affected by the following CVEs with no fixes upstream.
  The relevant applets are disabled in our config. Add comments to the
  config file warning that enabling them would expose the unfixed CVEs:
  * dpkg-deb extraction-root escape via per-ar-member deferred
    symlink flush, CONFIG_DPKG disabled
    (CVE-2026-90954, bsc#1285581)
  * dpkg stale field_start pointer causing out-of-bounds read and
    status file corruption, CONFIG_DPKG disabled
    (CVE-2026-88842, bsc#1285579)
  * HTTP request smuggling via pipelined requests in httpd reverse
    proxy, CONFIG_FEATURE_HTTPD_PROXY disabled
    (CVE-2026-88829, bsc#1285577)
- Fix denial of service via terminal escape sequences in process
  names displayed by netstat (CVE-2024-58251, bsc#1241700)
  * 0001-Fix-CVE-2024-58251-sanitize-process-names-when-calli.patch
- Fix tar extraction-root escape via deferred symlink/hardlink
  creation (CVE-2026-108119, bsc#1284987)
  * 0001-tar-protect-against-Symlink-Hardlink-attack.patch
- Fix integer underflow in udhcpc d4_recv_raw_packet() leading to
  a crash when processing short untrusted DHCP packets
  (CVE-2026-88833, bsc#1285315)
  * 0001-udhcpc-ensure-packet.data.cookie-exists-before-we-ac.patch
- Fix httpd authentication timing difference between existing and
  non-existing system users caused by a missing else clause after
  a failed getspnam_r() call (CVE-2026-88834, bsc#1285314)
  * 0001-httpd-do-not-try-to-use-obviously-bogus-password-fro.patch
- Fix path traversal in libarchive allowing a crafted archive with
  a ".." member name to create files outside the extraction
  directory (CVE-2026-92205, bsc#1286932)
  * 0001-tar-.-is-also-an-unsafe-filename-treat-as-such.patch

==== bzip2 ====

- Remove the explicit Requires(pre) on libbz2-1: the bzip2 binaries
  already generate a libbz2.so.1()(64bit) dependency, which only
  libbz2-1 provides, so the effective requirement is unchanged, and
  bzip2 ships no %pre scriptlet for the (pre) qualifier to serve.
  Drop bzip2-rpmlintrc with it; its only filter hid the resulting
  explicit-lib-dependency error
- Hardlink the duplicated alias man-page stubs (bzcat.1/bunzip2.1
  and bzfgrep.1/bzegrep.1) with %fdupes
- Drop the Group tags

==== cpio ====

- Remove the leftover update-alternatives %post fragment and its
  Requires(post) from the mt subpackage. cpio-mt migrated away from
  update-alternatives to a Conflicts strategy (bsc#1240092) and the
  SLE 16 band already ships without the fragment (jsc#PED-15643);
  as written it could never fire, since it deregisters the
  alternative only when gnumt is absent, while cpio-mt’s own %post
  always runs with gnumt installed
- Annotate the two %ghost files of the mt subpackage with %attr
  (0755 for the /usr/bin/mt symlink path, 0644 for its man page)
  to silence the zero-permission ghost warnings; the ghosts stay
  so a stale /usr/bin/mt keeps an owning package
- Drop the obsolete Group tags and the commented-out install-info
  prereq lines

==== efivar ====
Version update (38 -> 39)

- Add efivar-bsc1286645-revert-file-wrapper-removal.patch to revert
  the removal of "File()" (bsc#1286645)
- CVE-2026-6862: efivar: stack overflow in device path node parsing
  can cause a denial of service (bsc#1262696)
  * efivar-bsc1262696-fix-stack-overflow-in-device-path-parsing.patch
- Update to 39:
  * efivar CLI: -A accepts hex values, -a can create a
    non-existent variable
  * Revamped efi_well_known variable handling
  * File device paths no longer print "File(" or ")"
  * Fixed IPv4 and IPv6 device path printing
  * Handle non-ACPI systems in device_get
  * Headers gained extern "C" for easier use by C++
  * Build fixes: musl libc, i686 format error, riscv64 -march,
    gcc-13, invalid free in main
  * Make-based build: LLD detection fixes, removed deprecated
  - -add-needed linker flag, docs can be disabled
  * Upstream moved from rhinstaller to the rhboot organization
- Drop efivar-bsc1202209-fix-glibc-2.36-build.patch,
  efivar-adjust-dependency.patch and
  efivar-bsc1206388-revamp-efi_well_known-variable-handling.patch:
  all fixed upstream in this release
- Rebase efivar-filter-gcc-march.patch for the upstream riscv64
  rework (boo#1231368)
- Rebase libefiboot-export-disk_get_partition_info.patch for the
  upstream extern "C" header rework
- Switch Source to the rhboot tag archive: upstream published no
  release tarball for 39

==== gnutls ====

- FIPS: Perform RSA-PSS self-tests. (bsc#1286296)
  * fips: perform RSA self-tests using RSA-PSS instead of PKCS#1
    v1.5 (ed0c45d)
  * pk: use deterministic RNG for RSA-PSS in self-tests (35c56812)
- FIPS: Mark internal HMAC-SHA-1 when session tickets are enabled
  as non approved (bsc#1284342)
  * Add gnutls-FIPS-SLI-session-ticket.patch
- FIPS: Mark TLS 1.2 cipher suites using HMAC-SHA-1 for record
  authentication as non approved (bsc#1284341)
  * Add an additional GNUTLS_MAC_AEAD check to independently
    evaluate the MAC algorithm
  * Add gnutls-FIPS-SLI-record-MAC.patch
- FIPS: Mark SHA-1 in TLS v1.0 PRF as non approved (bsc#1284343)
  * Add gnutls-FIPS-SLI-tls10-PRF.patch
- FIPS: TLS 1.3 initialized using empty input (bsc#1284344)
  * TLS 1.3 key schedule was initialized using an empty input
    instead of the zero-filled value specified by RFC 8446.
  * secrets: pass actual zeroes in _tls13_init_secret2 (7fad16dc)
  * Add gnutls-FIPS-zeros-in_tls13_init_secret2.patch

==== iproute2 ====
Version update (7.2 -> 7.3)

- Update to release 7.3
  * ip: add OVPN device mode support
  * ss: stop displaying dccp sockets
  * seg6: add support for lookup attribute in SRv6 encap routes
  * ip nexthop: support fdb destination port
  * ip/bond: add lacp_strict support

==== kernel-source ====
Version update (7.3.0 -> 7.3.1)

- Linux 7.3.1 (bsc#1012628).
- io_uring/poll: don't loop on HUP with multiple references
  (bsc#1012628).
- pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting
  the reaper (bsc#1012628).
- coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
  (bsc#1012628).
- signal: allow taks to temporarily block TIF_NOTIFY_SIGNAL
  (bsc#1012628).
- exit: hang up the tty before closing the files (bsc#1012628).
- fork: release the files of a failed fork after
  sched_cancel_fork() (bsc#1012628).
- ptrace: refuse to change the signal mask of a user worker
  (bsc#1012628).
- io-wq: order the exit bit against worker creation task work
  (bsc#1012628).
- signal: only SIGKILL and the freezers interrupt a coredumping
  task (bsc#1012628).
- signal: don't retarget shared signals in a dying thread group
  (bsc#1012628).
- coredump: hold RCU while releasing parked threads (bsc#1012628).
- ftrace: Initialize modname and offset in print_rec()
  (bsc#1012628).
- asymmetric_keys: reject trust keys without IDs (bsc#1012628).
- keys/trusted_keys: return immediately after TPM unseal failure
  (bsc#1012628).
- KEYS: trusted: Fix blob allocation size in tpm2_key_decode()
  (bsc#1012628).
- KEYS: Fix key_reject_and_link() race with keyring restriction
  (bsc#1012628).
- keys: Protect the read method check against type removal
  (bsc#1012628).
- keys: make keyring indexes independent of kernel addresses
  (bsc#1012628).
- keys: Protect the type name while describing a key
  (bsc#1012628).
- keys: Check the authorization payload in process keyring
  searches (bsc#1012628).
- keys: Avoid the owner account dereference in named keyring
  lookup (bsc#1012628).
- io_uring: end the drain when the drain request completes
  (bsc#1012628).
- io_uring/waitid: prevent cancel reference wrap (bsc#1012628).
- io_uring/net: keep recv buffer select length within MAX_RW_COUNT
  (bsc#1012628).
- io_uring/wait: wake real-time waiters from hard interrupt
  context (bsc#1012628).
- io_uring/poll: avoid retry wakeup loss when dropping ownership
  (bsc#1012628).
- tracing/syscalls: Use copy_from_user for the faultable syscall
  buffer (bsc#1012628).
- tracing/histograms: Verify event_call identity when updating
  synth_event refcount (bsc#1012628).
- tracing: Fix 64-bit and signed histogram fields on 32-bit
  kernels (bsc#1012628).
- tracing: Add the bucket size to expr_field_str() (bsc#1012628).
- tracing: Unregister field variable histograms when the command
  fails (bsc#1012628).
- tracing: Save the event file instead of the compatible histogram
  (bsc#1012628).
- tracing: Reject incomplete event filter expressions
  (bsc#1012628).
- tracing: Hold trace_types_lock when resetting last boot data
  from readers (bsc#1012628).
- tracing: Hold trace_types_lock when updating modules in
  persistent instances (bsc#1012628).
- tools/dma: fix building with O= (bsc#1012628).
- Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has
  conn (bsc#1012628).
- mm/damon/core: error damos_commit_quota_goal() for zero
  target_value (bsc#1012628).
- genirq/proc: Fix missing CPU header in /proc/interrupts
  (bsc#1012628).
- commit 8815021
- rpm/release-projects: Add SUSE:SLFO:Kernel:1.0
- commit 2b42edb
- rpm/mkspec: Adjust for 32bit arch rename again
  There is a discrepancy between OBS architecture and rpm architecture for
  32bit arm. Specify both variants.
  Fixes: 38dbb311314 ("rpm/mkspec: Adjust for 32bit Arm arch rename")
- commit 09b332e
- Revert "mkspec: Exclude rt flavor from kernel-syms dependencies (bsc#1244337)."
  This reverts commit 7c95ae0ac0bb4a4481565e3a3ead1e221ced817c.
- commit ee3b323
- Revert "rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337)"
  This reverts commit 630f139a764a8ea61dfc0bb46f3675769d8ac1e0.
- commit ebcac98
- Revert "rpm/mkspec: Exclude azure from kernel-syms dependencies"
  This reverts commit c174e9bd96115668914bc3ed97c2df3525bf7930.
- commit 16115a3
- series.conf: move a patch to sorted section
  patches.suse/ALSA-usb-audio-Avoid-applying-boot-quirk-for-Behring.patch
  is upstream now.
- commit 2c911cd
- Refresh
  patches.suse/powerpc-ftrace-Don-t-restore-r13-during-ftrace_regs_caller.patch.
  Update upstream status.
- commit 22d516d
- x86/mm/pat: Use pr_warn() for early W^X warnings (bsc#1284523).
    ... changelog too long, skipping 7 lines ...
- commit 71bace3

==== kirigami-addons6 ====
Version update (1.14.0 -> 1.16.0)
Subpackages: libKirigamiAddonsComponents6 libKirigamiAddonsStatefulApp6 libKirigamiApp6

- Update to 1.16.0
  https://carlschwan.eu/2026/10/29/kirigami-addons-1.16.0.-the-material-updates/

==== libostree ====
Version update (2026.5 -> 2026.6)
Subpackages: libostree-1-1

- Update to version 2026.6:
  * sign: Compare OpenSSL sign results against 1, test more spki cases
  * core: Reject duplicate names in dirtree objects
  * static-delta: Parse superblock files as untrusted
  * prepare-root: Allow /run/ostree to exist already
  * fetcher-uri: Keep https scheme when dropping default port
  * rofiles-fuse: Check hardlinks for O_TRUNC opens and removexattr
  * sign-spki: Pass GBytes when looking up revoked keys
  * static-delta: Avoid mapping BSPATCH output on FUSE

==== libupnp ====
Version update (22.1.8 -> 22.1.10)
Subpackages: libixml22 libupnp22

- Update to release 22.1.10
  * Reject CR and LF in the service type of a SOAP action.
- Update to release 22.1.9
  * Reject an HTTP response whose status code is not three digits.
  * Fix denial of service of the miniserver worker threads.
  * Fix a heap over-read when sending a GENA event.
  * Fix a path traversal in the web server.
  * Fix a corrupted attribute list when
    ixmlElement_setAttributeNode() or
    ixmlElement_setAttributeNodeNS() was called with an attribute
    the element already owned and the lookup did not return that
    same attribute.
  * Send "Content-Range: bytes */<length>" in the 416 response of
    the web server to a Range request that cannot be satisfied.

==== live555 ====
Version update (2026.10.24 -> 2026.10.29)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia122

- Update to version 2026.10.29:
  * Mostly cosmetic changes, and replaced more calls to "sprintf()" with calls
    to "snprintf()".

==== lvm2 ====
Subpackages: liblvm2cmd2_03

- lvm2 on LUKS: failed to activate VG after unencrypted device appears during boot (bsc#1288220)
  * Add upstream patch
    + bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch

==== lvm2-device-mapper ====
Subpackages: device-mapper libdevmapper-event1_03 libdevmapper1_03

- lvm2 on LUKS: failed to activate VG after unencrypted device appears during boot (bsc#1288220)
  * Add upstream patch
    + bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch

==== qt6-base ====
Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-printsupport-cups qt6-sql-sqlite qt6-wayland

- Add upstream fix:
  * CVE-2026-105924-qtbase-6.12.diff (CVE-2026-105924)

==== tesseract-ocr ====
Version update (5.5.3 -> 5.5.4)
Subpackages: libtesseract5 tesseract-ocr-common

- Update to version 5.5.4:
  * Hardening release: crafted-traineddata guards, Coverity
    fixes, leak and robustness fixes, training-tool fixes
  * Drop upstreamed patches contained in 5.5.4 (fixes
    credited 2026-09-23):
    tesseract-CVE-2026-88047.patch,
    tesseract-CVE-2026-88048.patch,
    tesseract-CVE-2026-88049.patch,
    tesseract-CVE-2026-88050.patch,
    tesseract-CVE-2026-88051.patch,
    tesseract-CVE-2026-88052.patch,
    tesseract-CVE-2026-88053.patch,
    tesseract-CVE-2026-88054.patch
  * Raise pkgconfig(lept) floor to >= 1.80 per upstream

==== wireplumber ====
Version update (0.5.18 -> 0.5.19)
Subpackages: libwireplumber-0_5-0

- Update to version 0.5.19:
  * Additions & Enhancements:
  - Added wpctl get-profile and wpctl get-route to show the
    available and active profiles and routes of a device,
    including their priorities and the direction of each route
    (#989 (closed); !933 (merged))
  - Added the node.slow-resume node property, together with the
    session.fast-capture-start and session.fast-playback-start
    client properties, which let clients keep slow-resume nodes
    idle instead of suspended while they are connected
    (!921 (merged))
  - Added the monitor.camera.seat-monitoring feature, which makes
    the V4L2 and libcamera monitors enumerate cameras only while
    the logind session is active, so that cameras are no longer
    skipped when WirePlumber starts before the session gets
    access to them. This is enabled by default (#1049 (closed);
    !939 (merged))
  - Added the bluetooth.autoswitch-switch-timeout and
    bluetooth.autoswitch-restore-timeout settings, and raised the
    default restore timeout to 4 seconds, so that applications
    reopening the microphone shortly after closing it keep the
    headset profile (#1050 (closed); !938 (merged))
  - Improved Bluetooth A2DP duplex profiles support: the source
    loopback is now also created for these profiles, making their
    microphone usable, and autoswitch-bluetooth-profile no longer
    switches away from them (#1051 (closed); !940 (merged))
  - Added the device.recover-on-error ALSA device property:
    closing and re-opening a device after a node error only helps
    some devices, so this recovery now only happens if the
    property is set (#1046 (closed); !929 (merged))
  * Fixes:
  - Fixed the priority of UCM HiFi* nodes to match that of
    analog-* nodes, so that they no longer lose the default sink
    election to HDMI (!924 (merged))
  - Fixed restricted and flatpak clients being wrongly given
    write and link permissions (#1044 (closed); !928 (merged))
  - Fixed autoswitch-bluetooth-profile leaving headsets stuck in
    the headset profile after connecting devices that advertise
    the A2DP profile later (#1048 (closed); !931 (merged))
  - Fixed all new streams getting corked after a card profile
    switch, until WirePlumber was restarted (#1030 (closed);
    !919 (merged))
  - Fixed new streams that enable a smart filter being linked
    before the filters were relinked, which made them capture
    unfiltered audio for a short time (!922 (merged))
  - Fixed an abort on shutdown with PipeWire 1.4 when V4L2
    devices are present, by tearing down WpSpaDevice on the
    thread of its owning client context, and did the same for
    destroying WpImplNode (!934 (merged), !935 (merged))
  - Fixed monitor.bluez.rules not being applied to the Bluetooth
    source loopback nodes (#1043 (closed); !927 (merged))
  - Fixed wpctl list not listing some objects, such as video
    devices, by requesting the minimal object features
    (!930 (merged))
  - Fixed object activation hanging forever if exporting an
    object to PipeWire fails, by returning an error instead
    (#1019; !937 (merged))

==== xkeyboard-config ====

- added xkeyboard-config-rpmlintrc as Source to Specfile
- Drop the %ghost entries for /var and /var/lib; both directories
  are owned by the filesystem package. The /var/lib/xkb
  directories themselves stay as ghosts and keep being created
  by tmpfiles (jsc#PED-14831).
- Drop the trailing slash from the /var/lib/xkb tmpfiles entry
  so the path matches the packaged file list.
- Run fdupes over /usr/share/xkeyboard-config-2 and the locale
  tree: the base and evdev rules files and the xkeyboard-config
  and xkeyboard-config-2 message catalogues are byte-identical
  pairs, now linked instead of duplicated (about 4 MB of
  duplicated payload).
- Collect the xkeyboard-config-2 message catalogues with
  %find_lang as well, so they carry %lang attributes like the
  xkeyboard-config ones.
- Drop unused BuildRequires: intltool and perl(XML::Parser);
  nothing in the build uses either.
- Add an rpmlintrc for the %post keymap-cache cleanup findings;
  the cleanup itself stays (bnc#662014).
- Drop the Group tag, fix a spelling error in the description
  and add the missing patch tags.