Packages changed:
  AppStream (1.0.0 -> 1.0.1)
  MozillaFirefox
  alsa (1.2.10 -> 1.2.11)
  alsa-ucm-conf (1.2.10 -> 1.2.11)
  alsa-utils (1.2.10 -> 1.2.11)
  crun (1.12 -> 1.14)
  crypto-policies
  cups
  cups-filters (1.28.15 -> 1.28.17)
  drkonqi5
  ffmpeg-4
  glibc (2.38 -> 2.39)
  gstreamer (1.22.8 -> 1.22.9)
  gstreamer-plugins-bad (1.22.8 -> 1.22.9)
  gstreamer-plugins-base (1.22.8 -> 1.22.9)
  gstreamer-plugins-good (1.22.8 -> 1.22.9)
  inxi (3.3.31 -> 3.3.32)
  iproute2 (6.6 -> 6.7)
  kernel-firmware (20240126 -> 20240201)
  kio
  kio-extras5
  ksystemstats5
  kwin5
  libksysguard5
  libusb-1_0 (1.0.26 -> 1.0.27)
  libzio (1.08 -> 1.09)
  mutter
  netpbm (11.2.0 -> 11.5.2)
  pam
  pam-full-src
  parted (3.5 -> 3.6)
  partitionmanager
  perl-gettext
  pipewire (1.0.1 -> 1.0.2)
  plasma5-addons
  plasma5-workspace
  podman (4.9.0 -> 4.9.2)
  python-Mako (1.3.0 -> 1.3.2)
  python-Twisted
  python-pip
  python-pytz (2023.3.post1 -> 2023.4)
  python-setuptools (69.0.2 -> 69.0.3)
  runc (1.1.11 -> 1.1.12)
  sddm
  shim (15.7 -> 15.8)
  strace
  systemd-presets-common-SUSE
  timezone (2023d -> 2024a)
  vlc
  xdg-utils

=== Details ===

==== AppStream ====
Version update (1.0.0 -> 1.0.1)
Subpackages: libAppStreamQt5-3 libappstream5

- Update to 1.0.1
  Bugfixes:
  * Fix lib name for Qt5 link target
  * meson: Pass -D_DARWIN_C_SOURCE on darwin
  * Fix macOS build
  * stemmer: Resolve potential issue where stemmer may never be
    initialized
  * cli: Don't fail what-provides if components were found
  * Fix query element order for what-provides queries
  * validator: Demote developer-name-tag-deprecated to info
    severity for now
  * content-rating: Fix missing or wrong value descriptions for
    rating IDs
  * curl: Add transfer speed timeouts for HTTP downloads
  * curl: Retry operations on potentially transient errors
    Miscellaneous:
  * validator: Improve hint for content-attribute-value-invalid
  * Allow building without zstd temporarily
- Drop patches, merged upstream:
  * 0001-validator-Demote-developer-name-tag-deprecated-to-in.patch
  * 0001-content-rating-Fix-missing-or-wrong-value-descriptio.patch
  * 0001-Fix-lib-name-for-Qt5-link-target.patch
- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== MozillaFirefox ====

- Recommend libfido2-udev on codestreams that exist, in order to try
  to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)

==== alsa ====
Version update (1.2.10 -> 1.2.11)
Subpackages: libasound2 libatopology2

- Updated to alsa-lib 1.2.11:
  * auto-tools fixes, versioned symbol fixes
  * support dB TLVs for single controls
  * various PCM updates, including subformat extensions
  * UMP and sequencer API fixes
  For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.10_v1.2.11#alsa-lib
- Dropped obsoleted patches:
  0001-control.h-Fix-ump-header-file-detection.patch
  0002-global.h-move-__STRING-macro-outside-PIC-ifdef-block.patch
  0003-pcm-Fix-segfault-with-32bit-libs.patch
  0004-reshuffle-included-files-to-include-config.h-as-firs.patch
  0005-seq-Fix-typos-in-symbol-version-definitions.patch
  0006-seq-Fix-invalid-sanity-check-in-snd_seq_set_input_bu.patch
  0007-mixer-simple-Support-dB-TLVs-for-CTL_SINGLE-controls.patch
  0008-seq-Clear-UMP-event-flag-for-legacy-apps.patch
  0009-seq-Simplify-snd_seq_extract_output.patch
  0010-seq-Check-protocol-compatibility-with-the-current-ve.patch

==== alsa-ucm-conf ====
Version update (1.2.10 -> 1.2.11)

- Update to version 1.2.11:
  * Qualcomm, Mediatek, SOF soundwire, and various USB-audio profiles
  For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.10_v1.2.11#alsa-ucm-conf
- Drop obsoleted patch:
  0001-SplitPCM-Device-argument-may-not-be-set.patch

==== alsa-utils ====
Version update (1.2.10 -> 1.2.11)

- Update to alsa-utils 1.2.11:
  * alsactl buffer overflow fix
  * alsatplg updates, NHLT ACPI parser updates
  * use smaller periods for speaker-test
  * add bandwidth-limited pink noise for speaker-test
  * aplay updates, including subformat extensions
  * compile warning fixes
  For details, see:
    https://www.alsa-project.org/wiki/Changes_v1.2.10_v1.2.11#alsa-utils
- Drop obsoleted patches:
  0001-axfer-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0002-amidi-use-ATTRIBUTE_UNUSED-instead-remove-argument-n.patch
  0003-alsaloop-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0004-bat-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0005-seq-use-ATTRIBUTE_UNUSED-instead-remove-argument-nam.patch
  0006-alsaucm-use-ATTRIBUTE_UNUSED-instead-remove-argument.patch
  0007-topology-use-ATTRIBUTE_UNUSED-instead-remove-argumen.patch
  0008-topology-include-locale.h.patch
  0009-nhlt-dmic-info.c-include-sys-types.h.patch
  0010-topology-pre-processor-Add-support-for-enum-controls.patch
  0011-configure.ac-fix-UMP-support-detection.patch
  0012-bat-really-skip-analysis-of-the-first-period-and-upd.patch
  0013-topology-add-include-for-ENABLE_NLS-on-musl.patch
  0014-nhlt-use-stdint.h-types.patch
  0015-Revert-nhlt-dmic-info.c-include-sys-types.h.patch
  0016-aplay-use-stdint.h-types-instead-u_int-u_short-u_cha.patch
  0017-alsa-restore.rules-use-devnode-instead-number-atribu.patch
  0018-nhlt-Revert-SSP_ANALOG-device_type-field.patch
  0019-alsactl-fix-potential-buffer-overwrite.patch
  0020-aplay-fix-buffer-overflow-and-tainted-format-string.patch
  0021-misc-fix-incorrect-usages-of-strerror.patch
  0022-aplay-Add-option-for-specifying-subformat.patch
  0023-aplay-allow-to-compile-with-older-alsa-lib-subformat.patch
  0024-aplay-log-pcm-status-before-reporting-a-fatal-error.patch
  0025-aplay-enable-timestamps-by-default.patch
  0026-aplay-status-dumps-are-called-only-in-verbose-mode.patch
  0027-aplaymidi-Set-event-completely-for-tempo-event.patch

==== crun ====
Version update (1.12 -> 1.14)

- update to 1.14:
  * build: drop dependency on libgcrypt. Use blake3 to compute the cache key.
  * cpuset: don't clobber parent cgroup value when writing the cpuset value.
  * linux: force umask(0). It ensures that the mknodat syscall is not affected by the umask of the calling process,
    allowing file permissions to be set as specified in the OCI configuration.
  * ebpf: do not require MEMLOCK for eBPF programs. This requirement was relaxed in Linux 5.11.
- update to 1.13:
  * src: use O_CLOEXEC for all open/openat calls
  * cgroup v1: use "max" when pids limit < 0.
  * improve error message when idmap mount fails because the underlying file system has no support for it.
  * libcrun: fix compilation when building without libseccomp and libcap.
  * fix relative idmapped mount when using the custom annotation.

==== crypto-policies ====
Subpackages: crypto-policies-scripts

- avoid the cycle rpm/cmake/crypto-policies/python-rpm-macros:
  we only need python3-base here, we don't need the python
  macros as no module is being built

==== cups ====
Subpackages: cups-client cups-config libcups2 libcupsimage2

- Removed outdated ntadmin stuff from cups.spec (boo#1219503)

==== cups-filters ====
Version update (1.28.15 -> 1.28.17)

- Removed outdated and obsoleted "Requires: cups > 1.5.4"
  which was used to require a sufficient CUPS version
  at times when also CUPS <= 1.5.4 was available
  but it was not meant to require CUPS (boo#1216560)
- Version upgrade to 1.28.17
  See https://github.com/OpenPrinting/cups-filters/releases
  Bug fix release, to more reliably discover all printer
  capablities from driverless printers, especially borderless
  printing, and to preferably use Apple Raster instead of
  PWG Raster or PCLM.
  * libcupsfilters: In PPD generator create only one *cupsFilter2:
    line for raster. Only use the most desirable/reliable format,
    usually Apple Raster (Issue #498).
  * libcupsfilters: In get_printer_attributes() poll
    media-col-database separately if needed. On some printers
    one gets media-col-database only this way. Often it reveals
    important functionality, like for example borderless printing
    (Issue #492).
  * libcupsfilters: Let PPD generator also parse media-col-ready
    IPP attribute. media-col-ready lists the loaded media,
    in contrary to media-ready, as list of complete descriptions
    of the media (media-col data structure). This often lists also
    variants like borderless (it is the same physical paper).
    Especially useful when media-col-database is not available
    (Issue #492).
  * libcupsfilters: In generate_sizes() consider all
    margin alternatives. When generating the PPD file
    for a driverless printer, and in the
    media-{left,right,top,bottom}-margin-supported printer
    IPP attributes there was more than 1 value, the first value
    (which often was the 0 for borderless printing) was not
    considered, leaving the borderless functionality of many
    printers undiscovered (Issue #492).
  Issues are those at
  https://github.com/OpenPrinting/cups-filters/issues
- Version upgrade to 1.28.16
  See https://github.com/OpenPrinting/cups-filters/releases
  Bug fix release, to make images be printed in their original
  size with "print-scaling=none" and to not use deprecated data
  types for reading TIFF images.
  * imagetoraster, imagetopdf, libcupsfilters: Added support
    for reading the resolution of an image from its EXIF data
    when loading it. This way we get the image reproduced in
    its original size with "print-scaling=none" (Issue #362).
  * libcupsfilters: Replaced deprecated data types uint16 and
    uint32. The function to read TIFF image files via libtiff
    in cupsfilters/image-tiff.c uses the deprecated types
    uint16 and uint32. The replacements for these types are
    uint16_t and uint32_t.
  Issues are those at
  https://github.com/OpenPrinting/cups-filters/issues

==== drkonqi5 ====
Subpackages: drkonqi5-lang

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== ffmpeg-4 ====
Subpackages: libavutil56_70 libpostproc55_9

- drop support for libmfx, which is no longer supported upstream
  at all (boo#1219494)

==== glibc ====
Version update (2.38 -> 2.39)
Subpackages: glibc-extra glibc-locale glibc-locale-base

- Update to glibc 2.39
  * A new tunable, glibc.cpu.plt_rewrite, can be used to enable PLT
    rewrite on x86-64
  * Sync with Linux kernel 6.6 shadow stack interface
  * struct statvfs now has an f_type member, equal to the f_type statfs
    member
  * On Linux, the functions posix_spawnattr_getcgroup_np and
    posix_spawnattr_setcgroup_np have been added, along with the
    POSIX_SPAWN_SETCGROUP flag
  * On Linux, the pidfd_spawn and pidfd_spawp functions have been added
  * On Linux, the pidfd_getpid function has been added
  * scanf-family functions now support the wN format length modifiers for
    arguments pointing to types intN_t, int_leastN_t, uintN_t or
    uint_leastN_t
  * A new tunable, glibc.mem.decorate_maps, can be used to add additional
    information on underlying memory allocated by the glibc
  * The <stdbit.h> header has been added from ISO C2X
  * On AArch64 new symbols were added to libmvec
  * The ldconfig program now skips file names containing ';' or ending in
    ".dpkg.tmp" or ".dpkg.new"
  * The dynamic linker calls the malloc and free functions in more cases
    during TLS access if a shared object with dynamic TLS is loaded and
    unloaded
- aarch64-rawmemchr-unwind.patch, cache-amd-legacy.patch,
  cache-intel-shared.patch, call-init-proxy-objects.patch,
  fstat-implementation.patch, gb18030-2022.patch,
  getaddrinfo-eai-memory.patch, getaddrinfo-memory-leak.patch,
  getcanonname-use-after-free.patch, iconv-error-verbosity.patch,
  intl-c-utf-8-like-c-locale.patch, ldconfig-process-elf-file.patch,
  libio-io-vtables.patch, libio-wdo-write.patch,
  no-aaaa-read-overflow.patch, posix-memalign-fragmentation.patch,
  ppc64-flock-fob64.patch, qsort-invalid-cmp.patch,
  sem-open-o-creat.patch, setxid-propagate-glibc-tunables.patch,
  syslog-buffer-overflow.patch, tls-modid-reuse.patch,
  tunables-string-parsing.patch: Removed
- syslog-buffer-overflow.patch: syslog: Fix heap buffer overflow in
  __vsyslog_internal (CVE-2023-6246, CVE-2023-6779, CVE-2023-6780,
  bsc#1218863, bsc#1218867, bsc#1218868)
- qsort-invalid-cmp.patch: qsort: handle degenerated compare function
  (bsc#1218866)
- Change minimum GCC to 13
- Split off libnsl.so.1 into a separate package

==== gstreamer ====
Version update (1.22.8 -> 1.22.9)
Subpackages: libgstreamer-1_0-0 typelib-1_0-Gst-1_0

- Update to version 1.22.9:
  + Highlighted bugfixes in 1.22.9
  - More Security fixes for the AV1 video codec parser
  - va: fixes for Mesa Gallium drivers in Mesa versions older
    than v23.2
  - v4l2src: Consider framerate during caps selection
  - v4l2codec: decoder fixes
  - rtspsrc: multicast fixes
  - camerabin viewfinder fixes
  - various bug fixes, build fixes, memory leak fixes, and other
    stability and reliability improvements
  + gstreamer
  - aggregator: fix use-after-free in queries processing
  - multiqueue: Ignore queue fullness for most events
- Rebase reduce-required-meson.patch

==== gstreamer-plugins-bad ====
Version update (1.22.8 -> 1.22.9)
Subpackages: libgstadaptivedemux-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstplayer-1_0-0 libgstsctp-1_0-0 libgsttranscoder-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0

- Update to version 1.22.9:
  + av1parser: Fix potential stack overflow during tile list
    parsing (CVE-2024-0444, bsc#1219453, ZDI-CAN-22300)
  + camerabin: Correctly relink viewfinderbin_queue
  + GstPlay: Fix error details parsing
  + h264decoder: Handle malformed avc/avc3 packets
  + h264decoder: h265decoder: Align with wraparound fix
  + vp8decoder: vp9decoder: av1decoder: mpeg2decoder:
    Fix multiplication wraparound
  + vah264enc/vah264dec issues after recent upgrade to 1.22.8
    from 1.22.7
  + va: fixes for Mesa Gallium drivers in Mesa versions older
    than v23.2
  + vp9parse: Fix critical warning during caps negotiation
- Rebase reduce-required-meson.patch

==== gstreamer-plugins-base ====
Version update (1.22.8 -> 1.22.9)
Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstfft-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgstrtp-1_0-0 libgstrtsp-1_0-0 libgstsdp-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 typelib-1_0-GstTag-1_0

- Update to version 1.22.9:
  + audiobasesink: Don't wait on gap events
  + audioconvert: change gst_audio_convert_get_unit_size() log
    levels
  + glcolorconvert: Correct transform_caps direction
  + gloverlay: Apply updated overlay coordinates correctly
  + videorate: keep pool if max_buffers is unlimited
- Rebase reduce-required-meson.patch

==== gstreamer-plugins-good ====
Version update (1.22.8 -> 1.22.9)
Subpackages: gstreamer-plugins-good-gtk

- Update to version 1.22.9:
  + rtpsession: Only warn once if configured latency needs to be
    known but isn't yet
  + rtphdrext-clientaudiolevel: Fix level value being written by
    the extension
  + rtspsrc: set multicast-iface on udpsinks and fix RTCP sink TTL
  + v4l2object: clear old fds when initializing poll during
    opening v4l2 device
  + v4l2src: Consider framerate during caps selection
  + vpxdec: Use appropriate domain and code for decoding errors
- Rebase reduce-required-meson.patch

==== inxi ====
Version update (3.3.31 -> 3.3.32)

- - Updated to version 3.3.32:
  + /usr/share/doc/packages/inxi/inxi.changelog.

==== iproute2 ====
Version update (6.6 -> 6.7)
Subpackages: iproute2-bash-completion

- Update to release 6.7
  * devlink: Support setting port function ipsec_crypto cap and
    ipsec_packet cap
  * iplink: bridge: Add support for bridge FDB learning limits
  * bridge: fdb: support match on source VNI, nexthop ID,
    destination VNI, destination port, destination IP address and
    [no]router flag in the flush command
  * bridge: mdb: Add get support

==== kernel-firmware ====
Version update (20240126 -> 20240201)
Subpackages: kernel-firmware-all kernel-firmware-amdgpu kernel-firmware-ath10k kernel-firmware-ath11k kernel-firmware-ath12k kernel-firmware-atheros kernel-firmware-bluetooth kernel-firmware-bnx2 kernel-firmware-brcm kernel-firmware-chelsio kernel-firmware-dpaa2 kernel-firmware-i915 kernel-firmware-intel kernel-firmware-iwlwifi kernel-firmware-liquidio kernel-firmware-marvell kernel-firmware-media kernel-firmware-mediatek kernel-firmware-mellanox kernel-firmware-mwifiex kernel-firmware-network kernel-firmware-nfp kernel-firmware-nvidia kernel-firmware-platform kernel-firmware-prestera kernel-firmware-qcom kernel-firmware-qlogic kernel-firmware-radeon kernel-firmware-realtek kernel-firmware-serial kernel-firmware-sound kernel-firmware-ti kernel-firmware-ueagle kernel-firmware-usb-network

- More update on version 20240201 (git commit 3677750467cb):
  * linux-firmware: wilc1000: update WILC1000 firmware to v16.1.2
  * rtl_nic: add firmware for RTL8126A (bsc#1217417)
  * qcom: Add Audio firmware for SM8550 HDK
- Update to version 20240201 (git commit 1b24d7d3379b):
  * linux-firmware: intel: Add IPU6 firmware binaries
  * ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37
  * Revert "amdgpu: DMCUB updates for various AMDGPU ASICs"
  * amdgpu: update SMU 13.0.0 firmware
  * amdgpu: update PSP 13.0.0 firmware
  * amdgpu: update GC 11.0.0 firmware
  * brcm: Add brcmfmac43430-sdio.xxx.txt nvram for the Chuwi Hi8 (CWI509) tablet
  * amdgpu: DMCUB updates for various AMDGPU ASICs

==== kio ====
Subpackages: kio-core

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== kio-extras5 ====
Subpackages: libkioarchive5

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== ksystemstats5 ====

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== kwin5 ====

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== libksysguard5 ====
Subpackages: ksysguardsystemstats-data libKSysGuardSystemStats1 libksysguard5-imports libksysguard5-plugins

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== libusb-1_0 ====
Version update (1.0.26 -> 1.0.27)

- Update to version 1.0.27
  * New libusb_init_context API to replace libusb_init
  * New libusb_get_max_alt_packet_size API
  * New libusb_get_platform_descriptor API (BOS)
  * Allow setting log callback with libusb_set_option/libusb_init_context
  * New WebAssembly + WebUSB backend using Emscripten
  * Fix regression in libusb_set_interface_alt_setting
  * Fix sync transfer completion race and use-after-free
  * Fix hotplug exit ordering
  * Linux: NO_DEVICE_DISCOVERY option set per context
- added signature and keyring. (key received via keyserver)

==== libzio ====
Version update (1.08 -> 1.09)

- Version 1.09: Allow to create files without suffix as well

==== mutter ====

- Drop mutter-SLE-bsc984738-grab-display.patch: It blocks non-CSD
  apps with GNOME 45, and the latest LTS Oracle Installer works
  fine without it, the original bug is not a problem (bsc#1218935).

==== netpbm ====
Version update (11.2.0 -> 11.5.2)
Subpackages: libnetpbm11

- version update to 11.5.2
  Release 11.05.02
  + ppmtowinicon: fix array overrun with 4 and 8 bits per pixel.
  Release 11.05.01
  Fix typo in ppmforge test case.
  Release 11.05.00
  + pnmpad: Add -color, -promote, -extend-edge, -detect-background .
  + pnmconvol: Restore ability of convolution matrix to be a
    pseudo-plain-PNM with samples that exceed the maxval.  Lost in
    10.30 (October 2005) because maxval-checking code was added to
    libnetpbm.  (Was fixed in 10.47.08 in November 2010, but only in
    the 10.47 series).
  + pnmindex: Improve failure mode when -size or -across is zero.
  + pnmindex: Make -plain work.
  + pnmpad: fix behavior with -left, -right, and -width together or
  - top, -bottom, -height together: ignores -width where it should
    fail.  Broken in Netpbm 10.72 (September 2015).
  + pamtosvg: fix "zero determinant" failure.  Introduced in
    Netpbm 11.04 (September 2023).
  + pjtoppm: fix crash based on uninitialized variable.
    Introduced in Netpbm 11.04 (September 2023).
  + ppmtopcxl: fix incorrect output with > 256 colors.  Always
    broken.  (Program was added in primordial Netpbm in 1990).
  + pbmtext: fix buffer overrun with insanely large input.
  + picttoppm: fix buffer overrun with insanely wide input.
  + ppmtoxpm: fix incorrect output with insanely large number of
    colors.
  + pnmscalefixed: fix incorrect output with really big image and
  - pixels option.
  + ppmdither: fix buffer overrun with insanely large dithering
    matrix.
  + pnmpad: no longer accept old-style options (e.g. -t50).
  + libnetpbm: Add pm_feed_from_file, pm_accept_to_files,
    pm_accept_to_filestream Standard Input feeder, Output accepter
    for pm_system.
  + libnetpbm, programs that use color maps: fix buffer overrun
    with insanely deep images.
  + merge build: Fix 'pnmcat'.  Introduced in Netpbm 11.00
    (September 2023).
  Release 11.04.00
  + pamaddnoise: add -salt.
  + pamaddnoise: reject options that aren't meaningful for the type
    of noise specified rather than just ignore them.
  + ppmtosixel: Add -7bit, so it works on more terminals, including
    xterms.  Thanks Scott Pakin.
  + g3topbm: Add -correctlong
  + pnmtojpeg: minor improvement to error messages about bad files.
  + pammixmulti: Remove disclaimer of patent license.
  + pamstack: Fix bug: acts like -firstmaxval specified when it
    wasn't.  Introduced in Netpbm 11.03 (June 2023).
  + pamstack: Fix -lcmmaxval: chooses wrong maxval.  Always
    broken (-lcmmaxval was new in Netpbm 11.03 (June 2023)).
  + pamstack: Fail gracefully when total number of planes is too
    large for unsigned integer.  Always broken (Pamstack was new in
    Netpbm 10.0 (June 2002).
  + pamtosvg: fix hang.
  + ppmfade: fix "file not found" crash for most fade modes.
    Introduced in Netpbm 10.98 (March 2022).
  + ppmfade: fix incorrect block mode fade.  Always broken
    (ppmfade was new in Netpbm 8.4 (April 2000)).
  + pamaddnoise: fix very incorrect noise added for all types.
    Introduced in Netpbm 10.94 (March 2021).
  + ppmrough: fix buffer overrun.  Always broken (Ppmrough was new
    in Netpbm 10.9 (September 2002).
    ppmrough: fix excessive roughness.  Introduced in Netpbm 10.94
    (March 2021).
  + pgmtexture: Fix buffer overflow with maxval > 255.  Always
    broken.  Maxvals > 255 were possible starting in Netpbm 9.0
    (April 2000).
  + pgmtexture: Fix bug: ignores -d.  Introduced in Netpbm 10.56
    (September 2011).
  + xwdtopnm Fix spurious output with really wide/deep rows.
  + imgtoppm: Fix spurious output with really wide/deep rows.
  + pbmtopgm: Fix error message for excessive -width.
  + pbmtoxbm: Fix spurious output with really wide rows.
  + tifftopnm: Fix incorrect output with insanely wide/deep rows.
  + thinkjettopbm: Fix incorrect output with insanely wide rows.
  + ybmtopbm: Fix incorrect output with insanely wide rows.
  + pjtoppm: Fix incorrect output with insanely large number of rows.
  + library: add check of maxval for computable size.
  + Build: Include LDFLAGS in link of shared library.
  * Release 11.03.00
  + pamstack: Add -firstmaxval, -lcmmaxval
  + pnmcolormap: make result independent of how system's qsort
    orders records with equal keys.  Affects pnmquant.
  + pamtopng: fix typo in error message about -chroma option.
  + pamtopng, pnmtopng, pngtopam: fix error message when something
    fails in libpng.  Always broken (the programs were new in Netpbm
    8.1 (March 2000)).
- modified patches
  % netpbm-gcc-warnings.patch (refreshed)
  % netpbm-security-code.patch (refreshed)

==== pam ====

- Enable pam_canonicalize_user.so

==== pam-full-src ====

- Enable pam_canonicalize_user.so

==== parted ====
Version update (3.5 -> 3.6)
Subpackages: libparted-fs-resize0 libparted2

- update to version 3.6:
  - Support GPT partition attribute bit 63 as no_automount flag
  - Add type commands to set type-id on MS-DOS and type-uuid on GPT
  - Add swap flag support to the dasd disklabel
  - Add display of GPT disk and partition UUIDs in JSON output
  refreshed patches:
  - parted-mac.patch
  - libparted-dasd-implicit-partition-disk-flag.patch
  - tests-disable.patch
  removed patches:
  - direct-handling-of-partition-type-id-and-uuid.patch
  - type-command.patch
  - libparted-dasd-improve-lvm-raid-flag-handling.patch
  - libparted-dasd-add-swap-flag-handling-for-DASD-CDL.patch

==== partitionmanager ====

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== perl-gettext ====

- Run testsuite with locale LANG=en_US.UTF. It fails otherwise with
  glibc 2.39

==== pipewire ====
Version update (1.0.1 -> 1.0.2)
Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-jack pipewire-libjack-0_3 pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools

- Update to version 1.0.2:
  * Highlights
  - Fix v4l2 enumeration with filter. This should fix negotiation
    in some GStreamer pipelines with capsfilter. Also probe for
    EXPBUF support before using it.
  - Fix max-latency property and Buffer param when dealing with
    small ALSA device buffers. This should fix stuttering with
    some AMD based soundcards.
  - More small cleanups an improvements.
  * Modules
  - Improve netjack2 channel positions.
  - Improve RAOP module state after suspend/resume. (#3778)
  - Avoid crash in some LV2 plugins by configuring the Atom
    ports. (#3815)
  * SPA
  - Bump libcamera requirements to 0.2.0.
  - Try to avoid unaligned load exceptions. (#3790)
  - Fix v4l2 enumeration with filter. (#1793)
  - Fix max-latency property and Buffer param when dealing with
    small ALSA device buffers. This should fix stuttering with
    some AMD based soundcards. (#3744,#3622)
  - Add a resync.ms option to node.driver to make it possible to
    resync fast to clock jumps.
  - Probe for EXPBUF support in v4l2 before using it. (#3821)
  * pulse-server
  - Also emit change events when the port list change.
  * Bluetooth
  - Log a more verbose explanation when other soundservers seem
    to be interfering with bluetooth.
  - Add quirks for Rockbox Brick. (#3786)
  - Add quirks for SoundCore mini2. (#2927)
  * JACK
  - Improve check for the running state of clients. (#3794)
- Drop patches already included by upstream:
  * 0001-spa-libcamera-use-CameraConfigurationorientation.patch
  * 0002-spa-libcamera-bump-minimum-supported-version-to-0.2.0.patch

==== plasma5-addons ====
Subpackages: plasma5-addons-lang

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== plasma5-workspace ====
Subpackages: gmenudbusmenuproxy plasma5-session plasma5-session-wayland plasma5-workspace-libs xembedsniproxy

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== podman ====
Version update (4.9.0 -> 4.9.2)

- Update to version 4.9.2:
  * Bump to v4.9.2
  * Release notes for v4.9.2
  * Cirrus: Update operating branch
  * [v4.9] Bump to c/common v0.57.4, buildkit v0.12.5, c/buidah v1.33.5
  * Fix updated runc dep breaking pod devices cgroup
  * systests: kube with policies test: fix race
  * Remove go.mod pin of runc and update to latest
  * systests: kube with policies test: fix race
  * Bump to v4.9.2-dev
- Update to version 4.9.1:
  * Bump to v4.9.1
  * Release notes for v4.9.1
  * [v4.9] Bump Buildah to v1.33.4, c/common v0.57.3, c/image v5.29.2
  * pkginstaller: bump Qemu version to 8.2.1
  * Assign separate ports for each appleHV machine
  * Fix machine inspect test config
  * AppleHV: update LastUp time
  * applehv: return socket path from setupAPIForwarding
  * applehv: Remove unneeded cmd.ExtraFiles assignment
  * abi: drop check for IsRootless()
  * system: enhance check for re-exec into rootless userns
  * system: enhance check for re-exec into rootless userns
  * Fix `podman machine set --rootful` for applehv
  * applehv - fix vm lookup
  * rpm: use go-rpm-macros on RHEL 10
  * Bump to v4.9.1-dev

==== python-Mako ====
Version update (1.3.0 -> 1.3.2)

- update to 1.3.2:
  * Fixed parsing issue where attempting to render a single percent
    sign % using an escaped percent %% would not function correctly
    if the escaped percent were not the first character on a line.
    Note that this is a revised version of a similar change made
    in Mako 1.3.1 which caused unexpected parsing regressions,
    resulting in the release being yanked.

==== python-Twisted ====
Subpackages: python311-Twisted python311-Twisted-tls

- Add stop-using-3-arg-throw.patch:
  * Avoid 3-arg throw to fix a DeprecationWarning in Python 3.12.

==== python-pip ====

- Drop deprecated setup.py installmethod, bootstrap PEP517 with
  built-in pip instead
- python3XX-pip-wheel can now be a regular subpackage
- Drop obsolete python2 directives in specfile

==== python-pytz ====
Version update (2023.3.post1 -> 2023.4)

- update to 2023.4:
  * Update olson to 2023d

==== python-setuptools ====
Version update (69.0.2 -> 69.0.3)

- update to 69.0.3:
  * Bugfixes - Retain valid names with underscores in egg_info.

==== runc ====
Version update (1.1.11 -> 1.1.12)

- Update to runc v1.1.12. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894
  * This release fixes a container breakout vulnerability (CVE-2024-21626). For
    more details, see the upstream security advisory:
    <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>
  * Remove upstreamed patches:
  - CVE-2024-21626.patch
  * Update runc.keyring to match upstream changes.
[ This was only ever released for SLES. ]
- Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894
  <https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>
  + CVE-2024-21626.patch

==== sddm ====
Subpackages: sddm-branding-openSUSE sddm-greeter-qt5

- Switch to the latest GCC version available in Leap for packages
  that can't build with the default compiler

==== shim ====
Version update (15.7 -> 15.8)

-- Update to version 15.8
  - Various CVE fixes are already merged into this version
    mok: fix LogError() invocation (bsc#1215099,CVE-2023-40546)
    avoid incorrectly trusting HTTP headers (bsc#1215098,CVE-2023-40547)
    Fix integer overflow on SBAT section size on 32-bit system (bsc#1215100,CVE-2023-40548)
    Authenticode: verify that the signature header is in bounds (bsc#1215101,CVE-2023-40549)
    pe: Fix an out-of-bound read in verify_buffer_sbat() (bsc#1215102,CVE-2023-40550)
    pe-relocate: Fix bounds check for MZ binaries (bsc#1215103,CVE-2023-40551)
  - remove shim-Enable-the-NX-compatibility-flag-by-default.patch
    The codes in this patch are already existing in shim-15.8
    The NX flag is disable which is same as the default value of shim-15.8,
    hence, not need to enable it by this patch now.
  - Patches (git log --oneline --reverse 15.7..15.8)
    657b248 Make sbat_var.S parse right with buggy gcc/binutils
    7c76425 Enable the NX compatibility flag by default.
    89972ae CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper
    c7b3051 pe: Align section size up to page size for mem attrs
    e4f40ae pe: Add IS_PAGE_ALIGNED macro
    f23883c Don't loop forever in load_certs() with buggy firmware
    1f38cb3 Optionally allow to keep shim protocol installed
    102a658 Drop invalid calls to `CRYPTO_set_mem_functions`
    aae3df0 test-sbat: Fix exit code
    cca3933 Block Debian grub binaries with SBAT < 4
    cf59f34 Further improve load_certs() for non-compliant drivers/firmwares
    0601f44 SBAT-related documents formatting and spelling
    0640e13 Add a security contact email address in README.md
    0bfc397 Work around malformed path delimiters in file paths from DHCP
    a8b0b60 pe: only process RelocDir->Size of reloc section
    f7a4338 Skip testing msleep()
    549d346 Rename 'msecs' to 'usecs' to avoid potential confusion
    908c388 Change type of fallback_verbose_wait from int to unsigned long
    05eae92 Add SbatLevel_Variable.txt to document the various revocations
    243f125 Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL
    89d25a1 Add a make rule for compile_commands.json
    118ff87 Add gnu-stack notes
    f132655 test: Make our fake dprintf be a statement.
    be00279 Remove CentOS 7 test builds.
    9964960 Split pe.c up even more.
    569270d Test (and fix) ImageAddress()
    61e9894 Verify signature before verifying sbat levels
    1578b55 Add libFuzzer support for csv.c
    a0673e3 Fix a 1-byte memory leak in .sbat parsing.
    e246812 Add libFuzzer support to the .sbat parser.
    fd43eda Work around ImageAddress() usage mistake
    1e985a3 Correctly free memory allocated in handle_image()
    dbbe3c8 mok: Avoid underflow in maximum variable size calculation
    04111d4 Make some of the static analysis tools a little easier to run
    7ba7440 compile_commands.json: remove stuff clang doesn't like
    66e6579 CVE-2023-40546 mok: fix LogError() invocation
    f271826 Add primitives for overflow-checked arithmetic operations.
    8372147 pe-relocate: Add a fuzzer for read_header()
    5a5147d CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries
    e912071 pe-relocate: make read_header() use checked arithmetic operations.
    93ce255 CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat()
    e7f5fdf pe-relocate: Ensure nothing else implements CVE-2023-40550
    afdc503 CVE-2023-40549 Authenticode: verify that the signature header is in bounds.
    96dccc2 CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system
    dae82f6 Further mitigations against CVE-2023-40546 as a class
    ea0f9df Allow SbatLevel data from external binary
    b078ef2 Always clear SbatLevel when Secure Boot is disabled
    7dfb687 BS Variables for bootmgr revocations
    a967c0e shim should not self revoke
    577cedd Print message when refusing to apply SbatLevel
    e801b0d sbat revocations: check the full section name
    0226b56 CVE-2023-40547 - avoid incorrectly trusting HTTP headers
    6f0c8d2 Print errors when setting/clearing memory attrs
    57c0eed Updated Revocations for January 2024 CVEs
    49c6d95 Fix some minor ia32 build issues.
    be8ff7c post-process-pe: Don't set the NX_COMPAT flag by default after all.
    13abd9f pe-relocate: Avoid __builtin_add_overflow() on GCC < 5
    c46c975 Suppress "Failed to open <..>\revocations.efi" when file does not exist
    30a4f37 Rename "previous" revocations to "automatic"
    6f395c2 Build time selectable automatic SBATLevel revocations
    a23e2f0 netboot read_image() should not hardcode DEFAULT_LOADER
    993a345 Try to load revocations.efi even if directory read fails
    1770a03 gitmodules: use shim-15.8 for gnu-efi branch
    5914984 (HEAD -> main, tag: latest-release, tag: 15.8, origin/main, origin/HEAD) Bump version to 15.8

==== strace ====

- Enable SELinux Context Printing (--secontext).

==== systemd-presets-common-SUSE ====

- Split hcn-init.service to hcn-init-NetworkManager and hcn-init-wicked
  (bsc#1200731 ltc#198485 https://github.com/ibm-power-utilities/powerpc-utils/pull/84)
  Support both the old and new service to avoid complex version interdependency.

==== timezone ====
Version update (2023d -> 2024a)

- Update to 2024a:
  * Kazakhstan unifies on UTC+5 beginning 2024-03-01
  * Palestine springs forward a week later after Ramadan
  * zic no longer pretends to support indefinite-past DST
  * localtime no longer mishandles Ciudad Juárez in 2422

==== vlc ====
Subpackages: libvlc5 libvlccore9 vlc-codec-gstreamer vlc-lang vlc-noX

- drop support for libmfx, which is no longer supported upstream
  at all (boo#1219494)

==== xdg-utils ====

- Update to version 1.2.0+20240130:
  * xdg-icon-resource: unbreak syntax by removing stray grave accent
    (boo#1219420)