n/a

- net: gro: don't merge zcopy skbs (git-fixes).
- net: skbuff: propagate shared-frag marker through frag-transfer
  helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
  (CVE-2026-46300 bsc#1265209).
- commit 9cbfbf9

- Revert "net: skbuff: propagate shared-frag marker through pskb_copy()"
  This reverts commit 6efe0d21527e99384f2bf133c6f425539df0441e.
- commit 454d2dc

- Deleted
  patches.kabi/ptrace-slightly-saner-get_dumpable-logic-kabi-assert.patch
  Previously reverted by commit cd71df924cad5283fd5efbd9ebf19ff1c9d8278c
- commit 07f5a40

- Refresh
  patches.suse/perf-Fix-__perf_event_overflow-vs-perf_remove_from_context.patch.
  Fix ISO C90 warnings in previous submission
- commit 52955e7

- kernel-binary: Only apply vmlinux workaround on SLE15 and later
  To create debuginfo for vmlinux the file needs to be present even if
  it's not packaged because a compressed file is packaged insteand.
  To accomplish that the file is marked as ghost in the file list. Then
  rpm does not complain that the file exists but does not package it.
  However, rpm still reserves space for ghost files when installing a
  package. To avoid reserving space for a file that is not used the file
  is truncated.
  That works on SLE 15 but on SLE 12 rpm then fails packaging the
  debuginfo complaiing that extra debuginfo files are present. Limit the
  workaround to SLE 15 and later.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit 1ef7451

- Kernel-binary: Do not truncate vmlinux when it's the boot image
  Some architectures use vmlinux to boot. Truncating vmlinux on those
  architectures causes signing failure during build. Also if the signing
  was disabled a brokne kernel would be produced.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit d3cf603

- perf: Fix __perf_event_overflow() vs perf_remove_from_context()
  race (bsc#1260018 CVE-2026-23271).
- commit 581183d

- kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements
  define %__spec_install_post to truncate the uncompressed vmlinux
  to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents
  rpmbuild from baking the %ghost file size into the FILESIZES
  header, which can cause installation failures on smaller /boot partitions.
  Fixes: bsc#1265456
- commit 222edac

- net/rds: reset op_nents when zerocopy page pin fails
  (bsc#1265626 CVE-2026-43494).
- net/rds: reset op_nents when zerocopy page pin fails
  (bsc#1265626).
- commit 7f316d0

- VUL-1 CVE-2026-41051: csync2: uses insecure temporary directories when compiled with C99 or later
  (bsc#1262472) Add patch:
  configure_mkstemp_c99.patch

- CVE-2026-4480: Fix Unauthenticated Remote Code Execution;
  (bso#16033); (bsc#1261161).
- CVE-2026-4408: Fix Remote Code Execution in SAMR;(bso#16034);
  (bsc#1261163).
- CVE-2026-3238: Fix unauthenticated udp packet crashes AD DC
  nbt server; (bso#16012); (bsc#1261160).
- CVE-2026-3012: Fix CVE-2026-3012 group policy certificate
  enrollment using http:// without validation;(bso#16003);
  (bsc#1261159).
- CVE-2026-2340: vfs_worm does not block directory modification;
  (bso#15997); (bsc#1261158).

- Security fixes:
  * CVE-2026-33846: buffers: add more checks to DTLS reassembly (bsc#1263705)
  * CVE-2026-42009: lib/buffers: ensure packets have differing sequence numbers (bsc#1263708)
  * CVE-2026-33845: buffers: switch from end_offset over to frag_length (bsc#1263704)
  * CVE-2026-42010: lib/auth/rsa_psk: fix binary PSK identity lookup (bsc#1263709)
  * CVE-2026-3833: x509/name-constraints: compare domain names case-insensitive (bsc#1263707)
  * CVE-2026-42011: x509/name_constraints: fix intersecting empty constraints (bsc#1263710)
  * CVE-2026-42012: x509/hostname-verify: make URI/SRV SAN preclude CN fallback (bsc#1263711)
  * CVE-2026-42013: x509: prevent fallback on oversized SAN (bsc#1263712)
  * CVE-2026-42014: pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin (bsc#1263713)
  * CVE-2026-42015: x509/pkcs12_bag: fix off-by-one in bag element bounds check (bsc#1263714)
  * CVE-2026-5260: lib/pkcs11_privkey: guard against overreading on short ciphertexts (bsc#1263715)
  * Add patches:
    gnutls-CVE-2026-33846.patch gnutls-CVE-2026-42009.patch
    gnutls-CVE-2026-33845.patch gnutls-CVE-2026-42010.patch
    gnutls-CVE-2026-3833.patch  gnutls-CVE-2026-42011.patch
    gnutls-CVE-2026-42012.patch gnutls-CVE-2026-42013.patch
    gnutls-CVE-2026-42014.patch gnutls-CVE-2026-5260.patch
    gnutls-CVE-2026-42015.patch

- Fix buffer overflow in lzma_index_append (bsc#1261280, CVE-2026-34743)
  * CVE-2026-34743.patch
- Change SUSE-Public-Domain license to LicenseRef-SUSE-Public-Domain to
  fix rpmlint errors

- added patches
  CVE-2026-34757: Information disclosure and data corruption via use-after-free vulnerability [bsc#1261957]
  * libpng16-CVE-2026-34757.patch

- Added openssh-cve-2026-35385-scp-setuid-modes.patch (bsc#1261427),
  ensuring setuid bits default to being masked out by scp.
- Added openssh-cve-2026-35414-mishandled-ca-commas.patch
  (bsc#1261430), fixing mishandling of comma characters in CA in
  certain situations.

- Add python36-certifi provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-idna provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-packaging provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-ply provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- CVE-2026-40475: improper input handling of null bytes can lead to
  silent data truncation and security-state inconsistency (bsc#1262803)
  * CVE-2026-40475.patch

- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-python-dateutil provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-py provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch

- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch

- Fix testsuite failures
- Backport of the CVE-2026-31958 fix (bsc#1259554)
- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * fix-test-failures-754.patch
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch

- Add python36-six provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- CVE-2026-44431: sensitive information disclosure due to sensitive
  headers being forwarded across origins in proxied low-level redirects
  (bsc#1265267)
  Add patch CVE-2026-44431.patch

- fix regression in CVE-2025-66471.patch when downloading large files
  (bsc#1259829)

- CVE-2026-40475: improper input handling of null bytes can lead to
  silent data truncation and security-state inconsistency (bsc#1262803)
  * CVE-2026-40475.patch

- Security update:
  - bsc#1234100, CVE-2024-12084: Heap Buffer Overflow in Checksum Parsing
  - bsc#1234101, CVE-2024-12085: Info Leak via uninitialized Stack contents defeats ASLR
  - bsc#1234102, CVE-2024-12086: server leaks arbitrary client files
  - bsc#1234103, CVE-2024-12087: server can make client write files outside of destination directory using symbolic links
  - bsc#1234104, CVE-2024-12088: --safe-links bypass
  - bsc#1235475, CVE-2024-12747: Race Condition in rsync Handling Symbolic Links
  - bsc#1254441, CVE-2025-10158: Out of bounds array access via negative index
  - bsc#1262223, CVE-2026-41035: Count of entries mismatch can lead to a use-after-free
  - bsc#1264511, CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no)
  - bsc#1264515, CVE-2026-43617: Authorization Bypass via Hostname Resolution
  - bsc#1264512, CVE-2026-43618: Integer Overflow Information Disclosure
  - bsc#1264513, CVE-2026-43620: Out-of-Bounds Array Read via recv_files()
  - bsc#1265296, CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing
- With the big security update above-mentioned, we received a big amount of harderning
  patches that are pre-requisitoes that we added to this version:
  - rsync-hardening-0001-Fix-warning-about-conflicting-lseek-lseek64-prototyp.patch
  - rsync-hardening-0002-hlink-Fix-function-pointer-cast-in-qsort.patch
  - rsync-hardening-0003-bool-is-a-keyword-in-C23.patch
  - rsync-hardening-0004-Fix-warning-about-missing-bomb-.-prototype.patch
  - rsync-hardening-0005-CVE-2024-12084-Some-checksum-buffer-fixes.patch
    (replaces: rsync-CVE-2024-12084-overflow-01.patch)
  - rsync-hardening-0006-CVE-2024-12084-Another-cast-when-multiplying-integers.patch
    (replaces: rsync-CVE-2024-12084-overflow-02.patch)
  - rsync-hardening-0007-CVE-2024-12085-prevent-information-leak-off-the-stack.patch
    (replaces: rsync-CVE-2024-12085.patch)
  - rsync-hardening-0008-CVE-2024-12086-refuse-fuzzy-options-when-fuzzy-not-selected.patch
    (replaces: rsync-CVE-2024-12086_01.patch)
  - rsync-hardening-0009-added-secure_relative_open.patch
    (replaces: rsync-CVE-2024-12086_02.patch)
  - rsync-hardening-0010-receiver-use-secure_relative_open-for-basis-file.patch
    (replaces: rsync-CVE-2024-12086_03.patch)
  - rsync-hardening-0011-disallow-.-elements-in-relpath-for-secure_relative_o.patch
    (replaces: rsync-CVE-2024-12086_04.patch)
  - rsync-hardening-0012-CVE-2024-12087-Refuse-a-duplicate-dirlist.patch
    (replaces: rsync-CVE-2024-12087_01.patch)
  - rsync-hardening-0013-CVE-2024-12087-range-check-dir_ndx-before-use.patch
    (replaces:: rsync-CVE-2024-12087_02.patch)
  - rsync-hardening-0014-CVE-2024-12088-make-safe-links-stricter.patch
    (replaces: rsync-CVE-2024-12088.patch)
  - rsync-hardening-0015-CVE-2024-12747-fixed-symlink-race-condition-in-sender.patch
    (replaces: rsync-CVE-2024-12747.patch)
  - rsync-hardening-0016-syscall-fix-a-Y2038-bug-by-replacing-Int32x32To64-wi.patch
  - rsync-hardening-0017-options.c-Fix-segv-if-poptGetContext-returns-NULL.patch
  - rsync-hardening-0018-Using-a-correct-time-in-log-file.patch
  - rsync-hardening-0019-configure.ac-check-for-xattr-support-both-in-libc-an.patch
    (replaces: rsync-no-libattr.patch)
  - rsync-hardening-0020-util-fixed-issue-in-clean_fname.patch
  - rsync-hardening-0021-testsuite-added-clean-fname-underflow-test.patch
  - rsync-hardening-0022-CVE-2025-10158-fixed-an-invalid-access-to-files-array.patch
    (replaces: rsync-CVE-2025-10158.patch)
  - rsync-hardening-0023-fix-uninitialized-buf1-in-get_checksum2-MD4-path.patch
  - rsync-hardening-0024-reject-negative-token-values-in-compressed-stream-re.patch
  - rsync-hardening-0025-acl-fixed-ACL-ID-mapping-for-non-root.patch
  - rsync-hardening-0026-fix-uninitialized-mul_one-in-AVX2-checksum-and-add-S.patch
  - rsync-hardening-0027-Fix-glibc-2.43-constness-warnings.patch
  - rsync-hardening-0029-fix-signed-integer-overflow-in-proxy-protocol-v2-hea.patch
  - rsync-hardening-0030-zero-all-new-memory-from-allocations.patch
  - rsync-hardening-0031-CVE-2026-41035-xattrs-fixed-count-in-qsort.patch
  - rsync-hardening-0032-call-tzset-before-chroot-to-cache-timezone-data.patch
  - rsync-hardening-0033-testsuite-xattrs-ignore-SUNWattr_-in-the-Solaris-xls.patch
  - rsync-hardening-0037-CVE-2026-29518-syscall-clientserver-am_chrooted-and-use_secure_syml.patch
  - rsync-hardening-0038-CVE-2026-29518-sender-fix-read-path-TOCTOU-by-opening-from-module-r.patch
  - rsync-hardening-0044-CVE-2026-43618-token-harden-compressed-token-decoding-against-integ.patch
  - rsync-hardening-0045-CVE-2026-43618-testsuite-cover-refuse-options-compress-for-the-daem.patch
  - rsync-hardening-0046-CVE-2026-43620-receiver-add-parent_ndx-0-guard-mirroring-797e17f.patch
  - rsync-hardening-0047-CVE-2026-43617-clientserver-fix-hostname-ACL-bypass-when-using-daem.patch
  - rsync-hardening-0048-CVE-2026-43618-defence-in-depth-bound-wire-supplied-counts-and-leng.patch
  - rsync-hardening-0049-CVE-2026-43618-defence-in-depth-guard-cumulative-snprintf-against-l.patch
  - rsync-hardening-0050-CVE-2026-43620-defence-in-depth-receiver-block-index-bounds-read_de.patch
  - rsync-hardening-0052-exclude-fix-crashes-with-fortified-strlcpy.patch
    (replaces: rsync-fortified-strlcpy-fix.patch)
  - rsync-hardening-0053-testsuite-use-integer-sleep-in-clean-fname-underflow.patch
  - rsync-hardening-0055-popt-fix-poptDupArgv-strlcpy-size-argument.patch
  - rsync-hardening-0056-testsuite-fixes-for-3.2.7-backport.patch
  - rsync-hardening-0057-rsync.h-lower-MAX_WIRE_DEL_STAT-to-avoid-signed-int-.patch
  - rsync-hardening-0058-CVE-2026-45232-socket-reject-over-long-proxy-response-line.patch
  - rsync-hardening-0059-main-reject-hyphen-prefixed-remote-shell-hostnames.patch
  - rsync-hardening-0060-util1-handle-out-of-range-times-in-timestring.patch
- A few hardening patches were discarded, as the don't affect SUSE distributions:
  - rsync-hardening-0028-zlib-convert-K-R-function-definitions-to-ANSI-style
    (we don't bundle zlib, nothing to patch)
  - rsync-hardening-0051-CI-added-workflows-from-master-for-backport-testing
    (fixes CI Github Actions, not present in release tarballs)
  - rsync-hardening-0054-ci-update-RSYNC_EXPECT_SKIPPED-for-3.2.7-backport-ba
    (fixes CI Github Actions, not present in release tarballs)
- Rename rsync-fix-FLAG_GOT_DIR_FLIST.patch to rsync-fix-duplicate.patch to align codestreams.

- Security update (CVE-2026-41035, bsc#1262223): rsync: count of
  entries mismatch can lead to a use-after-free
  - Add rsync-CVE-2026-41035.patch

n/a

n/a

n/a

n/a

n/a

n/a

n/a

n/a

- Update to version 0.0.9+git.1778500769.8c44b8b
  * collect XSA information
    (jsc#PED-16103, jsc#PED-16105, jsc#PED-16104)
  * fix error for 'saphostexec -status' and adapt change in HANA
    installation (read /etc/sysctl.d/sap_hdb_sysctl.conf)

- Update to v9.2.0530.
- Fix for SG#71948, bsc#1262395:
  * vim-9.1.1732-fix-inc-detection.patch: Fix for incorrectly detecting
- Upstream fixed the following bugs / CVEs:
  * bsc#1264706 CVE-2026-42307
  * bsc#1265360 CVE-2026-46483
  * bsc#1264708 CVE-2026-45130
  * bsc#1264707 CVE-2026-44656
  * bsc#1265349 CVE-2026-43961
- Changes:
  * 9.2.0530: WinBar row vertical separator not refreshed on window change
  * 9.2.0529: GTK4: clipboard returns empty after a foreign app takes the selection
  * 9.2.0528: possible overflow in XIM resource handling
  * 9.2.0527: Possible double free in fill_partial_and_closure()
  * 9.2.0526: missing out-of-memory check in ex_substitute()
  * 9.2.0525: spell: memory leak in spell_read_dic()
  * 9.2.0524: spell: buffer overflow with many affix or compound flags
  * 9.2.0523: tests: no test for using shellescape() in combination with :!
  * 9.2.0522: event_nr2name() in autocmd.c can be improved
  * 9.2.0521: GTK4: cannot resize shell after the window is shown
  * 9.2.0520: Reversed text opacity in popup when termguicolor is set
  * 9.2.0519: GTK4: GUI tabline is not displayed correctly
  * 9.2.0518: GTK4: input method cannot compose text
  * 9.2.0517: quickfix: can set quickfixtextfunc in restricted/sandbox mode
  * 9.2.0516: socketserver: spurious error when servername is taken
  * 9.2.0515: virtualedit=insert doesn't work during change operation
  * 9.2.0514: GTK4: build errors when socketserver is enabled
  * 9.2.0513: [security]: memory safety issues in spellfile.c
  * 9.2.0512: clientserver uses binary protocol
  * 9.2.0511: configure: when GTK4 is used also links in X11 libs
  * 9.2.0510: setline() mapping may trigger autoindent
  * 9.2.0509: term.c: compile error when LOG_TRN is enabled
  * 9.2.0508: completion: cannot complete user cmd :K with 'ignorecase'
  * 9.2.0507: Vim9 class: public/protected member name clash uses same error
  * 9.2.0506: home_replace() function can be improved
  * 9.2.0505: GTK4: text looks blurry on HiDPI displays
  * 9.2.0504: configure: requires X11 libraries for GTK4 build
  * 9.2.0503: Makefile: Missing dependencies for new GTK4 source files
  * 9.2.0502: runtime(netrw): bookmark handling can be improved
  * 9.2.0501: GTK4: there is no GTK4 UI available
  * 9.2.0500: filetype: some html files wrongly recognized as htmlangular
  * 9.2.0499: modeline: allow to disable modelines with modelinestrict
  * 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c
  * 9.2.0497: Cannot jump to remote tags
  * 9.2.0496: [security]: Code Injection in cucumber filetype plugin
  * 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave()
  * 9.2.0494: User commands cannot handle single args with spaces
  * 9.2.0493: popup: missing  Popup, PopupBorder and PopupTitle hi groups
  * 9.2.0492: popup: decoration wrongly drawn with clipping on border
  * 9.2.0491: VMS: various build issues
  * 9.2.0490: matchfuzzy() can crash on long multi-word patterns
  * 9.2.0489: filetype: some Objective-C files are not recognized
  * 9.2.0488: statusline: status line highlight blends into adjacent vsep cells
  * 9.2.0487: viminfo: possible signed int overflow in register array
  * 9.2.0486: out-of-bound read when recovering swap files
  * 9.2.0485: clipboard provider callback can be called recursively
  * 9.2.0484: TextPutPre triggers clipboard provider callback twice
  * 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input
  * 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd
  * 9.2.0481: runtime(netrw): command injection possible via maps
  * 9.2.0480: [security]: runtime(netrw): code injection via mf command
  * 9.2.0479: [security]: runtime(tar): command injection in tar plugin
  * 9.2.0478: channel: redundant str/length assignments in channel_part_info()
  * 9.2.0477: popup: leftover content after popup_free under layout change
  * 9.2.0476: pattern completion leaks memory on alloc failures
  * 9.2.0475: runtime(netrw): bookmark paths not normalized
  * 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC
  * 9.2.0473: Pasting ". register without autocommands breaks TextPut*
  * 9.2.0472: popup: column jitters when scrolled outside viewport
  * 9.2.0471: vimvars di_key initialized at runtime
  * 9.2.0470: No way to hook into put commands
  * 9.2.0469: popup: textprop-anchored popups bleed past host window edges
  * 9.2.0468: popups: not correctly updated from a CmdlineChanged autocommand
  * 9.2.0467: multi-line statusline loses highlighting attributes
  * 9.2.0466: popup: redraw can use stale blended cells
  * 9.2.0465: modeline: foldmarker cannot be set with modelinestrict
  * 9.2.0464: runtime(netrw): bookmarking directory uses current dir
  * 9.2.0463: Not able to use legacy expression evaluation in a vim9script maps
  * 9.2.0462: MS-Windows: workaround for assert error on GUI
  * 9.2.0461: Corrupted undofile causes use-after-free
  * 9.2.0460: did_set_shellpipe_redir() in wrong file
  * 9.2.0459: tests: test_termcodes fails (after v9.2.0456)
  * 9.2.0458: Crash with invalid shellredir/shellpipe value
  * 9.2.0457: Compile warning about unused variable
  * 9.2.0456: stray p character displayed on some terms
  * 9.2.0455: 'findfunc' only allows extra info for cmdline completion
  * 9.2.0454: tests: no test that "abbr" in customlist completion is shown
  * 9.2.0453: vertical separator of statusline blend into active statusline
  * 9.2.0452: screen.c popup opacity blend logic is duplicated
  * 9.2.0451: 'findfunc' can't return extra info for cmdline completion
  * 9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound()
  * 9.2.0449: Make proto fails in non GTK builds
  * 9.2.0448: Vim9: dangling cmdline pointer after skip_expr_cctx()
  * 9.2.0447: cindent does not ignore comments
  * 9.2.0446: runtime(netrw): off-by-one bug in s:NetrwUnMarkFile()
  * 9.2.0445: win_fix_scroll() called before win_comp_pos() in command_height()
  * 9.2.0444: Cannot set 'path' option via modeline
  * 9.2.0443: GUI: cancelling save dialog overwrites or discards unnamed buffer
  * 9.2.0442: completion: i_CTRL-X_CTRL-V doesn't use dict from customlist
  * 9.2.0441: statusline: click handler not called on multi-line statusline
  * 9.2.0440: MS-Windows: cursor flicker during update_screen()
  * 9.2.0439: completion: info popup not removed in cmdline mode
  * 9.2.0438: tests: test_plugin_termdebug is flaky
  * 9.2.0437: MS-Windows: cursor flicker in vtp mode
  * 9.2.0436: Buffer overflow when parsing overlong errorformat lines
  * 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
  * 9.2.0434: cscope: filename interpreted by /bin/sh
  * 9.2.0433: customlist completion cannot supply pum metadata
  * 9.2.0432: blob to string conversion can be improved
  * 9.2.0431: blob encoding can be improved
  * 9.2.0430: tests: Test_shortmess_F3() is flaky on MS-Windows
  * 9.2.0429: tests: flaky screendump Test_smoothscroll_incsearch()
  * 9.2.0428: popup: no opacity support for completepopup/previewpopup
  * 9.2.0427: popup: opacity blend may leaks white bg color
  * 9.2.0426: tests: still some flaky screendump tests
  * 9.2.0425: Cannot silence undo/redo messages
  * 9.2.0424: popup: flicker when wildtrigger() refreshes the popup menu
  * 9.2.0423: popup: wrapped cmdline truncated with wildoptions=pum
  * 9.2.0422: popup: leave stray char when scrollbar changes
  * 9.2.0421: vimball: can smuggle Vimscript into VimballRecord file
  * 9.2.0420: channel: cannot handle binary data via channel callbacks
  * 9.2.0419: popup: rendering issues
  * 9.2.0418: wildcards in expanded env vars reinterpreted by glob
  * 9.2.0417: completion: no support for "noinsert" with 'wildmode'
  * 9.2.0416: Unix: filename completion splits at space for single-file Ex commands
  * 9.2.0415: Wrong behavior when executing register that ends in Insert mode
  * 9.2.0414: Flicker when drawing window separator and pum is shown
  * 9.2.0413: Scrolling wrong with 'splitkeep' when changing 'cmdheight'
  * 9.2.0412: channel: term_start() out_cb/err_cb no longer deliver raw chunks
  * 9.2.0411: tabpanel: no Vim script functions for the tabpanel
  * 9.2.0410: test suite races when run with parallel make
  * 9.2.0409: memory leaks in copy_substring_from_pos()
  * 9.2.0408: Insert-mode <Cmd> edits can corrupt undo
  * 9.2.0407: tabpanel: A few issues with the tabpanel
  * 9.2.0406: VisualNOS not used when Wayland selection ownership lost
  * 9.2.0405: when jumping to tags, will open URLs
  * 9.2.0404: redraw_listener_add() does not check secure flag
  * 9.2.0403: Vim9: def function sandbox bypass
  * 9.2.0402: pum: opacity not applied to wildmenu pum
  * 9.2.0401: tests: still a few flaky tests
  * 9.2.0400: sandbox callbacks selected through 'complete'
  * 9.2.0399: MS-Windows: compile warning in strptime.c

- Fix bsc#1261833 / CVE-2026-39881.
- Update to 9.2.0398.
- Changes:
  * 9.2.0398: MS-Windows: missing strptime() support
  * 9.2.0397: tabpanel: double-click opens a new tab
  * 9.2.0396: tests: Test_error_callback_terminal is flaky on macOS
  * 9.2.0395: tests: Test_backupskip() may read from $HOME
  * 9.2.0394: xxd: offsets greater than LONG_MAX print as negative
  * 9.2.0393: MS-Windows: link error with XPM support on UCRT64
  * 9.2.0392: tests: Some tests are flaky
  * 9.2.0391: tests: Comment in test_vim9_cmd breaks syntax highlighting
  * 9.2.0390: filetype: some Beancount files are not recognized
  * 9.2.0389: DECRQM still leaves stray "pp" on Apple Terminal.app
  * 9.2.0388: strange indent in update_topline()
  * 9.2.0387: DECRQM request may leave stray chars in terminal
  * 9.2.0386: No scroll/scrollbar support in the tabpanel
  * 9.2.0385: Integer overflow with "ze" and large 'sidescrolloff'
  * 9.2.0384: stale Insstart after <Cmd> cursor move breaks undo
  * 9.2.0383: [security]: runtime(netrw): shell-injection via sftp: and file: URLs
  * 9.2.0382: Wayland: focus-stealing is non-working
  * 9.2.0381: Vim9: Missing check_secure() in exec_instructions()
  * 9.2.0380: completion: a few issues in completion code
  * 9.2.0379: gui.color_approx is never used
  * 9.2.0378: Using int as bool type in win_T struct
  * 9.2.0377: Using int as bool type in gui_T struct
  * 9.2.0376: Vim9: elseif condition compiled in dead branch
  * 9.2.0375: prop_find() does not find a virt text in starting line
  * 9.2.0374: c_CTRL-{G,T} does not handle offset
  * 9.2.0373: Ctrl-R mapping not triggered during completion
  * 9.2.0372: pum: rendering issues with multibyte text and opacity
  * 9.2.0371: filetype: ghostty config files are not recognized
  * 9.2.0370: duplicate code with literal string_T assignment
  * 9.2.0369: multiple definitions of STRING_INIT macro
  * 9.2.0368: too many strlen() calls when adding strings to dicts
  * 9.2.0367: runtime(netrw): ~ note expanded on MS Windows
  * 9.2.0366: pum: flicker when updating pum in place
  * 9.2.0365: using int as bool
  * 9.2.0364: tests: test_smoothscroll_textoff_showbreak() fails
  * 9.2.0363: Vim9: variable shadowed by script-local function
  * 9.2.0362: division by zero with smoothscroll and small windows
  * 9.2.0361: tests: no tests for ch_listen() with IPs
  * 9.2.0360: Cannot handle mouse-clicks in the tabpanel
  * 9.2.0359: wrong VertSplitNC highlighting on winbar
  * 9.2.0358: runtime(vimball): still path traversal attacks possible
  * 9.2.0357: [security]: command injection via backticks in tag files
  * 9.2.0356: Cannot apply 'scrolloff' context lines at end of file
  * 9.2.0355: runtime(tar): missing path traversal checks in tar#Extract()
  * 9.2.0354: filetype: not all Bitbake include files are recognized
  * 9.2.0353: Missing out-of-memory check in register.c
  * 9.2.0352: 'winhighlight' of left window blends into right window
  * 9.2.0351: repeat_string() can be improved
  * 9.2.0350: Enabling modelines poses a risk
  * 9.2.0349: cannot style non-current window separator
  * 9.2.0348: potential buffer underrun when setting statusline like option
  * 9.2.0347: Vim9: script-local variable not found
  * 9.2.0346: Wrong cursor position when entering command line window
  * 9.2.0345: Wrong autoformatting with 'autocomplete'
  * 9.2.0344: channel: ch_listen() can bind to network interface
  * 9.2.0343: tests: test_clientserver may fail on slower systems
  * 9.2.0342: tests: test_excmd.vim leaves swapfiles behind
  * 9.2.0341: some functions can be run from the sandbox
  * 9.2.0340: pum_redraw() may cause flicker
  * 9.2.0339: regexp: nfa_regmatch() allocates and frees too often
  * 9.2.0338: Cannot handle mouseclicks in the tabline
  * 9.2.0337: list indexing broken on big-endian 32-bit platforms
  * 9.2.0336: libvterm: no terminal reflow support
  * 9.2.0335: json_encode() uses recursive algorithm
  * 9.2.0334: GTK: window geometry shrinks with with client-side decorations
  * 9.2.0333: filetype: PklProject files are not recognized
  * 9.2.0332: popup: still opacity rendering issues
  * 9.2.0331: spellfile: stack buffer overflows in spell file generation
  * 9.2.0330: tests: some patterns in tar and zip plugin tests not strict enough
  * 9.2.0329: tests: test_indent.vim leaves swapfiles behind
  * 9.2.0328: Cannot handle mouseclicks in the statusline
  * 9.2.0327: filetype: uv scripts are not detected
  * 9.2.0326: runtime(tar): but with dotted path
  * 9.2.0325: runtime(tar): bug in zstd handling
  * 9.2.0324: 0x9b byte not unescaped in <Cmd> mapping
  * 9.2.0323: filetype: buf.lock files are not recognized
  * 9.2.0322: tests: test_popupwin fails
  * 9.2.0321: MS-Windows: No OpenType font support
  * 9.2.0320: several bugs with text properties
  * 9.2.0319: popup: rendering issues with partially transparent popups
  * 9.2.0318: cannot configure opacity for popup menu
  * 9.2.0317: listener functions do not check secure flag
  * 9.2.0316: [security]: command injection in netbeans interface via defineAnnoType
  * 9.2.0315: missing bound-checks
  * 9.2.0314: channel: can bind to all network interfaces
  * 9.2.0313: Callback channel not registered in GUI
  * 9.2.0312: C-type names are marked as translatable
  * 9.2.0311: redrawing logic with text properties can be improved
  * 9.2.0310: unnecessary work in vim_strchr() and find_term_bykeys()
  * 9.2.0309: Missing out-of-memory check to may_get_cmd_block()
  * 9.2.0308: Error message E1547 is wrong
  * 9.2.0307: more mismatches between return types and documentation
  * 9.2.0306: runtime(tar): some issues with lz4 support
  * 9.2.0305: mismatch between return types and documentation
  * 9.2.0304: tests: test for 9.2.0285 doesn't always fail without the fix
  * 9.2.0303: tests: zip plugin tests don't check for warning message properly
  * 9.2.0302: runtime(netrw): RFC2396 decoding double escaping spaces
  * 9.2.0301: Vim9: void function return value inconsistent
  * 9.2.0300: The vimball plugin needs some love
  * 9.2.0299: runtime(zip): may write using absolute paths
  * 9.2.0298: Some internal variables are not modified
  * 9.2.0297: libvterm: can improve CSI overflow code
  * 9.2.0296: Redundant and incorrect integer pointer casts in drawline.c
  * 9.2.0295: 'showcmd' shows wrong Visual block size with 'linebreak'
  * 9.2.0294: if_lua: lua interface does not work with lua 5.5
  * 9.2.0293: :packadd may lead to heap-buffer-overflow
  * 9.2.0292: E340 internal error when using method call on void value
  * 9.2.0291: too many strlen() calls
  * 9.2.0290: Amiga: no support for AmigaOS 3.x
  * 9.2.0289: 'linebreak' may lead to wrong Visual block highlighting
  * 9.2.0288: libvterm: signed integer overflow parsing long CSI args
  * 9.2.0287: filetype: not all ObjectScript routines are recognized
  * 9.2.0286: still some unnecessary (int) casts in alloc()
  * 9.2.0285: :syn sync grouphere may go beyond end of line
  * 9.2.0284: tabpanel: crash when tabpanel expression returns variable line count
  * 9.2.0283: unnecessary (int) casts before alloc() calls
  * 9.2.0282: tests: Test_viminfo_len_overflow() fails
  * 9.2.0281: tests: Test_netrw_FileUrlEdit.. fails on Windows