- Add patches:
  * 0001-cifs.upcall-correctly-treat-UPTARGET_UNSPECIFIED-as-.patch
  (bsc#1243488)
  * 0001-mount.cifs-retry-mount-on-EINPROGRESS.patch

- coreutils-9.7-sort-CVE-2025-5278.patch: Add upstream patch:
  sort with key character offsets of SIZE_MAX, could induce
  a read of 1 byte before an allocated heap buffer.
  (CVE-2025-5278, bsc#1243767)

- Add Channel Binding support for GSSAPI/GSS-SPNEGO; (bsc#1229655);
  (jsc#PED-12097); Add patch
  0009-Add-Channel-Binding-support-for-GSSAPI-GSS-SPNEGO.patch
- Add support for setting max ssf 0 to GSS-SPNEGO; (bsc#1229655);
  (jsc#PED-12097); Add patch
  0010-Add-support-for-setting-max-ssf-0-to-GSS-SPNEGO.patch

[ This update is a no-op, only needed to work around unfortunate automated
  packaging script behaviour on SLES. ]
- The following patches were removed in openSUSE in the Docker 28.1.1-ce
  update, but the patch names were later renamed in a SLES-only update before
  Docker 28.1.1-ce was submitted to SLES.
  This causes the SLES build scripts to refuse the update because the patches
  are not referenced in the changelog. There is no obvious place to put the
  patch removals (the 28.1.1-ce update removing the patches chronologically
  predates their renaming in SLES), so they are included here a dummy changelog
  entry to work around the issue.
  - 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

- Update to docker-buildx v0.25.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.25.0>

- Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as
  Docker does not have permission to access the host zypper credentials in this
  mode (and unprivileged users cannot disable the feature using
  /etc/docker/suse-secrets-enable.) bsc#1240150
  * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
- Rebase patches:
  * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

- Always clear SUSEConnect suse_* secrets when starting containers regardless
  of whether the daemon was built with SUSEConnect support. Not doing this
  causes containers from SUSEConnect-enabled daemons to fail to start when
  running with SUSEConnect-disabled (i.e. upstream) daemons.
  This was a long-standing issue with our secrets support but until recently
  this would've required migrating from SLE packages to openSUSE packages
  (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
  away from in-built SUSEConnect support, this is now a practical issue users
  will run into. bsc#1244035
  + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
- Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

[NOTE: This update was only ever released in SLES and Leap.]
- Always clear SUSEConnect suse_* secrets when starting containers regardless
  of whether the daemon was built with SUSEConnect support. Not doing this
  causes containers from SUSEConnect-enabled daemons to fail to start when
  running with SUSEConnect-disabled (i.e. upstream) daemons.
  This was a long-standing issue with our secrets support but until recently
  this would've required migrating from SLE packages to openSUSE packages
  (which wasn't supported). However, as SLE Micro 6.x and SLES 16 will move
  away from in-built SUSEConnect support, this is now a practical issue users
  will run into. bsc#1244035
  + 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
- Rearrange patches:
  - 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  + 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  - 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  - 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  + 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  + 0007-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  + 0008-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch

- Update to Docker 28.2.2-ce. See upstream changelog online at
  <https://github.com/moby/moby/releases/tag/v28.2.2>
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

- Update to Docker 28.2.1-ce. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/28/#2820> bsc#1243833
  <https://github.com/moby/moby/releases/tag/v28.2.1>
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch

- Update to docker-buildx v0.24.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.24.0>

- Update to Docker 28.1.1-ce. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/28/#2811> bsc#1242114
  Includes upstream fixes:
  - CVE-2025-22872 bsc#1241830
- Remove long-outdated build handling for deprecated and unsupported
  devicemapper and AUFS storage drivers. AUFS was removed in v24, and
  devicemapper was removed in v25.
  <https://docs.docker.com/engine/deprecated/#aufs-storage-driver>
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Remove upstreamed patches:
  - 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch
  - 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch
  - cli-0001-docs-include-required-tools-in-source-tree.patch

- Update to docker-buildx v0.23.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.23.0>

- Update to docker-buildx v0.22.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.22.0>
  * Includes fixes for CVE-2025-0495. bsc#1239765

- Disable transparent SUSEConnect support for SLE-16. PED-12534
  When this patchset was first added in 2013 (and rewritten over the years),
  there was no upstream way to easily provide SLE customers with a way to build
  container images based on SLE using the host subscription. However, with
  docker-buildx you can now define secrets for builds (this is not entirely
  transparent, but we can easily document this new requirement for SLE-16).
  Users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
  in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
  when doing their builds.
- Now that the only blocker for docker-buildx support was removed for SLE-16,
  enable docker-buildx for SLE-16 as well. PED-8905

- Add glib2-CVE-2025-6052.patch: fix overflow check when expanding
  a GString (bsc#1244596 CVE-2025-6052).

- Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
  (bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).

- Check that %{_sysconfdir}/sysconfig/network/ifcfg-eth0 actually
  exists before making any modifications to it (bsc#1241112)

- Override upstream version to address upgrade problems (bsc#1243997)

- Update to version 20250416.02 (bsc#1244304, bsc#1244503)
  * defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)
  * Add output of some packagemanagers to the testdata (#808)
- from version 20250416.01
  * Refactor OS Info package (#809)
- from version 20250416.00
  * Report RPM inventory as YUM instead of empty SoftwarePackage
    when neither Zypper nor YUM are installed. (#805)
- from version 20250414.00
  * Update hash computation algorithm (#799)

- Update to version 20250320.00
  * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)
- from version 20250318.00
  * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)
- from version 20250317.02
  * Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)
  * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)
- from version 20250317.01
  * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)
- from version 20250317.00
  * Add tests for retryutil package. (#795)
- from version 20250306.00
  * Update OWNERS (#794)
- from version 20250206.01
  * Use separate counters for pre- and post-patch reboots. (#788)
- from version 20250206.00
  * Update owners (#789)
- from version 20250203.00
  * Fix the vet errors for contants in logging (#786)
- from version 20250122.00
  * change available package check (#783)
- from version 20250121.00
  * Fix Inventory reporting e2e tests. (#782)
- from version 20250120.00
  * fix e2e tests (#781)
- Add -buildmode=pie to go build command line (bsc#1239948)
- Drop CVE-2024-45339.patch, merged upstream
- Renumber patches

- Security fix: [bsc#1236931, bsc#1239119, CVE-2025-30258]
  * gpg: Fix regression for the recent malicious subkey DoS fix.
  * gpg: Fix another regression due to the T7547 fix.
  * gpg: Allow the use of an ADSK subkey as ADSK subkey.
  * Add patches:
  - gnupg-gpg-Fix-regression-for-the-recent-malicious-subkey-D.patch
  - gnupg-gpg-Fix-another-regression-due-to-the-T7547-fix.patch
  - gnupg-gpg-Allow-the-use-of-an-ADSK-subkey-as-ADSK-subkey.patch

- Don't install expired sks certificate [bsc#1243069]
  * Add patch gnupg-dirmngr-Don-t-install-expired-sks-certificate.patch

- Fix a verification DoS due to a malicious subkey in the keyring: [bsc#1239119]
  * Add patch gnupg-gpg-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-the-keyring.patch

- Security fix [bsc#1243772, CVE-2025-48964]
  * Fix  integer overflow in ping statistics via zero timestamp
  * Add iputils-CVE-2025-48964_01.patch
  * Add iputils-CVE-2025-48964_02.patch
  * Add iputils-CVE-2025-48964_03.patch
  * Add iputils-CVE-2025-48964_04.patch
  * Add iputils-CVE-2025-48964_regression.patch

- Add patch CVE-2024-23337.patch (CVE-2024-23337, bsc#1243450)

- Workaround kernel module size increase due to BTF deduplication
  issue since the introduction of TYPEOF_UNQUAL (poo#183503 bsc#1244135)
  * add 0001-libbpf-Add-identical-pointer-detection-to-btf_dedup_.patch

- Disable the select backend, this can be easily done by lying
  to configure. This is done due to:
  * using fd number > 1024 on an fd_set results in a runtime
    fortify source assertion, preventing further doom.
  * select will not be changed to handle fd > 1024.
  * this limit is unreasonable low for this century.

- Drop insserv_prereq and fillup_prereq macros: there are no
  pre-scripts that would justify these dependencies.

- Update to 2.1.12 stable
  * buffer: do not pass NULL to memcpy() from evbuffer_pullup()
  * http: fix undefined-shift in EVUTIL_IS*_ helpers
  * Check error code of evhttp_add_header_internal() in
    evhttp_parse_query_impl()
  * http: fix EVHTTP_CON_AUTOFREE in case of timeout
  * evdns: Add additional validation for values of dns options
  * Fix memory corruption in EV_CLOSURE_EVENT_FINALIZE with debug enabled
  * increase segment refcnt only if evbuffer_add_file_segment() succeeds
  * evdns: fix a crash when evdns_base with waiting requests is freed
  * event_base_once: fix potential null pointer threat
  * http: do not assume body for CONNECT
  * evbuffer_add_file: fix freeing of segment in the error path
  * Fix checking return value of the evdns_base_resolv_conf_parse()
  * Support EV_CLOSED on linux for poll(2)
  * Parse IPv6 scope IDs.
  * evutil_time: detect and use _gmtime64_s()/_gmtime64()
  * bufferevent: allow setting priority on socket and openssl type
  * Fix EV_CLOSED detection/reporting
  * Revert "Warn if forked from the event loop during event_reinit()"

- Add upstream patches with the feature of "prepare" and "check"
  watchers. That feature is needed by envoy-proxy:
  * 0001-evwatch-Add-prepare-and-check-watchers.patch
  * 0002-evwatch-fix-race-condition.patch

- Update to 2.1.11 stable
  * Fix ABI breakage that had been introduced in 2.1.10. Strictly speaking
    this release breaks ABI again to make it compatible with <= 2.1.9.
    + See git commit 18104973 for more details
  * evdns: add new options -- so-rcvbuf/so-sndbuf
  * various autotools and cmake build changes
  * buffer: fix possible NULL dereference in evbuffer_setcb() on ENOMEM
  * Warn if forked from the event loop during event_reinit()
  * evutil: set the have_checked_interfaces in evutil_check_interfaces()
  * https-client: correction error checking

- Use FAT LTO objects in order to provide proper static library.

- Fix name of library package (bsc#1138369)

- Update to 2.1.10 stable
  * evdns: add DNS_OPTION_NAMESERVERS_NO_DEFAULT /
    EVDNS_BASE_NAMESERVERS_NO_DEFAULT
  * Add support for EV_TIMEOUT to event_base_active_by_fd
  * kqueue: Avoid undefined behaviour.
  * Prevent integer overflow in kq_build_changes_list.
  * evdns: fix lock/unlock mismatch in evdns_close_server_port()
  * Protect min_heap_push_ against integer overflow.
  * le-proxy: initiate use of the Winsock DLL
  * Fix leaks in error path of the bufferevent_init_common_()
  * buffer: make evbuffer_prepend() of zero-length array no-op
  * Don't loose top error in SSL
  * Remove needless check for arc4_seeded_ok
  * Cleanup __func__ detection
  * Add convenience macros for user-triggered events
  * Notify event base if there are no more events, so it can exit without
    delay
  * Fix base unlocking in event_del() if event_base_set() runned in another
    thread
  * If precise_time is false, we should not set EVENT_BASE_FLAG_PRECISE_TIMER
  * Fix race in access to ev_res from event loop with event_active()
  * Return from event_del() after the last event callback termination
  * Preserve socket error from listen across closesocket cleanup
  * fix connection retries when there more then one request for connection
  * improve error path for bufferevent_{setfd,enable,disable}()
  * Fix conceivable UAF of the bufferevent in evhttp_connection_free()
  * Fix evhttp_connection_get_addr() fox incomming http connections
  * fix leaks in evhttp_uriencode()
  * CONNECT method only takes an authority
  * Allow bodies for GET/DELETE/OPTIONS/CONNECT
  * Do not crash when evhttp_send_reply_start() is called after a timeout.
  * Fix crashing http server when callback do not reply in place
  * fix handling of close_notify (ssl) in http with openssl bufferevents
  * use *_new_with_arg() to match function prototype
  * avoid NULL dereference on request is not EVHTTP_REQ_POST
  * bufferevent_socket_connect{,_hostname}() missing event callback and use
    ret code
  * don't fail be_null_filter if bytes are copied
  * Call underlying bev ctrl GET_FD on filtered bufferevents
  * be_openssl: avoid leaking of SSL structure
  * Add missing includes into openssl-compat.h
  * Explicitly call SSL_clear when reseting the fd.
  * sample/https-client: use host SSL certificate store by default
  * ipv6only socket bind support
  * evdns: handle NULL filename explicitly
  * Fix assert() condition in evbuffer_drain() for IOCP
  * fix incorrect unlock of the buffer mutex (for deferred callbacks)
  * Fix wrong assert in evbuffer_drain()
  * Port `event_rpcgen.py` and `test/check-dumpevents.py` to Python 3.
- rename python2-shebang.patch -> python3-shebang.patch following port

- Make use of %license macro

- Add devel-static package, which is needed for building Envoy
  (https://www.envoyproxy.io/) and Cilium with Envoy integration
- Fix an error about /usr/bin/env shebang in event_rpcgen.py
  * python2-shebang.patch

- Security fix [bsc#1221107, CVE-2024-2236]
  * Add --enable-marvin-workaround to spec to enable workaround
  * Fix  timing based side-channel in RSA implementation ( Marvin attack )
  * Add libgcrypt-CVE-2024-2236_01.patch
  * Add libgcrypt-CVE-2024-2236_02.patch

- Add icu-CVE-2025-5222.patch:
  Backport 2c667e3 from upstream, ICU-22973 Fix buffer overflow by
  using CharString.
  (CVE-2025-5222, bsc#1243721)

- gssd: add support for an "allowed-enctypes" option in nfs.conf
  (bsc#1240899)
  - add 0008-gssd-add-support-for-an-allowed-enctypes-option-in-n.patch

- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch

- Fix CVE-2025-5318: Likely read beyond bounds in sftp server handle management (bsc#1245311)
  * Add patch libssh-CVE-2025-5318.patch
- Fix CVE-2025-4877: Write beyond bounds in binary to base64 conversion functions (bsc#1245309)
  * Add patch libssh-CVE-2025-4877.patch
- Fix CVE-2025-4878: Use of uninitialized variable in privatekey_from_file() (bsc#1245310)
  * Add patches:
  - libssh-CVE-2025-4878-1.patch
  - libssh-CVE-2025-4878-2.patch
- Fix CVE-2025-5372: ssh_kdf() returns a success code on certain failures (bsc#1245314)
  * Add patch libssh-CVE-2025-5372.patch

- Import commit 278fb676146e35a7b4057f52f34a7bbaf1b82369
  aa12f501ae logs-show: get timestamp and boot ID only when necessary (bsc#1242827)
  e8b17d11bc sd-journal: drop to use Hashmap to manage journal files per boot ID
  ea80273738 tree-wide: set SD_JOURNAL_ASSUME_IMMUTABLE where appropriate
  a5b3b5344f sd-journal: introduce SD_JOURNAL_ASSUME_IMMUTABLE flag
  5fa0600b34 sd-journal: make journal_file_read_tail_timestamp() notify to the caller that some new journal entries added
  737e8193e7 sd-journal: cache last entry offset and journal file state
  057dca426f sd-journal: fix typo in function name

- Start the systemd-coredump.socket unit on systemd-coredump package
  installation.
- Restore the kernel default values of the coredump sysctl settings on
  systemd-coredump package removal.

- Import commit e08f49f2432509787abfb7f3fc0b2f2c459def04 (merge of v254.25)
  This merge includes the following fix:
    7fc7aa5a4d coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/b0ae3b6e85b6a4030cf2adb88519a6ca0ffc1343...e08f49f2432509787abfb7f3fc0b2f2c459def04
- Drop 1021-Revert-macro-terminate-the-temporary-VA_ARGS_FOREACH.patch
  The SUSE specific patch has been integrated into the SUSE/v254 git
  branch. Some of the imported commits from the stable tree rely on the macro
  now.

- Import commit b0ae3b6e85b6a4030cf2adb88519a6ca0ffc1343
  41d2be2fb5 Revert "macro: terminate the temporary VA_ARGS_FOREACH() array with a sentinel" (SUSE specific)

- security update
- added patches
  CVE-2025-49794 [bsc#1244554], heap use after free (UAF) can lead to Denial of service (DoS)
  CVE-2025-49796 [bsc#1244557], type confusion may lead to Denial of service (DoS)
  + libxml2-CVE-2025-49794,49796.patch
  CVE-2025-49795 [bsc#1244555], null pointer dereference may lead to Denial of service (DoS)
  + libxml2-CVE-2025-49795.patch

- security update
- added patches
  CVE-2025-6170 [bsc#1244700], stack buffer overflow may lead to a crash
  CVE-2025-6021 [bsc#1244580], Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2
  + libxml2-CVE-2025-6170,6021.patch

- Fix credential handling in HEAD requests (bsc#1244105)
- version 17.37.5 (35)

- RepoInfo: use pathNameSetTrailingSlash (fixes #643)
- Fix wrong userdata parameter type when running zypp with debug
  verbosity (bsc#1239012)
- version 17.37.4 (35)

- Do not warn about no mirrors if mirrorlist was switched on
  automatically. (bsc#1243901)
- Relax permission of cached packages to 0644 & ~umask
  (bsc#1243887)
- version 17.37.3 (35)

- Add a note to service maintained .repo file entries (fixes #638)
- Support using %{url} variable in a RIS service's repo section.
- version 17.37.2 (35)

- Use a cookie file to validate mirrorlist cache.
  This patch extends the mirrorlist code to use a cookie file to
  validate the contents of the cache against the source URL, making
  sure that we do not accidentially use a old cache when the
  mirrorlist url was changed. For example when migrating a system
  from one release to the next where the same repo alias might just
  have a different URL.
- Let Service define and update gpgkey, mirrorlist and metalink.
- Preserve a mirrorlist file in the raw cache during refresh.
- version 17.37.1 (35)

- Code16: Enable curl2 backend and parallel package download by
  default. In Code15 it's optional.
  Environment variables ZYPP_CURL2=<0|1> and ZYPP_PCK_PRELOAD=<0|1>
  can be used to turn the features on or off.
- Make gpgKeyUrl the default source for gpg keys.
  When refreshing zypp now primarily uses gpgKeyUrl information
  from the repo files and only falls back to a automatically
  generated key Url if a gpgKeyUrl was not specified.
- Introduce mirrors into the Media backends (bsc#1240132)
- Drop MediaMultiCurl backend.
- Throttle progress updates when preloading packages (bsc#1239543)
- Check if request is in valid state in CURL callbacks (fixes
  openSUSE/zypper#605)
- spec/CMake: add conditional build
  '--with[out] classic_rpmtrans_as_default'.
  classic_rpmtrans is the current builtin default for SUSE,
  otherwise it's single_rpmtrans.
  The `enable_preview_single_rpmtrans_as_default_for_zypper` switch
  was removed from the spec file.  Accordingly the CMake option
  ENABLE_PREVIEW_SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER was removed.
- version 17.37.0 (35)

- update to version 4.36
  * remove support for OS/2
  * remove support for Unixware, Bsdi, old AIX, old HPUX9 & scoos
  * remove support for Windows 16 bit
  * renamed the prwin16.h header to prwin.h
  * configure was updated from 2.69 to 2.71
  * various build, test and automation script fixes
  * major parts of the source code were reformatted

- update to NSS 3.112
  * bmo#1963792 - Fix alias for mac workers on try
  * bmo#1966786 - ensure all options can be configured with SSL_OptionSet and SSL_OptionSetDefault
  * bmo#1931930 - ABI/API break in ssl certificate processing
  * bmo#1955971 - remove unnecessary assertion in sec_asn1d_init_state_based_on_template
  * bmo#1965754 - update taskgraph to v14.2.1
  * bmo#1964358 - Workflow for automation of the release on GitHub when pushing a tag
  * bmo#1952860 - fix faulty assertions in SEC_ASN1DecoderUpdate
  * bmo#1934877 - Renegotiations should use a fresh ECH GREASE buffer
  * bmo#1951396 - update taskgraph to v14.1.1
  * bmo#1962503 - Partial fix for ACVP build CI job
  * bmo#1961827 - Initialize find in sftk_searchDatabase
  * bmo#1963121 - Add clang-18 to extra builds
  * bmo#1963044 - Fault tolerant git fetch for fuzzing
  * bmo#1962556 - Tolerate intermittent failures in ssl_policy_pkix_ocsp
  * bmo#1962770 - fix compiler warnings when DEBUG_ASN1D_STATES or CMSDEBUG are set
  * bmo#1961835 - fix content type tag check in NSS_CMSMessage_ContainsCertsOrCrls
  * bmo#1963102 - Remove Cryptofuzz CI version check

- update to NSS 3.111
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1957685 - Turn off Websites Trust Bit from CAs
  * bmo#1937338 - Update nssckbi version following April 2025 Batch of Changes
  * bmo#1943135 - Disable SMIME ‘trust bit’ for GoDaddy CAs
  * bmo#1874383 - Replaced deprecated sprintf function with snprintf in dbtool.c
  * bmo#1954612 - Need up update NSS for PKCS 3.1
  * bmo#1773374 - avoid leaking localCert if it is already set in ssl3_FillInCachedSID
  * bmo#1953097 - Decrease ASAN quarantine size for Cryptofuzz in CI
  * bmo#1943962 - selfserv: Add support for zlib certificate compression

- update to NSS 3.110
  * bmo#1930806 - FIPS changes need to be upstreamed: force ems policy
  * bmo#1954724 - Prevent excess allocations in sslBuffer_Grow
  * bmo#1953429 - Remove Crl templates from ASN1 fuzz target
  * bmo#1953429 - Remove CERT_CrlTemplate from ASN1 fuzz target
  * bmo#1952855 - Fix memory leak in NSS_CMSMessage_IsSigned
  * bmo#1930807 - NSS policy updates
  * bmo#1951161 - Improve locking in nssPKIObject_GetInstances
  * bmo#1951394 - Fix race in sdb_GetMetaData
  * bmo#1951800 - Fix member access within null pointer
  * bmo#1950077 - Increase smime fuzzer memory limit
  * bmo#1949677 - Enable resumption when using custom extensions
  * bmo#1952568 - change CN of server12 test certificate
  * bmo#1949118 - Part 2: Add missing check in
    NSS_CMSDigestContext_FinishSingle
  * bmo#1949118 - Part 1: Fix smime UBSan errors
  * bmo#1930806 - FIPS changes need to be upstreamed: updated key checks
  * bmo#1951491 - Don't build libpkix in static builds
  * bmo#1951395 - handle `-p all` in try syntax
  * bmo#1951346 - fix opt-make builds to actually be opt
  * bmo#1951346 - fix opt-static builds to actually be opt
  * bmo#1916439 - Remove extraneous assert
- Removed upstreamed nss-fips-stricter-dh.patch
- Added bmo1962556.patch to fix test failures
- Rebased nss-fips-approved-crypto-non-ec.patch nss-fips-combined-hash-sign-dsa-ecdsa.patch
- update to NSS 3.109
  * bmo#1939512 - Call BL_Init before RNG_RNGInit() so that special
    SHA instructions can be used if available
  * bmo#1930807 - NSS policy updates - fix inaccurate key policy issues
  * bmo#1945883 - SMIME fuzz target
  * bmo#1914256 - ASN1 decoder fuzz target
  * bmo#1936001 - Part 2: Revert “Extract testcases from ssl gtests
    for fuzzing”
  * bmo#1915155 - Add fuzz/README.md
  * bmo#1936001 - Part 4: Fix tstclnt arguments script
  * bmo#1944545 - Extend pkcs7 fuzz target
  * bmo#1912320 - Extend certDN fuzz target
  * bmo#1944300 - revert changes to HACL* files from bug 1866841
  * bmo#1936001 - Part 3: Package frida corpus script
- update to NSS 3.108
  * bmo#1923285 - libclang-16 -> libclang-19
  * bmo#1939086 - Turn off Secure Email Trust Bit for Security
    Communication ECC RootCA1
  * bmo#1937332 - Turn off Secure Email Trust Bit for BJCA Global Root
    CA1 and BJCA Global Root CA2
  * bmo#1915902 - Remove SwissSign Silver CA – G2
  * bmo#1938245 - Add D-Trust 2023 TLS Roots to NSS
  * bmo#1942301 - fix fips test failure on windows
  * bmo#1935925 - change default sensitivity of KEM keys
  * bmo#1936001 - Part 1: Introduce frida hooks and script
  * bmo#1942350 - add missing arm_neon.h include to gcm.c
  * bmo#1831552 - ci: update windows workers to win2022
  * bmo#1831552 - strip trailing carriage returns in tools tests
  * bmo#1880256 - work around unix/windows path translation issues
    in cert test script
  * bmo#1831552 - ci: let the windows setup script work without $m
  * bmo#1880255 - detect msys
  * bmo#1936680 - add a specialized CTR_Update variant for AES-GCM
  * bmo#1930807 - NSS policy updates
  * bmo#1930806 - FIPS changes need to be upstreamed: FIPS 140-3 RNG
  * bmo#1930806 - FIPS changes need to be upstreamed: Add SafeZero
  * bmo#1930806 - FIPS changes need to be upstreamed - updated POST
  * bmo#1933031 - Segmentation fault in SECITEM_Hash during pkcs12 processing
  * bmo#1929922 - Extending NSS with LoadModuleFromFunction functionality
  * bmo#1935984 - Ensure zero-initialization of collectArgs.cert
  * bmo#1934526 - pkcs7 fuzz target use CERT_DestroyCertificate
  * bmo#1915898 - Fix actual underlying ODR violations issue
  * bmo#1184059 - mozilla::pkix: allow reference ID labels to begin
    and/or end with hyphens
  * bmo#1927953 - don't look for secmod.db in nssutil_ReadSecmodDB if
    NSS_DISABLE_DBM is set
  * bmo#1934526 - Fix memory leak in pkcs7 fuzz target
  * bmo#1934529 - Set -O2 for ASan builds in CI
  * bmo#1934543 - Change branch of tlsfuzzer dependency
  * bmo#1915898 - Run tests in CI for ASan builds with detect_odr_violation=1
  * bmo#1934241 - Fix coverage failure in CI
  * bmo#1934213 - Add fuzzing for delegated credentials, DTLS short
    header and Tls13BackendEch
  * bmo#1927142 - Add fuzzing for SSL_EnableTls13GreaseEch and
    SSL_SetDtls13VersionWorkaround
  * bmo#1913677 - Part 3: Restructure fuzz/
  * bmo#1931925 - Extract testcases from ssl gtests for fuzzing
  * bmo#1923037 - Force Cryptofuzz to use NSS in CI
  * bmo#1923037 - Fix Cryptofuzz on 32 bit in CI
  * bmo#1933154 - Update Cryptofuzz repository link
  * bmo#1926256 - fix build error from 9505f79d
  * bmo#1926256 - simplify error handling in get_token_objects_for_cache
  * bmo#1931973 - nss doc: fix a warning
  * bmo#1930797 - pkcs12 fixes from RHEL need to be picked up
- remove obsolete patches
  * nss-fips-safe-memset.patch
  * nss-bmo1930797.patch
- update to NSS 3.107
  * bmo#1923038 - Remove MPI fuzz targets.
  * bmo#1925512 - Remove globals `lockStatus` and `locksEverDisabled`.
  * bmo#1919015 - Enable PKCS8 fuzz target.
  * bmo#1923037 - Integrate Cryptofuzz in CI.
  * bmo#1913677 - Part 2: Set tls server target socket options in config class
  * bmo#1913677 - Part 1: Set tls client target socket options in config class
  * bmo#1913680 - Support building with thread sanitizer.
  * bmo#1922392 - set nssckbi version number to 2.72.
  * bmo#1919913 - remove Websites Trust Bit from Entrust Root
    Certification Authority - G4.
  * bmo#1920641 - remove Security Communication RootCA3 root cert.
  * bmo#1918559 - remove SecureSign RootCA11 root cert.
  * bmo#1922387 - Add distrust-after for TLS to Entrust Roots.
  * bmo#1927096 - update expected error code in pk12util pbmac1 tests.
  * bmo#1929041 - Use random tstclnt args with handshake collection script
  * bmo#1920466 - Remove extraneous assert in ssl3gthr.c.
  * bmo#1928402 - Adding missing release notes for NSS_3_105.
  * bmo#1874451 - Enable the disabled mlkem tests for dtls.
  * bmo#1874451 - NSS gtests filter cleans up the constucted buffer
    before the use.
  * bmo#1925505 - Make ssl_SetDefaultsFromEnvironment thread-safe.
  * bmo#1925503 - Remove short circuit test from ssl_Init.
- fix build on loongarch64 (setting it as 64bit arch)
- Remove upstreamed bmo-1400603.patch
- Added nss-bmo1930797.patch to fix failing tests in testsuite
- update to NSS 3.106
  * bmo#1925975 - NSS 3.106 should be distributed with NSPR 4.36.
  * bmo#1923767 - pk12util: improve error handling in p12U_ReadPKCS12File.
  * bmo#1899402 - Correctly destroy bulkkey in error scenario.
  * bmo#1919997 - PKCS7 fuzz target, r=djackson,nss-reviewers.
  * bmo#1923002 - Extract certificates with handshake collection script.
  * bmo#1923006 - Specify len_control for fuzz targets.
  * bmo#1923280 - Fix memory leak in dumpCertificatePEM.
  * bmo#1102981 - Fix UBSan errors for SECU_PrintCertificate and
    SECU_PrintCertificateBasicInfo.
  * bmo#1921528 - add new error codes to mozilla::pkix for Firefox to use.
  * bmo#1921768 - allow null phKey in NSC_DeriveKey.
  * bmo#1921801 - Only create seed corpus zip from existing corpus.
  * bmo#1826035 - Use explicit allowlist for for KDF PRFS.
  * bmo#1920138 - Increase optimization level for fuzz builds.
  * bmo#1920470 - Remove incorrect assert.
  * bmo#1914870 - Use libFuzzer options from fuzz/options/\*.options in CI.
  * bmo#1920945 - Polish corpus collection for automation.
  * bmo#1917572 - Detect new and unfuzzed SSL options.
  * bmo#1804646 - PKCS12 fuzzing target.
- requires NSPR 4.36
- update to NSS 3.105
  * bmo#1915792 - Allow importing PKCS#8 private EC keys missing public key
  * bmo#1909768 - UBSAN fix: applying zero offset to null pointer in sslsnce.c
  * bmo#1919577 - set KRML_MUSTINLINE=inline in makefile builds
  * bmo#1918965 - Don't set CKA_SIGN for CKK_EC_MONTGOMERY private keys
  * bmo#1918767 - override default definition of KRML_MUSTINLINE
  * bmo#1916525 - libssl support for mlkem768x25519
  * bmo#1916524 - support for ML-KEM-768 in softoken and pk11wrap
  * bmo#1866841 - Add Libcrux implementation of ML-KEM 768 to FreeBL
  * bmo#1911912 - Avoid misuse of ctype(3) functions
  * bmo#1917311 - part 2: run clang-format
  * bmo#1917311 - part 1: upgrade to clang-format 13
  * bmo#1916953 - clang-format fuzz
  * bmo#1910370 - DTLS client message buffer may not empty be on retransmit
  * bmo#1916413 - Optionally print config for TLS client and server
    fuzz target
  * bmo#1916059 - Fix some simple documentation issues in NSS.
  * bmo#1915439 - improve performance of NSC_FindObjectsInit when
    template has CKA_TOKEN attr
  * bmo#1912828 - define CKM_NSS_ECDHE_NO_PAIRWISE_CHECK_KEY_PAIR_GEN
- Fix build error under Leap by rebasing nss-fips-safe-memset.patch.
- update to NSS 3.104
  * bmo#1910071 - Copy original corpus to heap-allocated buffer
  * bmo#1910079 - Fix min ssl version for DTLS client fuzzer
  * bmo#1908990 - Remove OS2 support just like we did on NSPR
  * bmo#1910605 - clang-format NSS improvements
  * bmo#1902078 - Adding basicutil.h to use HexString2SECItem function
  * bmo#1908990 - removing dirent.c from build
  * bmo#1902078 - Allow handing in keymaterial to shlibsign to make
    the output reproducible
  * bmo#1908990 - remove nec4.3, sunos4, riscos and SNI references
  * bmo#1908990 - remove other old OS (BSDI, old HP UX, NCR,
    openunix, sco, unixware or reliantUnix
  * bmo#1908990 - remove mentions of WIN95
  * bmo#1908990 - remove mentions of WIN16
  * bmo#1913750 - More explicit directory naming
  * bmo#1913755 - Add more options to TLS server fuzz target
  * bmo#1913675 - Add more options to TLS client fuzz target
  * bmo#1835240 - Use OSS-Fuzz corpus in NSS CI
  * bmo#1908012 - set nssckbi version number to 2.70.
  * bmo#1914499 - Remove Email Trust bit from ACCVRAIZ1 root cert.
  * bmo#1908009 - Remove Email Trust bit from certSIGN ROOT CA.
  * bmo#1908006 - Add Cybertrust Japan Roots to NSS.
  * bmo#1908004 - Add Taiwan CA Roots to NSS.
  * bmo#1911354 - remove search by decoded serial in
    nssToken_FindCertificateByIssuerAndSerialNumber
  * bmo#1913132 - Fix tstclnt CI build failure
  * bmo#1913047 - vfyserv: ensure peer cert chain is in db for
    CERT_VerifyCertificateNow
  * bmo#1912427 - Enable all supported protocol versions for UDP
  * bmo#1910361 - Actually use random PSK hash type
  * bmo#1911576 - Initialize NSS DB once
  * bmo#1910361 - Additional ECH cipher suites and PSK hash types
  * bmo#1903604 - Automate corpus file generation for TLS client Fuzzer
  * bmo#1910364 - Fix crash with UNSAFE_FUZZER_MODE
  * bmo#1910605 - clang-format shlibsign.c
- remove obsolete nss-reproducible-builds.patch
- update to NSS 3.103
  * bmo#1908623 - move list size check after lock acquisition in sftk_PutObjectToList.
  * bmo#1899542 - Add fuzzing support for SSL_ENABLE_POST_HANDSHAKE_AUTH,
  * bmo#1909638 - Follow-up to fix test for presence of file nspr.patch.
  * bmo#1903783 - Adjust libFuzzer size limits
  * bmo#1899542 - Add fuzzing support for SSL_SetCertificateCompressionAlgorithm,
    SSL_SetClientEchConfigs, SSL_VersionRangeSet and SSL_AddExternalPsk
  * bmo#1899542 - Add fuzzing support for SSL_ENABLE_GREASE and
    SSL_ENABLE_CH_EXTENSION_PERMUTATION
- Add nss-reproducible-builds.patch to make the rpms reproducible,
  by using a hardcoded, static key to generate the checksums (*.chk-files)
- Updated nss-fips-approved-crypto-non-ec.patch to enforce
  approved curves with the CKK_EC_MONTGOMERY key type (bsc#1224113).
- update to NSS 3.102.1
  * bmo#1905691 - ChaChaXor to return after the function
- update to NSS 3.102
  * bmo#1880351 - Add Valgrind annotations to freebl Chacha20-Poly1305.
  * bmo#1901932 - missing sqlite header.
  * bmo#1901080 - GLOBALTRUST 2020: Set Distrust After for TLS and S/MIME.
  * bmo#1615298 - improve certutil keyUsage, extKeyUsage, and nsCertType keyword handling.
  * bmo#1660676 - correct length of raw SPKI data before printing in pp utility.

- Add nss-reproducible-chksums.patch to make NSS-build reproducible
  Use key from openssl (bsc#1081723)

- Updated nss-fips-approved-crypto-non-ec.patch to exclude the
  SHA-1 hash from SLI approval.

- Add openssh-scp-umask-preserve-permissions.patch (bsc#1241667).

- Stop adding pam_env in AUTH stack, and be sure to put this module at the
  really end of the SESSION stack.
  [bsc#1243226, CVE-2025-6018, remove-pam_env-from-auth-stack.patch]

- pam_namespace: convert functions that may operate on a user-controlled path
  to operate on file descriptors instead of absolute path. And keep the
  bind-mount protection from protect_mount() as a defense in depthmeasure.
  [bsc#1244509
  pam_inline-introduce-pam_asprintf-pam_snprintf-and-p.patch,
  pam_namespace-fix-potential-privilege-escalation.patch,
  pam_namespace-add-flags-to-indicate-path-safety.patch,
  pam_namespace-secure_opendir-do-not-look-at-the-grou.patch]
- pam_namespace-fix-potential-privilege-escalation.patch adapted and includes
  changes from upstream commits: ds6242a, bc856cd.
  * pam_namespace fix logic in return value handling
  * pam_namespace move functions around

- pam_env: Change the default to not read the user .pam_environment file
  [bsc#1243226, CVE-2025-6018,
  pam_env-change-the-default-to-not-read-the-user-env.patch]

- do not change the current directory when cloning an open
  directory handle [bnc#1244079] [CVE-2025-40909]
  new patch: perl-dirdup.diff

- Update to version 1.0.1
  + Fix infinite loop (bsc#1242064)
  + Fix bug in update infrastructure request (bsc#1242064)

- Add `minion_legacy_req_warnings` option to avoid noisy warnings
- Require M2Crypto >= 0.44.0 for SUSE Family distros
- Added:
  * add-minion_legacy_req_warnings-option-to-avoid-noisy.patch

- Prevent tests failures when pygit2 is not present
- Several fixes for security issues
  (bsc#1244561, CVE-2024-38822)
  (bsc#1244564, CVE-2024-38823)
  (bsc#1244565, CVE-2024-38824)
  (bsc#1244566, CVE-2024-38825)
  (bsc#1244567, CVE-2025-22240)
  (bsc#1244568, CVE-2025-22236)
  (bsc#1244570, CVE-2025-22241)
  (bsc#1244571, CVE-2025-22237)
  (bsc#1244572, CVE-2025-22238)
  (bsc#1244574, CVE-2025-22239)
  (bsc#1244575, CVE-2025-22242)
  * Request server hardening
  * Prevent traversal in local_cache::save_minions
  * Add test and fix for file_recv cve
  * Fix traversal in gitfs find_file
  * Fix traversal in salt.utils.virt
  * Fix traversal in pub_ret
  * Reasonable failures when pillars timeout
  * Make send_req_async wait longer
  * Remove token to prevent decoding errors
  * Fix checking of non-url style git remotes
  * Allow subdirs in GitFS find_file check
- Add subsystem filter to udev.exportdb (bsc#1236621)
- tornado.httputil: raise errors instead of logging in
  multipart/form-data parsing (CVE-2025-47287, bsc#1243268)
- Fix Ubuntu 24.04 edge-case test failures
- Fix broken tests for Ubuntu 24.04
- Fix refresh of osrelease and related grains on Python 3.10+
- Make "salt" package to obsolete "python3-salt" package on SLE15SP7+
- Fix issue requiring proper Python flavor for dependencies and recommended package
- Added:
  * fix-tests-issues-in-salt-shaker-environments-721.patch
  * several-fixes-for-security-issues.patch
  * add-subsystem-filter-to-udev.exportdb-bsc-1236621-71.patch
  * fix-of-cve-2025-47287-bsc-1243268-718.patch
  * fix-ubuntu-24.04-specific-failures-716.patch
  * fix-debian-tests-715.patch
  * fix-refresh-of-osrelease-and-related-grains-on-pytho.patch

- Update to runc v1.2.6. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.6>.

- Update to runc v1.2.5. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.5>.

- Update to runc v1.2.4. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.4>.
- Update runc.keyring to match upstream.

- Update to runc v1.2.3. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.3>.

- Update to runc v1.2.2. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.2>.

- Update to runc v1.2.1. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.1>.

- Update to runc v1.2.0. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.0>.
- Remove upstreamed patches.
  - 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
  - 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
  - 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
  - 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch

- Update to runc v1.2.0~rc3. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.3>.
  Includes the patch for CVE-2024-45310. bsc#1230092

- Windows security hardening locks out schannel'ed netlogon dc
  calls like netr_DsRGetDCName; (bsc#1246431); (bso#15876).

- also use tty fd passing after a suspend (MSG_CONT)
  new patch: sendfdcont.diff
- do not chmod the tty for multiattach, rely on tty fd passing
  instead [bsc#1242269] [CVE-2025-46802]
  new patch: nottychmod.diff
- fix resume after suspend in multiuser mode
  new patch: multicont.diff

- Fix a possible local privilege escalation via the --host option
  [bsc#1245274, CVE-2025-32462]
- Fix a possible local privilege Escalation via chroot option
  [bsc#1245275, CVE-2025-32463]

- Fix bsc#1228776 / CVE-2024-41965.
- Fix bsc#1239602 / CVE-2025-29768.
- Refresh patch:
  vim-7.3-sh_is_bash.patch
- Update to 9.1.1406:
  9.1.1406: crash when importing invalid tuple
  9.1.1405: tests: no test for mapping with special keys in session file
  9.1.1404: wrong link to Chapter 2 in new-tutor
  9.1.1403: expansion of 'tabpanelopt' value adds wrong values
  9.1.1402: multi-byte mappings not properly stored in session file
  9.1.1401: list not materialized in prop_list()
  9.1.1400: [security]: use-after-free when evaluating tuple fails
  9.1.1399: tests: test_codestyle fails for auto-generated files
  9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
  9.1.1397: tabpanel not correctly updated on :tabonly
  9.1.1396: 'errorformat' is a global option
  9.1.1395: search_stat not reset when pattern differs in case
  9.1.1394: tabpanel not correctly redrawn on tabonly
  9.1.1393: missing test for switching buffers and reusing curbuf
  9.1.1392: missing patch number
  9.1.1391: Vim does not have a vertical tabpanel
  9.1.1390: style: more wrong indentation
  9.1.1389: completion: still some issue when 'isexpand' contains a space
  9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
  9.1.1387: memory leak when buflist_new() fails to reuse curbuf
  9.1.1386: MS-Windows: some minor problems building on AARCH64
  9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
  9.1.1384: still some problem with the new tutors filetype plugin
  9.1.1383: completion: 'isexpand' option does not handle space char correct
  9.1.1382: if_ruby: unused compiler warnings from ruby internals
  9.1.1381: completion: cannot return to original text
  9.1.1380: 'eventignorewin' only checked for current buffer
  9.1.1379: MS-Windows: error when running evim when space in path
  9.1.1378: sign without text overwrites number option
  9.1.1377: patch v9.1.1370 causes some GTK warning messages
  9.1.1376: quickfix dummy buffer may remain as dummy buffer
  9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
  9.1.1374: completion: 'smartcase' not respected when filtering matches
  9.1.1373: 'completeopt' checking logic can be simplified
  9.1.1372: style: braces issues in various files
  9.1.1371: style: indentation and brace issues in insexpand.c
  9.1.1370: CI Tests favor GTK2 over GTK3
  9.1.1369: configure still using autoconf 2.71
  9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
  9.1.1367: too many strlen() calls in gui.c
  9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
  9.1.1365: MS-Windows: compile warnings and too many strlen() calls
  9.1.1364: style: more indentation issues
  9.1.1363: style: inconsistent indentation in various files
  9.1.1362: Vim9: type ignored when adding tuple to instance list var
  9.1.1361: [security]: possible use-after-free when closing a buffer
  9.1.1360: filetype: GNU Radio companion files are not recognized
  9.1.1359: filetype: GNU Radio config files are not recognized
  9.1.1358: if_lua: compile warnings with gcc15
  9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
  9.1.1356: Vim9: crash when unletting variable
  9.1.1355: The pum_redraw() function is too complex
  9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
  9.1.1353: missing change from v9.1.1350
  9.1.1352: style: inconsistent indent in insexpand.c
  9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
  9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
  9.1.1349: CmdlineLeavePre may trigger twice
  9.1.1348: still E315 with the terminal feature
  9.1.1347: small problems with gui_w32.c
  9.1.1346: missing out-of-memory check in textformat.c
  9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
  9.1.1344: double free in f_complete_match() (after v9.1.1341)
  9.1.1343: filetype: IPython files are not recognized
  9.1.1342: Shebang filetype detection can be improved
  9.1.1341: cannot define completion triggers
  9.1.1340: cannot complete :filetype arguments
  9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
  9.1.1338: Calling expand() interferes with cmdcomplete_info()
  9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
  9.1.1336: comment plugin does not support case-insensitive 'commentstring'
  9.1.1335: Coverity complains about Null pointer dereferences
  9.1.1334: Coverity complains about unchecked return value
  9.1.1333: Coverity: complains about unutilized variable
  9.1.1332: Vim9: segfault when using super within a lambda
  9.1.1331: Leaking memory with cmdcomplete()
  9.1.1330: may receive E315 in terminal
  9.1.1329: cannot get information about command line completion
  9.1.1328: too many strlen() calls in indent.c
  9.1.1327: filetype: nroff detection can be improved
  9.1.1326: invalid cursor position after 'tagfunc'
  9.1.1325: tests: not checking error numbers properly
  9.1.1324: undefined behaviour if X11 connection dies
  9.1.1323: b:undo_ftplugin not executed when re-using buffer
  9.1.1322: small delete register cannot paste multi-line correctly
  9.1.1321: filetype: MS ixx and mpp files are not recognized
  9.1.1320: filetype: alsoft config files are not recognized
  9.1.1319: Various typos in the code, issue with test_inst_complete.vim
  9.1.1318: tests: test_format fails
  9.1.1317: noisy error when restoring folds from session fails
  9.1.1316: missing memory allocation failure in os_mswin.c
  9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
  9.1.1314: max allowed string width too small
  9.1.1313: compile warning about uninitialized value
  9.1.1312: tests: Test_backupskip() fails when HOME is defined
  9.1.1311: completion: not possible to limit number of matches
  9.1.1310: completion: redundant check for preinsert effect
  9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
  9.1.1308: completion: cannot order matches by distance to cursor
  9.1.1307: make syntax does not reliably detect different flavors
  9.1.1306: completion menu rendering can be improved
  9.1.1305: completion menu active after switching windows/tabs
  9.1.1304: filetype: some man files are not recognized
  9.1.1303: missing out-of-memory check in linematch.c
  9.1.1302: Coverity warns about using uninitialized value
  9.1.1301: completion: cannot configure completion functions with 'complete'
  9.1.1300: wrong detection of -inf
  9.1.1299: filetype: mbsyncrc files are not recognized
  9.1.1298: define_function() is too long
  9.1.1297: Ctrl-D scrolling can get stuck
  9.1.1296: completion: incorrect truncation logic
  9.1.1295: clientserver: does not handle :stopinsert correctly
  9.1.1294: gui tabline menu does not use confirm when closing tabs
  9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
  9.1.1292: statusline not correctly evaluated
  9.1.1291: too many strlen() calls in buffer.c
  9.1.1290: tests: missing cleanup in test_filetype.vim
  9.1.1289: tests: no test for matchparen plugin with WinScrolled event
  9.1.1288: Using wrong window in ll_resize_stack()
  9.1.1287: quickfix code can be further improved
  9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
  9.1.1285: Vim9: no error message for missing method after "super."
  9.1.1284: not possible to configure pum truncation char
  9.1.1283: quickfix stack is limited to 10 items
  9.1.1282: Build and test failure without job feature
  9.1.1281: extra newline output when editing stdin
  9.1.1280: trailing additional semicolon in get_matches_in_str()
  9.1.1279: Vim9: null_object and null_class are no reserved names
  9.1.1278: Vim9: too long functions in vim9type.c
  9.1.1277: tests: trailing comment char in test_popupwin
  9.1.1276: inline word diff treats multibyte chars as word char
  9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
  9.1.1274: Vim9: no support for object<type> as variable type
  9.1.1273: Coverity warns about using uninitialized value
  9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
  9.1.1271: filetype: Power Query files are not recognized
  9.1.1270: missing out-of-memory checks in buffer.c
  9.1.1269: completion: compl_shown_match is updated when starting keyword completion
  9.1.1268: filetype: dax files are not recognized
  9.1.1267: Vim9: no support for type list/dict<object<any>>
  9.1.1266: MS-Windows: type conversion warnings
  9.1.1265: tests: no tests for typing normal char during completion
  9.1.1264: Vim9: error when comparing objects
  9.1.1263: string length wrong in get_last_inserted_save()
  9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
  9.1.1261: No test for 'pummaxwidth' non-truncated items
  9.1.1260: Hang when filtering buffer with NUL bytes
  9.1.1259: some issues with comment package and tailing spaces
  9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
  9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
  9.1.1256: if_python: duplicate tuple data entries
  9.1.1255: missing test condition for 'pummaxwidth' setting
  9.1.1254: need more tests for the comment plugin
  9.1.1253: abort when closing window with attached quickfix data
  9.1.1252: typos in code and docs related to 'diffopt' "inline:"
  9.1.1251: if_python: build error with tuples and dynamic python
  9.1.1250: cannot set the maximum popup menu width
  9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
  9.1.1248: compile error when building without FEAT_QUICKFIX
  9.1.1247: fragile setup to get (preferred) keys from key_name_entry
  9.1.1246: coverity complains about some changes in v9.1.1243
  9.1.1245: need some more tests for curly braces evaluation
  9.1.1244: part of patch v9.1.1242 was wrong
  9.1.1243: diff mode is lacking for changes within lines
  9.1.1242: Crash when evaluating variable name
  9.1.1241: wrong preprocessort indentation in term.c
  9.1.1240: Regression with ic/ac text objects and comment plugin
  9.1.1239: if_python: no tuple data type support
  9.1.1238: wrong cursor column with 'set splitkeep=screen'
  9.1.1237: Compile error with C89 compiler in term.c
  9.1.1236: tests: test_comments leaves swapfiles around
  9.1.1235: cproto files are outdated
  9.1.1234: Compile error when SIZE_MAX is not defined
  9.1.1233: Coverity warns about NULL pointer when triggering WinResized
  9.1.1232: Vim script is missing the tuple data type
  9.1.1231: filetype: SPA JSON files are not recognized
  9.1.1230: inconsistent CTRL-C behaviour for popup windows
  9.1.1229: the comment plugin can be improved
  9.1.1228: completion: current position column wrong after got a match
  9.1.1227: no tests for the comment package
  9.1.1226: "shellcmdline" completion doesn't work with input()
  9.1.1225: extra NULL check in VIM_CLEAR()
  9.1.1224: cannot :put while keeping indent
  9.1.1223: wrong translation used for encoding failures
  9.1.1222: using wrong length for last inserted string
  9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
  9.1.1220: filetype: uv.lock file not recognized
  9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
  9.1.1218: missing out-of-memory check in filepath.c
  9.1.1217: tests: typos in test_matchfuzzy.vim
  9.1.1216: Pasting the '.' register multiple times may not work
  9.1.1215: Patch 9.1.1213 has some issues
  9.1.1214: matchfuzzy() can be improved for camel case matches
  9.1.1213: cannot :put while keeping indent
  9.1.1212: too many strlen() calls in edit.c
  9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
  9.1.1211: TabClosedPre is triggered just before the tab is being freed
  9.1.1210: translation(ru): missing Russian translation for the new tutor
  9.1.1209: colorcolumn not drawn after virtual text lines
  9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
  9.1.1207: MS-Windows: build warning in filepath.c
  9.1.1206: tests: test_filetype fails when a file is a directory
  9.1.1205: completion: preinserted text not removed when closing pum
  9.1.1204: MS-Windows: crash when passing long string to expand()
  9.1.1203: matchparen keeps cursor on case label in sh filetype
  9.1.1202: Missing TabClosedPre autocommand
  9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
  9.1.1200: cmdline pum not cleared for input() completion
  9.1.1199: gvim uses hardcoded xpm icon file
  9.1.1198: [security]: potential data loss with zip.vim
  9.1.1197: process_next_cpt_value() uses wrong condition
  9.1.1196: filetype: config files for container tools are not recognized
  9.1.1195: inside try-block: fn body executed with default arg undefined
  9.1.1194: filetype: false positive help filetype detection
  9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
  9.1.1192: Vim crashes with term response debug logging enabled
  9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
  9.1.1190: C indentation does not detect multibyte labels
  9.1.1189: if_python: build error due to incompatible pointer types
  9.1.1188: runtime(tera): tera support can be improved
  9.1.1187: matchparen plugin wrong highlights shell case statement
  9.1.1186: filetype: help files in git repos are not detected
  9.1.1185: endless loop with completefuzzycollect and no match found
  9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
  9.1.1083: "above" virtual text breaks cursorlineopt=number
  9.1.1182: No cmdline completion for 'completefuzzycollect'
  9.1.1181: Unnecessary STRLEN() calls in insexpand.c
  9.1.1180: short-description
  9.1.1179: too many strlen() calls in misc2.c
  9.1.1178: not possible to generate completion candidates using fuzzy matching
  9.1.1177: filetype: tera files not detected

- bsc#1246112, bsc#1238896 - VUL-0: xen: More AMD transient
  execution attack (CVE-2024-36350, CVE-2024-36357, XSA-471)
  66f28b47-x86-cpufeature-reposition-ext-leaf-21-EAX.patch
  685c29cf-x86-idle-Move-monitor-mwait-wrappers.patch
  685c29d0-x86-idle-remove-MFENCEs-for-CLFLUSH_MONITOR.patch
  685c29d1-revert-part-of-mwait-idle-disable-IBRS-.patch
  686277ed-x86-cpu-policy-simplify-logic-in-gcdfa.patch
  68656b6f-x86-cpu-policy-leaf-80000021-handling.patch
  68681770-x86-idle-remove-broken-MWAIT-implementation.patch
  68681771-x86-idle-drop-incorrect-smp_mb-in-.patch
  68681772-x86-idle-convert-force_mwait_ipi_wakeup-to-.patch
  68681773-rework-arch_skip_send_event_check-into-.patch
  68681774-x86-new-MWAIT-IPI-elision-algorithm.patch
  68681775-x86-idle-fix-IRQ-enable-before-C1-on-Xeons.patch
  xsa471-13.patch
  686d2646-x86-cpu-policy-rearrange-gc_fa.patch
  686d2647-x86-cpu-policy-CPUID-leaf-0x80000021-ecx.patch
  686d2648-x86-AMD-ucode-digests-for-TSA.patch
  686d2649-x86-idle-rearrange-VERW-and-MONITOR-in-.patch
  686d264a-x86-spec-ctrl-mitigate-Transitive-Scheduler-Attacks.patch
- bsc#1244644 - VUL-0: CVE-2025-27465: xen: x86: Incorrect stubs
  exception handling for flags recovery (XSA-470)
  6863cd0b-x86emul-extable-registration-in-invoke_stub.patch
  Replaces xsa470.patch
- Upstream bug fixes (bsc#1027519)
  6835a042-VMX-VMEntry-failure-on-ADL-SPR-with-shadow.patch
  6835a043-x86-PV-breakpoint-reporting.patch

- bsc#1244644 - VUL-0: CVE-2025-27465: xen: x86: Incorrect stubs
  exception handling for flags recovery (XSA-470)
  xsa470.patch

- Update to version 5.8.1
  * Dropped patches, which are included upstream now:
  - CVE-2019-20044.patch
  - CVE-2021-45444.patch
  * See included NEWS file for complete changes
  * Implements ECO PED-12771

- BuildRequires:  libzypp-devel >= 17.37.0.
- Use libzypp improvements for preload and mirror handling.
- xmlout.rnc: Update repo-element (bsc#1241463)
  Add the "metalink" attribute and reflect that the "url" elements
  list may in fact be empty, if no baseurls are defined in the
  .repo files.
- man: update --allow-unsigned-rpm description.
  Explain how to achieve the same for packages provided by
  repositories.
- version 1.14.90