sles-16-0-chost-byos-v20260708-x86-64 Package Source Changes

curl

- Security fixes:
  * CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402)
  * CVE-2026-8458: wrong reuse for different services (bsc#1268407)
  * CVE-2026-8924: traling dot domain super cookie (bsc#1268409)
  * CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413)
  * CVE-2026-9079: stale proxy password leak (bsc#1268415)
  * CVE-2026-9080: UAF after pause in socket callback (bsc#1268416)
  * CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417)
  * CVE-2026-9547: SSH improper host validation (bsc#1268420)
  * CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422)
  * CVE-2026-12064: proto-default skips SSH verification (bsc#1268427)
  * Add patches:
    curl-CVE-2026-8286.patch curl-CVE-2026-8458.patch curl-CVE-2026-8924.patch
    curl-CVE-2026-8927.patch curl-CVE-2026-9079.patch curl-CVE-2026-9080.patch
    curl-CVE-2026-9545.patch curl-CVE-2026-9547.patch curl-CVE-2026-10536.patch
    curl-config2setopts-exit-if-curl_url_set-fails-on-OOM.patch
    curl-CVE-2026-12064.patch

dracut

- Update to version 059+suse.724.gaa87d1594:
  * fix(fips): handle zipl (bsc#1262515)

python-kiwi

- Fix rereading DASD partition table with partprobe
On s390 and with a DASD disk the rereading of the partition
table can only be done properly with partprobe. This commit
changes the dracut code to Require parted and partprobe only
for DASD disks on s390.
In addition this commit prevents the active device locking
for parted and partprobe when called in the context of a
DASD device. The reason for this change is because of a
patch in libparted which applies flock() itself in this
condition. For details see:
https://build.opensuse.org/projects/Base:System/packages/parted/files/libparted-make-BLKRRPART-more-robust.patch?expand=1
This change however does not exist in the upstream version
of parted which is causing problems that are hard to solve
by kiwi. However, a dead-lock condition should be avoided
and I think it's still better to have this change in kiwi
and convince people to upstream the above parted fix, rather
than living with a dead-lock condition due to double locking
in kiwi. This Fixes bsc#1263973

- Do not hardcode dracut omit module in live builder
This is a relict from the old days when the pure presence of
multipath in a live ISO caused issues at boot time. kiwi should
not maintain a hardcoded list of dracut modules except for those
that are mandatory for live boot, if there should be any special
setting needed it should come from an overlay setup in
/etc/dracut.conf.d/*.conf as part of the image description.
This is related to bsc#1260340

- Drop parted requirement for msdos partitioner
parted was used in kiwi at one place to set the active flag
on a partition in the DOS table. This action can also be
done via sfdisk and drops the parted requirement from the
kiwi builder code

- Move OVA support to open-vmdk
Finally this commit drops the use of the VMware ovftool
and moves to the real opensource alternative open-vmdk
This Fixes #2292 and Fixes #2627 and Fixes jira#PED-9497

- Limit workflow to SLE supported pythons

- Refactor use of kiwi settings file
KIWI supports an optional runtime configuration file for
settings to control the behavior of the tools used by
KIWI on the build host. So far this config file could be
specified via --config or is searched in the user's HOME
or looked up as /etc/kiwi.yml. With this commit the
following changes to this heuristic are made:
1. Support reading of /etc/kiwi.yml.d/*.yml
2. Support reading of /usr/share/kiwi/kiwi.yml and /usr/share/kiwi/kiwi.yml.d/*.yml
3. Install default settings file as /usr/share/kiwi/kiwi.yml.example
from the main package and drop it from kiwi-man-pages which
was considered a weird place.

- Add support for oci format for disk images
The (oci|docker):image_format format is a special case that
stores the disk image inside of an OCI-compliant
container. The disk image is stored in the specified
image_format in the disk/ directory of the container.
The disk format can be one of the above formats
or just raw if the disk should be stored as a raw disk
inside of the container. Custom naming conventions for
the disk image can be applied by using the bundle_format
attribute. The derived_from attribute can be used to
specify the source container. The resulting container
image will be built by adding the disk image as a
new layer on top of the specified reference container.
If there is no derived_from attribute, the container
image will be built from scratch using an empty root
directory. This format is particularly useful for building
an image which bundles the actual disk image and its
runtime requirements into one artifact.
This Fixes jira#PCT-1008

- Fix caller environment for non chroot scripts
Make sure non chroot scripts also knows about the kiwi
profile environment such that e.g. the current profile name
or other settings from the build can be used in the script

- Update spec file due to new package restrictions
On SUSE new package restrictions where added to support the
concept of the so called immutable mode. The new guideline
says "Any files in the RPM spec %files section that are not
in /usr or /etc is likely to break in Immutable Mode". For
the kiwi packaging this applies to the kiwi-pxeboot sub
package. This commit implements the suggested solution based
on systemd-tmpfiles and only applies for SUSE.
This Fixes jira#PCT-1055

- Fix result bundler for uncompressed container data
When building container images with the respective runtime
configuration:
```yaml
container:
- compress: false
```
The resulting image output files will be uncompressed meaning
there is no ".xz" extension present. When running the result
bundler there is an index bug which causes the container format
type of the filename name e.g. ".docker" to be dropped from the
result names. This commit fixes it.

- Fix spec file requirements for SUSE
There is no erofs on SLES. This commit drops the respective
requirement settings which we have upstream where it exists
This Fixes jira#PCT-899

- Fix upstream merge README

jq

- Add patch CVE-2026-32316.patch (CVE-2026-32316, bsc#1262044)
- Add patch CVE-2026-33947.patch (CVE-2026-33947, bsc#1262069)
- Add patch CVE-2026-39956.patch (CVE-2026-39956, bsc#1262070)
- Add patch CVE-2026-39979.patch (CVE-2026-39979, bsc#1262071)
- Add patch CVE-2026-40164.patch (CVE-2026-40164, bsc#1262072)
- Add patch CVE-2026-40612.patch (CVE-2026-40612, bsc#1265060)
- Add patch CVE-2026-41256.patch (CVE-2026-41256, bsc#1265061)
- Add patch CVE-2026-41257.patch (CVE-2026-41257, bsc#1265062)
- Add patch CVE-2026-43894.patch (CVE-2026-43894, bsc#1265070)

- Add patch CVE-2026-33948.patch (CVE-2026-33948, bsc#1262043)

- Add patches CVE-2025-48060-1.patch and CVE-2025-48060-2.patch
  (CVE-2025-48060, bsc#1244116)

podman

- Add patch for CVE-2026-34986 (bsc#1262856):
  * 0007-CVE-2026-34986-Merge-commit-from-fork.patch
- Add patch for CVE-2026-39829, CVE-2026-39830, CVE-2026-42508, CVE-2026-46598
  (bsc#1266125)
  * 0008-CVE-2026-39829-CVE-2026-39830-CVE-2026-42508-CVE-202.patch
- Rebase patches:
  * 0001-CVE-2025-22869-ssh-limit-the-size-of-the-internal-pa.patch
  * 0002-Fix-Remove-appending-rw-as-the-default-mount-option.patch
  * 0003-CVE-2025-6032-machine-init-fix-tls-check.patch
  * 0004-CVE-2025-9566-kube-play-don-t-follow-volume-symlinks.patch
  * 0005-CVE-2025-52881-backport-subset-of-patch-from-runc.patch
  * 0006-CVE-2025-47913-CVE-2025-47914-ssh-agent-fixes.patch