- Update apparmor-lessopen-profile.patch:
  * Allow execution of /usr/bin/zstd (bsc#1265620)

- Fix setting log priority for all direct mounts (bsc#1264686)
  + autofs-fix-handling-of-direct-mount-path.patch

- Force use of python3.11 since the required minimum version is now
  3.10. This is only really relevant for the tests.
  [bsc#1263494]

- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]

- Refresh
  patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch.
  Added missing locking in backport (bsc#1267732).
- commit 4ec6bb0

- scsi: hisi_sas: Fix NULL pointer exception during user_scan()
  (CVE-2026-43413, bsc#1264671).
- commit bfe6757

- ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
  (CVE-2026-46157 bsc#1267726).
- commit f38bfb2

- Refresh
  patches.suse/team-avoid-NETDEV_CHANGEMTU-event-when-unregistering.patch.
  Added missing locking in backport (bsc#1267732).
- commit a8766b2

- Bluetooth: hci_conn: fix potential UAF in create_big_sync
  (CVE-2026-46111 bsc#1267626).
- commit 7777a50

- nfsd: never defer requests during idmap lookup (CVE-2026-45983
  bsc#1266697).
- Delete
  patches.suse/nfsd-do-not-defer-requests-during-idmap-lookup-in-v4-compo.patch.
- commit 664a09a

- drm/gem: Fix inconsistent plane dimension calculation in
  drm_gem_fb_init_with_funcs() (CVE-2026-46209 bsc#1267663).
- commit 2c841fc

- libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() (CVE-2026-46024 bsc#1267218).
- commit e967a8f

- libceph: prevent potential out-of-bounds reads in process_message_header() (CVE-2026-43406 bsc#1265073).
- commit 79f8547

- rbd: fix null-ptr-deref when device_add_disk() fails (CVE-2026-46079 bsc#1266452).
- commit 82a7e5e

- ocfs2: handle invalid dinode in ocfs2_group_extend (CVE-2026-31596 bsc#1263319).
- commit d319998

- libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (CVE-2026-43407 bsc#1265020).
- commit d87fc06

- nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
  (CVE-2026-43470 bsc#1265128).
- commit 9fc75a8

- cgroup: Increment nr_dying_subsys_* from rmdir context
  (git-fixes).
- Refresh patches.kabi/kabi-cgroup.stat-fixup.patch.
- commit f87663c

- af_unix: read UNIX_DIAG_VFS data under unix_state_lock
  (CVE-2026-31673 bsc#1263143).
- Refresh patches.suse/vfs-add-super_operations-get_inode_dev.
- commit 00e1878

- ALSA: aloop: Fix peer runtime UAF during format-change stop
  (CVE-2026-46090 bsc#1267531).
- ALSA: aloop: Use guard() for spin locks (CVE-2026-46090
  bsc#1267531).
- ALSA: aloop: Fix peer runtime UAF during format-change stop
  (CVE-2026-46090 bsc#1267531).
- ALSA: aloop: Use guard() for spin locks (CVE-2026-46090
  bsc#1267531).
- commit d19a9e2

- drm/amdkfd: Fix watch_id bounds checking in debug address
  watch v2 (CVE-2026-45878 bsc#1266767).
- commit aa9368a

- arm64: Add support for TSV110 Spectre-BHB mitigation (bsc#1264430 CVE-2026-43261)
- commit ba98a63

- perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415 CVE-2026-43150)
- commit 5c62ef4

- perf/arm-cmn: Ensure dtm_idx is big enough (bsc#1264415 CVE-2026-43150)
- commit bd77733

- ALSA: seq: dummy: fix UMP event stack overread (git-fixes).
- drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
  (git-fixes).
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl
  (git-fixes).
- drm/xe: Clear pending_disable before signaling suspend fence
  (git-fixes).
- drm/amd/display: Bound VBIOS record-chain walk loops
  (git-fixes).
- commit 3c0f3d3

- Input: atkbd - skip deactivate for HONOR BCC-N's internal
  keyboard (git-fixes).
- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain()
  on linked streams (git-fixes).
- drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
  (git-fixes).
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore
  on GFX11 (git-fixes).
- drm/amdkfd: fix NULL dereference in get_queue_ids() (git-fixes).
- drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
  (git-fixes).
- drm/amd/display: Reject gpio_bitshift >= 32 in
  bios_parser_get_gpio_pin_info() (git-fixes).
- drm/amd/display: Use krealloc_array() in dal_vector_reserve()
  (git-fixes).
- drm/amd/display: Fix NULL deref and buffer over-read in SDP
  debugfs (git-fixes).
- commit 276cfd7

- scsi: imm: Fix use-after-free bug caused by unfinished delayed
  work (CVE-2025-68324 bsc#1255416).
- commit 195217b

- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (CVE-2026-43026 bsc#1263932).
- commit 059378b

- xfs: stop reclaim before pushing AIL during unmount
  (CVE-2026-31455 bsc#1262615).
- commit e53a301

- xfs: save ailp before dropping the AIL lock in push callbacks
  (CVE-2026-31454 bsc#1262624).
- commit 7159c4e

- packaging: Add nvidia kernel description
- commit 5f2699f

- pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724 CVE-2026-31655)
- commit 9295a19

- bpf: Fix bpf_xdp_store_bytes proto for read-only arg
  (CVE-2026-45886 bsc#1266810).
- commit 20a9956

- bpf: Fix regsafe() for pointers to packet (CVE-2026-43030
  bsc#1264000).
- commit 8f3e36e

- bpf: Fix tcx/netkit detach permissions when prog fd isn't given
  (CVE-2026-45932 bsc#1266827).
- commit b648f57

- spi: fix resource leaks on device setup failure (bsc#1266696 CVE-2026-46083)
- commit 742a92d

- thermal: core: Free thermal zone ID later during removal
  (git-fixes).
- commit cd70ed5

- Bluetooth: MGMT: Fix backward compatibility with userspace
  (git-fixes).
- Bluetooth: bnep: reject short frames before parsing (git-fixes).
- Bluetooth: hci_sync: reject oversized Broadcast Announcement
  prepend (git-fixes).
- Bluetooth: RFCOMM: validate skb length in MCC handlers
  (git-fixes).
- Bluetooth: MGMT: validate advertising TLV before type checks
  (git-fixes).
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
  (git-fixes).
- wifi: mac80211: limit injected antenna index in
  ieee80211_parse_tx_radiotap (git-fixes).
- wifi: nl80211: reject oversized EMA RNR lists (git-fixes).
- mmc: sdhci: add signal voltage switch in sdhci_resume_host
  (git-fixes).
- mmc: litex_mmc: Set mandatory idle clocks before CMD0
  (git-fixes).
- mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock
  calculation (git-fixes).
- mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC (git-fixes).
- mmc: core: Fix host controller programming for fixed driver type
  (git-fixes).
- commit 1ef939b

- btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which
  can lead  to info-leak (bsc#1267652,CVE-2026-46159).
- commit 56f6424

- kabi: arm64: module: Update missing .init.text.ftrace_trampoline section message (bsc#1265579 bsc#1265170)
  Message was supposed to give us a hint that these KMP's
  will have issue when user try to ftrace them. But it turns out
  to be just source confusion and worry.
- commit 2983ae5

- gfs2: Fix use-after-free in iomap inline data write path
  (CVE-2026-45984 bsc#1267214).
- gfs2: Add metapath_dibh helper (CVE-2026-45984 bsc#1267214).
- commit 7f4705a

- mctp: route: hold key->lock in mctp_flow_prepare_output()
  (CVE-2026-43455 bsc#1264765).
- net: mctp: Ensure keys maintain only one ref to corresponding
  dev (CVE-2026-43455 bsc#1264765).
- commit 7c8d579

- io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
  (CVE-2026-31774 bsc#1264040).
- commit 449403d

- rpm/mkspec: Conditionally set Rust BuildReqs (bsc#1258538)
  This is a further optimization of kernel packaging rust-enablement.
  Add the check of CONFIG_RUST at creating the spec for each kernel
  flavor, and set BuildRequires conditionally only for archs that have
  CONFIG_RUST.  This avoids the unnecessary dependency chains due to
  unused rust.
  The main knob ENABLE_RUST is still needed because otherwise we can't
  know whether to pass the dummy-tools or not at processing
  run_oldconfig.
- commit ccf4b93

- rpm/check-for-config-changes: ignore Rust-related configs (bsc#1258538)
  Those configs may be dynamically changed at the build time
- commit 5251980

- rpm: Add BuildRequires for Rust enablement (bsc#1258538)
  Update mkspec and template to generate the spec files with
  BuildRequires of Rust-related packages when ENABLE_RUST=Yes is set in
  rpm/config.sh.
- commit d0f276f

- bonding: alb: fix UAF in rlb_arp_recv during bond up/down
  (CVE-2026-45970 bsc#1267205).
- commit c7c508f

- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
  (CVE-2026-46181 bsc#1266826).
- commit 971667c

- x86: shadow stacks: proper error handling for mmap lock (bsc#1264484 CVE-2026-43109).
- commit fbd32de

- ALSA: caiaq: Don't abort when no input device is available
  (CVE-2026-46004 bsc#1267222).
- ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path
  (CVE-2026-46004 bsc#1267222).
- commit a3abbee

- ALSA: caiaq: Handle probe errors properly (CVE-2026-46004
  bsc#1267222).
- commit c42211b

- thermal: core: Fix thermal zone governor cleanup issues
  (CVE-2026-46021 bsc#1267220).
- commit 5b274e1

- Bluetooth: MGMT: Fix list corruption and UAF in command complete
  handlers (CVE-2026-43059 bsc#1264184).
- commit 58f5225

- Bluetooth: MGMT: fix crash in set_mesh_sync and
  set_mesh_complete (CVE-2026-43059 bsc#1264184).
- Refresh patches.kabi/hci_dev-centralize-extra-lock.patch.
- commit 59594e6

- scsi: qla2xxx: Add support to report MPI FW state (git-fixes).
- dm: fix a buffer overflow in ioctl processing (git-fixes).
- scsi: ses: Handle positive SCSI error from ses_recv_diag()
  (git-fixes).
- commit a7edf1f

- slip: reject VJ receive packets on instances with no rstate array (CVE-2026-45842 bsc#1266400)
- commit 9c6954f

- media: dvb-net: fix OOB access in ULE extension header tables (CVE-2026-31405 bsc#1261700)
- commit 0115edd

- usb: usbtmc: Flush anchored URBs in usbtmc_release (CVE-2026-31758 bsc#1264093)
- commit 862c169

- xfrm_user: fix info leak in build_report() (CVE-2026-31671 bsc#1263115)
- commit e993b23

- bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (CVE-2026-45846 bsc#1266394)
- commit 8489b03

- KVM: x86: Fix shadow paging use-after-free due to unexpected
  GFN (CVE-2026-46113 bsc#1266969).
- commit 492a8ff

- net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (CVE-2026-43040 bsc#1264091)
- commit afb5ee9

- nvme-pci: add NVME_QUIRK_DISABLE_WRITE_ZEROES for Kingston
  OM3SGP4 (git-fixes).
- commit f7aa00d

- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (CVE-2025-38549 bsc#1248235).
- commit 07594aa

- ext4: fix bounds check in check_xattrs() to prevent
  out-of-bounds access (bsc#1266927 CVE-2026-46094).
- commit 7627409

- writeback: Fix use after free in inode_switch_wbs_work_fn()
  (bsc#1263883 CVE-2026-31703).
- commit afdb742

- ext4: avoid allocate block from corrupted group in
  ext4_mb_find_by_goal() (bsc#1264255 CVE-2026-43068).
- commit 3900419

- ext4: avoid infinite loops caused by residual data (bsc#1262622
  CVE-2026-31448).
- commit 23a715f

- ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
  (bsc#1264245 CVE-2026-43066).
- commit 283732e

- ext4: always drain queued discard work in ext4_mb_release()
  (bsc#1264243 CVE-2026-43065).
- commit 01e5eec

- ext4: fix use-after-free in update_super_work when racing with
  umount (bsc#1262619 CVE-2026-31446).
- commit 2d5d4dc

- arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes)
- commit 0883f58

- arm64: tlb: Allow XZR argument to TLBI ops (git-fixes)
- commit a27017d

- drm/amdgpu/vpe: Force collaborate sync after TRAP
  (stable-fixes).
- commit 2f6a9ab

- Bluetooth: serialize accept_q access (git-fixes).
- Refresh
  patches.suse/Bluetooth-fix-UAF-in-l2cap_sock_cleanup_listen-vs-l2.patch.
- commit e766bd7

- RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114 bsc#1266972)
- commit 76ec1c1

- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856 bsc#1266720)
- commit c95a10d

- auxdisplay: line-display: fix OOB read on zero-length
  message_store() (git-fixes).
- security/keys: fix missed RCU read section on lookup
  (stable-fixes).
- drm/amd/display: Validate payload length and link_index in
  dc_process_dmub_aux_transfer_async (stable-fixes).
- drm/amd/display: Validate GPIO pin LUT table size before
  iterating (stable-fixes).
- drm/amd/display: Fix integer overflow in bios_get_image()
  (stable-fixes).
- phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL
  register access (git-fixes).
- spi: ti-qspi: fix use-after-free after DMA setup failure
  (git-fixes).
- spi: sprd: fix error pointer deref after DMA setup failure
  (git-fixes).
- spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
  (git-fixes).
- ALSA: asihpi: Fix potential OOB array access at reading cache
  (stable-fixes).
- net: wwan: iosm: fix potential memory leaks in ipc_imem_init()
  (git-fixes).
- drivers/base/memory: fix memory block reference leak in poison
  accounting (git-fixes).
- HID: quirks: really enable the intended work around for
  appledisplay (git-fixes).
- HID: uclogic: Fix regression of input name assignment
  (git-fixes).
- string: add mem_is_zero() helper to check if memory area is
  all zeros (stable-fixes).
- commit 55d2e55

- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176 bsc#1266816)
- commit f587e2a

- net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).
- net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).
- net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).
- net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).
- drm/hyperv: validate VMBus packet size in receive callback (git-fixes).
- drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).
- net: mana: Skip redundant detach on already-detached port (git-fixes).
- net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).
- RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).
- commit 81225ae

- net: mvpp2: guard flow control update with global_tx_fc in buffer switching (CVE-2026-23438 bsc#1261619)
- commit c2bc3dd

- net: bonding: fix NULL deref in bond_debug_rlb_hash_show (CVE-2026-31546 bsc#1263006)
- commit ec64778

- 9p/xen: protect xen_9pfs_front_free against concurrent calls
  (bsc#1264476 CVE-2026-43249).
- commit efe84aa

- net: macb: fix use-after-free access to PTP clock (CVE-2026-31396 bsc#1261791)
- commit a390b05

- sched/rt: Skip currently executing CPU in rto_next_cpu()
  (bsc#1262649).
- commit 239586c

- RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910 bsc#1266889)
- commit d80968b

- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898 bsc#1266888)
- commit 683ea89

- RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852 bsc#1266711)
- commit 16dd3c8

- cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (CVE-2026-23327 bsc#1260548)
- commit 27dbf08

- nfc: llcp: add missing return after LLCP_CLOSED checks (CVE-2026-31629 bsc#1263790)
- commit db86873

- smb: client: Don't log plaintext credentials in cifs_set_cifscreds (CVE-2026-23303 bsc#1260502)
- commit 53c0ff0

- kabi fix after rtmutex_api: provide correct extern functions
  (bsc#1263122 CVE-2026-31591).
- commit 8c82223

- team: avoid NETDEV_CHANGEMTU event when unregistering slave
  (CVE-2026-43234 bsc#1264409).
- commit 6b7c409

- tipc: fix divide-by-zero in tipc_sk_filter_connect() (CVE-2026-43411 bsc#1264672)
- commit 32611e5

- net: stmmac: Prevent NULL deref when RX memory exhausted
  (CVE-2026-46110 bsc#1266759).
- net: stmmac: rename STMMAC_GET_ENTRY() -> STMMAC_NEXT_ENTRY()
  (CVE-2026-46110 bsc#1266759).
- net/mlx5: lag: Check for LAG device before creating debugfs
  (CVE-2026-43013 bsc#1264011).
- commit b15f093

- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043 bsc#1266901)
- commit 909d78b

- esp: fix skb leak with espintcp and async crypto (CVE-2026-31518 bsc#1262606)
- commit f42cbf9

- packaging: Replace compute-PATCHVERSION with python implementation
  This script is copied by kkspec to the package directory and called from
  there. That means that libraries from kernel-source cannot be loaded,
  and that's the reason why the script is appended to the library that is
  most useful for it. compute-PATCHVERSION and mkspec are no longer
  shipped in rpm packages which means compute-PATCHVERSION could be folded
  into mkspec, and that in turn into tar-up. However, these are all
  written in different languages.
- commit de458e0

- kabi: arm: io: Export ioremap_prot() symbol v2 (CVE-2026-23346 bsc#1260529 bsc#1266993)
  First version of this kABI fix missed that ioremap_prot() now
  accept only user-space mappings which breaks any out of tree
  KMP's which used the function for legitimate kernel IO mappings.
  Lets fix this by allowing kernel mappings and at same time
  properly handle user-space mappings
  [1] 9625623795d3 ("kabi: arm: io: Export ioremap_prot() symbol (CVE-2026-23346 bsc#1260529)")
- commit 223d255

- btrfs: reserve enough transaction items for qgroup ioctls
  (CVE-2026-43338 bsc#1264716).
- commit 9eef1bf

- rtmutex_api: provide correct extern functions (bsc#1263122
  CVE-2026-31591).
- commit fa571c2

- btrfs: fix transaction abort on set received ioctl due to item
  overflow (CVE-2026-43359 bsc#1264719).
- commit 847b693

- kABI fix after locking/mutex: implement
  mutex_lock_killable_nest_lock (bsc#1263122 CVE-2026-31591).
- commit f2aebfb

- Input: ims-pcu - fix usb_free_coherent() size in
  ims_pcu_buffers_free() (git-fixes).
- Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
  (git-fixes).
- Input: xpad - fix out-of-bounds access for Share button
  (git-fixes).
- Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB
  buffer size (git-fixes).
- commit f75d3d9

- usb: typec: tcpm: improve handling of DISCOVER_MODES failures
  (git-fixes).
- commit 9d7793b

- USB: serial: cypress_m8: validate interrupt packet headers
  (git-fixes).
- USB: serial: safe_serial: fix memory corruption with small
  endpoint (git-fixes).
- USB: serial: omninet: fix memory corruption with small endpoint
  (git-fixes).
- USB: serial: mxuport: fix memory corruption with small endpoint
  (git-fixes).
- USB: serial: option: add missing RSVD(5) flag for Rolling
  RW135R-GL (git-fixes).
- USB: serial: mct_u232: fix missing interrupt-in transfer sanity
  check (git-fixes).
- USB: serial: keyspan: fix missing indat transfer sanity check
  (git-fixes).
- USB: serial: belkin_sa: validate interrupt status length
  (git-fixes).
- USB: cdc-acm: Fix bit overlap and move quirk definitions to
  header (git-fixes).
- usb: dwc2: Fix use after free in debug code (git-fixes).
- usb: chipidea: core: convert ci_role_switch to local variable
  (git-fixes).
- usb: gadget: f_fs: copy only received bytes on short ep0 read
  (git-fixes).
- usb: gadget: dummy_hcd: Reject hub port requests for
  non-existent ports (git-fixes).
- usbip: vudc: Fix use after free bug in vudc_remove due to race
  condition (git-fixes).
- usb: usbtmc: reject interrupt endpoints with small
  wMaxPacketSize (git-fixes).
- usb: usbtmc: check URB actual_length for interrupt-IN
  notifications (git-fixes).
- usb: gadget: net2280: Fix double free in probe error path
  (git-fixes).
- usb: gadget: f_hid: fix device reference leak in hidg_alloc()
  (git-fixes).
- usb: cdns3: gadget: fix request skipping after clearing halt
  (git-fixes).
- usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call
  permanently leaks the runtime PM usage counter across
  bind/unbind cycles (git-fixes).
- usb: gadget: composite: fix integer underflow in WebUSB GET_URL
  handling (git-fixes).
- tty: serial: pch_uart: add check for dma_alloc_coherent()
  (git-fixes).
- commit 2bf3f1e

- thunderbolt: property: Reject dir_len < 4 to prevent size_t
  underflow (git-fixes).
- thunderbolt: property: Reject u32 wrap in
  tb_property_entry_valid() (git-fixes).
- serial: fsl_lpuart: fix rx buffer and DMA map leaks in
  start_rx_dma (git-fixes).
- serial: qcom-geni: fix UART_RX_PAR_EN bit position (git-fixes).
- parport: Fix race between port and client registration
  (git-fixes).
- comedi: comedi_test: fix check for valid scan_begin_src in
  waveform_ai_cmdtest() (git-fixes).
- comedi: comedi_test: Fix limiting of convert_arg in
  waveform_ai_cmdtest() (git-fixes).
- iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
  (git-fixes).
- iio: gyro: itg3200: fix i2c read into the wrong stack location
  (git-fixes).
- iio: dac: ad5686: acquire lock when doing powerdown control
  (git-fixes).
- iio: temperature: tsys01: fix broken PROM checksum validation
  (git-fixes).
- iio: buffer: hw-consumer: fix use-after-free in error path
  (git-fixes).
- iio: dac: ad5686: fix input raw value check (git-fixes).
- iio: ssp_sensors: cancel delayed work_refresh on remove
  (git-fixes).
- iio: dac: max5821: fix return value check in powerdown sync
  (git-fixes).
- iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
  (git-fixes).
- iio: light: cm3323: fix reg_conf not being initialized correctly
  (git-fixes).
- iio: magnetometer: st_magn: fix default DRDY pin selection
  for LIS2MDL (git-fixes).
- iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for
  dual mux (git-fixes).
- drm/hyperv: validate VMBus packet size in receive callback
  (git-fixes).
- drm/hyperv: validate resolution_count and fix WIN8 fallback
  (git-fixes).
- drm/amd/pm/si: Disregard vblank time when no displays are
  connected (git-fixes).
- drm/i915: Fix potential UAF in TTM object purge (git-fixes).
- commit 129155c

- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
  (git-fixes).
- ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
  (git-fixes).
- ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware
  2417 (git-fixes).
- ALSA: pcm: oss: Fix setup list UAF on proc write error
  (git-fixes).
- commit 42ae3f2

- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device
  close (git-fixes).
- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
  (git-fixes).
- Bluetooth: ISO: fix UAF in iso_recv_frame (git-fixes).
- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
  (git-fixes).
- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration
  success (git-fixes).
- Bluetooth: 6lowpan: check skb_clone() return value in
  send_mcast_pkt() (git-fixes).
- Bluetooth: btusb: Allow firmware re-download when version
  matches (git-fixes).
- Bluetooth: HIDP: fix missing length checks in
  hidp_input_report() (git-fixes).
- Bluetooth: L2CAP: use chan timer to close channels in
  cleanup_listen() (git-fixes).
- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout()
  on !conn (git-fixes).
- ASoC: codecs: simple-mux: Fix enum control bounds check
  (git-fixes).
- ASoC: qcom: q6asm-dai: fix error handling in prepare and
  set_params (git-fixes).
- ASoC: qcom: q6asm-dai: close stream only when running
  (git-fixes).
- ASoC: qcom: q6asm-dai: do not set stream state in event and
  trigger callbacks (git-fixes).
- HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
  (git-fixes).
- commit 5cccd97

- btrfs: fix transaction abort when snapshotting received
  subvolumes (CVE-2026-43361 bsc#1264722).
- commit 68eb967

- btrfs: fix transaction abort on file creation due to name hash
  collision (CVE-2026-43360 bsc#1264720).
- commit 335b528

- locking/mutex: implement mutex_trylock_nested (bsc#1263122
  CVE-2026-31591).
- commit f61110c

- wifi: iwlwifi: mvm: don't send a 6E related command when not
  supported (CVE-2026-43325 bsc#1265110).
- commit 3c8b5bc

- locking/mutex: implement mutex_lock_killable_nest_lock
  (bsc#1263122 CVE-2026-31591).
- commit c8f7fd9

- Delete patches.suse/wifi-mac80211-Remove-generic-.ndo_get_stats64.patch (bsc#1266036)
  The patch slipped in the backport series although the assumption there
  isn't applied to SLE15-SP7 kernel base, which resulted in the bogus wifi
  statistics.  Drop the patch to fix it.
- commit 18311a2

- KVM: add kvm_lock_all_vcpus and kvm_trylock_all_vcpus
  (bsc#1263122 CVE-2026-31591).
- commit d85a03e

- smb: client: reject userspace cifs.spnego descriptions
  (bsc#1266238).
- commit b2ca6ab

- KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch
  finish (bsc#1263122 CVE-2026-31591).
- commit f3989e6

- drm/i915/dsi: Don't do DSC horizontal timing adjustments in
  command mode (CVE-2026-31767 bsc#1264124).
- commit f45f094

- KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with
  in-kernel APIC (git-fixes).
- commit 671dbfb

- KVM: X86: Fix array_index_nospec protection in __pv_send_ipi
  (git-fixes).
- commit ef45aed

- Refresh patches.suse/selftests-bpf-Add-more-precision-tracking-tests-for-.patch. (CVE-2026-43009 bsc#1264014)
- commit 1de8df8

- selftests/bpf: add test for nullable PTR_TO_BUF access
  (CVE-2026-43333 bsc#1264726).
- commit 9b6669a

- bpf: reject direct access to nullable PTR_TO_BUF pointers
  (CVE-2026-43333 bsc#1264726).
- commit 8b12683

- xfrm: prevent policy_hthresh.work from racing with netns
  teardown (CVE-2026-31516 bsc#1262755).
- commit 5ec6779

- mptcp: pm: in-kernel: always set ID as avail when rm endp
  (CVE-2026-43252 bsc#1264300).
- commit f1372d7

- net/ipv6: ioam6: prevent schema length wraparound in trace fill
  (CVE-2026-43341 bsc#1265044).
- commit 26ee766

- slip: bound decode() reads against the compressed packet length
  (CVE-2026-45843 bsc#1266395).
- commit c9770c0

- s390/entry: Scrub r12 register on kernel entry (bsc#1263068).
- s390/syscalls: Add spectre boundary for syscall dispatch table
  (bsc#1263068).
- s390/barrier: Make array_index_mask_nospec() __always_inline
  (bsc#1263068).
- commit f6cfac6

- s390/entry: Scrub r12 register on kernel entry (bsc#1261591).
- s390/syscalls: Add spectre boundary for syscall dispatch table
  (bsc#1261591).
- s390/barrier: Make array_index_mask_nospec() __always_inline
  (bsc#1261591).
- s390/mm: Add missing secure storage access fixups for donated
  memory (bsc#1264835).
- commit ade4cd0

- tracing: Fix potential deadlock in cpu hotplug with osnoise
  (CVE-2026-31480 bsc#1262634).
- tracing: Switch trace_osnoise.c code over to use guard()
  and __free() (bsc#1262634).
- commit 6db35fe

- bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584
  CVE-2026-23359).
- commit 0fb7dc1

- wifi: mac80211: always free skb on ieee80211_tx_prepare_skb()
  failure (CVE-2026-23444 bsc#1266307).
- commit a948d1e

- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()
  (CVE-2026-43206 bsc#1264551).
- commit 7f880f2

- octeontx2-af: Workaround SQM/PSE stalls by disabling sticky
  (CVE-2026-43296 bsc#1264805).
- commit f336a2d

- bcache: fix uninitialized closure object (git-fixes).
- commit d35dc31

- bcache: fix cached_dev.sb_bio use-after-free and crash
  (CVE-2026-3150 bsc#1263169).
- scsi: target: tcm_loop: Drain commands in target_reset handler
  (CVE-2026-43054 bsc#1264063).
- scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
  (CVE-2026-31464 bsc#1262656).
- scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414
  bsc#1264669).
- commit b1bc3f3

- rtmutex: Use waiter::task instead of current in remove_waiter()
  (bsc#1266001 CVE-2026-43499).
- commit f92fa24

- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
  (CVE-2026-43501 bsc#1266009).
- commit d86aabe

- ip6_tunnel: clear skb2->cb in ip4ip6_err() (CVE-2026-43037
  bsc#1263995).
- commit 60e0626

- Improve compatibility with awk 2.4.0 (bsc#1266214)
  This was meant to match the literal '+', so it needs to be backslashed
  not a repetition of the '^' symbol.
- commit fbbce3e

- media: mc, v4l2: serialize REINIT and REQBUFS with
  req_queue_mutex (CVE-2026-31473 bsc#1262663).
- commit 3f03cf7

- Update
  patches.suse/net-skbuff-propagate-shared-frag-marker-through-frag-trans.patch
  (CVE-2026-43503 bsc#1265960 CVE-2026-43284 bsc#1264449).
- Update
  patches.suse/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
  (CVE-2026-43284 bsc#1264449).
  Add references and move to the sorted section.
- commit 83a3405

- RDMA/efa: Fix possible deadlock (git-fixes)
- commit b9b2bbf

- RDMA/efa: Fix use of completion ctx after free (CVE-2026-31493 bsc#1262668)
- commit 3fa0669

- RDMA/efa: Improve admin completion context state machine (git-fixes)
- commit 8e8c981

- RDMA/efa: Extend admin timeout error print (git-fixes)
- commit 4d9f061

- RDMA/efa: Check stored completion CTX command ID with received one (git-fixes)
- commit f0e6a90

- wifi: mac80211: check tdls flag in ieee80211_tdls_oper
  (CVE-2026-43052 bsc#1263945).
- commit e6ee8c1

- KVM: SEV: Drop WARN on large size for
  KVM_MEMORY_ENCRYPT_REG_REGION (CVE-2026-31590 bsc#1263152).
- commit 4957e7f

- openvswitch: vport: fix self-deadlock on release of tunnel ports
  (CVE-2026-31678 bsc#1263562).
- commit 7eb6b28

- KVM: SVM: Set/clear CR8 write interception when AVIC is
  (de)activated (CVE-2026-43483 bsc#1265240).
- commit de0bf57

- smb: client: fix in-place encryption corruption in SMB2_write()
  (bsc#1264989 CVE-2026-43362)
- commit 2633e79

- compute-PATCHVERSION: Do not append .. to default patch directories
  All the callers are either using . or a specific patch directory.
  If a caller really needs to load patches from .. it should be passed as
  parameter.
- commit d383394

- compute-PATCHVERSION: Remove unpack logic
  This used to be needed when compute-PATCHVERSION was shipped as part of
  the rpm package where unpacked patches are not available.
  It is not done annymore, and the unpackinng is not needed.
- commit 9a8fa0e

- openvswitch: defer tunnel netdev_put to RCU release
  (CVE-2026-31678 bsc#1263562).
- commit c40a933

- KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested
  [#]VMEXIT (git-fixes).
- commit ec599f4

- KVM: x86: Fix Xen hypercall tracepoint argument assignment
  (git-fixes).
- commit bee29ed

- packaging: Rip out extra symbols support
  Extra symbols are not supported for a long time.
  The oldest branch we maintain is SLE 11 SP1 and it does not use patch
  guards to select patches.
- commit 7b3d5b0

- drm/amdgpu: update the handle ptr in early_init (stable-fixes).
- Refresh
  patches.suse/drm-amdgpu-mes11-implement-detect-and-reset-callback.patch.
- Refresh
  patches.suse/drm-amdgpu-mes12-implement-detect-and-reset-callback.patch.
- commit c261344

- drm/xe/oa: Fix exec_queue leak on width check in stream open
  (git-fixes).
- drm/xe: Define CACHE_MODE_1 as MCR register (git-fixes).
- drm/xe/pf: Fix CFI failure in debugfs access (git-fixes).
- drm/xe/vf: Fix signature of print functions (git-fixes).
- drm/xe/gsc: Fix double-free of managed BO in error path
  (git-fixes).
- drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDP
  (git-fixes).
- ALSA: seq: Serialize UMP output teardown with event_input
  (git-fixes).
- ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()
  (git-fixes).
- ALSA: timer: avoid past-the-end iterator in
  snd_timer_dev_register() (git-fixes).
- ALSA: pcm: Don't setup bogus iov_iter for silencing (git-fixes).
- Bluetooth: btmtk: fix urb->setup_packet leak in error paths
  (git-fixes).
- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not
  stack pointer (git-fixes).
- drm/amdgpu/uvd4.2: Don't initialize UVD 4.2 when DPM is disabled
  (git-fixes).
- ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver
  (git-fixes).
- ACPI: x86: cmos_rtc: Clean up address space handler driver
  (stable-fixes).
- soundwire: debugfs: initialize firmware_file to empty string
  (git-fixes).
- drm/amdgpu: update the handle ptr in dump_ip_state
  (stable-fixes).
- drm/amdgpu: add amdgpu_device reference in ip block
  (stable-fixes).
- commit 8df2a77

- batman-adv: fix batadv_skb_is_frag() kernel-doc (git-fixes).
- commit f65d5f2

- hwmon: (pmbus/adm1266) register the nvmem device after
  pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) register the gpio_chip after
  pmbus_do_probe() (git-fixes).
- hwmon: (pmbus/adm1266) reject short block-read responses in
  the GPIO accessors (git-fixes).
- hwmon: (pmbus/adm1266) don't clobber GPIO bits before PDIO
  read in get_multiple (git-fixes).
- hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at
  ADM1266_PDIO_NR (git-fixes).
- hwmon: (pmbus/adm1266) bounce blackbox records through a
  protocol-sized buffer (git-fixes).
- hwmon: (pmbus/adm1266) include adapter number in GPIO line label
  (git-fixes).
- hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer
  read buffer (git-fixes).
- hwmon: (pmbus/adm1266) reject implausible blackbox record_count
  (git-fixes).
- hwmon: (pmbus/adm1266) widen blackbox-info buffer to
  I2C_SMBUS_BLOCK_MAX (git-fixes).
- hwmon: (pmbus/adm1266) seed timestamp from the real-time clock
  (git-fixes).
- drm/virtio: use uninterruptible resv lock for plane updates
  (git-fixes).
- drm/bridge: megachips: remove bridge when irq request fails
  (git-fixes).
- drm/bridge: chipone-icn6211: use devm_drm_bridge_add in i2c
  probe (git-fixes).
- drm/bridge: it66121: acquire reset GPIO in probe (git-fixes).
- drm/radeon/evergreen_cs: Add missing NULL prefix check in
  surface check (git-fixes).
- drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets
  (git-fixes).
- drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets
  (git-fixes).
- drm/msm/snapshot: fix dumping of the unaligned regions
  (git-fixes).
- drm/msm/dsi: don't dump registers past the mapped region
  (git-fixes).
- platform/x86: intel-vbtn: Check ACPI_HANDLE() against NULL
  (git-fixes).
- platform/x86: intel-hid: Check ACPI_HANDLE() against NULL
  (git-fixes).
- platform/x86: hp_accel: Check ACPI_COMPANION() against NULL
  (git-fixes).
- platform/x86: adv_swbutton: Check ACPI_HANDLE() against NULL
  (git-fixes).
- wifi: ath11k: clear shared SRNG pointer state on restart
  (git-fixes).
- wifi: ath11k: fix use after free in ath11k_dp_rx_msdu_coalesce()
  (git-fixes).
- wifi: ath11k: fix peer resolution on rx path when peer_id=0
  (git-fixes).
- wifi: ath10k: skip WMI and beacon transmission when device is
  wedged (git-fixes).
- wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
  (git-fixes).
- wifi: ath11k: fix error path leaks in some WMI calls
  (git-fixes).
- wifi: ath11k: fix error path leaks in some WMI WOW calls
  (git-fixes).
- wifi: mac80211: consume only present negotiated TTLM maps
  (git-fixes).
- wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
  (git-fixes).
- efi: Allocate runtime workqueue before ACPI init (git-fixes).
- firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
  (git-fixes).
- firmware: arm_ffa: Check for NULL FF-A ID table while driver
  registration (git-fixes).
- drm/amdgpu/uvd3.1: Don't validate the firmware when already
  validated (git-fixes).
- r8152: fix incorrect register write to USB_UPHY_XTAL
  (git-fixes).
- drm/amdgpu: fix spelling typos (stable-fixes).
- drm/i915: Loop over all active pipes in intel_mbus_dbox_update
  (stable-fixes).
- spi: st-ssc4: switch to use modern name (stable-fixes).
- commit 8b80180

- device property: set fwnode->secondary to NULL in fwnode_init()
  (git-fixes).
- ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
  (git-fixes).
- ALSA: ua101: Reject too-short USB descriptors (git-fixes).
- batman-adv: bla: fix report_work leak on backbone_gw purge
  (git-fixes).
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs
  l2cap_conn_del() (git-fixes).
- Bluetooth: hci_uart: fix UAFs and race conditions in close
  and init paths (git-fixes).
- Bluetooth: MGMT: validate Add Extended Advertising Data length
  (git-fixes).
- Bluetooth: ISO: drop ISO_END frames received without prior
  ISO_START (git-fixes).
- Bluetooth: bnep: Fix UAF read of dev->name (git-fixes).
- batman-adv: frag: disallow unicast fragment in fragment
  (git-fixes).
- batman-adv: tp_meter: avoid use of uninit sender vars
  (git-fixes).
- batman-adv: dat: handle forward allocation error (git-fixes).
- batman-adv: clear current gateway during teardown (git-fixes).
- batman-adv: fix fragment reassembly length accounting
  (git-fixes).
- batman-adv: tt: fix negative last_changeset_len (git-fixes).
- batman-adv: tt: fix negative tt_buff_len (git-fixes).
- batman-adv: fix tp_meter counter underflow during shutdown
  (git-fixes).
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
  (git-fixes).
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
  (git-fixes).
- ALSA: sc6000: Keep the programmed board state in card-private
  data (git-fixes).
- ASoC: SOF: Intel: hda: Fix NULL pointer dereference
  (stable-fixes).
- ALSA: hda/conexant: Renaming the codec with device ID 0x1f86
  and 0x1f87 (stable-fixes).
- ALSA: sc6000: Use standard print API (stable-fixes).
- drm/i915: Extract intel_dbuf_mdclk_cdclk_ratio_update()
  (stable-fixes).
- ASoC: SOF: Intel: hda-dai: add support for dspless mode beyond
  HDAudio (stable-fixes).
- ASoC: SOF: Intel: hda-dai: remove dspless special case
  (stable-fixes).
- commit b214d9a

- gve: Enable reading max ring size from the device in DQO-QPL
  mode (bsc#1265925).
- gve: Update QPL page registration logic (bsc#1265925).
- gve: add XDP DROP and PASS support for DQ (bsc#1265925).
- gve: update XDP allocation path support RX buffer posting
  (bsc#1265925).
- gve: merge packet buffer size fields (bsc#1265925).
- gve: update GQ RX to use buf_size (bsc#1265925).
- gve: introduce config-based allocation for XDP (bsc#1265925).
- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics
  (bsc#1265925).
- gve: Add RSS cache for non RSS device option scenario
  (bsc#1265925).
- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup
  (bsc#1265925).
- gve: process XSK TX descriptors as part of RX NAPI
  (bsc#1265925).
- commit a95e7b7

- Fix the wrong kabi patch order at merging from SLE15-SP6-LTSS
  No functional changes
- commit edd353b

- net: gro: don't merge zcopy skbs (git-fixes).
- net: skbuff: propagate shared-frag marker through frag-transfer
  helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
  (CVE-2026-46300 bsc#1265209).
- net: gro: don't merge zcopy skbs (git-fixes).
- net: skbuff: propagate shared-frag marker through frag-transfer
  helpers (CVE-2026-43503 bsc#1265960).
- net: skbuff: preserve shared-frag marker during coalescing
  (CVE-2026-46300 bsc#1265209).
- commit 17348bf

- Revert "net: skbuff: propagate shared-frag marker through pskb_copy()"
  This reverts commit 7d64bf1e8cbaf1eb308d2e84a0475b85e0129adc.
- commit 44dd5e4

- packaging: compute-PATCHVERSION.sh -> compute-PATCHVERSION
- commit fc624df

- Fix errors in prior merge from fixes/linux-6.4:
- Adjust ptrace-slightly-saner-get_dumpable-logic-kabi-assert.patch
  (kabi fixup) so 'task_struct_orig' matches SP7 task_struct layout.
- Fix ordering of ptrace kabi fixup patches in series.conf to match
  SLE15-SP6-LTSS [no functional difference].
- commit 46dfb5c

- kernel-binary: Only apply vmlinux workaround on SLE15 and later
  To create debuginfo for vmlinux the file needs to be present even if
  it's not packaged because a compressed file is packaged insteand.
  To accomplish that the file is marked as ghost in the file list. Then
  rpm does not complain that the file exists but does not package it.
  However, rpm still reserves space for ghost files when installing a
  package. To avoid reserving space for a file that is not used the file
  is truncated.
  That works on SLE 15 but on SLE 12 rpm then fails packaging the
  debuginfo complaiing that extra debuginfo files are present. Limit the
  workaround to SLE 15 and later.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit 1ef7451

- scsi: target: iscsi: validate CHAP_R length before base64 decode
  (bsc#1265449).
- commit 9997c88

- net: mana: Fix crash from unvalidated SHM offset read from BAR0 during FLR (bsc#1265846).
- net: mana: remove double CQ cleanup in mana_create_rxq error path (git-fixes).
- net: mana: Skip WQ object destruction for uninitialized RXQ (git-fixes).
- net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() (git-fixes).
- RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (git-fixes).
- RDMA/mana: Validate rx_hash_key_len (git-fixes).
- hv_sock: fix ARM64 support (git-fixes).
- commit 18c2af9

- Kernel-binary: Do not truncate vmlinux when it's the boot image
  Some architectures use vmlinux to boot. Truncating vmlinux on those
  architectures causes signing failure during build. Also if the signing
  was disabled a brokne kernel would be produced.
  Fixes: 222edac2a18 (kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements)
- commit d3cf603

- perf: Fix __perf_event_overflow() vs perf_remove_from_context()
  race (bsc#1260018 CVE-2026-23271).
- commit d05430f

- xfs: avoid dereferencing log items after push callbacks
  (CVE-2026-31404 bsc#1261628).
- commit bed0ec1

- kernel-binary: prevent uncompressed vmlinux from inflating rpm size requirements
  define %__spec_install_post to truncate the uncompressed vmlinux
  to 0 bytes after find-debuginfo.sh and brp-* scripts run. This prevents
  rpmbuild from baking the %ghost file size into the FILESIZES
  header, which can cause installation failures on smaller /boot partitions.
  Fixes: bsc#1265456
- commit 222edac

- net/rds: reset op_nents when zerocopy page pin fails
  (bsc#1265626, CVE-2026-43494).
- net/rds: reset op_nents when zerocopy page pin fails
  (bsc#1265626).
- commit b66d9fc

- perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001
  CVE-2026-31528).
- commit 2f72854

- RDMA/irdma: Fix deadlock during netdev reset with active connections (CVE-2026-31565 bsc#1263064)
- commit e3d01c8

- net/sched: fix pedit partial COW leading to page cache corruption
  (bsc#1265421).
- commit a756c69

- RDMA/irdma: Fix double free related to rereg_user_mr (CVE-2026-43120)
- commit c514796

- drm/amdkfd: Make all TLB-flushes heavy-weight (stable-fixes).
- commit be16332

- ALSA: hda: Fix NULL pointer dereference in snd_hda_ctl_add()
  (git-fixes).
- ALSA: scarlett2: Add missing error check when initialise
  Autogain Status (git-fixes).
- ALSA: hda: cs35l41: Put ACPI device on missing physical node
  (git-fixes).
- ALSA: hda: cs35l56: Put ACPI device after setting companion
  (git-fixes).
- ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
  (git-fixes).
- ALSA: usb-audio: Bound MIDI endpoint descriptor scans
  (git-fixes).
- drm/amdgpu: gate VM CPU HDP flush on reset lock (stable-fixes).
- drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower
  count (stable-fixes).
- leds: qcom-lpg: Check for array overflow when selecting the
  high resolution (stable-fixes).
- commit 219e1c4

- spi: zynq-qspi: switch to use modern name (stable-fixes).
- Refresh
  patches.suse/spi-zynq-qspi-Add-check-for-clk_enable.patch.
- commit 79d17cd

- USB: serial: option: add Telit Cinterion LE910Cx compositions
  (stable-fixes).
- usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
  (stable-fixes).
- usb: usblp: fix heap leak in IEEE 1284 device ID via short
  response (stable-fixes).
- platform/x86: hp-wmi: Ignore backlight and FnLock events
  (stable-fixes).
- mtd: spi-nor: sst: Fix write enable before AAI sequence
  (git-fixes).
- mtd: docg3: fix use-after-free in docg3_release() (git-fixes).
- spi: uniphier: fix controller deregistration (git-fixes).
- spi: syncuacer: fix controller deregistration (git-fixes).
- spi: sun4i: fix controller deregistration (git-fixes).
- spi: omap2-mcspi: fix controller deregistration (git-fixes).
- spi: mtk-nor: fix controller deregistration (git-fixes).
- spi: microchip-core-qspi: fix controller deregistration
  (git-fixes).
- spi: uniphier: Simplify clock handling with
  devm_clk_get_enabled() (stable-fixes).
- wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
  (git-fixes).
- wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
  (stable-fixes).
- mtd: spi-nor: sst: Fix SST write failure (git-fixes).
- mtd: spi-nor: sst: Factor out common write operation to
  `sst_nor_write_data()` (stable-fixes).
- spi: uniphier: switch to use modern name (stable-fixes).
- spi: synquacer: switch to use modern name (stable-fixes).
- spi: sun4i: switch to use modern name (stable-fixes).
- spi: spi-ti-qspi: Convert to platform remove callback returning
  void (stable-fixes).
- spi: microchip-core-qspi: Use helper function
  devm_clk_get_enabled() (stable-fixes).
- commit 401263c

- drm/amdkfd: Add upper bound check for num_of_nodes
  (stable-fixes).
- commit 46b01e2

- HID: playstation: Clamp num_touch_reports (git-fixes).
- drm/amdgpu: zero-initialize GART table on allocation
  (stable-fixes).
- drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in
  KIQ (stable-fixes).
- fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent
  use-after-free (stable-fixes).
- ipmi: Add limits to event and receive message requests
  (git-fixes).
- crypto: authencesn - reject short ahash digests during instance
  creation (git-fixes).
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (git-fixes).
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (git-fixes).
- drm/amdkfd: validate SVM ioctl nattr against buffer size
  (stable-fixes).
- drm/amdgpu: fix zero-size GDS range init on RDNA4
  (stable-fixes).
- drm/amdkfd: Clear VRAM on allocation to prevent stale data
  exposure (stable-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
  (stable-fixes).
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
  (stable-fixes).
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
  (stable-fixes).
- drm/amdgpu/vce: Prevent partial address patches (stable-fixes).
- drm/amdgpu: Add bounds checking to ib_{get,set}_value
  (stable-fixes).
- mtd: docg3: Convert to platform remove callback returning void
  (stable-fixes).
- commit 8bb0040

- ASoC: amd: yc: Add HP OMEN Gaming Laptop 16-ap0xxx product
  line in quirk table (stable-fixes).
- ALSA: core: Serialize deferred fasync state checks (git-fixes).
- ACPI: video: force native backlight on HP OMEN 16 (8A44)
  (stable-fixes).
- ACPI: scan: Use acpi_dev_put() in object add error paths
  (git-fixes).
- ALSA: aoa: i2sbus: clear stale prepared state (git-fixes).
- ALSA: seq_oss: return full count for successful SEQ_FULLSIZE
  writes (stable-fixes).
- ALSA: aoa: Skip devices with no codecs in i2sbus_resume()
  (git-fixes).
- crypto: arm64/aes - Fix 32-bit aes_mac_update() arg treated
  as 64-bit (git-fixes).
- ALSA: misc: Use guard() for spin locks (stable-fixes).
- ALSA: aoa: Use guard() for mutex locks (stable-fixes).
- ALSA: seq: Notify client and port info changes (stable-fixes).
- commit fd79ce9

- drm/loongson: Use managed KMS polling (git-fixes).
- drm/xe/dma-buf: handle empty bo and UAF races (git-fixes).
- commit 6307785

- drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init
  (git-fixes).
- drm/gma500/oaktrail_lvds: fix hang on init failure (git-fixes).
- drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup
  (git-fixes).
- accel/qaic: Add overflow check to remap_pfn_range during mmap
  (git-fixes).
- drm/panfrost: Fix wait_bo ioctl leaking positive return from
  dma_resv_wait_timeout() (git-fixes).
- drm/i915/dp: Fix VSC dynamic range signaling for RGB formats
  (git-fixes).
- drm/i915: skip __i915_request_skip() for already signaled
  requests (git-fixes).
- commit a143ec8

- Add patch for CVE-2026-34986 (bsc#1262948)
  * 0003-CVE-2026-34986-Bump-go-jose-to-v3.0.5.patch
- Add patch for CVE-2026-39821 (bsc#1266640)
  * 0004-CVE-2026-39821-idna-update-from-x-text-fix-ToUnicode.patch
- Add patch for CVE-2026-33814 (bsc#1265794)
  * 0005-CVE-2026-33814-http2-prevent-hanging-Transport-due-t.patch

- Add patch for CVE-2026-33186 (bsc#1260296):
  * 0002-CVE-2026-33186-containerd-google.golang.org-grpc-aut.patch

- proc: Use affinity mask even on systems with more than 1024 CPUs (bsc#1259327)
  - add coreutils-gnulib-nproc-Use-affinity-mask-even-on-systems-with-more-th.patch

- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero
  Content-Length empty body check (bsc#1264971)
  * Add patch: curl-http-prefer-chunked-encoding-over-Content-Length-0.patch

-  Update to Docker 29.4.0. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/29/#2940>
- Update to buildx 0.33.0. See upstream changelog online at
  <https://github.com/docker/buildx/releases/tag/v0.33.0>
- Rebased patches:
  * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
  * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch
- Removed patch
  * 0007-CVE-2025-58181-fix-vendor-crypto-ssh.patch (applicable only
    when docker version < v29.1.0)

- Update to version 059+suse.568.g200aa75e:
  * fix(systemd): explicitly install /bin/bash (bsc#1263940)

- ungetwc-byte-stream.patch: libio: Fix ungetwc operating on byte stream
  (CVE-2026-5928, bsc#1262464, BZ #33998)
- scanf-mc-buffer-overflow.patch: stdio-common: Fix buffer overflow in
  scanf %mc (CVE-2026-5450, bsc#1262465, BZ #34008)

- ibm139x-pending-char-state.patch: Use pending character state in
  IBM1390, IBM1399 character sets (CVE-2026-4046, bsc#1261206, BZ #33980)

- Update to version 3.15
  * Remove LoggingClient error failure for hanadiskrestore and hanadiskbackup.
  * Add checks for unexpected arguments in hanadiskbackup and hanadiskrestore.
  * Update SAP Agent version to 3.15.
  * Refactor grubBootLoaderX5 to check for BLS support via grub2-mkconfig help.
  * Update all go dependencies
  * Check grub2-mkconfig for BLS support on X4 instances.
  * Add tenant SID collection to supportbundle.
  * Update golang.org/x/net dependency. This is to address (#444)
    (bsc#1266604, CVE-2026-39821)
  * Fork tuned.conf to tuned-x5.conf for X5 series configurations
  * Enable configureX5 in configureinstance.
  * Create skeleton implementation and tests for X5 configureinstance support.
  * Enable detection of x5 machine types in configureinstance
- Drop CVE-2026-33186.patch, merged upstream
- Drop CVE-2026-33814.patch, merged upstream
- Drop CVE-2026-34986.patch, merged upstream

- Update to version 3.14 (bsc#1265991)
  * Update Daemon Restart method to pass the correct cancel function to the new handler.
  * Remove redundant error logging in HANA disk restore.
  * Fetch and rename Logical Volume during HANA disk restore.
  * Add usage metrics for CMEK disk restore.
  * Add multi-region and global KMS keys location checks.
  * Convert HANA SID to uppercase in hanadiskbackup and hanadiskrestore.
  * Log warning instead of erroring out on KMS key get failure.
  * Initialize GCE client in status onetime command.
  * Validate presence of KMS key in hanadiskrestore.
  * Add SID parameter to HANA backup/restore path functions.
  * Add KMS key location validation for HANA disk restore.
  * Update agent version to 3.14.
  * Fixes an issue if there is a whitespace around an argument passed in
  * Add validation to prevent using both CSEK and KMS keys in hanadiskrestore.
  * Handle disk recreation in HANA disk restore when IOPS, throughput, size, or KMS key are specified.
  * Refactor disk restore and configuration logic.
  * Add support for CMEK encryption of restored disks.
  * Remove obsolete TODOs.

- Add CVE-2026-33814.patch to fix hanging Transport in http2 code
  due to bad SETTINGS frame (bsc#1265764, CVE-2026-33814)

- Update to version 3.13
  * Replace strings.TrimSuffix with strings.TrimSpace in hanabackup.go
  * Improve error messages in hanabackup.go.
  * Add system state logging and logical device verification.
  * Minor version bump
  * Improve SAP instance comparison for process metrics collectors to
    prevent unnecessary restarts of collectors.
  * Delete supportbundlehandler package.
  * Remove configurehandler from sapguestactions.
  * Delete hanadiskbackuphandler from sapguestactions.
  * Remove Guest Actions and GCBDR Actions from initial daemon start.
  * Remove `gsutil` check from collection definition.
  * Delete performancediagnosticshandler package.
  * Remove unused handlers and shell command execution.
  * status feature fixes - pass secret name
  * Fix an issue in system discovery if discovering a network fails,
    particularly due to an IAM permission error.
  * Add verification for HANA data volume state after disk restore.
  * Error handling for rescanVolumegroups and improved logging.
  * Add link to What's New page in the sapagent README.
  * Add secret manager IAM checks if secret key is preset in status

- Update to version 20260529.00
  * Dependency updates (#616) (bsc#1266603, CVE-2026-39821)
    (bsc#1266171, CVE-2026-39827, CVE-2026-39834, CVE-2026-39828,
    CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833,
    CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598,
    CVE-2026-46595, CVE-2026-39835)
- from version 20260522.00
  * Fix improper umask calculation on socket creation (#614)
- from version 20260520.01
  * Update OWNERS (#609)

- Packaging improvements:
  * Remove define github project name components no longer needed
  * Define shortname corresponding to binary name when different
    from package name. Use shortname where applicable to normalize
    common lines across Go app packages, similar to name macro.
  * Drop BuildRequires: golang-packaging. The original macros for
    file movements into GOPATH are obsolete with Go modules. Macro
    go_nostrip is no longer needed with current binutils and Go.
  * Remove go_nostrip macro which is no longer recommended
  * Re-enable binary stripping and debuginfo boo#1210938
  * Remove goprep macro which is no longer recommended
  * Build PIE with pattern that may become recommended procedure:
    %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build
    A go toolchain buildmode default config would be preferable
    but none exist at this time.
  * Drop export CGO_ENABLED="0". Use the default unless there is a
    defined requirement or benefit.
  * For this package, we were seeing the expected error
    "-buildmode=pie requires external (cgo) linking, but cgo is not
    enabled" when using buildmode=pie and CGO_ENABLED=0. The error
    manifested only on s390x and i586 architectures, which was not
    expected. Resolve by using default CGO_ENABLED.
  * Remove ldflags -s (Omit symbol table and debug info) and -w
    (Omit DWARF symbol table). This information is used to produce
    separate debuginfo packages and binaries are stripped for
    reduced size by GNU strip during RPM build.
  * Remove ldflags -X entry for embedding build version metadata.
    This information is embedded in binaries with go1.18+ and
    available via go version -m or runtime/debug.ReadBuildInfo().
  * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable

- Update to version 20260430.00
  * Update OWNERS (#609)
  * Update THIRD_PARTY_LICENSES to be package specific location. (#608)
  * Update dependencies and go version to 1.26.2 (#607)
    (bsc#1265762, CVE-2026-33814)
  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)
    (bsc#1260264, CVE-2026-33186)
  * Backport oslogin changes for sles16 to legacy agent (#603)
  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)
  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602) (bsc#1260264, CVE-2026-33186)
  * Actually finally fix the RPM spec (#601)
  * Correct guest telemetry build target (#600)
  * Add packaging for new telemetry extension (#599)
  * Implement new scheduled job for routes monitor (#598)
  * Add packaging changes for locally bundled extensions feature support (#593)
  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)
  * Disable certificates when security keys are enabled (#588)
  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)
  * Source the contents of /var/google-users.d config files. (#586)
  * Force remove core plugin configuration for windows (#587)
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
    (bsc#1239334, CVE-2025-22869, bsc#1253889, CVE-2025-58181)
  * Don't delete the authorized_keys file when an empty key list
    is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20260424.00
  * Bring topic-stable up to latest point. (#606)
  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20260423.01
  * Update THIRD_PARTY_LICENSES to be package specific location. (#608)
- from version 20260423.00
  * Update dependencies and go version to 1.26.2 (#607)
  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)
  * Backport oslogin changes for sles16 to legacy agent (#603)
  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)
  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)
  * Actually finally fix the RPM spec (#601)
  * Correct guest telemetry build target (#600)
  * Add packaging for new telemetry extension (#599)
  * Implement new scheduled job for routes monitor (#598)
  * Add packaging changes for locally bundled extensions feature support (#593)
  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)
  * Disable certificates when security keys are enabled (#588)
  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)
  * Source the contents of /var/google-users.d config files. (#586)
  * Force remove core plugin configuration for windows (#587)
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
  * Don't delete the authorized_keys file when an empty key
    list is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20260422.01
  * Bring topic-stable up to latest point. (#606)
  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20260422.00
  * Update dependencies and go version to 1.26.2 (#607)
  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)
  * Backport oslogin changes for sles16 to legacy agent (#603)
  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)
  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)
  * Actually finally fix the RPM spec (#601)
  * Correct guest telemetry build target (#600)
  * Add packaging for new telemetry extension (#599)
  * Implement new scheduled job for routes monitor (#598)
  * Add packaging changes for locally bundled extensions feature support (#593)
  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)
  * Disable certificates when security keys are enabled (#588)
  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)
  * Source the contents of /var/google-users.d config files. (#586)
  * Force remove core plugin configuration for windows (#587)
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
  * Don't delete the authorized_keys file when an empty key
    list is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20260421.00
  * Bring topic-stable up to latest point. (#606)
  * Bring stable branch up to 822ad49fd52b4d29869604af836a33cb22a667ba (#592)
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20260414.00
  * Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#604)
- Bump Go API version to 1.26
- Drop CVE-2026-34986.patch, merged upstream

- Add CVE-2026-34986.patch to fix crafted JWE input with a missing encrypted
  key can lead to a denial of service (bsc#1262926, CVE-2026-34986)

- Update to version 20260402.00: (bsc#1257010)
  * Backport oslogin changes for sles16 to legacy agent (#603)
  * Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 (#596)
  * Bump google.golang.org/grpc from 1.75.0 to 1.79.3 (#602)
  * Actually finally fix the RPM spec (#601)
  * Correct guest telemetry build target (#600)
  * Add packaging for new telemetry extension (#599)
  * Implement new scheduled job for routes monitor (#598)
  * Add packaging changes for locally bundled extensions feature support (#593)
  * Ensure the uninstall script handles GCE metadata endpoint unavailability. (#591)
  * Disable certificates when security keys are enabled (#588)
  * Move sourcing of per-user configs to the end of sshd_config, fixing 2FA logins. (#590)

- Update to version 20260108.00
  * Source the contents of /var/google-users.d config files. (#586)

- Update to version 20251223.00
  * Force remove core plugin configuration for windows (#587)
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
  * Don't delete the authorized_keys file when an empty key list
    is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251218.01
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251218.00
  * Force remove core plugin configuration for windows (#587)
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
  * Don't delete the authorized_keys file when an empty key list
    is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251216.00
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251215.00
  * Force remove core plugin configuration for windows (#587)
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
  * Don't delete the authorized_keys file when an empty key list
    is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251210.00
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251209.00
  * Force remove core plugin configuration for windows (#587)

- Update to version 20251208.00
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
  * Don't delete the authorized_keys file when an empty key list is passed
    to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251206.00
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251205.00
  * network: force address manager to always consolidate the OS state (#585)
  * Bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#583)
  * Don't delete the authorized_keys file when an empty key list
    is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)

- Update to version 20251120.01
  * fix start mode for windows on stable release (#584)
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251120.00
  * Don't delete the authorized_keys file when an empty key list
    is passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251117.00
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251115.00
  * Don't delete the authorized_keys file when an empty key list is
    passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251108.00
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251107.01
  * Don't delete the authorized_keys file when an empty key list is
    passed to updateAuthorizedKeysFile (#582)
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251031.00
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251030.02
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251030.01
  * Update agent_uninstall.ps1 (#558) (#580)
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251030.00
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251011.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20251009.01
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251009.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- Drop disable_google_guest_agent_manager.patch, fixed upstream

- Update to version 20251007.00
  * Add Tyler, Saswat, Hank to OWNERS (#577)
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251006.01
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20251006.00
  * Honor core plugin setting on windows package update (#576)
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20251005.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20250930.01
  * Honor core plugin setting on windows package update (#576)
- from version 20250929.01
  * Restart agent if core plugin is disabled (#575)
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250929.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20250926.00
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250924.02
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20250924.01
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250924.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)

- Update to version 20250923.01
  * Add extra debug logging around toggling OS Login (#572)
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250923.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20250921.00
  * Add extra debug logging around toggling OS Login (#572)
- from version 20250920.01
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250920.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20250918.01
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250917.01
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20250917.00
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250916.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20250915.00
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- Add disable_google_guest_agent_manager.patch to disable missing daemon
  google_guest_agent_manager referenced by google-startup-scripts.service

- Update to version 20250908.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20250907.00
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250905.01
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20250905.00
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250902.00
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- Build and install new gce_workload_cert_refresh binary
- Fix installation source of google_metadata_script_runner_adapt script
- Install new systemd service file
  * gce-workload-cert-refresh.service

- Update to version 20250901.00
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250831.03
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20250831.02
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250831.01
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent
    and disable core plugin (#557)
- from version 20250831.00
  * Update go version to 1.25 (#565)
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250830.02
  * Update go version for stable branch to 1.25 (#571)
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent
    and disable core plugin (#557)
- from version 20250830.01
  * Update go version to 1.25 (#565)
- from version 20250830.00
  * Add compat adapt script to windows in agent sysprep (#569)
  * Fix adapt to use more portable shebang line (#567)
  * Remove routes script from packaging (#566)
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250828.00
  * Add adapt script in stable branch as per #569 (#570)
  * Backport fix from #567 to stable branch (#568)
- from version 20250826.00
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and
    disable core plugin (#557)
- from version 20250821.01
  * Remove routes script from packaging (#566)
- Drop CVE-2025-22868.patch, merged upstream
- Update Go API version to 1.25

- Update to version 20250718.00
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)

- Update to version 20250709.02
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20250709.01
  * Update adapt script to run on startup/shutdown both (#561)
  * Update agent_uninstall.ps1 (#558)
  * Stop core plugin before removing agent package (#554)
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
- from version 20250709.00
  * Revert compat behavior and call known binary directly (#560)
  * Revert compat behavior and call known binary directly (#559)
  * Build rollforward package to re-enable original agent and disable core plugin (#557)
- from version 20250702.00
  * Update adapt script to run on startup/shutdown both (#561)
- from version 20250701.01
  * Update agent_uninstall.ps1 (#558)
- from version 20250701.00
  * Stop core plugin before removing agent package (#554)
- from version 20250628.00
  * Startup scripts should start after agent manager instead (#553)
  * Update presets and install dependencies on systemd units (#552)
  * Ensure agent service is disabled (#551)
- from version 20250626.00
  * Disable legacy agent to enable core plugin (#550)
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
  * startup script: wrap compatibility decision into its own scripts (#538)
  * Reapply "oslogin: Correctly handle newlines at the end of modified files (#520)" (#523) (#540)
- from version 20250625.00
  * prepare stable release.
- Install google_metadata_script_runner_adapt script (bsc#1245759)

- Update to version 20250624.00
  * Final fix for RHEL packaging for routes setup (#549)
  * Fix RHEL packaging for routes scripts (#548)
  * Packaging changes to include routes script installation (#542)
  * Update CLI name in packaging (#543)
  * systemd should manage only the main process (#544)
  * startup script: wrap compatibility decision into its own scripts (#538)
  * Reapply "oslogin: Correctly handle newlines at the end of modified
    files (#520)" (#523) (#540)
- from version 20250611.01
  * prepare stable release.
- from version 20250611.00
  * startup script: wrap compatibility decision into its own scripts (#538)
  * Reapply "oslogin: Correctly handle newlines at the end of modified
    files (#520)" (#523) (#540)
- from version 20250609.00
  * prepare stable release.
- from version 20250605.00
  * startup script: wrap compatibility decision into its own scripts (#538)
  * Reapply "oslogin: Correctly handle newlines at the end of modified
    files (#520)" (#523) (#540)
  * Make sure agent added connections are activated by NM (#534)
  * wrap NSS cache refresh in a goroutine (#533)
  * Wicked: Only reload interfaces for which configurations are
    written or changed. (#524)
  * Add AuthorizedKeysCompat to windows packaging (#530)
  * Remove error messages from gce_workload_cert_refresh and metadata
    script runner (#527)
  * Update guest-logging-go dependency (#526)
  * Add 'created-by' metadata, and pass it as option to logging library (#508)
  * Revert "oslogin: Correctly handle newlines at the end of
    modified files (#520)" (#523)
  * Re-enable disabled services if the core plugin was enabled (#522)
  * Enable guest services on package upgrade (#519)
  * oslogin: Correctly handle newlines at the end of modified files (#520)
  * Fix core plugin path (#518)
  * Fix package build issues (#517)
  * Fix dependencies ran go mod tidy -v (#515)
  * Fix debian build path (#514)
  * Bundle compat metadata script runner binary in package (#513)
  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)
  * Update startup/shutdown services to launch compat manager (#503)
  * Bundle new gce metadata script runner binary in agent package (#502)
  * Revert "Revert bundling new binaries in the package (#509)" (#511)

- Update to version 20250604.00
  * Preparing stable build.
- from version 20250602.00
  * Make sure agent added connections are activated by NM (#534)
  * wrap NSS cache refresh in a goroutine (#533)
  * Wicked: Only reload interfaces for which configurations are written or changed. (#524)
  * Add AuthorizedKeysCompat to windows packaging (#530)
  * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)
  * Update guest-logging-go dependency (#526)
  * Add 'created-by' metadata, and pass it as option to logging library (#508)
  * Revert "oslogin: Correctly handle newlines at the end of modified files (#520)" (#523)
  * Re-enable disabled services if the core plugin was enabled (#522)
  * Enable guest services on package upgrade (#519)
  * oslogin: Correctly handle newlines at the end of modified files (#520)
  * Fix core plugin path (#518)
  * Fix package build issues (#517)
  * Fix dependencies ran go mod tidy -v (#515)
  * Fix debian build path (#514)
  * Bundle compat metadata script runner binary in package (#513)
  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)
  * Update startup/shutdown services to launch compat manager (#503)
  * Bundle new gce metadata script runner binary in agent package (#502)
  * Revert "Revert bundling new binaries in the package (#509)" (#511)
- from version 20250521.00
  * Preparing stable build.
- from version 20250515.00
  * Make sure agent added connections are activated by NM (#534)
  * wrap NSS cache refresh in a goroutine (#533)
  * Wicked: Only reload interfaces for which configurations are written or changed. (#524)
  * Add AuthorizedKeysCompat to windows packaging (#530)
  * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527)
  * Update guest-logging-go dependency (#526)
  * Add 'created-by' metadata, and pass it as option to logging library (#508)
  * Revert "oslogin: Correctly handle newlines at the end of modified files (#520)" (#523)
  * Re-enable disabled services if the core plugin was enabled (#522)
  * Enable guest services on package upgrade (#519)
  * oslogin: Correctly handle newlines at the end of modified files (#520)
  * Fix core plugin path (#518)
  * Fix package build issues (#517)
  * Fix dependencies ran go mod tidy -v (#515)
  * Fix debian build path (#514)
  * Bundle compat metadata script runner binary in package (#513)
  * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512)
  * Update startup/shutdown services to launch compat manager (#503)
  * Bundle new gce metadata script runner binary in agent package (#502)
  * Revert "Revert bundling new binaries in the package (#509)" (#511)

- Packaging improvements:
  * Remove define github project name components no longer needed
  * Define shortname corresponding to binary name when different
    from package name. Use shortname where applicable to normalize
    common lines across Go app packages, similar to name macro.
  * Drop BuildRequires: golang-packaging. The original macros for
    file movements into GOPATH are obsolete with Go modules. Macro
    go_nostrip is no longer needed with current binutils and Go.
  * Remove go_nostrip macro which is no longer recommended
  * Re-enable binary stripping and debuginfo boo#1210938
  * Remove goprep macro which is no longer recommended
  * Build PIE with pattern that may become recommended procedure:
    %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build
    A go toolchain buildmode default config would be preferable
    but none exist at this time.
  * Drop export CGO_ENABLED="0". Use the default unless there is a
    defined requirement or benefit.
  * For this package, we were seeing the expected error
    "-buildmode=pie requires external (cgo) linking, but cgo is not
    enabled" when using buildmode=pie and CGO_ENABLED=0. The error
    manifested only on s390x and i586 architectures, which was not
    expected. Resolve by using default CGO_ENABLED.
  * Remove ldflags -s (Omit symbol table and debug info) and -w
    (Omit DWARF symbol table). This information is used to produce
    separate debuginfo packages and binaries are stripped for
    reduced size by GNU strip during RPM build.
  * Remove ldflags -X entry for embedding build version metadata.
    This information is embedded in binaries with go1.18+ and
    available via go version -m or runtime/debug.ReadBuildInfo().
  * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
  * Raise minimum golang API version to 1.25.5 to match go.mod file
  * Use explicit upstream GitHub homepage in URL field
  * Use single invocation of %setup with -a1 to unpack both tarballs

- Update to version 20260615.01
  * Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
    (bsc#1266171, CVE-2026-39827, CVE-2026-39834, CVE-2026-39828,
    CVE-2026-39829, CVE-2026-39831, CVE-2026-42508, CVE-2026-39833,
    CVE-2026-39830, CVE-2026-39832, CVE-2026-46597, CVE-2026-46598,
    CVE-2026-46595, CVE-2026-39835) (bsc#1266603, CVE-2026-39821)
- from version 20260615.00
  * Add unit tests for ospatch_apt_upgrade.go (#938)

- Update to version 20260611.00
  * Add unit tests for policies/policies.go PART 5 (#998)
- from version 20260610.00
  * Add unit tests for policies/policies.go PART 4 (#997)
- from version 20260609.02
  * squash commits (#936)
- from version 20260609.01
  * Add unit tests for policies/policies.go PART 3 (#996)
- from version 20260609.00
  * Add unit tests for policies/policies.go PART 2 (#991)
- from version 20260602.01
  * Align format of dates and timestamp collected across Windows packages (#973)
- from version 20260602.00
  * Add unit tests for config/config,go (#979)
- from version 20260528.00
  * Bump github.com/containerd/containerd (#990)
- from version 20260521.00
  * Cover agentconfig functionality by unit tests (#925)
- from version 20260520.04
  * Add unit tests for policies/googet.go (#961)
  * Bump github.com/go-git/go-git/v5 (#987)
- from version 20260520.02
  * Add unit tests for policies/yum.go (#952)
  * Add unit tests for policies/apt.go PART 3 (#951)
- from version 20260520.00
  * Add unit tests for policies/zypper.go (#953)
- from version 20260519.00
  * Add unit tests for policies/policies.go PART 1 (#949)
- from version 20260513.01
  * Bump github.com/go-git/go-git/v5 (#981), this also updates
    golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
- from version 20260513.00
  * upgrade a few packages (#980)
- from version 20260512.02
  * Add/improve unit tests for agentendpoint/exec_task.go (#933)
- from version 20260512.01
  * Cover google_update.go by unit tests (#941)
- from version 20260512.00
  * Change zone for arm64 builds because of stockout (#978)

- Add CVE-2026-33186.patch to fix authorization bypass in grpc-go due to improper
  validation of the HTTP/2 :path pseudo-header (bsc#1260264, CVE-2026-33186)

- Update to version 20260511.00
  * switch to t2a-standard-2 on ARM package build (#977)
- from version 20260505.03
  * Cover zypper_patch by unit tests (#958)
- from version 20260505.02
  * Remove unused functions DisableAutoUpdates (#970)
- from version 20260505.01
  * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)
- from version 20260505.00
  * Upgrade a few dependencies across the repo (#968)
    + github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506)
    + github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986)
    + github.com/go-viper/mapstructure/v2 2.3.0->2.4.0
    + go.opentelemetry.io/otel 1.40.0->1.41.0
    + go.opentelemetry.io/otel/sdk 1.39.0->1.43.0
- from version 20260504.01
  * bump github.com/docker/cli to 29.2.0 (#962)
- from version 20260504.00
  * Bump github.com/opencontainers/selinux (#960)
- Add missing CVE reference to previous changelog entry
- Drop CVE-2026-34986.patch, merged upstream

- Update to version 20260428.00
  * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)
- from version 20260427.03
  * Cover config/file.go by unit tests (#935)
- from version 20260422.01
  * Cover patch_linux.go by unit tests (#932)
- from version 20260422.00
  * upgrade grpc package in main package and e2e tests (#959)
    (bsc#1260264, CVE-2026-33186)
- from version 20260417.04
  * Bump OSV-Scalibr version to v0.4.3 (#956)
- from version 20260417.03
  * Add unit tests for updates_linux.go (#937)
- from version 20260417.02
  * Add zone to CreateDisk step (#955)
- from version 20260417.01
  * Change disk type for deb11 (#954)
- from version 20260417.00
  * Add unit tests for policies/apt.go PART 1 (#950)
- from version 20260410.02
  * Add unit tests for packages/pty_linux.go (#943)
- from version 20260410.01
  * fix disk type for arm workflows (#948)
- from version 20260410.00
  * Change machine type for arm based workflows (#946)
- Drop CVE-2026-33186.patch, merged upstream

- Add CVE-2026-34986.patch to fix crafted JWE input with a missing encrypted
  key can lead to a denial of service (bsc#1262926, CVE-2026-34986)

- Update to version 20260330.00
  * bump timeouts for all workflows (#940)
- from version 20260326.00
  * Cover exec_resource.go by unit tests (#934)
- from version 20260318.00
  * Integrate OSConfig agent with ReportVmInventory (#923)
- from version 20260313.02
  * remove cacheonly flag from yum upgrade (#924)
- from version 20260313.01
  * conditions python version override (#927)
- from version 20260313.00
  * Fix presubmits by explicitly set python version for rpm based systems (#926)
- from version 20260311.00
  * Bump osconfig version (#922)
- from version 20260309.02
  * Extend OSV scalibr extractor (#921)
- from version 20260309.01
  * upgrade golang.org/x/crypto and it's transitive deps (#918)
- from version 20260309.00
  * Add purl to pkg info (#920)
- from version 20260306.00
  * Add 'Type' field to PkgInfo (#919)
- from version 20260303.01
  * Upgrade go.opentelemetry.io/otel/sdk (#913)
- from version 20260303.00
  * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)
- from version 20260302.00
  * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)
- from version 20260126.00
  * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)
  * Bump github.com/sirupsen/logrus (#894)

- Update to version 20260119.00
  * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)
- Add missing Bugzilla and CVE references for CVE-2023-45288
- Drop CVE-2025-47911.patch, fixed upstream
- Drop CVE-2025-58190.patch, fixed upstream

- Update to version 20251230.00
  * chore: Migrate gsutil usage to gcloud storage (#904)
- from version 20251223.00
  * fix e2e tests for report inventory (#903)
- from version 20251222.01
  * Revert "Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)" (#902)
- from version 20251222.00
  * Bump golang to the new version (#900)
- from version 20251218.00
  * add new CODEOWNERS (#901)
- from version 20251217.00
  * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)
- Bump the golang compiler version to 1.24.5

- Update to version 20251202.00
  * Revert "Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)" (#893)

- Update to version 20251201.00
  * Revert "Bump github.com/containerd/containerd (#890)" (#892)

- Update to version 20251126.00
  * Bump github.com/containerd/containerd (#890)
  * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)

- Update to version 20251028.00
  * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)
  * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)
- from version 20251023.02
  * Create multiple_os.yaml (#883)
- from version 20251023.00
  * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)
  * Add test runner for e2e tests (#876)
- Reword previous changelog entry so that the added patches are accepted

- Update to version 20250925.00
  * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)
  * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)
  * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)
  * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)

- Add CVE-2025-47911.patch to fix an issue in the HTML parser where a large
  number of open elements can cause the parser to become extremely slow by
  limiting the stack size of open elements (bsc#1251453, CVE-2025-47911)
- Add CVE-2025-58190.patch to fix an issue in the HTML parser where a specific
  HTML document can cause the parser to enter an infinite loop when trying
  to parse a </tbody> and implied </tr> next to each other.
  (bsc#1251704, CVE-2025-58190)

- Update to version 20250902.01
  * Bump github.com/googleapis/enterprise-certificate-proxy (#829)
- from version 20250902.00
  * update github.com/go-jose/go-jose/v4 (#869)
  * Upgrade scalibr and other deps (#866)
- from version 20250901.00
  * Fix possibility of path traversal for zip and tar archival (#868)
- from version 20250825.00
  * set CODEOWNERS file as required by org (#863)
- from version 20250819.00
  * Fix/rhel10 build centos image (#860)
- from version 20250814.00
  * Fix/rhel10 build image (#859)
- from version 20250813.00
  * Fix: Add RHEL 10 support to RPM startup script (#858)
- from version 20250811.00
  * Remove old/sles-15-sp4-sap as image is deprecated (#857)

- Update to version 20250806.00
  * Fixed JSON identifier for the universe domain (#855)
- from version 20250729.00
  * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)
- from version 20250725.02
  * Update utils.go (#854)
  * Upgrade golang.org/x/oauth2 package to the latest. (#853)
  * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)
- from version 20250725.01
  * Bump golang.org/x/oauth2 (#848)
  * Port fix for debian 11 to goo package manager. (#852)
- from version 20250725.00
  * Update Golang version in common.sh and skip backports
    repo for debian 11 (#850)
- from version 20250723.01
  * Add workflows to build package for el10 (#849)
- from version 20250721.00
  * Make OS Config agent TPC aware (#846)
- from version 20250718.00
  * Create workflows for new Debian 13. (#847)
- Drop CVE-2025-22868.patch, merged upstream

- Update to version 20250703.00
  * Fix sles images (#844)
- from version 20250702.00
  * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)
- from version 20250701.00
  * Bump the go_modules group across 1 directory with 2 updates (#840)

- Update to version 20250606.00
  * Change base docker images Google's official base images. (#838)

- Update to version 2.6.7+git.1779709318.be17b23d:
  * Dev: complement the rsc_constraint parser
  * Fix: parsing ambiguity in cib_ops_path format handling
  * Fix: parsing `crm resources constraints <ID>`
  * Fix: resource `Recent events` menu
  * Add more timeout to mitigate ElementNotInteractableException
  * Fixing the „Problem reading geckodriver versions: error sending request for url“ warning
  * check_cluster_conf_ssh

- Update to version 2.6.7+git.1779441013.87a8ea7c:
  * Fix: parsing `crm resources constraints <ID>`
  * Fix: resource `Recent events` menu
  * Add more timeout to mitigate ElementNotInteractableException
  * Fixing the „Problem reading geckodriver versions: error sending request for url“ warning
  * check_cluster_conf_ssh
  * Fix python version module compatible (TEAM-11049)
  * Test: add leap16.0 hawk-node
  * Fix: nodes `Clear state` doesn't depend on Fencing
  * Test: build the hypervisor `hawk-examiner` runtime
  * Test: make e2e selenium-v4 compatible
  * Test: build `hawk-node` run-time
  * Fix: don't inflect/capitalize FENCING
  * Fix: don't inflect/capitalize FENCING
  * Dev: rename STONITH --> FENCING
  * Dev: give the Fencing wizard fa-plug icon (same as Stonith)
  * Dev: replace 'cibadmin -!' with 'pacemakerd -F'
  * Dev: bump e2e image leap:15.4 --> leap:15.5
  * Dev: Update LLC year --> 2026
  * Tests: add /cib/live/primitives/{primitive-id}/edit tests
  * Dev: add a new route /internal/auth to check if authenticated
  * Dev: add created/updated/delete flash url argument to notify the hawk-apserver
  * Dev: Update LLC year --> 2025

- update to 0.406:
  * Update pci and vendor ids

- update to 0.405:
  * Update pci and vendor ids

- Update to version 0.397:
  * Update pci and vendor ids

- Update to version 0.395:
  * Update pci and vendor ids

- add DPLL support (bsc#1255752 jsc#PED-14083)
  * dpll-Add-dpll-command.patch
  * dpll-Fix-missing-notifications-in-monitor-mode.patch
  * dpll-Send-object-per-event-in-JSON-monitor-mode.patch
  * dpll-add-client-side-filtering-for-device-show.patch
  * dpll-add-client-side-filtering-for-pin-show.patch
  * dpll-add-direction-and-state-filtering-for-pin-show.patch
  * dpll-add-mode-setting-support.patch
  * dpll-add-pin-filtering-by-parent-device-and-parent-p.patch
  * dpll-add-support-for-fractional-frequency-offset-in-.patch
  * dpll-fix-pin-id-get-type-filter-parsing.patch
  * lib-Add-str_to_bool-helper-function.patch
  * lib-Move-mnlg-to-lib-for-shared-use.patch
- refresh
  * patches/ss-escape-characters-in-command-name.patch

- update sync-UAPI-header-copies-with-SLE15-SP6.patch and rename
  it to sync-UAPI-header-copies-with-SLE15-SP7.patch

- Add patch CVE-2026-33948.patch (CVE-2026-33948, bsc#1262043)

- Add avahi-CVE-2026-34933.patch: refuse to accept publish flags
  where both wide_area and multicast are set.
  (CVE-2026-34933, bsc#1261546)

- loopdev: Prevent unauthorized read access to symlinked filesystem
  images (bsc#1261606, CVE-2026-27456,
  util-linux-CVE-2026-27456.patch).

- update to NSS 3.112.5
  * bmo#2033783 - reject DTLS 1.3 Server Hello after HVR without capping ss->vrange.max.
  * bmo#2034185 - update to version 2.84 of builtins module.

- Added "Suggests: p11-kit-nss-trust" to favor over mozilla-nss-certs
    (Jira: PED-15633)

- added patches
  CVE-2026-50593: Out-of-bounds write via Graphite actions [bsc#1267733]
  * graphite2-CVE-2026-50593.patch

- Add libinput-cve-2026-50265.patch: sanitize phys before printing
  it (bsc#1267852 CVE-2026-50265 CVE-2026-50292
  glfdo#libinput/libinput#1296).

- Update to version 1.11+27.g58cfc755:
  * fabrics: issue a warning on invalid traddr format (bsc#1248750)
  * fabrics: sanitize FC traddr (bsc#1248750)
  * nvme: expose tls mode in use (bsc#1259672)
  * fabrics: add helper to update tls and concat (bsc#1259672)
  * tree: avoid updating --tls in nvme_read_sysfs_tls() (bsc#1259672)

- Security fixes:
  * CVE-2026-42766: Possible NULL Dereference in Password-Based CMS
    Decryption (bsc#1266349)
  * CVE-2026-9076:  Out-of-Bounds Read in CMS Password-Based Decryption
    (bsc#1266341)
  * CVE-2026-7383:  Possible Heap Buffer Overflow in ASN.1 Multibyte String
    Conversion (bsc#1266340)
  * CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing
    (bsc#1266342)
  * CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
  * Add patches:
    openssl-CVE-2026-42766.patch openssl-CVE-2026-9076.patch
    openssl-CVE-2026-7383.patch openssl-CVE-2026-34180.patch
    openssl-CVE-2026-45447.patch

- Security fix:
  * CVE-2026-42767 NULL Pointer Dereference in CRMF EncryptedValue Decryption
    (bsc#1266350)
  * Add patch: openssl-CVE-2026-42767.patch

- Security fixes:
  * CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357)
  * CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356)
  * CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353)
  * CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355)
  * CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351)
  * CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352)
  * CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349)
  * CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345)
  * CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343)
  * CVE-2026-9076:  Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341)
  * CVE-2026-7383:  Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340)
  * CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342)
  * Add patches:
    openssl-CVE-2026-34180.patch openssl-CVE-2026-34181.patch
    openssl-CVE-2026-34183.patch openssl-CVE-2026-42766.patch
    openssl-CVE-2026-42768.patch openssl-CVE-2026-42769.patch
    openssl-CVE-2026-42770.patch openssl-CVE-2026-45445.patch
    openssl-CVE-2026-45446.patch openssl-CVE-2026-45447.patch
    openssl-CVE-2026-7383.patch openssl-CVE-2026-9076.patch

- fix solv_chksum_free segfault when called with a NULL pointer
- bump version to 0.7.39

- made repo_add_solv more robust against corrupt files
  [bsc#1265935] [CVE-2026-9149]
- fix potential buffer overflow when verifying EdDSA signatures
  [bsc#1266039] [CVE-2026-48863]
- added limit checks in multiple places to catch overflows
- reduce the size of the language id cache
- fixed Debian canon selection
- fixed dbpath detection in repo_rpmdb_librpm
- reduced stack usage in repo page compression (needed for musl)
- bump version to 0.7.38

- fix parsing of sha512 checksums in debian repositories
  [bsc#1265938] [CVE-2026-9150]
- improve speed of dirpool_add_dir makeing parsing of filelists.xml
  twice as fast
- fix parsing of recommends in the old Mandriva synthesis format
- bump version to 0.7.37

- respect the "default" attribute in environment optionlist in
  the comps parser
- support suse namespace deps in boolean dependencies [bsc#1258193]
- support for the Elbrus2000 (e2k) architecture
- support language() suse namespace rewriting
- bump version to 0.7.36

- Sync version 3.53.2 from Factory:
  * bsc#1268013, CVE-2026-11824: heap-based buffer overflow
    vulnerability in the FTS5 full-text search extension.
  * bsc#1268012, CVE-2026-11822: memory corruption vulnerabilities
    in the FTS5 full-text search extension.

- A .repo files "path=" entry must not refer to a location
  outside the repo (bsc#1267874, CVE-2026-44942)
  A "path=" entry may solely denote a sub-directory of the baseurl
  where the metadata are located. A relative path trying to access
  data outside the baseurl is reported and sanitized.
- version 17.38.13 (35)

- Repo "keyhint" must denote a filename, no path (bsc#1267426,
  CVE-2026-44941)
- version 17.38.12 (35)

- Fix potential crash on malformed or malicious repository
  metadata (fixes #740)
- version 17.38.11 (35)

- Repo metadata: discard entries referring to a location outside
  the repo (bsc#1259802, CVE-2026-25707)
  Mirroring those data locally would refer to a location outside
  the repo's local cache directory. Those data entries are reported
  and discarded.
- zypp.conf: Allow [env] section to add environment variables.
  This feature is designed to enable environment-specific settings
  or debugging options over an extended period. See zypp.conf(5).
- version 17.38.10 (35)

- Prevent configured scripts from escaping the sigcheck directory
  (bsc#1265223, CVE-2026-44933)
- StringV: guard hasPrefix/hasPrefixCI against reading past the
  view end (fixes #735)
- version 17.38.9 (35)

- Mandatory signature verification plugin support (PED#11922)
- version 17.38.8 (35)

- Fix purge-kernel -rc kernel handling (bsc#1239718)
- Explicitly_set_pool_DISTTYPE_RPM (fixes #726)
- version 17.38.7 (35)

- Check for trusted key updates when updating the general keyring
  (bsc#1259706)
- Support multiple MirroredOrigin authorities (bsc#1253193)
- Workaround doxygen bug: doxygen/doxygen#12057
- libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842)
- version 17.38.6 (35)

- Fix preloader not caching packages from arch specific subrepos
  (bsc#1253740)
- Deprioritize invalid mirrors (fixes openSUSE/zypper#636)
- version 17.38.5 (35)

- Fix Product::referencePackage lookup (bsc#1259311)
  Use a provided autoproduct() as hint to the package name of the
  release package. It might be that not just multiple versions of
  the same release package provide the same product version, but
  also different release packages.
- version 17.38.4 (35)

- specfile: on fedora use %{_prefix}/share as zyppconfdir if
  %{_distconfdir} is undefined (fixes #693)
  This will set '-DZYPPCONFDIR=%{zyppconfdir}' for cmake.
- Fall back to a writable location when precaching packages
  without root (bsc#1247948)
- version 17.38.3 (35)

- Prepare a legacy /etc/zypp/zypp.conf to be installed on old distros.
  See the ZYPP.CONF(5) man page for details.
- Fix runtime check for broken rpm --runposttrans (bsc#1257068)
- version 17.38.2 (35)

- Avoid libcurl-mini4 when building as it does not support ftp
  protocol.
- Translation: updated .pot file.
- version 17.38.1 (35)

- zypp.conf: follow the UAPI configuration file specification
  (PED-14658)
  In short terms it means we will no longer ship an
  /etc/zypp/zypp.conf, but store our own defaults in
  /usr/etc/zypp/zypp.conf. The systems administrator may choose to
  keep a full copy in /etc/zypp/zypp.conf ignoring our config file
  settings completely, or - the preferred way - to overwrite
  specific settings via /etc/zypp/zypp.conf.d/*.conf overlay files.
  See the ZYPP.CONF(5) man page for details.
- cmake: correctly detect rpm6 (fixes #689)
- Use 'zypp.tmp' as temp directory component to ease setting up
  SELinux policies (bsc#1249435)
- zyppng: Update Provider to current MediaCurl2 download
  approach, drop Metalink ( fixes #682 )
- version 17.38.0 (35)

- Update to version 2.11+30.g5e0abfb44:
  * fabrics: add helper to update tls and concat (bsc#1259672)

- Add patch rebased from upstream to add missing askpass check for
  proxy-mode multiplexing sessions (CVE-2026-35388, bsc#1261441):
  * openssh-cve-2026-35388-askpass-multiplexing.patch
- Update patch to fix a possible information disclosure or denial
  of service due to uninitialized variables in gssapi patches
  (CVE-2026-3497, bsc#1259642) :
  * openssh-8.0p1-gssapi-keyex.patch

- Add patch to fix a potential issue when validating mac or ciphers
  (bsc#1264568):
  * fix-mac-validation-strsep-logic-bug.patch

- Improve %prep LDAP regex to preserve subdirectories (e.g., ope-
  nbsd-compat/) and handle optional [ab]/ prefixes.

- added patches
  CVE-2026-8450: HTTP:Daemon versions before 6.17 for Perl allow OS command injection via send_file() [bsc#1266370]
  * perl-HTTP-Daemon-CVE-2026-8450.patch

- added patches
  CVE-2026-8177: versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences [bsc#1264715]
  * perl-XML-LibXML-CVE-2026-8177.patch

- CVE-2026-40475: improper input handling of null bytes can lead to
  silent data truncation and security-state inconsistency (bsc#1262803)
  * CVE-2026-40475.patch

- Update to 2026b:
  * British Columbia moved to permanent -07 on 2026-03-09. (bsc#1264965)
  * Some more overflow bugs have been fixed in zic.
- Refresh revert-philippines-historical-data.patch
- Change SUSE-Public-Domain license to LicenseRef-SUSE-Public-Domain to
  fix rpmlint errors

- Update to 2026a:
  * Moldova has used EU transition times since 2022.
  * The "right" TZif files are no longer installed by default.
  * -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds.
  * TZif files are no longer limited to 50 bytes of abbreviations.
  * zic is no longer limited to 50 leap seconds.
  * Several integer overflow bugs have been fixed.
- Changes from 2025c:
  * update Baja California DST rules in 1953, 1961-1975
  * An unset TZ is no longer invalid when /etc/localtime is
    missing, and is abbreviated "UTC" not "-00".  This reverts to
    2024b behavior
  * tzset etc. are now more cautious about questionable TZ settings.
  * tzset etc. now treat ' ' like '_' in time zone abbreviations
  * tzfree now preserves errno, consistently with POSIX.1-2024 ‘free’.
  * zic has new options inspired by FreeBSD.  ‘-D’ skips creation of
    output ancestor directories, ‘-m MODE’ sets output files’ mode,
    and ‘-u OWNER[:GROUP]’ sets output files’ owner and group.
  * multiple changes visible to developers
- Use "REDO=posix_right" to keep installing "right" TZif files.

- Update to v9.2.0530.
- Fix for SG#71948, bsc#1262395:
  * vim-9.1.1732-fix-inc-detection.patch: Fix for incorrectly detecting
- Upstream fixed the following bugs / CVEs:
  * bsc#1264706 CVE-2026-42307
  * bsc#1265360 CVE-2026-46483
  * bsc#1264708 CVE-2026-45130
  * bsc#1264707 CVE-2026-44656
  * bsc#1265349 CVE-2026-43961
- Changes:
  * 9.2.0530: WinBar row vertical separator not refreshed on window change
  * 9.2.0529: GTK4: clipboard returns empty after a foreign app takes the selection
  * 9.2.0528: possible overflow in XIM resource handling
  * 9.2.0527: Possible double free in fill_partial_and_closure()
  * 9.2.0526: missing out-of-memory check in ex_substitute()
  * 9.2.0525: spell: memory leak in spell_read_dic()
  * 9.2.0524: spell: buffer overflow with many affix or compound flags
  * 9.2.0523: tests: no test for using shellescape() in combination with :!
  * 9.2.0522: event_nr2name() in autocmd.c can be improved
  * 9.2.0521: GTK4: cannot resize shell after the window is shown
  * 9.2.0520: Reversed text opacity in popup when termguicolor is set
  * 9.2.0519: GTK4: GUI tabline is not displayed correctly
  * 9.2.0518: GTK4: input method cannot compose text
  * 9.2.0517: quickfix: can set quickfixtextfunc in restricted/sandbox mode
  * 9.2.0516: socketserver: spurious error when servername is taken
  * 9.2.0515: virtualedit=insert doesn't work during change operation
  * 9.2.0514: GTK4: build errors when socketserver is enabled
  * 9.2.0513: [security]: memory safety issues in spellfile.c
  * 9.2.0512: clientserver uses binary protocol
  * 9.2.0511: configure: when GTK4 is used also links in X11 libs
  * 9.2.0510: setline() mapping may trigger autoindent
  * 9.2.0509: term.c: compile error when LOG_TRN is enabled
  * 9.2.0508: completion: cannot complete user cmd :K with 'ignorecase'
  * 9.2.0507: Vim9 class: public/protected member name clash uses same error
  * 9.2.0506: home_replace() function can be improved
  * 9.2.0505: GTK4: text looks blurry on HiDPI displays
  * 9.2.0504: configure: requires X11 libraries for GTK4 build
  * 9.2.0503: Makefile: Missing dependencies for new GTK4 source files
  * 9.2.0502: runtime(netrw): bookmark handling can be improved
  * 9.2.0501: GTK4: there is no GTK4 UI available
  * 9.2.0500: filetype: some html files wrongly recognized as htmlangular
  * 9.2.0499: modeline: allow to disable modelines with modelinestrict
  * 9.2.0498: potential heap buffer overflow in if_xcmdsrv.c
  * 9.2.0497: Cannot jump to remote tags
  * 9.2.0496: [security]: Code Injection in cucumber filetype plugin
  * 9.2.0495: [security]: runtime(netrw): code injection via NetrwBookHistSave()
  * 9.2.0494: User commands cannot handle single args with spaces
  * 9.2.0493: popup: missing  Popup, PopupBorder and PopupTitle hi groups
  * 9.2.0492: popup: decoration wrongly drawn with clipping on border
  * 9.2.0491: VMS: various build issues
  * 9.2.0490: matchfuzzy() can crash on long multi-word patterns
  * 9.2.0489: filetype: some Objective-C files are not recognized
  * 9.2.0488: statusline: status line highlight blends into adjacent vsep cells
  * 9.2.0487: viminfo: possible signed int overflow in register array
  * 9.2.0486: out-of-bound read when recovering swap files
  * 9.2.0485: clipboard provider callback can be called recursively
  * 9.2.0484: TextPutPre triggers clipboard provider callback twice
  * 9.2.0483: popup: terminal embedded in an opacity popup freezes Vim on input
  * 9.2.0482: runtime(osc52): triggered twice with TextPutPoste autocmd
  * 9.2.0481: runtime(netrw): command injection possible via maps
  * 9.2.0480: [security]: runtime(netrw): code injection via mf command
  * 9.2.0479: [security]: runtime(tar): command injection in tar plugin
  * 9.2.0478: channel: redundant str/length assignments in channel_part_info()
  * 9.2.0477: popup: leftover content after popup_free under layout change
  * 9.2.0476: pattern completion leaks memory on alloc failures
  * 9.2.0475: runtime(netrw): bookmark paths not normalized
  * 9.2.0474: MS-Windows: hard to tell which Visual Studio version was selected with MSVC
  * 9.2.0473: Pasting ". register without autocommands breaks TextPut*
  * 9.2.0472: popup: column jitters when scrolled outside viewport
  * 9.2.0471: vimvars di_key initialized at runtime
  * 9.2.0470: No way to hook into put commands
  * 9.2.0469: popup: textprop-anchored popups bleed past host window edges
  * 9.2.0468: popups: not correctly updated from a CmdlineChanged autocommand
  * 9.2.0467: multi-line statusline loses highlighting attributes
  * 9.2.0466: popup: redraw can use stale blended cells
  * 9.2.0465: modeline: foldmarker cannot be set with modelinestrict
  * 9.2.0464: runtime(netrw): bookmarking directory uses current dir
  * 9.2.0463: Not able to use legacy expression evaluation in a vim9script maps
  * 9.2.0462: MS-Windows: workaround for assert error on GUI
  * 9.2.0461: Corrupted undofile causes use-after-free
  * 9.2.0460: did_set_shellpipe_redir() in wrong file
  * 9.2.0459: tests: test_termcodes fails (after v9.2.0456)
  * 9.2.0458: Crash with invalid shellredir/shellpipe value
  * 9.2.0457: Compile warning about unused variable
  * 9.2.0456: stray p character displayed on some terms
  * 9.2.0455: 'findfunc' only allows extra info for cmdline completion
  * 9.2.0454: tests: no test that "abbr" in customlist completion is shown
  * 9.2.0453: vertical separator of statusline blend into active statusline
  * 9.2.0452: screen.c popup opacity blend logic is duplicated
  * 9.2.0451: 'findfunc' can't return extra info for cmdline completion
  * 9.2.0450: [security]: heap buffer overflow in spellfile.c read_compound()
  * 9.2.0449: Make proto fails in non GTK builds
  * 9.2.0448: Vim9: dangling cmdline pointer after skip_expr_cctx()
  * 9.2.0447: cindent does not ignore comments
  * 9.2.0446: runtime(netrw): off-by-one bug in s:NetrwUnMarkFile()
  * 9.2.0445: win_fix_scroll() called before win_comp_pos() in command_height()
  * 9.2.0444: Cannot set 'path' option via modeline
  * 9.2.0443: GUI: cancelling save dialog overwrites or discards unnamed buffer
  * 9.2.0442: completion: i_CTRL-X_CTRL-V doesn't use dict from customlist
  * 9.2.0441: statusline: click handler not called on multi-line statusline
  * 9.2.0440: MS-Windows: cursor flicker during update_screen()
  * 9.2.0439: completion: info popup not removed in cmdline mode
  * 9.2.0438: tests: test_plugin_termdebug is flaky
  * 9.2.0437: MS-Windows: cursor flicker in vtp mode
  * 9.2.0436: Buffer overflow when parsing overlong errorformat lines
  * 9.2.0435: [security]: backticks in 'path' may cause shell execution on completion
  * 9.2.0434: cscope: filename interpreted by /bin/sh
  * 9.2.0433: customlist completion cannot supply pum metadata
  * 9.2.0432: blob to string conversion can be improved
  * 9.2.0431: blob encoding can be improved
  * 9.2.0430: tests: Test_shortmess_F3() is flaky on MS-Windows
  * 9.2.0429: tests: flaky screendump Test_smoothscroll_incsearch()
  * 9.2.0428: popup: no opacity support for completepopup/previewpopup
  * 9.2.0427: popup: opacity blend may leaks white bg color
  * 9.2.0426: tests: still some flaky screendump tests
  * 9.2.0425: Cannot silence undo/redo messages
  * 9.2.0424: popup: flicker when wildtrigger() refreshes the popup menu
  * 9.2.0423: popup: wrapped cmdline truncated with wildoptions=pum
  * 9.2.0422: popup: leave stray char when scrollbar changes
  * 9.2.0421: vimball: can smuggle Vimscript into VimballRecord file
  * 9.2.0420: channel: cannot handle binary data via channel callbacks
  * 9.2.0419: popup: rendering issues
  * 9.2.0418: wildcards in expanded env vars reinterpreted by glob
  * 9.2.0417: completion: no support for "noinsert" with 'wildmode'
  * 9.2.0416: Unix: filename completion splits at space for single-file Ex commands
  * 9.2.0415: Wrong behavior when executing register that ends in Insert mode
  * 9.2.0414: Flicker when drawing window separator and pum is shown
  * 9.2.0413: Scrolling wrong with 'splitkeep' when changing 'cmdheight'
  * 9.2.0412: channel: term_start() out_cb/err_cb no longer deliver raw chunks
  * 9.2.0411: tabpanel: no Vim script functions for the tabpanel
  * 9.2.0410: test suite races when run with parallel make
  * 9.2.0409: memory leaks in copy_substring_from_pos()
  * 9.2.0408: Insert-mode <Cmd> edits can corrupt undo
  * 9.2.0407: tabpanel: A few issues with the tabpanel
  * 9.2.0406: VisualNOS not used when Wayland selection ownership lost
  * 9.2.0405: when jumping to tags, will open URLs
  * 9.2.0404: redraw_listener_add() does not check secure flag
  * 9.2.0403: Vim9: def function sandbox bypass
  * 9.2.0402: pum: opacity not applied to wildmenu pum
  * 9.2.0401: tests: still a few flaky tests
  * 9.2.0400: sandbox callbacks selected through 'complete'
  * 9.2.0399: MS-Windows: compile warning in strptime.c

- Update to version 0.6.79
  - Fix an indirect remote shell command injection via unsanitized
    dhcp strings and leaseinfo dump (bsc#1265221,CVE-2026-44932):
  - Fix to escape single-quotes in leaseinfo dump output used by the
    `wicked test dhcp4` and `wicked test dhcp6` and written to the
    /run/wicked/leaseinfo.* files, e.g. to pass them to netconfig.
    A netconfig modify filtered for strict key='value' lines without
    any escaped quotes and discarded these lines already before.
  - Fix posix-tz-dbname and tz-string option processing checks to
    permit only valid characters according to RFC4833.
  - Discard string values containing single-quotes in other options.
  - Trigger to regenerate initrd that may contain wicked binaries on
    updates from wicked versions <= 0.6.78.

- bsc#1266952 - VUL-0: CVE-2026-42487: xen: x86 HVM I/O port list
  traversal (XSA-491)
  xsa491.patch
- bsc#1266953 - VUL-0: CVE-2026-42489,CVE-2026-42490: xen: domctl
  lock open to abuse (XSA-492)
  xsa492-01.patch
  xsa492-02.patch
  xsa492-03.patch
  xsa492-04.patch
  xsa492-05.patch
  xsa492-06.patch
  xsa492-07.patch
  xsa492-08.patch
  xsa492-09.patch
  xsa492-10.patch
  xsa492-11.patch
  xsa492-12.patch
  xsa492-13.patch
  xsa492-14.patch
  xsa492-15.patch
  xsa492-16.patch
  xsa492-17.patch
  xsa492-18.patch
- bsc#1266955 - VUL-0: CVE-2026-42488: xen: x86: mismatched
  mapcache metadata (XSA-494)
  xsa494.patch

- Transactional systems: Delegate rw-commands to
  transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)
  On a transactional system where the root filesystem is mounted
  read-only, zypper commands that modify the system cannot be
  executed directly.
  If the system provides a transactional-wrapper utility, zypper
  will automatically attempt to invoke it. The wrapper
  transparently executes the zypper command within a new, writable
  snapshot and manages the lifecycle of that snapshot based on the
  command's exit status.
  On transactional systems lacking a transactional-wrapper, users
  must manually invoke specialized tools -such as
  transactional-update- to install, update, or remove software.
- version 1.14.98

- Add --filter-version-change to zypper lu.
  Adds filtering by version change significance to reduce noise in
  update listings. Supports levels: rebuild (hides rebuild-only
  changes) and package (hides all release-only changes).
- version 1.14.97

- Autorefresh ris-services the way as plugin-services (bsc#1246504)
  It's actually wrong to treat service refreshes different
  depending on the service type. For the purpose of a service it
  makes no difference how the data about the repos to use are
  acquired.
- version 1.14.96

- Report download progress for command line rpms (fixes #613)
- Hint to '-vv ref' to see the mirrors used to download the
  metadata (bsc#1257882)
- Service: Allow "zypper ls SERVICE ..." to test whether a
  service with this alias is defined (bsc#1252744)
  The command prints an abstract of all services passed on the
  command line. It returns 3-ZYPPER_EXIT_ERR_INVALID_ARGS if some
  argument does not name an existing service.
- Keep repo data when updating the service settings (bsc#1252744)
- info: Enhance pattern content table (bsc#1158038)
  Alternatives (multiple packages providing the same requirement)
  are now listed as a single entry in the content table. The entry
  shows either the installed package which satisfies the
  requirement or the requirement itself as type 'Provides'.
  Listing all potential alternatives was miss leading, especially
  if the alternatives were mutual exclusive. It looked like an
  installed pattern had not-installed requirements and it was not
  possible to install all requirements at the same time.
- version 1.14.95