- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb;
- add add-samba-bgqd.diff: add profile for samba-bgqd;
- Fix handling of add-on signature settings, introduced when fixing
  bsc#1192437 (bsc#1194881).
- 4.3.96
- Properly merge the autoupgrade workflow when using the online
  medium (bsc#1192437, bsc#1194440).
- 4.3.95
- Update to version 2.26
  * On s390/x and PPC64 gcc misses unused arg0
- Remove patch fcb9e0c2.patch as now part of tar ball
- Add upstream patch fcb9e0c2.patch
  * On s390/x and PPC64 gcc misses unused arg0
- Update to version 2.24
  * Avoid install errror due missed directory
- Update to version 2.22
  * Avoid KillMode=none for newer systemd version as well as rework
    the systemd unit files of blog (boo#1186506)
- Move to /usr for UsrMerge (boo#1191057)
- Update to version 2.21
  * Merge pull request #4 from samueldr/fix/makefile
    Fixup Makefile for better build system support
  * Silent new gcc compiler
- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies
- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch
- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.
- coreutils-df-fuse-portal-dummy.patch:
  df: Add "/fuse.portal"/ as a dummy file system (used in flatpak
  implementations). (bsc#1189152)
- CVE-2022-24407: cyrus-sasl: SQL injection in sql_auxprop_store
  in plugins/sql.c (bsc#1196036)
  o add upstream patch:
- postfix: sasl authentication with password fails (bsc#1194265)
  Add config parameter --with-dblib=gdbm
- Avoid converting of /etc/sasldb2 by every update. Convert
  /etc/sasldb2 only if it is a Berkeley DB
- CVE-2022-24407: cyrus-sasl: SQL injection in sql_auxprop_store
  in plugins/sql.c (bsc#1196036)
  o add upstream patch:
- postfix: sasl authentication with password fails (bsc#1194265)
  Add config parameter --with-dblib=gdbm
- Update to Docker 20.10.12-ce. See upstream changelog online at
- Remove It hasn't been maintained since 2017, and all of the
  changelogs are currently only available online.
- Update to Docker 20.10.11-ce. See upstream changelog online at
  <>. bsc#1192814
  bsc#1193273 CVE-2021-41190
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
- Remove upstreamed patches:
  - 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Update to Docker 20.10.9-ce. See upstream changelog online at
  <>. bsc#1191355
  CVE-2021-41089 bsc#1191015 CVE-2021-41091 bsc#1191434
  CVE-2021-41092 bsc#1191334 CVE-2021-41103 bsc#1191121
- Update to Docker 20.10.6-ce. See upstream changelog online at
  <>. bsc#1184768
- Update to Docker 20.10.5-ce. See upstream changelog online at
  <>. bsc#1182947
- Update to version 049.1+suse.228.g07676562:
  * fix(network): consistent use of "/$gw"/ for gateway (bsc#1192685)
  * fix(install): handle builtin modules (bsc#1194716)
- Security fixes:
  * (CVE-2022-25236, bsc#1196025) Expat before 2.4.5 allows
    attackers to insert namespace-separator characters into
    namespace URIs
  - Added expat-CVE-2022-25236.patch
  * (CVE-2022-25235, bsc#1196026) xmltok_impl.c in Expat before
    2.4.5 does not check whether a UTF-8 character is valid in a
    certain context.
  - Added expat-CVE-2022-25235.patch
  * (CVE-2022-25313, bsc#1196168) Stack exhaustion in
    build_model() via uncontrolled recursion
  - Added expat-CVE-2022-25313.patch
  - The fix upstream introduced a regression that was later
    amended in 2.4.6 version
    + Added expat-CVE-2022-25313-fix-regression.patch
  * (CVE-2022-25314, bsc#1196169) Integer overflow in copyString
  - Added expat-CVE-2022-25314.patch
  * (CVE-2022-25315, bsc#1196171) Integer overflow in storeRawNames
  - Added expat-CVE-2022-25315.patch
- Security fix (CVE-2022-23852, bsc#1195054)
  * Expat (aka libexpat) before 2.4.4 has a signed integer overflow
    in XML_GetBuffer, for configurations with a nonzero
  * Add tests for CVE-2022-23852.
  * Added expat-CVE-2022-23852.patch
- Security fix (CVE-2022-23990, bsc#1195217)
  * Fix unsigned integer overflow in function doProlog triggered
    by large content in element type declarations when there is
    an element declaration handler present (from a prior call to
  * Add expat-CVE-2022-23990.patch
  * Added expat-CVE-2022-22827.patch
- getcwd-erange.patch: getcwd: Set errno to ERANGE for size == 1
  (CVE-2021-3999, bsc#1194640, BZ #28769)
- 0001-powerpc-Optimized-strcpy-for-POWER9.patch,
  0015-powerpc-Add-optimized-rawmemchr-for-POWER10.patch: ppc64le ifunc
  improvements (bsc#1194785, jsc#SLE-18195)
- clnt-create-unix-overflow.patch: Buffer overflow in sunrpc clnt_create
  for "/unix"/ (CVE-2022-23219, bsc#1194768, BZ #22542)
- svcunix-create-overflow.patch: Buffer overflow in sunrpc svcunix_create
  (CVE-2022-23218, bsc#1194770, BZ #28768)
- Add support for livepatches (jsc#SLE-20049).
- Enable livepatching on x86_64.
- Generate ipa-clones tarball artifact when livepatching is enabled.
- Security fix: [bsc#1196167, CVE-2021-4209]
  * Null pointer dereference in MD_UPDATE
  * Add gnutls-CVE-2021-4209.patch
- Fix wrong default entry when booting snapshot (bsc#1159205)
  * grub2-btrfs-08-workaround-snapshot-menu-default-entry.patch
- Improve support for SLE Micro 5.1 on s390x.  (bsc#1190395)
  * grub2-s390x-04-grub2-install.patch
- Patch refreshed
  * grub2-s390x-11-secureboot.patch
- powerpc/perf: Fix power_pmu_disable to call
  clear_pmi_irq_pending only if PMI is pending (bsc#1156395).
- commit a08ca77
- RDMA/uverbs: Fix a NULL vs IS_ERR() bug (git-fixes)
- commit 82ce09e
- RDMA/mlx5: Fix query DCT via DEVX (git-fixes)
- commit 4b56cb2
- RDMA/core: Don't access cm_id after its destruction (git-fixes)
- commit 4a117e6
- RDMA/mlx5: Recover from fatal event in dual port mode (git-fixes)
- commit 875e0ed
- RDMA/rxe: Clear all QP fields if creation failed (git-fixes)
- commit 07c8b4d
- RDMA/siw: Properly check send and receive CQ pointers (git-fixes)
- commit d84b45b
- RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res (git-fixes)
- commit 8c226d5
- RDMA/siw: Fix a use after free in siw_alloc_mr (git-fixes)
- commit a7eff62
- RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails (git-fixes)
- commit 2db1c84
- RDMA/cxgb4: add missing qpid increment (git-fixes)
- commit 591cdce
- RDMA/core: Unify RoCE check and re-factor code (git-fixes)
- commit e5e3d6f
- RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() (git-fixes)
- commit 76267d4
- IB/hfi1: Fix error return code in parse_platform_config() (git-fixes)
- commit 270bb46
- IB/hfi1: Use kzalloc() for mmu_rb_handler allocation (git-fixes)
- commit 05c0e16
- RDMA/core: Fix corrupted SL on passive side (git-fixes)
- commit d86d9cb
- IB/isert: Fix a use after free in isert_connect_request (git-fixes)
- commit fa7abfc
- RDMA/addr: Be strict with gid size (git-fixes)
- commit 0b96850
- RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server (git-fixes)
- commit 0f86491
- IB/mlx5: Add missing error code (git-fixes)
- commit 06919f0
- RDMA/rxe: Fix missing kconfig dependency on CRYPTO (git-fixes)
- commit 1cb9b27
- RDMA/siw: Fix calculation of tx_valid_cpus size (git-fixes)
- commit 35656e8
- RDMA/rxe: Correct skb on loopback path (git-fixes)
- commit 328cd44
- RDMA/rxe: Fix coding error in rxe_rcv_mcast_pkt (git-fixes)
- commit ad066a1
- RDMA/rxe: Remove useless code in rxe_recv.c (git-fixes)
- commit 6a7743e
- RDMA/rxe: Fix coding error in rxe_recv.c (git-fixes)
- commit 671cb83
- IB/cm: Avoid a loop when device has 255 ports (git-fixes)
- commit 2186e0a
- IB/mlx5: Return appropriate error code instead of ENOMEM (git-fixes)
- commit ba2e4e5
- IB/umad: Return EPOLLERR in case of when device disassociated (git-fixes)
- commit 0fc8532
- IB/umad: Return EIO in case of when device disassociated (git-fixes)
- commit 1beb1a9
- IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex (git-fixes)
- commit b747600
- RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation (git-fixes)
- commit d209b75
- RDMA/siw: Fix handling of zero-sized Read and Receive Queues. (git-fixes)
- commit 1bcb139
- RDMA/cxgb4: Fix the reported max_recv_sge value (git-fixes)
- commit 000358b
- RDMA/mlx5: Fix wrong free of blue flame register on error (git-fixes)
- commit a95b8b5
- IB/mlx5: Fix error unwinding when set_has_smi_cap fails (git-fixes)
- commit c125ce0
- RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() (git-fixes)
- commit 717d46c
- RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp (git-fixes)
- commit e2b003d
- Input: wm97xx: Simplify resource management (git-fixes).
- ASoC: fsl: Add missing error handling in pcm030_fabric_probe
- ASoC: max9759: fix underflow in speaker_gain_control_put()
- ASoC: cpcap: Check for NULL pointer after calling
  of_get_child_by_name (git-fixes).
- ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple
  of period bytes (git-fixes).
- ALSA: usb-audio: Correct quirk for VF0770 (git-fixes).
- ALSA: usb-audio: initialize variables that could ignore errors
- drm/i915/overlay: Prevent divide by zero bugs in scaling
- dma-buf: heaps: Fix potential spectre v1 gadget (git-fixes).
- drm/nouveau: fix off by one in BIOS boundary checking
- pinctrl: intel: Fix a glitch when updating IRQ flags on a
  preconfigured line (git-fixes).
- pinctrl: intel: fix unexpected interrupt (git-fixes).
- commit 78392e2
- nvme: fix use after free when disconnecting a reconnecting ctrl
- commit 6b18639
- nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t() (git-fixes).
- nvme-tcp: fix data digest pointer calculation (git-fixes).
- nvme-tcp: fix incorrect h2cdata pdu offset accounting
- commit 64fba5e
- nvme-tcp: fix possible use-after-completion (git-fixes).
- commit 656adbf
- nvme-fabrics: avoid double completions in
  nvmf_fail_nonready_command (git-fixes).
- nvme: introduce a nvme_host_path_error helper (git-fixes).
- blk-mq: introduce blk_mq_set_request_complete (git-fixes).
- nvme: refactor ns->ctrl by request (git-fixes).
- nvme-core: use list_add_tail_rcu instead of list_add_tail for
  nvme_init_ns_head (git-fixes).
- commit 35ee4c2
- Refresh patches.suse/NFS-don-t-store-struct-cred-in-struct-nfs_access_ent.patch.
  Update upstream info
- commit 7228799
- NFSv4: nfs_atomic_open() can race when looking up a non-regular
  file (git-fixes).
- NFSv4: Handle case where the lookup of a directory fails
- NFS: Ensure the server has an up to date ctime before renaming
- commit 1b23644
- blk-cgroup: fix missing put device in error path from
  blkg_conf_pref() (bsc#1195481).
- commit 1d9f7ed
- ext4: fix an use-after-free issue about data=journal writeback
  mode (bsc#1195482).
- commit dec4e3b
- ext4: make sure quota gets properly shutdown on error
- commit 37600f0
- blacklist.conf: blacklist 4013d47a5307
- commit 3d0f1d1
- fsnotify: fix fsnotify hooks in pseudo filesystems
- commit 3ed7ace
- fsnotify: invalidate dcache before IN_DELETE event
- commit 776f92d
- udf: Restore i_lenAlloc when inode expansion fails
- commit fa5618c
- udf: Fix NULL ptr deref when converting from inline format
- commit 26d7db1
- blacklist.conf: Blacklist ee12595147ac
- commit 1e354ac
- USB: serial: mos7840: fix probe error handling (git-fixes).
- commit 3875819
- xhci-pci: Allow host runtime PM as default for Intel Alpine
  Ridge LP (git-fixes).
- commit 7bdac2d
- Update patch reference for radeon regression fix (bsc#1195142)
- commit 3e139f1
- spi: mediatek: Avoid NULL pointer crash in interrupt
- spi: bcm-qspi: check for valid cs before applying chip select
- spi: meson-spicc: add IRQ check in meson_spicc_probe
- tty: Add support for Brainboxes UC cards (git-fixes).
- USB: core: Fix hang in usb_kill_urb by adding memory barriers
- usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
- PM: wakeup: simplify the output logic of pm_show_wakelocks()
- drm/msm/dsi: Fix missing put_device() call in dsi_get_phy
- rpmsg: char: Fix race between the release of rpmsg_eptdev and
  cdev (git-fixes).
- rpmsg: char: Fix race between the release of rpmsg_ctrldev
  and cdev (git-fixes).
- Bluetooth: refactor malicious adv data check (git-fixes).
- commit 0420ac4
- Update
  (bsc#1176447 bsc#1195371 CVE-2022-0286).
  Added CVE reference.
- commit e1eaedd
- net: bridge: vlan: fix memory leak in __allowed_ingress
- net: bridge: vlan: fix single net device option dumping
- net: sfp: fix high power modules without diagnostic monitoring
- net: bonding: fix bond_xmit_broadcast return value error bug
- RDMA/rxe: Remove the unnecessary variable (jsc#SLE-15176).
- Revert "/net/mlx5e: Block offload of outer header csum for GRE
  tunnel"/ (git-fixes).
- Revert "/net/mlx5e: Block offload of outer header csum for UDP
  tunnels"/ (git-fixes).
- igc: Fix TX timestamp support for non-MSI-X platforms
- net/mlx5: E-Switch, fix changing vf VLANID (jsc#SLE-15172).
- RDMA/core: Clean up cq pool mechanism (jsc#SLE-15176).
- net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW
  steering (jsc#SLE-8464).
- vxlan: fix error return code in __vxlan_dev_create()
- netdevsim: set .owner to THIS_MODULE (bsc#1154353).
- net/mlx5e: Protect encap route dev from concurrent release
- mlxsw: Only advertise link modes supported by both driver and
  device (bsc#1154488).
- commit 8d79e55
- Refresh patches.suse/ALSA-pcm-oss-Place-the-plugin-buffer-overflow-checks.patch.
  Remove duplicated tag.
- commit 6c506e7
- scripts/dtc: only append to HOST_EXTRACFLAGS instead of
  overwriting (git-fixes).
- commit 644966c
- drm/etnaviv: relax submit size limits (git-fixes).
- commit de0ae66
- usb: common: ulpi: Fix crash in ulpi_match() (git-fixes).
- usb: gadget: f_sourcesink: Fix isoc transfer for
  USB_SPEED_SUPER_PLUS (git-fixes).
- usb: typec: tcpm: Do not disconnect while receiving VBUS off
- usb: roles: fix include/linux/usb/role.h compile issue
- phylib: fix potential use-after-free (git-fixes).
- x86/gpu: Reserve stolen memory for first integrated Intel GPU
- PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA
  controller (git-fixes).
- phy: uniphier-usb3ss: fix unintended writing zeros to PHY
  register (git-fixes).
- usb: hub: Add delay for SuperSpeed hub resume to let links
  transit to U0 (git-fixes).
- usb: uhci: add aspeed ast2600 uhci support (git-fixes).
- usb: gadget: f_fs: Use stream_open() for endpoint files
- serial: core: Keep mctrl register state and cached copy in sync
- serial: pl010: Drop CR register reset on set_termios
- serial: Fix incorrect rs485 polarity on uart open (git-fixes).
- serial: amba-pl011: do not request memory region twice
- mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO
- regulator: qcom_smd: Align probe function with rpmh-regulator
- mtd: rawnand: gpmi: Add ERR007117 protection for
  nfc_apply_timings (git-fixes).
- mtd: rawnand: gpmi: Remove explicit default gpmi clock setting
  for i.MX6 (git-fixes).
- rsi: Fix use-after-free in rsi_rx_done_handler() (git-fixes).
- media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes
- mtd: nand: bbt: Fix corner case in bad block table handling
- commit ceccaf4
- lib82596: Fix IRQ check in sni_82596_probe (git-fixes).
- i2c: designware-pci: Fix to change data types of hcnt and lcnt
  parameters (git-fixes).
- i2c: mpc: Correct I2C reset procedure (git-fixes).
- i2c: i801: Don't silently correct invalid transfer size
- gpiolib: acpi: Do not set the IRQ type if the IRQ is already
  in use (git-fixes).
- HID: apple: Do not reset quirks when the Fn key is not found
- HID: quirks: Allow inverting the absolute X/Y values
- mac80211: allow non-standard VHT MCS-10/11 (git-fixes).
- iwlwifi: mvm: Fix calculation of frame length (git-fixes).
- iwlwifi: remove module loading failure message (git-fixes).
- iwlwifi: fix leaks/bad data after failed firmware load
- iwlwifi: mvm: Increase the scan timeout guard to 30 seconds
- iwlwifi: mvm: synchronize with FW after multicast commands
- media: saa7146: hexium_gemini: Fix a NULL pointer dereference
  in hexium_attach() (git-fixes).
- media: igorplugusb: receiver overflow should be reported
- media: m920x: don't use stack on USB reads (git-fixes).
- media: saa7146: hexium_orion: Fix a NULL pointer dereference
  in hexium_attach() (git-fixes).
- media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds
- media: b2c2: Add missing check in flexcop_pci_isr: (git-fixes).
- commit a86fa77
- floppy: Add max size check for user space request (git-fixes).
- gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock
- Bluetooth: Fix debugfs entry leak in hci_register_dev()
- drm/amdgpu: fixup bad vram size on gmc v8 (git-fixes).
- drm/etnaviv: limit submit sizes (git-fixes).
- drm/bridge: megachips: Ensure both bridges are probed before
  registration (git-fixes).
- drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga
  Book X91F/L (git-fixes).
- drm/nouveau/kms/nv04: use vzalloc for nv04_display (git-fixes).
- drm/nouveau/pmu/gm200-: avoid touching PMU outside of
  DEVINIT/PREOS/ACR (git-fixes).
- drm/lima: fix warning when CONFIG_DEBUG_SG=y &
  CONFIG_DMA_API_DEBUG=y (git-fixes).
- commit d637736
- ASoC: mediatek: mt8173: fix device_node leak (git-fixes).
- ALSA: seq: Set upper limit of processed events (git-fixes).
- ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5
- ACPICA: Fix wrong interpretation of PCC address (git-fixes).
- ACPICA: Executer: Fix the REFCLASS_REFOF case in
  acpi_ex_opcode_1A_0T_1R() (git-fixes).
- ACPICA: Utilities: Avoid deleting the same object twice in a
  row (git-fixes).
- batman-adv: allow netlink usage in unprivileged containers
- ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
- ath10k: Fix tx hanging (git-fixes).
- ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START
  reply (git-fixes).
- commit b090e4d
- hwmon: (lm90) Mark alert as broken for MAX6646/6647/6649
- hwmon: (lm90) Mark alert as broken for MAX6680 (git-fixes).
- hwmon: (lm90) Mark alert as broken for MAX6654 (git-fixes).
- hwmon: (lm90) Reduce maximum conversion rate for G781
- drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
- drm/msm: Fix wrong size calculation (git-fixes).
- drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
- ACPI: battery: Add the ThinkPad "/Not Charging"/ quirk
- ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions
- hwmom: (lm90) Fix citical alarm status for MAX6680/MAX6681
- commit e06c812
- serial: stm32: fix software flow control transfer (git-fixes).
- tty: n_gsm: fix SW flow control encoding/handling (git-fixes).
- serial: 8250: of: Fix mapped region size when using reg-offset
  property (git-fixes).
- ucsi_ccg: Check DEV_INT bit only when starting CCG4 (git-fixes).
- ata: pata_platform: Fix a NULL pointer dereference in
  __pata_platform_probe() (git-fixes).
- drm/msm/hdmi: Fix missing put_device() call in msm_hdmi_get_phy
- pinctrl: bcm2835: Add support for wake-up interrupts
- pinctrl: bcm2835: Match BCM7211 compatible string (git-fixes).
- commit 34e1762
- Update patch reference for vgacon patch (CVE-2020-28097 bsc#1187723 jsc#SLE-23485)
- commit 589ca07
- video: hyperv_fb: Fix validation of screen resolution
- commit c92ca58
- net: tipc: validate domain record count on input (bsc#1195254).
- commit 5e4e31e
- blacklist.conf: Add e1fbbd073137 prctl: allow to setup brk for et_dyn executables
- commit d38c68f
- ibmvnic: remove unused defines (bsc#1195293 ltc#196198).
- ibmvnic: Update driver return codes (bsc#1195293 ltc#196198).
- commit 2e27858
- RDMA/hns: Remove unnecessary access right set during INIT2INIT (git-fixes)
- commit 4f52905
- RDMA/core: Do not indicate device ready when device enablement fails (git-fixes)
- commit 8c078d4
- RDMA/uverbs: Tidy input validation of ib_uverbs_rereg_mr() (git-fixes)
- commit b76b1bf
- RDMA/hns: Remove the portn field in UD SQ WQE (git-fixes)
- commit 6b9c3b4
- RDMA/cxgb4: Validate the number of CQEs (git-fixes)
- commit 2d78782
- RDMA/mlx5: Fix corruption of reg_pages in mlx5_ib_rereg_user_mr() (git-fixes)
- commit 555e8b8
- RDMA/rxe: Compute PSN windows correctly (git-fixes)
- commit 6546545
- RDMA/bnxt_re: Set queue pair state when being queried (git-fixes)
- commit 68f6d87
- RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait (git-fixes)
- commit 64a081e
- RDMA/i40iw: Address an mmap handler exploit in i40iw (git-fixes)
- commit 1f8fac6
- RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs (git-fixes)
- commit 09fe3b5
- RDMA/mlx5: Fix type warning of sizeof in __mlx5_ib_alloc_counters() (git-fixes)
- commit e969537
- i40iw: Add support to make destroy QP synchronous (git-fixes)
- commit 1d9fde7
- RDMA/mlx5: Issue FW command to destroy SRQ on reentry (git-fixes)
- commit 7b4149b
- RDMA/mlx5: Fix potential race between destroy and CQE poll (git-fixes)
- commit a2e5b72
- RDMA/hns: Add a check for current state before modifying QP (git-fixes)
- commit 8117a96
- IB/mlx4: Separate tunnel and wire bufs parameters (git-fixes)
- commit 780f173
- update
- commit 8000467
- phonet: refcount leak in pep_sock_accep (bsc#1193867,
- commit 98c27cb
- xfrm: fix MTU regression (bsc#1185377, bsc#1194048).
- Delete
  which caused a regression (bsc#1194048).
- fix patches.kabi/revert-xfrm-xfrm_state_mtu-should-return-at-least-1280.patch
  fixes the resulting KABI change
- Replace with an alternative fix for bsc#1185377
- commit ccdfbb9
- Refresh
- Refresh patches.suse/ibmvnic-don-t-spin-in-tasklet.patch.
- Refresh patches.suse/ibmvnic-init-running_cap_crqs-early.patch.
- Refresh
- commit 6439146
- ext4: set csum seed in tmp inode while migrating to extents
- commit 22e9600
- drm/vmwgfx: Fix stale file descriptors on failed usercopy
  (CVE-2022-22942 bsc#1195065).
- commit b93c2a4
- nvme: add 'iopolicy' module parameter (bsc#1177599 bsc#1193096).
- commit 552f664
- bpf: Verifer, adjust_scalar_min_max_vals to always call
  update_reg_bounds() (bsc#1194227).
- commit bf95985
- net/packet: rx_owner_map depends on pg_vec (bsc#1195184
- commit ef975a8
- powerpc/book3s64/radix: make tlb_single_page_flush_ceiling a
  debugfs entry (bsc#1195183 ltc#193865).
- commit a3b42d2
- scsi: ufs: Correct the LUN used in eh_device_reset_handler()
  callback (bsc#1193864 CVE-2021-39657).
- commit 74b4241
- lightnvm: Remove lightnvm implemenation (bsc#1191881).
- commit e978276
- supported.conf: mark rtw88 modules as supported (jsc#SLE-22690)
- commit 0d3c7d0
- Update
  (bsc#1193861 CVE-2021-39648).
  updated references for a CVE that became known after the fix
  had been applied for other reasons
- commit f7fa182
- Update
  (bsc#1193802 CVE-2021-39685).
  Updated references to a CVE that became known after the fix had
  been applied for other reasons
- commit eeaa33a
- crypto: qat - fix undetected PFVF timeout in ACK loop
- commit 3cc9984
- asix: fix wrong return value in asix_check_host_enable()
- commit 9e94c23
- net: mana: Add RX fencing (bsc#1193506).
- commit aa896c0
- net: mana: Add XDP support (bsc#1193506).
- commit d5e53a9
- hv_netvsc: Set needed_headroom according to VF (bsc#1193506).
- commit f4f411e
- net, xdp: Introduce xdp_prepare_buff utility routine
- commit aca9d96
- net, xdp: Introduce xdp_init_buff utility routine (bsc#1193506).
- commit 9770783
- ibmvnic: remove unused ->wait_capability (bsc#1195073
- ibmvnic: don't spin in tasklet (bsc#1195073 ltc#195713).
- ibmvnic: init ->running_cap_crqs early (bsc#1195073 ltc#195713).
- ibmvnic: Allow extra failures before disabling (bsc#1195073
- commit e820667
- sched/fair: Fix detection of per-CPU kthreads waking a task
  (git fixes (sched/fair)).
- sched/numa: Fix is_core_idle() (git fixes (sched/numa)).
- commit 8f3f43a
- blacklist.conf: !SMP configs are not supported
- commit c80ad41
- scripts/dtc: dtx_diff: remove broken example from help text
- Documentation: fix firewire.rst ABI file path error (git-fixes).
- HID: wacom: Reset expected and received contact counts at the
  same time (git-fixes).
- HID: uhid: Fix worker destroying device without any protection
- drm/radeon: fix error handling in radeon_driver_open_kms
- clk: si5341: Fix clock HW provider cleanup (git-fixes).
- vfio/iommu_type1: replace kfree with kvfree (git-fixes).
- nfc: llcp: fix NULL error pointer dereference on sendmsg()
  after failed bind() (git-fixes).
- commit 8163787
- btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being  set improperly (bsc#1195009).
- commit dad9348
- btrfs: tree-checker: annotate all error branches as unlikely (bsc#1195009).
- commit f9364fe
- btrfs: tree-checker: Add EXTENT_ITEM and METADATA_ITEM check (bsc#1195009).
- commit 58912c3
- blacklist.conf: test_stackinit module is not built
- commit 79fa675
- blacklist.conf: bug: clean up; compiler likely does the same optimization
- commit 0f2e872
- workqueue: Fix unbind_workers() VS wq_worker_running() race
- commit 4a6e4c5
- drm/i915: Flush TLBs before releasing backing store
  (CVE-2022-0330 bsc#1194880).
- commit 9eddfd3
- drm/i915: Flush TLBs before releasing backing store
  (CVE-2022-0330 bsc#1194880).
- commit 34a8919
- kabi/severities: Add a kabi exception for drivers/tee/tee
  According to the partner modules database, the structs of this driver
  are not used by anything external so make a kABI exception for them.
  Do that on purpose so that any external module using this fails to load
  instead of causing a potential memory corruption due to a kabi
  workaround which would use the same offset but for a different thing:
  - struct dma_buf *dmabuf;
  +	refcount_t refcount;
  See upstream commit
  dfd0743f1d9e ("/tee: handle lookup of shm with reference count 0"/)
- commit c1b7aec
- Update config files.
- commit eae3c71
- net: allow retransmitting a TCP packet if original is still
  in queue (bsc#1188605 bsc#1187428).
- commit 372a9a4
- tee: handle lookup of shm with reference count 0 (bsc#1193767
- commit be75d82
- nvme-fabrics: ignore invalid fast_io_fail_tmo values
- nvme-tcp: fix memory leak when freeing a queue (git-fixes).
- nvme-multipath: fix ANA state updates when a namespace is not
  present (git-fixes).
- nvme-fabrics: remove superfluous nvmf_host_put in
  nvmf_parse_options (git-fixes).
- commit 51e4a5d
- arm64: Kconfig: add a choice for endianness (jsc#SLE-23432).
- commit 51a5c79
- tee: don't assign shm id for private shms (bsc#1193767
- commit 9ab9ee2
- tee: remove linked list of struct tee_shm (bsc#1193767
- commit a3c7739
- cgroup/cpuset: Fix a partition bug with hotplug (bsc#1194291).
- commit 9a89323
- blacklist.conf: Add 7ee285395b21 cgroup: Make rebind_subsystems() disable v2 controllers all at once
- commit 11abfa4
- blacklist.conf: Add 6ba34d3c7367 cgroup/cpuset: Fix violation of cpuset locking rule
- commit a116f42
- Revert "/net: sched: disable TCQ_F_NOLOCK for pfifo_fast (bsc#1183405)"/
  This reverts commit 3aa0c01fad38360cc9cd840d49bdfdc565e2e718.
  With the backport of the upstream fix for bsc#1183405 race, this workaround
  is no longer needed.
- commit 282cec9
- net: sched: add barrier to ensure correct ordering for lockless
  qdisc (bsc#1183405).
- net: sched: avoid unnecessary seqcount operation for lockless
  qdisc (bsc#1183405).
- net: sched: fix tx action reschedule issue with stopped queue
- net: sched: fix tx action rescheduling issue during deactivation
- net: sched: fix packet stuck problem for lockless qdisc
- net: sched: replaced invalid qdisc tree flush helper in
  qdisc_replace (bsc#1183405).
- net: sch_generic: aviod concurrent reset and enqueue op for
  lockless qdisc (bsc#1183405).
- commit 60ecee5
- Update to 1.19.2; (jsc#SLE-23329);
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "/password"/ and "/verify"/
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages.
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "/service@"/ as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with "/.rcache2"/
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "/enforce_ok_as_delegate"/ krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("/draft 9"/) variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "/dns_canonicalize_hostname=fallback"/, causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "/qualify_shortname"/ krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "/addprinc -randkey -kvno"/ from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "/kdb5_util dump"/ will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust.
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =>
- Modify packaging to allow parallel installation with libldb1
  + Private libraries are installed in %{_libdir}/ldb2/
  + Modules are installed in %{_libdir}/ldb2/modules
- Update to version 2.4.1; (jsc#SLE-23329);
  - Release 2.4.1
    + Corrected python behaviour for 'in' for LDAP attributes
    contained as part of ldb.Message; (bso#14845);
    + Fix memory handling in ldb.msg_diff; (bso#14836);
    + Corrected python docstrings
  - Release 2.4.0
    + Improve calculate_popt_array_length()
    + Use C99 initializers for builtin_popt_options[]
    + pyldb: Fix Message.items() for a message containing elements
    + pyldb: Add test for Message.items()
    + tests: Use ldbsearch '--scope instead of '-s'
    + pyldb: fix a typo
    + Change page size of guidindexpackv1.ldb
    + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream
    + attrib_handler casefold: simplify space dropping
    + fix ldb_comparison_fold off-by-one overrun
    + CVE-2020-27840: pytests: move Dn.validate test to ldb
    + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode
    + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds
    + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces
    + improve comments for ldb_module_connect_backend()
    + test/ldb_tdb: correct introductory comments
    + ldb.h: remove undefined async_ctx function signatures
    + correct comments in attrib_handers val_to_int64
    + dn tests use cmocka print functions
    + ldb_match: remove redundant check
    + add tests for ldb_wildcard_compare
    + ldb_match: trailing chunk must match end of string
    + pyldb: catch potential overflow error in py_timestring
    + ldb: remove some 'if PY3's in tests
    + Add missing break in switch statement
- Drop obsolete patch CVE-2020-25718-lib-Add-hex_byte-to-replace.h.patch
- Drop obsolete patch ldb-cve-2020-25718.patch
- buildrequire python-rpm-macros
- reenable python bindings at least for the distro default python3
  - adds make-python-build.patch
- Update to release 2.5.3
  * Update the syscall table for Linux v5.15
  * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2
  * Document that seccomp_rule_add() may return -EACCES
- Skip 11-basic-basic_errors test on qemu linux-user emulation
- Update to release 2.5.2
  * Update the syscall table for Linux v5.14-rc7
  * Add a function, get_notify_fd(), to the Python bindings to
    get the nofication file descriptor.
  * Consolidate multiplexed syscall handling for all
    architectures into one location.
  * Add multiplexed syscall support to PPC and MIPS
  * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within
    the kernel. libseccomp's fd notification logic was modified
    to support the kernel's previous and new usage of
- update to 2.5.1:
  * Fix a bug where seccomp_load() could only be called once
  * Change the notification fd handling to only request a notification fd if
  * the filter has a _NOTIFY action
  * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3) manpage
  * Clarify the maintainers' GPG keys
- remove testsuite-riscv64-missing-syscalls.patch
- Do not rely on gperf: pass GPERF=/bin/true to configure and
  remove gperf BuildRequires. The syscalls.perf file it would
  generate is part of the tarball already.
- testsuite-riscv64-missing-syscalls.patch: Fix testsuite failure on
- Ignore failure of tests/52-basic-load on qemu linux-user emulation
- Update to release 2.5.0
  * Add support for the seccomp user notifications, see the
    seccomp_notify_alloc(3), seccomp_notify_receive(3),
    seccomp_notify_respond(3) manpages for more information
  * Add support for new filter optimization approaches, including a balanced
    tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for
    more information
  * Add support for the 64-bit RISC-V architecture
  * Performance improvements when adding new rules to a filter thanks to the
    use of internal shadow transactions and improved syscall lookup tables
  * Properly document the libseccomp API return values and include them in the
    stable API promise
  * Improvements to the s390 and s390x multiplexed syscall handling
  * Multiple fixes and improvements to the libseccomp manpages
  * Moved from manually maintained syscall tables to an automatically generated
    syscall table in CSV format
  * Update the syscall tables to Linux v5.8.0-rc5
  * Python bindings and build now default to Python 3.x
  * Improvements to the tests have boosted code coverage to over 93%
- libseccomp.keyring: replaced by Paul Moore <> key.
- Update to release 2.4.3
  * Add list of authorized release signatures to
  * Fix multiplexing issue with s390/s390x shm* syscalls
  * Remove the static flag from libseccomp tools compilation
  * Add define for __SNR_ppoll
  * Fix potential memory leak identified by clang in the
    scmp_bpf_sim tool
- Drop no-static.diff, libseccomp-fix_aarch64-test.patch,
  SNR_ppoll.patch (merged)
- Add patch to fix ntpsec and others build (accidental drop of symbols):
  * SNR_ppoll.patch
- Tests are passing on all architectures
- Backport patch to fix test on aarch64:
  * libseccomp-fix_aarch64-test.patch
- Update to release 2.4.2
  * Add support for io-uring related system calls
- Public header files on older distros must use c++11
- Fix exception handling when reading or writing credentials
- version 17.29.3 (22)
- Fix Legacy include (bsc#1194597)
- version 17.29.2 (22)
- Fix broken install path for parser compat headers (fixes #372,
- RepoManager: remember exec errors in exception history
- version 17.29.1 (22)
- Use the default zypp.conf settings if no zypp.conf exists
- Fix wrong encoding of iso: URL components (bsc#954813)
- Handle armv8l as armv7hl compatible userland.
- Introduce zypp-curl a sublibrary for CURL related code.
- zypp-rpm: Increase rpm loglevel if ZYPP_RPM_DEBUG is set.
- Save all signatures associated with a public key in its
- version 17.29.0 (22)
- version 4.2.6-1
  * Do not build python 2 package for SLE15SP4 and higher
- version 4.2.5-1
  * do not build python 2 package for SLE15
- version 4.2.4-1
  * Fix python selinux package name depending on build target (bsc#1193600)
- version 4.2.4-1
  * Do not build python 2 package for SLE15SP4 and higher
- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
- CVE-2021-4115: fixed a denial of service via file descriptor leak (bsc#1195542)
  added CVE-2021-4115.patch
  * Determine the namespace of a process only once to speed
    up the parsing of fdinfo (bsc#1194172).
- Change patch 0001-Use-mountinfo-to-be-able-to-use-the-mount-identity.patch
- 15.3.20220202 (tracked in bsc#933411)
- Added kernel parameter changes (bsc#1195107)
- Added note about IBM Power10 support (bsc#1192121)
- Added note about deprecating XFS V4 (jsc#SLE-22663)
- Updated note about unixODBC drivers in production (jsc#SLE-20555)
- Added note about RTL8821CE support (jsc#SLE-22690)
- Updated KillMode=none note (bsc#1193843)
- version 4.2.5-1
  * do not build python 2 package for SLE15
- Revert unwanted /usr/bin/python -> /usr/bin/python2 change we
  got with the update to 4.14.3 [bsc#1194968]
  new patch: no-python2.diff
- add service dependencies for remote logging (bsc#1194669)
- update config example in remote.conf to match upstream documentation
- Fix inspector module export function (bsc#1097531)
- Add all ssh kwargs to sanitize_kwargs method
- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)
- Don't check for cached pillar errors on state.apply (bsc#1190781)
- Simplify "/transactional_update"/ module to not use SSH wrapper and allow more flexible execution
- Add "/--no-return-event"/ option to salt-call to prevent sending return event back to master.
- Make "/state.highstate"/ to acts on concurrent flag.
- Added:
  * state.apply-don-t-check-for-cached-pillar-errors.patch
  * add-all-ssh-kwargs-to-sanitize_kwargs-method-3002.2-.patch
  * wipe-notify_socket-from-env-in-cmdmod-bsc-1193357-30.patch
  * vendor-stateresult.patch
  * fix-inspector-module-export-function-bsc-1097531-480.patch
  * refactor-and-improvements-for-transactional-updates-.patch
- CVE-2021-44141: Information leak via symlinks of existance of
  files or directories outside of the exported share; (bso#14911);
- CVE-2021-44142: Out-of-bounds heap read/write vulnerability
  in VFS module vfs_fruit allows code execution; (bso#14914);
- CVE-2022-0336: Samba AD users with permission to write to an
  account can impersonate arbitrary services; (bso#14950);
- Update to 4.15.4
  * Duplicate SMB file_ids leading to Windows client cache
    poisoning; (bso#14928);
  * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -
    NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);
  * kill_tcp_connections does not work; (bso#14934);
  * Can't connect to Windows shares not requiring authentication
    using KDE/Gnome; (bso#14935);
  * smbclient -L doesn't set "/client max protocol"/ to NT1 before
    calling the "/Reconnecting with SMB1 for workgroup listing"/
    path; (bso#14939);
  * Cross device copy of the crossrename module always fails;
  * symlinkat function from VFS cap module always fails with an
    error; (bso#14941);
  * Fix possible fsp pointer deference; (bso#14942);
  * Missing pop_sec_ctx() in error path inside close_directory();
  * "/smbd --build-options"/ no longer works without an smb.conf file;
- Use pkgconfig(krb5) as dependency for the -devel package: allow
  OBS to pick the right flavor of krb5-devel (full vs mini).
- Do not require the 'krb5' symbol by samba-client-libs: this
  package has an automatic dependency due to linkage on Automatic deps are always better.
- Do not require the 'krb5' symbol from samba-libs: samba-libs
  requires samba-client-libs, which in turn requires krb5
  libraries. Samba-libs itself has no need for krb5 (but get it
  indirectly anyway).
- Update to version 4.15.3; (jsc#SLE-23329);
  + CVE-2021-43566: Symlink race error can allow directory creation
    outside of the exported share; (bso#13979); (bsc#1139519);
  + CVE-2021-20316: Symlink race error can allow metadata read and
    modify outside of the exported share; (bso#14842); (bsc#1191227);
- Reorganize libs packages. Split samba-libs into samba-client-libs,
  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba
  public libraries depending on internal samba libraries into these
  packages as there were dependency problems everytime one of these
  public libraries changed its version (bsc#1192684). The devel
  packages are merged into samba-devel.
- Rename package samba-core-devel to samba-devel
- Add python-rpm-macros to build requirements
- Update the symlink create by samba-dsdb-modules to private samba
  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to
- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).
- version 4.2.19-1
  * Retrieve and store copyright information about patches
  * SLES PAYG client support on cloud
  * Add headers to update proxy auth token in listChannels (bsc#1193585)
  * require python macros for building
  * exchange zypp-plugin dependency to use the python3 version (bsc#1192514)
- version 4.2.16-1
  * do not build python 2 package for SLE15
  * require python macros for building
- version 4.2.9-1
  * Update the token in case a channel can't be found in the cache.
- version 4.2.25-1
  * Add support for custom SSH port for SSH minions
  * SLES PAYG client support on cloud
  * Migrate the displaying of the date/time to rhn:formatDate, get rid of the legacy fmt:formatDate glue
  * Fix header search autofocus
  * Fix virtual systems list request error (bsc#1194397)
  * UI for changing proxy
  * Fix legacy timepicker passing wrong time to the backend if server and
    user time differ (bsc#1192699)
  * Fix legacy timepicker passing wrong time to the backend if selected
    date is in summer time (bsc#1192776)
- Add support in the LDAP filter for negated users, patch taken
  from upstream (jsc#20068)
  * Adds sudo-feature-negated-LDAP-users.patch
- Restrict use of sudo -U other -l to people who have permission
  to run commands as that user (bsc#1181703, jsc#SLE-22569)
  * feature-upstream-restrict-sudo-U-other-l.patch
- Update to version 1.0.6 (bsc#1195095, bsc#1195096)
  + Include cloud-init logs whenever they are present
  + Update the packages we track in AWS, Azure, and Google
  + Include the ecs logs for AWS ECS instances
- Import commit 773652879446a81689c39aea23a486627992409b
  a76263ced9 meson: allow extra net naming schemes to be defined during configuration
  301bf4f1bf meson: drop the list of valid net naming schemes
  b89924793d netif-naming: inline one iterator variable
  da4a4df29c udev: fix potential memleak
  d60486bf1b udev: allow onboard index up to 65535
  ac2baecc84 udev: use snprintf_ok()
  8aad315c7c udev: fix potential infinite loop
  471ea73eb0 udev: make dev_pci_slot() return earlier when PCI bridge is found
  69b7c9a6bd udev: use uint32_t for hotplug_slot
  cdd0e89c0e udev: split out logic of parsing s390 PCI slots
  84e1a91baa udev: it is not necessary that the path is readable
  03548e8d0e udev: add missing initialization to fix freeing invalid address
  772f964bf6 udev: fix slot based network names on s390
  c5071cf699 tree-wide: fix typo
  06640d06df net_id: fix newly added naming scheme name
  58f9592f1f udev/net_id: don't generate slot based names if multiple devices might claim the same slot (bsc#1192637)
  df9e240c92 udev/net_id: parse _SUN ACPI index as a signed integer
  cfcaddfa74 localectl: don't omit keymaps files that are symlinks (bsc#1191826)
- Add 6000-udev-net_id-add-debug-logging-for-construction-of-de.patch
- Import commit 6a96632f26f20a68578f9d620a593ceab2a0e3b6
  c4aa40982c shared/rm-rf: loop over nested directories instead of instead of recursing (CVE-2021-3997 bsc#1194178)
  ae13ea6511 shared/rm_rf: refactor rm_rf() to shorten code a bit
  3266d7f5c8 shared/rm_rf: refactor rm_rf_children_inner() to shorten code a bit
- Drop 5000-shared-rm_rf-refactor-rm_rf_children_inner-to-shorte.patch
  Drop 5001-shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch
  Drop 5002-shared-rm-rf-loop-over-nested-directories-instead-of.patch
  They have been merged into 'SUSE/v246' branch.
- resolved: disable DNSSEC until the following issue is solved:
- resolved: disable fallback DNS servers and fail when no DNS server info could
  be obtained from the links. It's better to let the sysadmin know that
  something is likely misconfigured rather than silently handing over the DNS
  queries to Google or Cloudflare.
- resolved: DNSSEC support (build) requires openssl therefore document this
  build dependency in systemd-network sub-package.
- Add 1009-drop-or-soften-deprecation-warnings.patch (bsc#1193086)
- Bump version to 10
- %sysusers_create_inline was wrongly marked as deprecated
- %sysusers_create can be useful in certain cases and won't go away until we'll
  move to file triggers. So don't mark it as deprecated too
- Update to 2.3.3; (jsc#SLE-23329);
  + python: Ensure reference counts are properly incremented
  + Change pytalloc source to LGPL;(bso#9931);
- Update to 2.3.2
- Fix build with RPM 4.16:
  bad %if condition:  01550 != 1110 || "/x86_64"/ == x86_64
  no bare word support, x86_64 needs to be quoted
- Update to version 1.4.4; (jsc#SLE-23329);
  + Fix a memory leak on error
  + python: remove all 'from __future__ import print_function'
  + Fix CID 1471761 String not null terminated
  + Use hex_byte() in parse_hex()
  + Use hex_byte() in read_data()
  + fix studio compiler build
  + Fix some signed/unsigned comparisons
  + also use __has_attribute macro to check for attribute support
  + Fix clang 9 missing-field-initializer warnings
  + pytdb tests: add test for storev()
  + pytdb: add python binding for storev()
  + tdbtorture: Use ARRAY_DEL_ELEMENT()
  + py3: Remove #define PyInt_FromLong PyLong_FromLong
  + py3: Remove #define PyInt_AsLong PyLong_AsLong
  + py3: Remove #define PyInt_Check PyLong_Check
  + tdb: Align integer types
- Drop obsolete patch ignore-tdb1-run-transaction-expand.diff
- Fix header file using undefined function visibility macro;
  Add patch 0001-tdb-Fix-invalid-syntax-in-tdb.h.patch; (bso#14762);
- Adust tevent spec to export bundled libcmocka-tevent needed
  by ldb; (jsc#SLE-23329);
- Update to version 0.11.0
  + Other minor build fixes; (bso#14526);
  + Add custom tag to events
  + Add event trace api
- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
- blockdev: Remove NBSP character in values (bsc#1188507#c31,
- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).
- blockdev: allow for larger values for start sector (bsc#1188507)
- Fix unauthorized umount (CVE-2021-3995, CVE-2021-3996,
- blockdev: Remove NBSP character in values (bsc#1188507#c31,
- The legacy code does not support /etc/login.defs.d used by YaST.
  Enable libeconf to read it (bsc#1192954).
- blockdev: allow for larger values for start sector (bsc#1188507)
- version 4.2.6-1
  * Read modularity data from DISTTAG tag as fallback (bsc#1192487)
  * require python macros for building
- Minimal fix for Bug 1195004 - (CVE-2022-0318) VUL-0: CVE-2022-0318: vim:
  Heap-based Buffer Overflow in vim prior to 8.2.
  / vim-8.0.1568-CVE-2022-0413.patch
- Fixing bsc#1190570 CVE-2021-3796: vim: use-after-free in nv_replace() in
  normal.c / vim-8.0.1568-CVE-2021-3796.patch
- Fixing bsc#1191893 CVE-2021-3872: vim: heap-based buffer overflow in
  win_redr_status() drawscreen.c / vim-8.0.1568-CVE-2021-3872.patch
- Fixing bsc#1192481 CVE-2021-3927: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-3927.patch
- Fixing bsc#1192478 CVE-2021-3928: vim: vim is vulnerable to
  Stack-based Buffer Overflow / vim-8.0.1568-CVE-2021-3928.patch
- Fixing bsc#1193294 CVE-2021-4019: vim: vim is vulnerable to
  Heap-based Buffer Overflow / vim-8.0.1568-CVE-2021-4019.patch
- Fixing bsc#1193298 CVE-2021-3984: vim: illegal memory access when C-indenting
  could lead to Heap Buffer Overflow / vim-8.0.1568-CVE-2021-3984.patch
- Fixing bsc#1190533 CVE-2021-3778: vim: Heap-based Buffer Overflow in regexp_nfa.c
  / vim-8.0.1568-CVE-2021-3778.patch
- Fixing bsc#1194216 CVE-2021-4193: vim: vulnerable to Out-of-bounds Read
  / vim-8.0.1568-CVE-2021-4193.patch
- Fixing bsc#1194556 CVE-2021-46059: vim: A Pointer Dereference vulnerability
  exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which
  causes a denial of service. / vim-8.0.1568-CVE-2021-46059.patch
- Fixing bsc#1195066 CVE-2022-0319: vim: Out-of-bounds Read in vim/vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0319.patch
- Fixing bsc#1195126 CVE-2022-0351: vim: uncontrolled recursion in eval7()
  / vim-8.0.1568-CVE-2022-0351.patch
- Fixing bsc#1195202 CVE-2022-0361: vim: Heap-based Buffer Overflow in vim
  prior to 8.2. / vim-8.0.1568-CVE-2022-0361.patch
- Fixing bsc#1195356 CVE-2022-0413: vim: use after free in src/ex_cmds.c
  / vim-8.0.1568-CVE-2022-0413.patch
- fsm: fix device rename via yast (bsc#1194392)
  Reset worker config instead to reject a NULL/empty config
  xml node -- introduced in wicked 0.6.67 by commit c2a0385.
  [+ 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]
- version 0.6.68
- sysctl: process sysctl.d directories as in sysctl --system
- sysctl: fix sysctl values for loopback device (bsc#1181163, bsc#1178357)
- dhcp4: add option to set route pref-src to dhcp IP (bsc#1192353)
- cleanup: warnings, time calculations and dhcp fixes (bsc#1188019)
- wireless: reconnect on unexpected wpa_supplicant restart (bsc#1183495)
- tuntap: avoid sysfs attr read error (bsc#1192311)
- ifstatus: fix warning of unexpected interface flag combination (bsc#1192164)
- dbus: config files in /usr shouldn't be marked as config in spec
- version 0.6.67
- dbus: install bus config in /usr (bsc#1183407,jsc#SLE-9750)
- logging: log reaped sub-process command and as debug, not error
- ifstatus: Don't show link as "/up"/ without RUNNING flag set
- firewalld: Make the zone assignment permanent (boo#1189560)
- fsm: cleanup and improve ifconfig and ifpolicy access utils
- dbus: cleanup the dbus-service.h file and unused property makros
- cleanup: applied code-spell run typo corrections
- dracut: initial fixes and improved option handling (boo#1182227)
- version 0.6.66
- wireless: migrate to wpa-supplicant v1 DBus interface (bsc#1156920)
  - support multiple networks configurations per interface
  - show connection status and scan-results (bsc#1160654)
  - corrected eap-tls,ttls cetificate handling and open vs. shared
    wep,open,psk,eap-tls,ttls,peap parsing from ifcfg (bsc#1057592)
  - cleanups and several other improvements, see changes
  - updated man ifcfg-wireless manual pages
- nanny: fix identify node owner exit condition
- schema: several xml-schema and dbus/property improvements
- utils: format/parse bitmap to array and string alternatives
- client: expose ethtool --get-permanent-address option
- removed sle15-sp3 patches included in the master sources (bsc#1181812)
  [- 0001-dhcp4-discover-on-reboot-timeout-after-start-delay.1181812.patch]
  [- 0002-dhcp6-request-nis-options-on-sle15-by-default.1181812.patch]
- bsc#1194576 - VUL-0: CVE-2022-23033: xen: arm:
  guest_physmap_remove_page not removing the p2m mappings (XSA-393)
- bsc#1194581 - VUL-0: CVE-2022-23034: xen: a PV guest could DoS
  Xen while unmapping a grant (XSA-394)
- bsc#1194588 - VUL-0: CVE-2022-23035: xen: insufficient cleanup of
  passed-through device IRQs (XSA-395)
- bsc#1191668 - L3: issue around xl and virsh operation - virsh
  list not giving any output
- bsc#1193447 - Slow execution of hvmloader+ovmf when VM contains an sriov device
- Upstream bug fixes (bsc#1027519)
- Collect active VM config files in the supportconfig plugin
- Upstream bug fixes (bsc#1027519)
- Drop xsa patches in favor of upstream versions
- do not strip surrounding white space in CDATA XML elements (bsc#1195910)
- 4.3.68
- do not strip trailing white space in XML elements (bsc#1195910)
- 4.3.67
- Restore the repo unexpanded URL to get it properly saved in
  the /etc/zypp/repos.d file (bsc#972046, bsc#1194851).
- 4.3.10
- Fix DNS zone creation by fixing a maintained DNS zone check.
  Reported and fixed by Daniel Pätzold <>
  See github#yast/yast-dhcp-server#59.
- 4.3.2
- Fix URL in .spec file
- Added CVE-2019-20044.patch: fixes insecure dropping of privileges when
  unsetting PRIVILEGED option (CVE-2019-20044 bsc#1163882)
- Added CVE-2021-45444.patch: fixes a vulnerability in prompt expansion which
  could be exploited through e.g.  VCS_Info to execute arbitrary shell
  commands (CVE-2021-45444 bsc#1196435)
- Singletrans: handle fatal and non-fatal script errors properly.
- Add SingleTransReportReceiver.
- Immediately write out additional rpm output.
- BuildRequires:  libzypp-devel >= 17.29.0.
  Need SingleTransReport and immediate rpm script output reports.
- version 1.14.51