- Add patch bsc1245199.patch
  * Fix histfile missing timestamp for the oldest record (bsc#1245199)

- Security Fixes:
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379, bind-9.16-CVE-2025-40778.patch]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380, bind-9.16-CVE-2025-40780.patch]

- Update to current 2.45 branch at 94cb1c075 to include fix
  for PR33584 (a problem related to LTO vs fortran COMMON
  blocks).

- Amend binutils-compat-old-behaviour.diff to not enable
  '-z gcs=implicit' on aarch64 for old codestreams.

- Update to version 2.45:
  * New versioned release of libsframe.so.2
  * s390: tools now support SFrame format 2; recognize "z17" as CPU
    name [bsc#1247105, jsc#IBM-1485]
  * sframe sections are now of ELF section type SHT_GNU_SFRAME.
  * sframe secions generated by the assembler have
    SFRAME_F_FDE_FUNC_START_PCREL set.
  * riscv: Support more extensions: standard: Zicfiss v1.0, Zicfilp v1.0,
    Zcmp v1.0, Zcmt v1.0, Smrnmi v1.0, S[sm]dbltrp v1.0, S[sm]ctr v1.0,
    ssqosid v1.0, ssnpm v1.0, smnpm v1.0, smmpm v1.0, sspm v1.0, supm v1.0,
    sha v1.0, zce v1.0, smcdeleg v1.0, ssccfg v1.0, svvptc v1.0, zilsd v1.0,
    zclsd v1.0, smrnmi v1.0;
    vendor: CORE-V, xcvbitmanip v1.0 and xcvsimd v1.0;
    SiFive, xsfvqmaccdod v1.0, xsfvqmaccqoqv1.0 and xsfvfnrclipxfqf v1.0;
    T-Head: xtheadvdot v1.0;
    MIPS: xmipscbop v1.0, xmipscmov v1.0, xmipsexectl v1.0, xmipslsp v1.0.
  * Support RISC-V privileged version 1.13, profiles 20/22/23, and
    .bfloat16 directive.
  * x86: Add support for these ISAs: Intel Diamond Rapids AMX, MOVRS,
    AVX10.2 (including SM4), MSR_IMM; Zhaoxin PadLock PHE2, RNG2, GMI, XMODX.
    Drop support for  AVX10.2 256 bit rounding.
  * arm: Add support for most of Armv9.6, enabled by -march=armv9.6-a and
    extensions '+cmpbr', '+f8f16mm', '+f8f32mm', '+fprcvt', '+lsfe', '+lsui',
    '+occmo', '+pops', '+sme2p2', '+ssve-aes', '+sve-aes', '+sve-aes2',
    '+sve-bfscale', '+sve-f16f32mm' and '+sve2p2'.
  * Predefined symbols "GAS(version)" and, on non-release builds, "GAS(date)"
    are now being made available.
  * Add .errif and .warnif directives.
  * linker:
  - Add --image-base=<ADDR> option to the ELF linker to behave the same
    as -Ttext-segment for compatibility with LLD.
  - Add support for mixed LTO and non-LTO codes in relocatable output.
  - s390: linker generates .eh_frame and/or .sframe for linker
    generated .plt sections by default (can be disabled
    by --no-ld-generated-unwind-info).
  - riscv: add new PLT formats, and GNU property merge rules for zicfiss
    and zicfilp extensions.
- gold is no longer included
- Contains fixes for these non-CVEs (not security bugs per upstreams
  SECURITY.md):
  * bsc#1236632 aka CVE-2025-0840 aka PR32560
  * bsc#1236977 aka CVE-2025-1149 aka PR32576
  * bsc#1236978 aka CVE-2025-1148 aka PR32576
  * bsc#1236999 aka CVE-2025-1176 aka PR32636
  * bsc#1237000 aka CVE-2025-1153 aka PR32603
  * bsc#1237001 aka CVE-2025-1152 aka PR32576
  * bsc#1237003 aka CVE-2025-1151 aka PR32576
  * bsc#1237005 aka CVE-2025-1150 aka PR32576
  * bsc#1237018 aka CVE-2025-1178 aka PR32638
  * bsc#1237019 aka CVE-2025-1181 aka PR32643
  * bsc#1237020 aka CVE-2025-1180 aka PR32642
  * bsc#1237021 aka CVE-2025-1179 aka PR32640
  * bsc#1237042 aka CVE-2025-1182 aka PR32644
  * bsc#1240870 aka CVE-2025-3198 aka PR32716
  * bsc#1243756 aka CVE-2025-5244 aka PR32858
  * bsc#1243760 aka CVE-2025-5245 aka PR32829
  * bsc#1246481 aka CVE-2025-7545 aka PR33049
  * bsc#1246486 aka CVE-2025-7546 aka PR33050
  * bsc#1247114 aka CVE-2025-8224 aka PR32109
  * bsc#1247117 aka CVE-2025-8225 no PR
- Add these backport patches:
  * pr32556.diff for bsc#1236976 aka CVE-2025-1147 aka PR32556
  * pr33457.diff for bsc#1250632 aka CVE-2025-11083 aka PR33457
  * pr33452.diff for bsc#1251275 aka CVE-2025-11412 aka PR33452
  * pr33456.diff and pr33456-2.diff for bsc#1251276 aka CVE-2025-11413
    aka PR33456
  * pr33450.diff for bsc#1251277 aka CVE-2025-11414 aka PR33450
  * pr33499.diff for bsc#1251794 aka CVE-2025-11494 aka PR33499
  * pr33502.diff for bsc#1251795 aka CVE-2025-11495 aka PR33502
- Adjust binutils-disable-code-arch-error.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff,
  binutils-revert-rela.diff, binutils-skip-rpaths.patch
- Remove pr33029.patch (upstreamed), enable-targets-gold.diff (obsolete),
  binutils-2.43.tar.bz2.sig, binutils-2.43.tar.bz2,
  binutils-2.43-branch.diff.gz
- Add binutils-2.45.tar.bz2.sig, binutils-2.45.tar.bz2,
  binutils-2.45-branch.diff.gz
- Rename binutils-fix-branch.diff to binutils-fix-branch.diff.templ
  as long as its empty.

- Skip PGO with %want_reproducible_builds (boo#1040589)

- pr33029.patch: Fix crash in assembler with -gdwarf-5

- Drop aarch64-common-pagesize.patch, aarch64 no longer uses 64K page size

- Add -std=gnu17 to move gcc15 forward, as temporary measure until
  the binutils version can be updated [bsc#1241916].

- Do not build binutils-gold for SLFO.

- Enable multitarget build on loongarch64

- Unset SUSE_ZNOW while running testsuite, many tests cannot cope

- bsc#1246544: Fix racy socket creation
  * Add chrony-unix-socket.patch
  * Add chrony-remove-chmod.patch
- Use make quickcheck to speedup build.

- Add patches:
  * 0001-cifs-utils-Skip-TGT-check-if-valid-service-ticket-is.patch (bsc#1248816)
  * 0001-setcifsacl-fix-memory-allocation-for-struct-cifs_ace.patch
  * 0001-cifs.upcall-fix-UAF-in-get_cachename_from_process_en.patch
  * 0001-cifs-utils-avoid-using-mktemp-when-updating-mtab.patch
  * 0001-cifs-utils-add-documentation-for-upcall_target.patch
  * 0001-cifs.upcall-fix-memory-leaks-in-check_service_ticket.patch

- Update to containerd v1.7.29. Upstream release notes:
  <https://github.com/containerd/containerd/releases/tag/v1.7.29>
  * CVE-2024-25621 bsc#1253126
  * CVE-2025-64329 bsc#1253132
- Rebase patches:
  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch

- Update to containerd v1.7.28. Upstream release notes:
  <https://github.com/containerd/containerd/releases/tag/v1.7.28>

- Security fix: [bsc#1253757, CVE-2025-11563]
  * curl: wcurl path traversal with percent-encoded slashes
  * Add curl-CVE-2025-11563.patch

- systemctl start lvmlockd.service times out (bsc#1233655)
  * Add a patch containing multiple picked upstream patches
    + bug-1233655_configure-add-option-disable-enable-sd-notify-and-au.patch
  * Update lvm2.spec
  - add pkgconfig(systemd) for lvmlockd build
  - enable configure option '--enable-sd-notify' for lvmlockd

- Enable SELinux in default daemon.json config (--selinux-enabled). This has no
  practical impact on non-SELinux systems. bsc#1252290

- Update to Docker 28.5.1-ce. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/28/#2851>
- Rebased patches:
  * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
  * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch
- Remove upstreamed patch:
  - 0007-Add-back-vendor.sum.patch

- Update to Docker 28.5.0-ce. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/28/#2850>
- Backport <https://github.com/moby/moby/pull/51091> to re-add vendor.sum,
  fixing our builds.
  + 0007-Add-back-vendor.sum.patch
- Rebased patches:
  * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
  * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

- Update to docker-buildx v0.29.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.29.0>

- Remove git-core recommends also on openSUSE: the below argument
  is valid for those users too.

- Remove git-core recommends on SLE. Most SLE systems have
  installRecommends=yes by default and thus end up installing git with Docker.
  bsc#1250508
  This feature is mostly intended for developers ("docker build git://") so
  most users already have the dependency installed, and the error when git is
  missing is fairly straightforward (so they can easily figure out what they
  need to install).

- Update to docker-buildx v0.28.0. Upstream changelog:
  <https://github.com/docker/buildx/releases/tag/v0.28.0>
- Update to Docker 28.4.0-ce. See upstream changelog online at
  <https://docs.docker.com/engine/release-notes/28/#2840>
  * Fixes a nil pointer panic in "docker push". bsc#1248373
- Rebased patches:
  * 0001-SECRETS-SUSE-always-clear-our-internal-secrets.patch
  * 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0004-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
  * 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0006-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
  * cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
  * cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

- Update warnings and errors related to "docker buildx ..." so that they
  reference our openSUSE docker-buildx packages.
  + cli-0001-openSUSE-point-users-to-docker-buildx-package.patch
- Enable building docker-buildx for SLE15 systems with SUSEConnect secret
  injection enabled. PED-12534 PED-8905 bsc#1247594
  As docker-buildx does not support our SUSEConnect secret injection (and some
  users depend "docker build" working transparently), patch the docker CLI so
  that "docker build" will no longer automatically call "docker buildx build",
  effectively making DOCKER_BUILDKIT=0 the default configuration. Users can
  manually use "docker buildx ..." commands or set DOCKER_BUILDKIT=1 in order
  to opt-in to using docker-buildx.
  Users can silence the "docker build" warning by setting DOCKER_BUILDKIT=0
  explicitly.
  In order to inject SCC credentials with docker-buildx, users should use
    RUN --mount=type=secret,id=SCCcredentials zypper -n ...
  in their Dockerfiles, and
    docker buildx build --secret id=SCCcredentials,src=/etc/zypp/credentials.d/SCCcredentials,type=file .
  when doing their builds.
  + cli-0002-SECRETS-SUSE-default-to-DOCKER_BUILDKIT-0-for-docker.patch

- Add elfutils-fix-large-alignment.diff and elfutils-pr28190.diff
  to fix build/testsuite for more recent glibc and kernels.
- Add elfutils-fuzz-1.diff, elfutils-fuzz-2.diff,
  elfutils-fuzz-3.diff, elfutils-fuzz-4.diff [bsc#1237236,
  bsc#1237240, bsc#1237241, bsc#1237242].
- Add elfutils-fix-debuginfod-groom-race.diff to fix a testsuite
  race in run-debuginfod-find.sh.

- Add CVE fixes:
  + glib2-CVE-2025-13601-1.patch, glib2-CVE-2025-13601-2.patch
    (bsc#1254297 CVE-2025-13601 glgo#GNOME/glib#3827).
  + glib2-CVE-2025-14087-1.patch, glib2-CVE-2025-14087-2.patch,
    glib2-CVE-2025-14087-3.patch (bsc#1254662 CVE-2025-14087
    glgo#GNOME/glib#3834).
  + glib2-CVE-2025-14512.patch (bsc#1254878 CVE-2025-14512
    glgo#GNOME/glib#3845).

- Add glib2-CVE-2025-7039.patch: fix computation of temporary file
  name (bsc#1249055 CVE-2025-7039 glgo#GNOME/glib#3716).

- Security fix: [bsc#1239119, CVE-2025-30258]
  * gpg: Lookup key for merging/inserting only by primary key.
  * gpg: Remove a signature check function wrapper.
  * gpg2: verification DoS due to a malicious subkey in the keyring
  * gpg: Fix regression for the recent malicious subkey
  * gpg: Fix another regression due to the T7547 fix.
  * gpg: Fix double free of internal data.
  * Add patches:
  - gnupg-CVE-2025-30258-Lookup-key-for-merging-inserting-only-by-primary-key.patch
  - gnupg-CVE-2025-30258-Remove-a-signature-check-function-wrapper.patch
  - gnupg-CVE-2025-30258-Fix-a-verification-DoS-due-to-a-malicious-subkey-in-the-keyring.patch
  - gnupg-CVE-2025-30258-Fix-regression-for-the-recent-malicious-subkey-DoS-fix.patch
  - gnupg-CVE-2025-30258-Fix-another-regression-due-to-the-T7547-fix.patch
  - gnupg-CVE-2025-30258-Fix-double-free-of-internal-data.patch
  * Remove unrecognized configure option: --enable-Werror

- Fix CVE-2025-54771 (bsc#1252931)
  * 0001-kern-file-Call-grub_dl_unref-after-fs-fs_close.patch
- Fix CVE-2025-61662 (bsc#1252933)
  * 0002-gettext-gettext-Unregister-gettext-command-on-module.patch
- Fix CVE-2025-61663 (bsc#1252934)
- Fix CVE-2025-61664 (bsc#1252935)
  * 0003-normal-main-Unregister-commands-on-module-unload.patch
  * 0004-tests-lib-functional_test-Unregister-commands-on-mod.patch
- Fix CVE-2025-61661 (bsc#1252932)
  * 0005-commands-usbtest-Use-correct-string-length-field.patch
  * 0006-commands-usbtest-Ensure-string-length-is-sufficient-.patch
- Bump upstream SBAT generation to 6

- man: modprobe.d: document the config file order handling (bsc#1253741)
  * man-modprobe.d-document-the-config-file-order-handling.patch

- Fix heap buffer overread in setpwnam() when processing 256-byte
  usernames (bsc#1254666, CVE-2025-14104,
  util-linux-CVE-2025-14104-1.patch,
  util-linux-CVE-2025-14104-2.patch).

- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
  util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

- package FTL.TXT and GPLv2.TXT as %license [bsc#1252148]

- Security fix bsc#1254132 CVE-2025-9820
  * Fix buffer overflow in gnutls_pkcs11_token_init
  * Added gnutls-CVE-2025-9820.patch

- pciutils.spec: Add a strict dependency to libpci. [bsc#1252338]
  Mixing different versions of pciutils and libpci could result in
  a segmentation fault due to incompatible ABI.

- Synchronize SLE-12 and openSUSE:Factory [jsc#PED-4587].
  The following patches are now obsolete in version 3.13.0:
  * add-decoding-of-vendor-specific-vpd-fields.patch
  * pciutils-3.1.7-fix-memory-leak-in-get_cache_name.patch
  * pciutils-3.2.0_update-dist.patch
  * pciutils-3.5.1-add-support-for-32-bit-pci-domains.patch
  * pciutils-lspci-Correct-Root-Capabilities-CRS-Software-Visibil.patch
  * show-gen4-speed-properly.patch

- Synchronize SLE-15 and openSUSE:Factory [jsc#PED-8393, bsc#1224138].
  The following patches are now obsolete in version 3.13.0:
  * lspci-Fixed-buffer-overflows-in-ls-tree.c.patch
  * pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  * pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch

- update to 3.13.0:
  * lspci decodes CXL 1.1 device link status information.
  * Further development of the pcilmr (the link margining
    utility)
  * Dump parsing supports 6-digit domain numbers.
  * Bug fixes in PCIe link state reporting.
  * Decode more fields in PCIe AER capability.
  * Fixed build on Linux systems with musl libc.
  * Updated pci.ids.

- update to 3.12.0:
  * lspci decodes the IDE (Integrity & Data Encryption) and
    TEE-IO extended capabilities.
  * Optimization flags used for compiling individual object files
    should be the same as optimization flags for linking the final
    executable to make link-time optimization possible.
  * no longer look up subsystems in the HWDB
  * Updated pci.ids
- include changes from 3.11:
  * update-pciids now supports XZ compression
  * update-pciids now sends itself as the User-Agent.
  * Added a pcilmr utility for PCIe lane margining
  * ECAM back-end now scans ACPI and BIOS memory faster.
  * Linux systems without pread/pwrite are no longer supported
  * Improved decoding of PCIe control and status registers.
  * Decoding of CXL capabilities now supports up to CXL 3.0.
  * lspci now displays interrupt message numbers consistently across
    different capabilities.
  * Cache of IDs resolved via DNS, which was located in ~/.pci-ids
    by default, is now stored according to the XDG base directory
    specification in $XDG_CACHE_HOME/pci-ids.
  * All source files now have SPDX license identifiers.
  * various minor bug fixes and updated pci.ids.

- security update
- added patches
  CVE-2025-66293 [bsc#1254480], LIBPNG out-of-bounds read in png_image_read_composite
  * libpng16-CVE-2025-66293-1.patch
  * libpng16-CVE-2025-66293-2.patch

- security update
- added patches
  CVE-2025-64505 [bsc#1254157], heap buffer over-read in `png_do_quantize` via malformed palette index
  * libpng16-CVE-2025-64505.patch
  CVE-2025-64506 [bsc#1254158], heap buffer over-read in `png_write_image_8bit` with 8-bit input and `convert_to_8bit` enabled
  * libpng16-CVE-2025-64506.patch
  CVE-2025-64720 [bsc#1254159], buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
  * libpng16-CVE-2025-64720.patch
  CVE-2025-65018 [bsc#1254160], heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
  * libpng16-CVE-2025-65018.patch

- Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
  quadratic complexity vulnerabilities of os.path.expandvars()
  (CVE-2025-6075, bsc#1252974).
- Readjusted patches:
  - CVE-2023-52425-libexpat-2.6.0-backport.patch
  - CVE-2023-52425-remove-reparse_deferral-tests.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

- Update to 3.11.14:
  - Security
  - gh-139700: Check consistency of the zip64 end of central
    directory record. Support records with “zip64 extensible data”
    if there are no bytes prepended to the ZIP file
    (CVE-2025-8291, bsc#1251305).
  - gh-139400: xml.parsers.expat: Make sure that parent Expat
    parsers are only garbage-collected once they are no longer
    referenced by subparsers created by
    ExternalEntityParserCreate(). Patch by Sebastian Pipping.
  - gh-135661: Fix parsing start and end tags in
    html.parser.HTMLParser according to the HTML5 standard.
  * Whitespaces no longer accepted between </ and the tag name. E.g.
    </ script> does not end the script section.
  * Vertical tabulation (\v) and non-ASCII whitespaces no longer
    recognized as whitespaces. The only whitespaces are \t\n\r\f and
    space.
  * Null character (U+0000) no longer ends the tag name.
  * Attributes and slashes after the tag name in end tags are now
    ignored, instead of terminating after the first > in quoted
    attribute value. E.g. </script/foo=">"/>.
  * Multiple slashes and whitespaces between the last attribute and
    closing > are now ignored in both start and end tags. E.g. <a
    foo=bar/ //>.
  * Multiple = between attribute name and value are no longer
    collapsed. E.g. <a foo==bar> produces attribute “foo” with value
    “=bar”.
  - gh-135661: Fix CDATA section parsing in html.parser.HTMLParser
    according to the HTML5 standard: ] ]> and ]] > no longer end the
    CDATA section. Add private method _set_support_cdata() which can
    be used to specify how to parse <[CDATA[ — as a CDATA section in
    foreign content (SVG or MathML) or as a bogus comment in the
    HTML namespace.
  - gh-102555: Fix comment parsing in html.parser.HTMLParser
    according to the HTML5 standard. --!> now ends the comment. -- >
    no longer ends the comment. Support abnormally ended empty
    comments <--> and <--->.
  - gh-135462: Fix quadratic complexity in processing specially
    crafted input in html.parser.HTMLParser. End-of-file errors are
    now handled according to the HTML5 specs – comments and
    declarations are automatically closed, tags are ignored.
  - gh-118350: Fix support of escapable raw text mode (elements
    “textarea” and “title”) in html.parser.HTMLParser.
  - gh-86155: html.parser.HTMLParser.close() no longer loses data
    when the <script> tag is not closed. Patch by Waylan Limberg.
  - Library
  - gh-139312: Upgrade bundled libexpat to 2.7.3
  - gh-138998: Update bundled libexpat to 2.7.2
  - gh-130577: tarfile now validates archives to ensure member
    offsets are non-negative. (Contributed by Alexander Enrique
    Urieles Nieto in gh-130577.)
  - gh-135374: Update the bundled copy of setuptools to 79.0.1.
- Drop upstreamed patches:
  - CVE-2025-8194-tarfile-no-neg-offsets.patch
  - CVE-2025-6069-quad-complex-HTMLParser.patch

- Add gh139257-Support-docutils-0.22.patch to fix build with latest
  docutils (>=0.22) gh#python/cpython#139257

- Drop AppStream buildrequires and don't run appstreamcli validate
  as part of the build process: the appdata.xml is not updated by
  source directly, so we have more contol. Having Appstream or the
  deprecated appstream-glib result in a build cycle.

- Require AppStream to validate appdata file instead of deprecated
  appstream-glib.
- Update idle3.appdata.xml to pass the more pedantic appstreamcli.

- Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
  CVE-2025-13836) to prevent reading an HTTP response from
  a server, if no read amount is specified, with using
  Content-Length per default as the length.
- Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
  behavior in node ID cache clearing (CVE-2025-12084,
  bsc#1254997).
- Add CVE-2025-13837-plistlib-mailicious-length.patch protect
  against OOM when loading malicious content (CVE-2025-13837,
  bsc#1254401).

- Add CVE-2025-6075-expandvars-perf-degrad.patch avoid simple
  quadratic complexity vulnerabilities of os.path.expandvars()
  (CVE-2025-6075, bsc#1252974).
- Skip test_curses on ppc64le (gh#python/cpython#141534)

- Add CVE-2025-8291-consistency-zip64.patch which checks
  consistency of the zip64 end of central directory record, and
  preventing obfuscation of the payload, i.e., you scanning for
  malicious content in a ZIP file with one ZIP parser (let's say
  a Rust one) then unpack it in production with another (e.g.,
  the Python one) and get malicious content that the other parser
  did not see (CVE-2025-8291, bsc#1251305)
- Readjust patches while synchronizing between openSUSE and SLE trees:
  - F00251-change-user-install-location.patch
  - doc-py38-to-py36.patch
  - gh126985-mv-pyvenv.cfg2getpath.patch

- add limit-decompressed-name-length.patch
  - fix ruby: denial of service (DoS) due to an insufficient check
    on the length of a decompressed domain name within a DNS packet
    in resolv gem
    bsc#1246430 CVE-2025-24294

- Security fix: [CVE-2025-8277, bsc#1249375]
  * Memory Exhaustion via Repeated Key Exchange
  * Add patches:
  - libssh-CVE-2025-8277-packet-Adjust-packet-filter-to-work-wh.patch
  - libssh-CVE-2025-8277-Fix-memory-leak-of-unused-ephemeral-ke.patch
  - libssh-CVE-2025-8277-ecdh-Free-previously-allocated-pubkeys.patch

- Security fix: [CVE-2025-8114, bsc#1246974]
  * NULL pointer dereference when calculating session ID during KEX
  * Add libssh-CVE-2025-8114.patch

- security update
- added patches
  CVE-2025-11731 [bsc#1251979], type confusion in exsltFuncResultCompfunction leading to denial of service
  * libxslt-CVE-2025-11731.patch

- propagate test failure into build failure
- added sources
  * libxslt-test-results.ref

- security update
- added patches
  CVE-2025-10911 [bsc#1250553], use-after-free with key data stored cross-RVT
  * libxslt-CVE-2025-10911.patch

- update to NSPR 4.36.2
  * Fixed a syntax error in test file parsetm.c,
    which was introduced in 4.36.1
- update to NSPR 4.36.1
  * Incorrect time value produced by PR_ParseTimeString and
    PR_ParseTimeStringToExplodedTime if input string doesn't
    specify seconds.

- Add bmo1990242.patch to move NSS DB password hash away from SHA-1

- update to NSS 3.112.2
  * bmo#1970079 - Prevent leaks during pkcs12 decoding.
  * bmo#1988046 - SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
- Adding patch bmo1980465.patch to fix bug on s390x (bmo#1980465)
- Adding patch bmo1956754.patch to fix possible undefined behaviour (bmo#1956754)

- update to NSS 3.112.1
  * bmo#1982742 - restore support for finding certificates by decoded serial number.

- Add openssh-cve-2025-61984-username-validation.patch
  (bsc#1251198, CVE-2025-61984).
- Add openssh-cve-2025-61985-nul-url-encode.patch
  (bsc#1251199, CVE-2025-61985).

- Update to version 2.14.0.1 (bsc#1253001)
  + Drop - included upstream
    ~ agent-btrfs-use-f.patch included upstream
    ~ remove-mock.patch
  + FIPS 140-3 support
  + Block extensions disallowed by policy
  + Report ext policy errors in heartbeat
  + Implement signature validation helper functions
  + Prevent ssh public key override
  + Use proper filesystem creation flag for btrfs
  + Enable resource monitoring in cgroup v2 machines
  + Update agent cgroup cleanup
  + Add cgroupv2 distros to supported list
  + Clean old agent cgroup setup
  + Redact sas tokens in telemetry events and agent log
  + Add conf option to use hardcoded wireserver ip instead of dhcp request
    to discover wireserver ip
  + Support for python 3.12
  + Update telemetry message for agent updates and send new telemetry for
    ext resource governance
  + Disable rsm downgrade
  + Add community support for Chainguard OS
  + Swap out legacycrypt for crypt-r for Python 3.13+
  + Pin setuptools version
  + Set the agent config file path for FreeBSD
  + Handle errors importing crypt module
- From 2.13.1.1
  + Setup: Fix install_requires list syntax
  + Pickup latest goal state on tenant certificate rotation + Avoid
    infinite loop when the tenant certificate is missing
  + Fix unsupported syntax in py2.6
  + Cgroup rewrite: uses systemctl for expressing desired configuration
    instead drop-in files
  + Remove usages of tempfile.mktemp
  + Use random time for attempting new Agent update
  + Enable logcollector in v2 machines
  + Clean history files
  + Missing firewall rules reason
  + Add support for nftables (+ refactoring of firewall code)
  + Create walinuxagent nftable atomically

- Add python36-certifi provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-idna provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-importlib-metadata provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-packaging provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-ply provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pyasn1 provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pytz provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-py provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36- provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-six provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- 15.5.20251031 (tracked in bsc#933411)
- Added note about docker-runc deprecation (jsc#PED-4018)
- Added note about LVFS UEFI firmware updates (jsc#PED-229)
- Added note about NVMe-oF booting over TCP (jsc#PED-2966)
- Added note about renaming APR devel packages (bsc#1247839)
- Added note about Ansible support (jsc#PED-13352)

- Security update (CVE-2025-10158, bsc#1254441): rsync: Out of
  bounds array access via negative index
  - Add rsync-CVE-2025-10158.patch

- Update to runc v1.3.4. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.3.4>. bsc#1254362

- Update to runc v1.3.3. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.3.3>. bsc#1252232
  * CVE-2025-31133
  * CVE-2025-52565
  * CVE-2025-52881
- Remove upstreamed patches for bsc#1252232:
  - 2025-11-05-CVEs.patch

[ This update was only released for SLE 12 and 15. ]
- Backport patches for three CVEs. All three vulnerabilities ultimately allow
  (through different methods) for full container breakouts by bypassing runc's
  restrictions for writing to arbitrary /proc files. bsc#1252232
  * CVE-2025-31133
  * CVE-2025-52565
  * CVE-2025-52881
  + 2025-11-05-CVEs.patch

[ This update was only released for SLE 12 and 15. ]
- Update to runc v1.2.7. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.2.7>.

- Update to runc v1.3.2. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.3.2> bsc#1252110
  - Includes an important fix for the CPUSet translation for cgroupv2.

- Update to runc v1.3.1. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.3.1>
- Fix runc 1.3.x builds on SLE-12 by enabling --std=gnu11.

- Update to runc v1.3.0. Upstream changelog is available from
  <https://github.com/opencontainers/runc/releases/tag/v1.3.0>

n/a

n/a

n/a

n/a

n/a

n/a

n/a

n/a

- Fix heap buffer overread in setpwnam() when processing 256-byte
  usernames (bsc#1254666, CVE-2025-14104,
  util-linux-CVE-2025-14104-1.patch,
  util-linux-CVE-2025-14104-2.patch).

- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682,
  util-linux-lscpu-add-arm64-NVIDIA-Olympus.patch).

- Fix for bsc#1250593.
- Backported from 9.1.1683 (xxd: Avoid null dereference in autoskip colorless).

- Fix for bsc#1229750.
- nocompatible must be set before the syntax highlighting is turned on.

- Update to Xen 4.17.6 security bug fix release (bsc#1027519)
  xen-4.17.6-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Rename xsa466.patch to
  67616cc2-docs-guest-guide-Discuss-when-not-use-a-hypercall-page.patch
- Dropped patches contained in new tarball
  66f2af41-x86-vLAPIC-undue-recursion-of-vlapic_error.patch
  xsa463-01.patch
  xsa463-02.patch
  xsa463-03.patch
  xsa463-04.patch
  xsa463-05.patch
  xsa463-06.patch
  xsa463-07.patch
  xsa463-08.patch
  xsa463-09.patch
  xsa463-10.patch
  xsa464.patch
  xsa467.patch
  xsa469-01.patch
  xsa469-02.patch
  xsa469-03.patch
  xsa469-04.patch
  xsa469-05.patch
  xsa469-06.patch
  xsa469-07.patch
  xsa470.patch
  xsa471-01.patch
  xsa471-02.patch
  xsa471-03.patch
  xsa471-04.patch
  xsa471-05.patch
  xsa471-06.patch
  xsa471-07.patch
  xsa471-08.patch
  xsa471-09.patch
  xsa471-10.patch
  xsa471-11.patch
  xsa471-12.patch
  xsa471-13.patch
  xsa471-14.patch
  xsa471-15.patch
  xsa471-16.patch
  xsa471-17.patch
  xsa471-18.patch
  xsa471-19.patch
  xsa471-20.patch
  xsa471-21.patch
  xsa471-22.patch
  xsa472-1.patch
  xsa472-2.patch
  xsa472-3.patch
  xsa475-1.patch
  xsa475-2.patch
  xsa476.patch
  xen.stubdom.newlib.patch

- bsc#1254180 - [SLES][15-SP7][x86_64][Build41647] virtxend service
  restart. Caused by a failure to start xenstored.
  x86-have-.note.Xen-segment-contents-before-others.patch

- bsc#1252692 - VUL-0: CVE-2025-58149: xen: incorrect removal of
  permissions on PCI device unplug allows PV guests to access
  memory of devices no longer assigned to it (XSA-476)
  xsa476.patch

- bsc#1251271 - VUL-0: CVE-2025-58147,CVE-2025-58148: xen:
  Incorrect input sanitisation in Viridian hypercalls (XSA-475)
  xsa475-1.patch
  xsa475-2.patch

- bsc#1248807 - VUL-0: CVE-2025-27466, CVE-2025-58142,
  CVE-2025-58143: xen: Mutiple vulnerabilities in the Viridian
  interface (XSA-472)
  xsa472-1.patch
  xsa472-2.patch
  xsa472-3.patch