- Fix unbounded NSEC3 iterations when validating referrals to
  unsigned delegations.
  (CVE-2026-1519)
  [bsc#1260805, bind-9.16-CVE-2026-1519.patch]

- Security fixes:
  * CVE-2026-1965: Bad reuse of HTTP Negotiate connection (bsc#1259362)
  * CVE-2026-3783: Token leak with redirect and netrc (bsc#1259363)
  * CVE-2026-3784: Wrong proxy connection reuse with credentials (bsc#1259364)
  * CVE-2026-3805: Use after free in SMB connection reuse (bsc#1259365)
  * Add patches:
  - curl-CVE-2026-1965.patch
  - curl-CVE-2026-3783.patch
  - curl-CVE-2026-3784.patch
  - curl-CVE-2026-3805.patch

- Security fix: [bsc#1256105, CVE-2025-14017]
  * call ldap_init() before setting the options
  * Add patch curl-CVE-2025-14017.patch

- Security fixes:
  * [bsc#1255731, CVE-2025-14524] if redirected, require permission to use bearer
  * [bsc#1255734, CVE-2025-15224] require private key or user-agent for public key auth
  * [bsc#1255732, CVE-2025-14819] toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache
  * [bsc#1255733, CVE-2025-15079] set both knownhosts options to the same file
  * Add patches:
  - curl-CVE-2025-14524.patch
  - curl-CVE-2025-15224.patch
  - curl-CVE-2025-14819.patch
  - curl-CVE-2025-15079.patch

- Add Channel Binding support for GSSAPI/GSS-SPNEGO; (bsc#1229655);
  (jsc#PED-12097); Add patch
  0008-Add-Channel-Binding-support-for-GSSAPI-GSS-SPNEGO.patch
- Add support for setting max ssf 0 to GSS-SPNEGO; (bsc#1229655);
  (jsc#PED-12097); Add patch
  0009-Add-support-for-setting-max-ssf-0-to-GSS-SPNEGO.patch

- use %license tag [bsc#1252142]

- Places a hard cap on the amount of mechanisms that can be specified and
  encoded in the payload. (bsc#1253904, CVE-2025-58181)
  * 0007-CVE-2025-58181-fix-vendor-crypto-ssh.patch

- Add CVE fixes:
  + glib2-CVE-2026-1484.patch (bsc#1257355 CVE-2026-1484
    glgo#GNOME/glib!4979).
  + glib2-CVE-2026-1485.patch (bsc#1257354 CVE-2026-1485
    glgo#GNOME/glib!4981).
  + glib2-CVE-2026-1489.patch (bsc#1257353 CVE-2026-1489
    glgo#GNOME/glib!4984).

- Add glib2-CVE-2026-0988.patch: fix a potential integer overflow
  in g_buffered_input_stream_peek (bsc#1257049 CVE-2026-0988
  glgo#GNOME/glib#3851).

- memalign-overflow-check.patch: memalign: reinstate alignment overflow
  check (CVE-2026-0861, bsc#1256766, BZ #33796)
- nss-dns-getnetbyaddr.patch: resolv: Fix NSS DNS backend for getnetbyaddr
  (CVE-2026-0915, bsc#1256822, BZ #33802)
- wordexp-wrde-reuse.patch: posix: Reset wordexp_t fields with WRDE_REUSE
  (CVE-2025-15281, bsc#1257005, BZ #33814)

- regcomp-double-free.patch: posix: Fix double-free after allocation
  failure in regcomp (CVE-2025-8058, bsc#1246965, BZ #33185)

- Security fix [bsc#1256389] (gpg.fail/filename)
  * Added gnupg-accepts-path-separators-literal-data.patch
  * GnuPG Accepts Path Separators and Path Traversals in Literal Data

- Security fix: [bsc#1255715, CVE-2025-68973] (gpg.fail/memcpy)
  * gpg: Fix possible memory corruption in the armor parser [T7906]
  * Add gnupg-CVE-2025-68973.patch

- Security fix: [bsc#1256246] (gpg.fail/sha1)
  * gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures [T7904]
  * Add gnupg-gpg-Avoid-potential-downgrade-to-SHA1-in-3rd-party-keysig.patch

- Security fix: [bsc#1256244] (gpg.fail/detached)
  * gpg: Error out on unverified output for non-detached signatures [T7903]
  * Add gnupg-gpg-Error-out-on-unverified-output-for-non-detached-signatures.patch

- Security fix: [bsc#1256390] (gpg.fail/notdash)
  * gpg2: Cleartext Signature Forgery in the NotDashEscaped header
    implementation in GnuPG
  * Add patch gnupg-notdash-escape.patch
  * Add patch compat_flags_base.patch
  * Add patch parse_compat_flags.patch

- Fix double free in xen booting if root filesystem is Btrfs (bsc#1259543)
  * grub2-btrfs-01-add-ability-to-boot-from-subvolumes.patch
  * grub2-btrfs-09-get-default-subvolume.patch

- Backport upstream's commit to prevent BIOS assert (bsc#1258022)
  * 0001-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch

- Update to 20240116.3
  * Fix potential integer overflow in hash container create/resize (bsc#1237543, CVE-2025-0838)
    The sized constructors, reserve(), and rehash() methods of
    absl::{flat,node}_hash_{set,map} did not impose an upper bound on
    their size argument. As a result, it was possible for a caller to pass
    a very large size that would cause an integer overflow when computing
    the size of the container's backing store. Subsequent accesses to the
    container might then access out-of-bounds memory.
- from version 20240116.2
  * Prevent overflow in absl::CEscape(). Strings larger than 1 GiB on a
    platform with a 32-bit size_t could potentially overflow size_t in
    `CEscapedLength()`, resulting in an undersized allocation. The resulting
    write in `CEscapeAndAppendInternal()` would then write beyond the bounds
    of the output buffer.
  * A second overflow, where the calculated escaped length is added to the
    size of the string being appended to, is also fixed. In both cases the
    program will now abort prior to the overflow.
  * Workaround for NVIDIA C++ compiler being unable to parse variadic
    expansions in range of range-based for loop

- Update to version 20240116.3
  * Fix potential integer overflow in hash container create/resize (#1813)
    (bsc#1237543, CVE-2025-0838)
- from version 20240116.2
  * Abseil LTS Branch, Jan 2024, Patch 2 (#1650)
  - Prevent overflow in absl::CEscape()
  - Workaround for NVIDIA C++ compiler being unable to parse variadic
    expansions in range of range-based for loop
  - Fix OSX support with CocoaPods and Xcode 15
  - PR #1643: add xcprivacy to all subspecs

- Add avahi-CVE-2025-68276.patch:
  Backport 0c013e2 from upstream, refuse to create wide-area record
  browsers when wide-area is off.
  (CVE-2025-68276, bsc#1256498)

- Add avahi-CVE-2025-68471.patch:
  Backport 9c6eb53 from upstream, fix DoS bug by changing assert to
  return.
  (CVE-2025-68471, bsc#1256500)

- Add avahi-CVE-2025-68468.patch:
  Backport f66be13 from upstream, fix DoS bug by removing incorrect
  assertion.
  (CVE-2025-68468, bsc#1256499)

- Recognize fuse "portal" as a virtual file system (boo#1234736,
  util-linux-libmount-fuse-portal.patch).

- fdisk: Fix possible partition overlay and data corruption if EBR
  gap is missing (boo#1222465,
  util-linux-libfdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-2.patch,
  util-linux-libfdisk-ebr-missing-gap-2.patch,
  util-linux-tests-fdisk-ebr-missing-gap-3.patch).

- Use full hostname for PAM to ensure correct access control for
  "login -h" (bsc#1258859, CVE-2026-3184,
  util-linux-CVE-2026-3184.patch).

- CVE-2026-4878: Fixed a a potential TOCTOU race condition in cap_set_file() (bsc#1261809)
  0001-Address-a-potential-TOCTOU-race-condition-in-cap_set.patch:

- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch

- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch

- Add gcc14-bsc1257463.patch to fix bogus expression simplification
  [bsc#1257463]

- Security fix:
  * CVE-2025-14831: DoS via excessive resource consumption during
    certificate verification (bsc#1257960)
  * Add gnutls-CVE-2025-14831.patch

- Add patch fix-bsc1259924.patch (bsc#1259924, CVE-2025-69720)
  * Backport from ncurses-6.5-20251213.patch

- added patches
  https://github.com/nghttp2/nghttp2/commit/61caf66f1b002105e5603fba030de57d445330a8
  * nghttp2-TZ-fix-test-failure.patch

- added patches
  CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845)
  * nghttp2-CVE-2026-27135.patch

- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch

- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * NULL pointer dereference when processing an
    OCSP response (bsc#1260446)
  * Add	patches:
    openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch
    openssl-CVE-2026-28389.patch
    openssl-CVE-2026-31789.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch

- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795], [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]

- Security fix: [bsc#1255765, CVE-2025-11961]
  * Fix out-of-bound-write and out-of-bound-read in pcap_ether_aton()
    due to missing validation of provided MAC-48 address string
  * Add libpcap-CVE-2025-11961.patch

- added patches
  CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code execution (bsc#1260754)
  * libpng16-CVE-2026-33416-1.patch
  * libpng16-CVE-2026-33416-2.patch
  * libpng16-CVE-2026-33416-3.patch
  * libpng16-CVE-2026-33416-4.patch

- added patches
  CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
  * libpng16-CVE-2026-25646.patch

- security update
- added patches
  CVE-2025-28162 [bsc#1257364], memory leaks when running `pngimage`
  CVE-2025-28164 [bsc#1257365], memory leaks when running `pngimage`
  * libpng16-CVE-2025-28162,28164.patch

- security update
- added patches
  CVE-2026-22695 [bsc#1256525], Heap buffer over-read in png_image_finish_read
  * libpng16-CVE-2026-22695.patch
  CVE-2026-22801 [bsc#1256526], Integer truncation causing heap buffer over-read in png_image_write_*
  * libpng16-CVE-2026-22801.patch

- avoid reading endless amounts of memory (CVE-2026-4897 bsc#1260859)
  0001-CVE-2026-4897-getline-string-overflow.patch

- Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has
  the same security model as open(). The documented limitations
  ensure compatibility with non-filesystem loaders; Python
  doesn't check that. (bsc#1259989, CVE-2026-3479,
  gh#python/cpython#146121).

- Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
  leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
  gh#python/cpython#143930).

- Add CVE-2025-13462-tarinfo-header-parse.patch which skips
  TarInfo DIRTYPE normalization during GNU long name handling
  (bsc#1259611, CVE-2025-13462).

- Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
  unbound C recursion in conv_content_model in pyexpat.c
  (bsc#1259735, CVE-2026-4224).

- Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
  control characters in http.cookies.Morsel.update() and
  http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644).

- Fix changelog

- Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
  ensuring that `SourcelessFileLoader` uses `io.open_code` when
  opening `.pyc` files (bsc#1259240, CVE-2026-2297).

- Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
  Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

- CVE-2025-11468: preserving parens when folding comments in
  email headers (bsc#1257029, gh#python/cpython#143935).
  CVE-2025-11468-email-hdr-fold-comment.patch
- CVE-2026-0672: rejects control characters in http cookies.
  (bsc#1257031, gh#python/cpython#143919)
  CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
- CVE-2026-0865: rejecting control characters in
  wsgiref.headers.Headers, which could be abused for injecting
  false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
  CVE-2026-0865-wsgiref-ctrl-chars.patch
- CVE-2025-15366: basically the same as the previous patch for
  IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
  CVE-2025-15366-imap-ctrl-chars.patch
- CVE-2025-15282: basically the same as the previous patch for
  urllib library. (bsc#1257046, gh#python/cpython#143925)
  CVE-2025-15282-urllib-ctrl-chars.patch
- CVE-2025-15367: basically the same as the previous patch for
  poplib library. (bsc#1257041, gh#python/cpython#143923)
  CVE-2025-15367-poplib-ctrl-chars.patch
- CVE-2025-12781: fix decoding with non-standard Base64 alphabet
  (bsc#1257108, gh#python/cpython#125346)
  CVE-2025-12781-b64decode-alt-chars.patch

- Add CVE-2025-13836-http-resp-cont-len.patch (bsc#1254400,
  CVE-2025-13836) to prevent reading an HTTP response from
  a server, if no read amount is specified, with using
  Content-Length per default as the length.
- Add CVE-2025-12084-minidom-quad-search.patch prevent quadratic
  behavior in node ID cache clearing (CVE-2025-12084,
  bsc#1254997).
- Add CVE-2025-13837-plistlib-mailicious-length.patch protect
  against OOM when loading malicious content (CVE-2025-13837,
  bsc#1254401).

- CVE-2025-11468: preserving parens when folding comments in
  email headers (bsc#1257029, gh#python/cpython#143935).
  CVE-2025-11468-email-hdr-fold-comment.patch
- CVE-2026-0672: rejects control characters in http cookies.
  (bsc#1257031, gh#python/cpython#143919)
  CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
- CVE-2026-0865: rejecting control characters in
  wsgiref.headers.Headers, which could be abused for injecting
  false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
  CVE-2026-0865-wsgiref-ctrl-chars.patch
- CVE-2025-15366: basically the same as the previous patch for
  IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
  CVE-2025-15366-imap-ctrl-chars.patch
- CVE-2025-15282: basically the same as the previous patch for
  urllib library. (bsc#1257046, gh#python/cpython#143925)
  CVE-2025-15282-urllib-ctrl-chars.patch
- CVE-2025-15367: basically the same as the previous patch for
  poplib library. (bsc#1257041, gh#python/cpython#143923)
  CVE-2025-15367-poplib-ctrl-chars.patch
- Modify CVE-2024-6923-email-hdr-inject.patch to also include
  patch for bsc#1257181 (CVE-2026-1299).

- Security fix: [bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277]
  * check Y==Z in addition to X==0
  * Add patch libsodium-CVE-2025-15444.patch

- Sync version 3.51.3 from Factory:
  * Fix the WAL-reset database corruption bug:
    https://sqlite.org/wal.html#walresetbug

- Sync version 3.51.2 from Factory:
  * bsc#1259619, CVE-2025-70873: zipfile extension may disclose
    uninitialized heap memory during inflation.
  * bsc#1254670, CVE-2025-7709: Integer Overflow in FTS5 Extension
  * bsc#1248586: Fix icu-enabled build.

- CVE-2026-3731: Denial of Service via out-of-bounds read in SFTP extension name handler  (bsc#1259377)
  Added libssh-CVE-2026-3731.patch

- Security fixes:
  * CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
  * CVE-2026-0965: Possible Denial of Service when parsing unexpected
    configuration files (bsc#1258045)
  * CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
  * CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
  * CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
  * Add patches:
  - libssh-CVE-2026-0964-scp-Reject-invalid-paths-received-thro.patch
  - libssh-CVE-2026-0965-config-Do-not-attempt-to-read-non-regu.patch
  - libssh-CVE-2026-0966-misc-Avoid-heap-buffer-underflow-in-ss.patch
  - libssh-CVE-2026-0966-tests-Test-coverage-for-ssh_get_hexa.patch
  - libssh-CVE-2026-0966-doc-Update-guided-tour-to-use-SHA256-f.patch
  - libssh-CVE-2026-0967-match-Avoid-recursive-matching-ReDoS.patch
  - libssh-CVE-2026-0968-sftp-Sanitize-input-handling-in-sftp_p.patch

- Update version to 1.21.1:
  - Fix nil token handling (bsc#1261155)
  - Switch to using go1.24-openssl as the default Go version to
    install to support building the package (jsc#SCC-585).

- Update version to 1.21:
  - Add expanded metric collection for kernel modules and hardware
    detection (jsc#TEL-226).
  - Support new profile based metric collection
  - Fix ignored --root parameter hanbling when reading and
    writing configuration (bsc#1257667)
  - Add expanded metric collection for system vendor/manfacturer
    (jsc#TEL-260).
  - Removed backport patch: fix-libsuseconnect-and-pci.patch
  - Add missing product id to allow yast2-registration to not break (bsc#1257825)
  - Fix libsuseconnect APIError detection logic (bsc#1257825)

- Regressions found during QA test runs:
  - Ignore product in announce call (bsc#1257490)
  - Registration to SMT server with failed (bsc#1257625)
  - Backported by PATCH: fix-libsuseconnect-and-pci.patch

- Update version to 1.20:
  - Update error message for Public Cloud instances with registercloudguest
    installed. SUSEConnect -d is disabled on PYAG and BYOS when the
    registercloudguest command is available. (bsc#1230861)
  - Enhanced SAP detected. Take TREX into account and remove empty values when
    only /usr/sap but no installation exists (bsc#1241002)
  - Fixed modules and extension link to point to version less documentation. (bsc#1239439)
  - Fixed SAP instance detection (bsc#1244550)
  - Remove link to extensions documentation (bsc#1239439)
  - Migrate to the public library

- Version 1.14 public library release
  This version is only available on Github as a tag to release the
  new golang public library which can be consumed without the need
  to interface with SUSEConnect directly.

- Import commit 8b6ed60a0c43c2c59be030fa58c6da1d3b9d43ad
  6a38d88a42 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
  8c9a592e5a udev: fix review mixup
  b57007a917 udev-builtin-net-id: print cescaped bad attributes
  ee23c7604b udev-builtin-net_id: do not assume the current interface name is ethX
  0f63e799e6 udev: ensure tag parsing stays within bounds
  046f52ec12 udev: ensure there is space for trailing NUL before calling sprintf
  5be21460ce udev: check for invalid chars in various fields received from the kernel (bsc#1259697)

- Import commit 6099da9424208d31f293bed34be0298192e5e41d
  9559607b16 core/cgroup: avoid one unnecessary strjoina()
  fcae348ca4 core: validate input cgroup path more prudently (CVE-2026-29111 bsc#1259418)
  a3ca6b3031 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere
  08125d6b06 units: add dep on systemd-logind.service by user@.service

- Security fix: [bsc#1256341, CVE-2025-13151]
  * Stack-based buffer overflow. The function asn1_expend_octet_string()
    fails to validate the size of input data resulting in a buffer overflow.
  * Add libtasn1-CVE-2025-13151.patch

- CVE-2026-0990: call stack overflow leading to application crash
  due to infinite recursion in `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811)
  * Add patch libxml2-CVE-2026-0990.patch
- CVE-2026-0992: excessive resource consumption when processing XML
  catalogs due to exponential behavior when handling `<nextCatalog>` elements (bsc#1256808, bsc#1256809, bsc#1256812)
  * Add patch libxml2-CVE-2026-0992.patch
- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850)
  * Add patch libxml2-CVE-2025-8732.patch

- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257593, bsc#1257594, bsc#1257595)
  * Add patch libxml2-CVE-2026-1757.patch

- CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)
  * Add patch libxml2-CVE-2025-10911.patch

- CVE-2026-0989: call stack exhaustion leading to application crash
  due to RelaxNG parser not limiting the recursion depth when
  resolving `<include>` directives (bsc#1256804, bsc#1256805, bsc#1256810)
  * Add patch libxml2-CVE-2026-0989.patch
  * https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374

- CVE-2025-10911 will be fixed on libxml2 side instead [bsc#1250553]
- deleted patches
  * libxslt-CVE-2025-10911.patch

- Fix CVE-2026-27171, infinite loop via the crc32_combine64 and
  crc32_combine_gen64 functions due to missing checks for negative
  lengths (bsc#1258392)
  * CVE-2026-27171.patch

- update to NSS 3.112.4
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1935995 - make ss->ssl3.hs.cookie an owned-copy of the cookie.

- update to NSS 3.112.3
  * bmo#2009552 - avoid integer overflow in platform-independent ghash

- Add python36-certifi provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-idna provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-importlib-metadata provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-packaging provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-ply provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- CVE-2026-30922: Denial of Service via Unbounded Recursion (bsc#1259803)
  Add patch CVE-2026-30922.patch

- fix regression in tests from CVE-2026-23490.patch (bsc#1257129)

- Add CVE-2026-23490.patch to fix CVE-2026-23490 (bsc#1256902)
- fix broken changelog entries

- Add python36-pyasn1 provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pytz provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-py provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36- provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-six provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- fix regression in CVE-2025-66471.patch when downloading large files
  (bsc#1259829)

- Add security patches:
  * CVE-2025-66471 (bsc#1254867)
  * CVE-2025-66418 (bsc#1254866)
  * CVE-2026-21441 (bsc#1256331)

- Add patch CVE-2025-69223-auto_decompress-zip-bomb.patch:
  * Prevent zip bomb with parser auto_compress feature.
    (bsc#1256017, CVE-2025-69223, GHSA-6mq8-rvhq-8wgg)
- Add patch CVE-2025-69224-unicode-processing-header-values.patch:
  * Check for ASCII in header values
    (bsc#1256018, CVE-2025-69224, GHSA-69f9-5gxw-wvc2)
- Add patch CVE-2025-69225-forbid-non-ascii-in-range.patch:
  * Forbid non-ASCII decimals in the Range header
    (bsc#1256019, CVE-2025-69225, GHSA-mqqc-3gqh-h2x8)
- Add patch CVE-2025-69226-brute-force-leak-static-elements.patch:
  * Reject static URLs that traverse outside static root
    (bsc#1256020, CVE-2025-69226, GHSA-54jq-c3m8-4m76)
- Add patch CVE-2025-69227-raise-exceptions-not-asserts.patch:
  * Raise exceptions when processing a POST body
    (bsc#1256021, CVE-2025-69227, GHSA-jj3x-wxrx-4x23)
- Add patch CVE-2025-69228-enforce-client_max_size-for-entire-multipart.patch
  * Enforce client_max_size over entire multipart form
    (bsc#1256022, CVE-2025-69228, GHSA-6jhg-hg63-jvvf)
- Add patch CVE-2025-69229-small-chunk-exhaustion.patch:
  * Pause reading of chunks when it reaches a high water mark
    (bsc#1256023, CVE-2025-69229, GHSA-g84x-mcqj-x9qq)
- Add patch use-correct-warning-pytest-warns.patch:
  * Look for correct warning during the testsuite.

- Add CVE-2026-21226.patch to fix deserialization of untrusted data in
  Azure Core shared client library for Python allowing an authorized
  attacker to execute code over a network (bsc#1257703, CVE-2026-21226)

- Add CVE-2025-68480.patch to fix CVE-2025-68480 (bsc#1255473)

- Add CVE-2026-1703.patch to fix bsc#1257599
  (bsc#1257599, CVE-2026-1703, gh#pypa/pip#13777)

- Add CVE-2026-0994.patch to fix google.protobuf.Any recursion depth
  bypass in Python json_format.ParseDict (bsc#1257173, CVE-2026-0994)

- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808)
  Add patch CVE-2026-27459.patch

- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804)
  Add patch CVE-2026-27448.patch

- Add patch pep-0639.patch to implement basic PEP 639 support,
  jsc#PED-14457, bsc#1254255
- Skip failing test test_debugging_tips

- Add CVE-2026-24049.patch to fix CVE-2026-24049 (bsc#1257100)

- 15.5.20260227 (tracked in bsc#933411)
- Added note about libmfx being removed (jsc#PED-10574)
- Updated note to say that AArch64 supports both 4K and 64K block
  sizes (bsc#1212186)
- Updated image filenames (jsc#DOCTEAM-1068)

- Add Microsoft-signed 16.1 shim
- shim.spec: Temporarily disable nx-shim
  - We still need time to test nx (non-executable) shim and develop
    the script for delivery. We will not support nx-shim on all Leap
    and SLE distros because the function should also be supported by
    grub2 and kernel.
- shim.spec: Remove the reproducibility check for the shim binary
  - The binutils on Leap 15.6 and SLE-15-SP3 has been upgraded to 2.45
    when we are waiting shim-review and Microsoft signing. It causes
    that the shim binary is NOT reproducible on build services.
  - We just direct use the Microsoft signed-back shim binaries
    because we build this binary before and have the logs to prove it.
    Before we find a good approach to save/restore the build service
    environment, let’s directly use the Microsoft signed-back shim for
    delivery.
- Certificates: Add Microsoft UEFI CA files to the target certificates
  array in pretrans script.
- Certificates: Convert the SUSE certificates from PEM to DER format
- timestamp.pl: fix the size of checksum in PE Optional Header
- shim.spec: Workaround the string comparison issue in elif directive
- shim.spec: Specify the certificate format in openssl commands
- shim.spec: Use io.open instead of pcall rpm.open in pretrans lua script

- Add a pretrans script to verify that the UEFI db should have the
  necessary certificate to allow the shim binary to boot. The installation
  will be aborted if the db is missing the target certificate. To proceed,
  the user must enroll the target certificate in the db or disable UEFI
  Secure Boot.

- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]

- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in
    codebase.
  - Set the minimum version is gcc-13.
    if gcc_version < 13
    define gcc_version 13
    endif
  (bsc#1247432)

- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'

- Using gcc12 for building shim/shim-nx
  - The gcc12 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 12
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc12
  (bsc#1247432)

- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)

- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)

Factory: Fri Jul 25 05:44:51 UTC 2025 - Joey Lee <jlee@suse.com>
- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)

Factory: Wed May 28 03:37:04 UTC 2025 - Tseng <dennis.tseng@suse.com>
- add revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)

Factory: Tue May  6 06:19:02 UTC 2025 - Dennis <dennis.tseng@suse.com>
- Update to version 16.0
  - https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS->LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry->revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0

Factory: Tue Jun 25 04:12:39 UTC 2024 - Dennis Tseng <dennis.tseng@suse.com>
- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc
  - asc files of shim-15.8 for sles is already updated on Apr 18, 2024
    signature-sles.x86_64.asc,
    signature-sles.aarch64.asc.

Factory: Mon Feb 26 13:09:29 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.

Factory: Sat Feb 17 07:51:01 UTC 2024 - Joey Lee <jlee@suse.com>
- Modified shim.spec file to add suffix string of project to filename
  of included certificates. e.g.
    rpm -pql shim-15.8-lp155.6.1.x86_64.rpm
    /etc/uefi
    /etc/uefi/certs
    /etc/uefi/certs/2B697CB1-shim-devel.crt
    /etc/uefi/certs/4659838C-shim-opensuse.crt
    /etc/uefi/certs/BCA4E38E-shim-sles.crt
  The original name of crt files are:
    /etc/uefi/certs/2B697CB1-shim.crt
    /etc/uefi/certs/4659838C-shim.crt
    /etc/uefi/certs/BCA4E38E-shim.crt
  It can indicate the souce project of certificates.

n/a

n/a

n/a

n/a

n/a

n/a

n/a

n/a

- CVE-2026-35535: potential privilege escalation when running
  the mailer (bsc#1261420)
  * fix-CVE-2026-35535.patch

- scplugin.rc is restored in package 3.2.12.1 for continued compatibility.
  There is no furture development for scplugin.rc. Use supportconfig.rc.
  Package version 3.2.12.2 does not have scplugin.rc. Supportconfig
  itself is the same for both versions. (bsc#1256709)

- Changes to version 3.2.12
  + Optimized lsof usage and honors OPTION_OFILES (bsc#1232351, PR#274)
  + Run in containers without errors (bsc#1245667, PR#272)
  + Removed pmap PID from memory.txt (bsc#1246011, PR#263)
  + Added missing /proc/pagetypeinfo to memory.txt (bsc#1246025, PR#264)
  + Improved database perforce with kGraft patching (bsc#1249657, PR#273)
  + Using last boot for journalctl for optimization (bsc#1250224, PR#287)
  + Fixed extraction failures (bsc#1252318, PR#275)
  + Update supportconfig.conf path in docs (bsc#1254425, PR#281)
  + drm_sub_info: Catch error when dir doesn't exist (PR#265)
  + Replace remaining `egrep` with `grep -E` (PR#261, PR#266)
  + Add process affinity to slert logs (PR#269)
  + Reintroduce cgroup statistics (and v2) (PR#270)
  + Minor changes to basic-health-check: improve information level (PR#271)
  + Collect important machine health counters (PR#276)
  + powerpc: collect hot-pluggable PCI and PHB slots (PR#278)
  + podman: collect podman disk usage (PR#279)
  + Exclude binary files in crondir (PR#282)
  + kexec/kdump: collect everything under /sys/kernel/kexec dir (PR#284)
  + Use short-iso for journalctl (PR#288)

- Changes to version 3.2.11
  + Collect rsyslog frule files (bsc#1244003, pr#257)
  + Remove proxy passwords (bsc#1244011, pr#257)
  + Missing NetworkManager information (bsc#1241284, pr#257)
  + Include agama logs bsc#1244937, pr#256)
  + Additional NFS conf files (pr#253)
  + New fadump sysfs files (pr#252)
  + Fixed change log dates

- Drop last sysvinit Requirement/Provide (PED-13698)

- Fix bsc#1246399 / CVE-2025-45582.
- Add patch:
  * CVE-2025-45582.patch

- Recognize fuse "portal" as a virtual file system (boo#1234736,
  util-linux-libmount-fuse-portal.patch).

- fdisk: Fix possible partition overlay and data corruption if EBR
  gap is missing (boo#1222465,
  util-linux-libfdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-2.patch,
  util-linux-libfdisk-ebr-missing-gap-2.patch,
  util-linux-tests-fdisk-ebr-missing-gap-3.patch).

- Use full hostname for PAM to ensure correct access control for
  "login -h" (bsc#1258859, CVE-2026-3184,
  util-linux-CVE-2026-3184.patch).

* Update Vim to version 9.2.0110 (from 9.2.0045).
  * Specifically, this fixes bsc#1259051 / CVE-2026-28417.

* Update Vim to version 9.2.0045 (from 9.1.1629).
  * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed
  upstream).
  * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed
  upstream).
  * Drop obsolete or upstreamed patches:
  - vim-7.3-filetype_spec.patch
  - vim-7.4-filetype_apparmor.patch
  - vim-8.2.2411-globalvimrc.patch
  - vim-9.1.1683-avoid-null-dereference.patch
  * Refresh the following patches:
  - vim-7.3-filetype_changes.patch
  - vim-7.3-filetype_ftl.patch
  - vim-7.3-sh_is_bash.patch
  - vim-9.1.1134-revert-putty-terminal-colors.patch
  * Remove autoconf BuildRequires and drop the autoconf call in %build.
  * Add --with-wayland=no to COMMON_OPTIONS to explicitly disable wayland.
  * Package new Swedish (sv) man pages and clean up duplicate encodings
  (sv.ISO8859-1 and sv.UTF-8) during %install.

- bsc#1259247 - VUL-0: CVE-2026-23554: xen: Use after free of
  paging structures in EPT (XSA-480)
  xsa480.patch

- bsc#1256745 - VUL-0: CVE-2025-58150: xen: x86: buffer overrun
  with shadow paging + tracing (XSA-477)
  xsa477.patch
- bsc#1256747 - VUL-0: CVE-2026-23553: xen: x86: incomplete IBPB
  for vCPU isolation (XSA-479)
  xsa479.patch