- Fix deny exec of rpc_witness; (bsc#1225811).
  * add apparmor-rpcd-witness.patch
- Add some misc fixes for samba-4.21.x denies; (bsc#1259441).
  * add samba-misc-rpcd-spoolss.patch

- fix deadlock on map entry removal (bsc#1246325)
  * 0001-autofs-5.1.9-fix-get-parent-multi-mount-check-in-try.patch
  * 0002-autofs-5.1.9-fix-deadlock-in-remount.patch
  * 0003-CHANGELOG-add-a-few-missing-entries.patch
  * 0004-autofs-5.1.9-quiet-possibly-noisy-log-message.patch
  * 0005-autofs-5.1.9-fix-devid-update-on-reload.patch
  * 0006-autofs-5.1.9-fix-cache-writelock-must-be-taken-in-up.patch
  * 0007-autofs-5.1.9-fix-skip-valid-map-entries-on-expire-cl.patch
  * 0008-autofs-5.1.9-remove-unnecessary-call-to-set_direct_m.patch
  * 0009-autofs-5.1.9-remove-unnecessary-assignment-in-umount.patch
  * 0010-autofs-5.1.9-fix-direct-mount-trigger-umount-failure.patch
  * 0011-autofs-5.1.9-refactor-do_umount_autofs_direct.patch
  * 0012-autofs-5.1.9-fix-stale-direct-mount-trigger-not-umou.patch
  * 0013-autofs-5.1.9-add-function-table_lookup_ino.patch
  * 0014-autofs-5.1.9-improve-handling-of-missing-map-entry-f.patch

- Fix autofs-5.1.1-dbus-udisks-monitor.patch (bsc#1246612) to account for:
  * d2feac6784b6 autofs-5.1.6 - make autofs.a a shared library
  * bcd8e1b642e9 autofs-5.0.7 - use LIBS for link libraries

- Fix unbounded NSEC3 iterations when validating referrals to
  unsigned delegations.
  (CVE-2026-1519)
  [bsc#1260805, bind-9.18-CVE-2026-1519.patch]

- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
  * Enable and prioritize sntrup761x25519-sha512 for OpenSSH by default
  * Add crypto-policies-OpenSSH-PQC.patch

- Security fixes:
  * CVE-2026-1965: Bad reuse of HTTP Negotiate connection (bsc#1259362)
  * CVE-2026-3783: Token leak with redirect and netrc (bsc#1259363)
  * CVE-2026-3784: Wrong proxy connection reuse with credentials (bsc#1259364)
  * CVE-2026-3805: Use after free in SMB connection reuse (bsc#1259365)
  * Add patches:
  - curl-CVE-2026-1965.patch
  - curl-CVE-2026-3783.patch
  - curl-CVE-2026-3784.patch
  - curl-CVE-2026-3805.patch

- use %license tag [bsc#1252142]

- Places a hard cap on the amount of mechanisms that can be specified and
  encoded in the payload. (bsc#1253904, CVE-2025-58181)
  * 0007-CVE-2025-58181-fix-vendor-crypto-ssh.patch

- resolv-count-resource-records.patch: resolv: Count records correctly
  (CVE-2026-4437, bsc#1260078, BZ #34014)
- resolv-check-hostname.patch: resolv: Check hostname for validity
  (CVE-2026-4438, bsc#1260082, BZ #34015)

- nss-missing-checks.patch: nss: Missing checks in __nss_configure_lookup,
  __nss_database_get (bsc#1258319, BZ #28940)

- Security fix [bsc#1257396, CVE-2026-24882]
  - gpg2: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys
  - Added gnupg-CVE-2026-24882.patch

- Security fix: [bsc#1256389] (gpg.fail/filename)
  * GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field
  * Add gnupg-accepts-path-separators-literal-data.patch

- Fix PowerPC network boot prefix to correctly locate grub.cfg (bsc#1249385)
  * 0001-ieee1275-Use-net-config-for-boot-location-instead-of.patch

- Fix double free in xen booting if root filesystem is Btrfs (bsc#1259543)
  * grub2-btrfs-01-add-ability-to-boot-from-subvolumes.patch
  * grub2-btrfs-09-get-default-subvolume.patch

- Backport upstream's commit to prevent BIOS assert (bsc#1258022)
  * 0001-kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-t.patch

- Fix error "grub-core/script/lexer.c:352:out of memory" after PowerPC CAS
  Reboot (bsc#1254299)
  * 0001-Fix-PowerPC-CAS-reboot-to-evaluate-menu-context.patch

- add CVE fix (CVE-2024-58251 bsc#1254324)
  * ss-escape-characters-in-command-name.patch

- Add avahi-CVE-2026-24401.patch: Fix unsolicited mDNS response
  containing a recursive CNAME record (bsc#1257235).

- Recognize fuse "portal" as a virtual file system (boo#1234736,
  util-linux-libmount-fuse-portal.patch).

- fdisk: Fix possible partition overlay and data corruption if EBR
  gap is missing (boo#1222465,
  util-linux-libfdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-1.patch,
  util-linux-tests-fdisk-ebr-missing-gap-2.patch,
  util-linux-libfdisk-ebr-missing-gap-2.patch,
  util-linux-tests-fdisk-ebr-missing-gap-3.patch).

- Use full hostname for PAM to ensure correct access control for
  "login -h" (bsc#1258859, CVE-2026-3184,
  util-linux-CVE-2026-3184.patch).

- CVE-2026-4878: Fixed a a potential TOCTOU race condition in cap_set_file() (bsc#1261809)
  0001-Address-a-potential-TOCTOU-race-condition-in-cap_set.patch:

- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch

- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch

- Add gcc14-bsc1257463.patch to fix bogus expression simplification
  [bsc#1257463]

- Add the functionality to allow to specify the hash algorithm for
  the PSK. This fixes a bug in the current implementation where the
  binder is always calculated with SHA256.
  * (bsc#1258083, jsc#PED-15752, jsc#PED-15753)
  * lib/psk: Add gnutls_psk_allocate_{client,server}_credentials2
  * tests/psk-file: Add testing for _credentials2 functions
  * lib/psk: add null check for binder algo
  * pre_shared_key: fix memleak when retrying with different binder algo
  * pre_shared_key: add null check on pskcred
  * Add patches:
  - gnutls-PSK-hash.patch
  - gnutls-PSK-hash-tests.patch
  - gnutls-PSK-hash-NULL-check.patch
  - gnutls-PSK-hash-NULL-check-pskcred.patch
  - gnutls-PSK-hash-fix-memleak.patch

- Security fix:
  * CVE-2025-14831: DoS via excessive resource consumption during
    certificate verification (bsc#1257960)
  * Add gnutls-CVE-2025-14831.patch

- jsc#PED-15735 - expose ldap_log.h in -devel
  * 0246-Include-ldap_log.h-in-devel.patch
- retcon .changes to satisfy source validator

- Add patch fix-bsc1259924.patch (bsc#1259924, CVE-2025-69720)
  * Backport from ncurses-6.5-20251213.patch

- Fix access checks when mounting subdirectories in NFSv3
  (CVE-2025-12801 bsc#1259204)
  - add Fix-access-checks-when-mounting-subdirectories-in-NFSv3.patch
  - add NFS-export-symlink-vulnerability-fix.patch
  - add configure-check-for-rpc_gss_seccreate.patch
  - add mountd-Minor-refactor-of-get_rootfh.patch
  - add mountd-Separate-lookup-of-the-exported-directory-and-the-m.patch
  - add support-Add-a-mini-library-to-extract-and-apply-RPC-creden.patch

- Split legacy libnfsidmap0 into a separate spec file (bsc#1246505)

- added patches
  https://github.com/nghttp2/nghttp2/commit/61caf66f1b002105e5603fba030de57d445330a8
  * nghttp2-TZ-fix-test-failure.patch

- added patches
  CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845)
  * nghttp2-CVE-2026-27135.patch

- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch

- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * NULL pointer dereference when processing an
    OCSP response (bsc#1260446)
  * Add	patches:
    openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch
    openssl-CVE-2026-28389.patch
    openssl-CVE-2026-31789.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch

- Enable MD2 in legacy provider (jsc#PED-15724)

- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch

- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch

- added patches
  CVE-2026-34757: Information disclosure and data corruption via use-after-free vulnerability [bsc#1261957]
  * libpng16-CVE-2026-34757.patch

- added patches
  CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code execution (bsc#1260754)
  * libpng16-CVE-2026-33416-1.patch
  * libpng16-CVE-2026-33416-2.patch
  * libpng16-CVE-2026-33416-3.patch
  * libpng16-CVE-2026-33416-4.patch
  CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and crashes (bsc#1260755)
  * libpng16-CVE-2026-33636.patch

- added patches
  CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
  * libpng16-CVE-2026-25646.patch

- avoid reading endless amounts of memory (CVE-2026-4897 bsc#1260859)
  0001-CVE-2026-4897-getline-string-overflow.patch

- Add CVE-2026-3479-pkgutil_get_data.patch pkgutil.get_data() has
  the same security model as open(). The documented limitations
  ensure compatibility with non-filesystem loaders; Python
  doesn't check that. (bsc#1259989, CVE-2026-3479,
  gh#python/cpython#146121).

- Add CVE-2026-4519-webbrowser-open-dashes.patch to reject
  leading dashes in webbrowser URLs (bsc#1260026, CVE-2026-4519,
  gh#python/cpython#143930).

- Add CVE-2025-13462-tarinfo-header-parse.patch which skips
  TarInfo DIRTYPE normalization during GNU long name handling
  (bsc#1259611, CVE-2025-13462).

- Add CVE-2026-4224-expat-unbound-C-recursion.patch avoiding
  unbound C recursion in conv_content_model in pyexpat.c
  (bsc#1259735, CVE-2026-4224).

- Add CVE-2026-3644-cookies-Morsel-update-II.patch to reject
  control characters in http.cookies.Morsel.update() and
  http.cookies.BaseCookie.js_output (bsc#1259734, CVE-2026-3644).

- Fix changelog

- Add CVE-2026-2297-SourcelessFileLoader-io_open_code.patch
  ensuring that `SourcelessFileLoader` uses `io.open_code` when
  opening `.pyc` files (bsc#1259240, CVE-2026-2297).

- Update to 3.11.15:
  - Security
  - gh-144125: BytesGenerator will now refuse to serialize
    (write) headers that are unsafely folded or delimited; see
    verify_generated_headers. (Contributed by Bas Bloemsaat and
    Petr Viktorin in gh-121650) (bsc#1257181, CVE-2026-1299).
  - gh-143935: Fixed a bug in the folding of comments when
    flattening an email message using a modern email policy.
    Comments consisting of a very long sequence of non-foldable
    characters could trigger a forced line wrap that omitted
    the required leading space on the continuation line,
    causing the remainder of the comment to be interpreted as
    a new header field. This enabled header injection with
    carefully crafted inputs (bsc#1257029 CVE-2025-11468).
  - gh-143925: Reject control characters in data: URL media
    types (bsc#1257046, CVE-2025-15282).
  - gh-143919: Reject control characters in http.cookies.Morsel
    fields and values (bsc#1257031, CVE-2026-0672).
  - gh-143916: Reject C0 control characters within
    wsgiref.headers.Headers fields, values, and parameters
    (bsc#1257042, CVE-2026-0865).
  - gh-142145: Remove quadratic behavior in xml.minidom node ID
    cache clearing. In order to do this without breaking
    existing users, we also add the ownerDocument attribute to
    xml.dom.minidom elements and attributes created by directly
    instantiating the Element or Attr class. Note that this way
    of creating nodes is not supported; creator functions like
    xml.dom.Document.documentElement() should be used instead
    (bsc#1254997, CVE-2025-12084).
  - gh-137836: Add support of the “plaintext” element, RAWTEXT
    elements “xmp”, “iframe”, “noembed” and “noframes”, and
    optionally RAWTEXT element “noscript” in
    html.parser.HTMLParser.
  - gh-136063: email.message: ensure linear complexity for
    legacy HTTP parameters parsing. Patch by Bénédikt Tran.
  - gh-136065: Fix quadratic complexity in
    os.path.expandvars() (bsc#1252974, CVE-2025-6075).
  - gh-119451: Fix a potential memory denial of service in the
    http.client module. When connecting to a malicious server,
    it could cause an arbitrary amount of memory to be
    allocated. This could have led to symptoms including
    a MemoryError, swapping, out of memory (OOM) killed
    processes or containers, or even system crashes
    (CVE-2025-13836, bsc#1254400).
  - gh-119452: Fix a potential memory denial of service in the
    http.server module. When a malicious user is connected to
    the CGI server on Windows, it could cause an arbitrary
    amount of memory to be allocated. This could have led to
    symptoms including a MemoryError, swapping, out of memory
    (OOM) killed processes or containers, or even system
    crashes.
  - gh-119342: Fix a potential memory denial of service in the
    plistlib module. When reading a Plist file received from
    untrusted source, it could cause an arbitrary amount of
    memory to be allocated. This could have led to symptoms
    including a MemoryError, swapping, out of memory (OOM)
    killed processes or containers, or even system crashes
    (bsc#1254401, CVE-2025-13837).
  - Library
  - gh-144833: Fixed a use-after-free in ssl when SSL_new()
    returns NULL in newPySSLSocket(). The error was reported
    via a dangling pointer after the object had already been
    freed.
  - gh-144363: Update bundled libexpat to 2.7.4
  - gh-90949: Add SetAllocTrackerActivationThreshold() and
    SetAllocTrackerMaximumAmplification() to xmlparser objects
    to prevent use of disproportional amounts of dynamic memory
    from within an Expat parser. Patch by Bénédikt Tran.
  - Core and Builtins
  - gh-120384: Fix an array out of bounds crash in
    list_ass_subscript, which could be invoked via some
    specificly tailored input: including concurrent
    modification of a list object, where one thread assigns
    a slice and another clears it.
  - gh-120298: Fix use-after free in list_richcompare_impl
    which can be invoked via some specificly tailored evil
    input.
  Remove upstreamed patches:
  - CVE-2025-11468-email-hdr-fold-comment.patch
  - CVE-2025-12084-minidom-quad-search.patch
  - CVE-2025-13836-http-resp-cont-len.patch
  - CVE-2025-13837-plistlib-mailicious-length.patch
  - CVE-2025-6075-expandvars-perf-degrad.patch
  - CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
  - CVE-2026-0865-wsgiref-ctrl-chars.patch
  - CVE-2025-15282-urllib-ctrl-chars.patch

- CVE-2025-11468: preserving parens when folding comments in
  email headers (bsc#1257029, gh#python/cpython#143935).
  CVE-2025-11468-email-hdr-fold-comment.patch
- CVE-2026-0672: rejects control characters in http cookies.
  (bsc#1257031, gh#python/cpython#143919)
  CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
- CVE-2026-0865: rejecting control characters in
  wsgiref.headers.Headers, which could be abused for injecting
  false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
  CVE-2026-0865-wsgiref-ctrl-chars.patch
- CVE-2025-15366: basically the same as the previous patch for
  IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
  CVE-2025-15366-imap-ctrl-chars.patch
- CVE-2025-15282: basically the same as the previous patch for
  urllib library. (bsc#1257046, gh#python/cpython#143925)
  CVE-2025-15282-urllib-ctrl-chars.patch
- CVE-2025-15367: basically the same as the previous patch for
  poplib library. (bsc#1257041, gh#python/cpython#143923)
  CVE-2025-15367-poplib-ctrl-chars.patch
- CVE-2025-12781: fix decoding with non-standard Base64 alphabet
  (bsc#1257108, gh#python/cpython#125346)
  CVE-2025-12781-b64decode-alt-chars.patch

- CVE-2025-11468: preserving parens when folding comments in
  email headers (bsc#1257029, gh#python/cpython#143935).
  CVE-2025-11468-email-hdr-fold-comment.patch
- CVE-2026-0672: rejects control characters in http cookies.
  (bsc#1257031, gh#python/cpython#143919)
  CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
- CVE-2026-0865: rejecting control characters in
  wsgiref.headers.Headers, which could be abused for injecting
  false HTTP headers. (bsc#1257042, gh#python/cpython#143916)
  CVE-2026-0865-wsgiref-ctrl-chars.patch
- CVE-2025-15366: basically the same as the previous patch for
  IMAP protocol. (bsc#1257044, gh#python/cpython#143921)
  CVE-2025-15366-imap-ctrl-chars.patch
- CVE-2025-15282: basically the same as the previous patch for
  urllib library. (bsc#1257046, gh#python/cpython#143925)
  CVE-2025-15282-urllib-ctrl-chars.patch
- CVE-2025-15367: basically the same as the previous patch for
  poplib library. (bsc#1257041, gh#python/cpython#143923)
  CVE-2025-15367-poplib-ctrl-chars.patch
- Modify CVE-2024-6923-email-hdr-inject.patch to also include
  patch for bsc#1257181 (CVE-2026-1299).

- Sync version 3.51.3 from Factory:
  * Fix the WAL-reset database corruption bug:
    https://sqlite.org/wal.html#walresetbug

- Sync version 3.51.2 from Factory:
  * bsc#1259619, CVE-2025-70873: zipfile extension may disclose
    uninitialized heap memory during inflation.
  * bsc#1254670, CVE-2025-7709: Integer Overflow in FTS5 Extension
  * bsc#1248586: Fix icu-enabled build.

- CVE-2026-3731: Denial of Service via out-of-bounds read in SFTP extension name handler  (bsc#1259377)
  Added libssh-CVE-2026-3731.patch

- Security fixes:
  * CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
  * CVE-2026-0965: Possible Denial of Service when parsing unexpected
    configuration files (bsc#1258045)
  * CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
  * CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
  * CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
  * Add patches:
  - libssh-CVE-2026-0964-scp-Reject-invalid-paths-received-thro.patch
  - libssh-CVE-2026-0965-config-Do-not-attempt-to-read-non-regu.patch
  - libssh-CVE-2026-0966-misc-Avoid-heap-buffer-underflow-in-ss.patch
  - libssh-CVE-2026-0966-tests-Test-coverage-for-ssh_get_hexa.patch
  - libssh-CVE-2026-0966-doc-Update-guided-tour-to-use-SHA256-f.patch
  - libssh-CVE-2026-0967-match-Avoid-recursive-matching-ReDoS.patch
  - libssh-CVE-2026-0968-sftp-Sanitize-input-handling-in-sftp_p.patch

- Update version to 1.21.1:
  - Fix nil token handling (bsc#1261155)
  - Switch to using go1.24-openssl as the default Go version to
    install to support building the package (jsc#SCC-585).

- Update version to 1.21:
  - Add expanded metric collection for kernel modules and hardware
    detection (jsc#TEL-226).
  - Support new profile based metric collection
  - Fix ignored --root parameter hanbling when reading and
    writing configuration (bsc#1257667)
  - Add expanded metric collection for system vendor/manfacturer
    (jsc#TEL-260).
  - Removed backport patch: fix-libsuseconnect-and-pci.patch
  - Add missing product id to allow yast2-registration to not break (bsc#1257825)
  - Fix libsuseconnect APIError detection logic (bsc#1257825)

- Regressions found during QA test runs:
  - Ignore product in announce call (bsc#1257490)
  - Registration to SMT server with failed (bsc#1257625)
  - Backported by PATCH: fix-libsuseconnect-and-pci.patch

- Update version to 1.20:
  - Update error message for Public Cloud instances with registercloudguest
    installed. SUSEConnect -d is disabled on PYAG and BYOS when the
    registercloudguest command is available. (bsc#1230861)
  - Enhanced SAP detected. Take TREX into account and remove empty values when
    only /usr/sap but no installation exists (bsc#1241002)
  - Fixed modules and extension link to point to version less documentation. (bsc#1239439)
  - Fixed SAP instance detection (bsc#1244550)
  - Remove link to extensions documentation (bsc#1239439)
  - Migrate to the public library

- Version 1.14 public library release
  This version is only available on Github as a tag to release the
  new golang public library which can be consumed without the need
  to interface with SUSEConnect directly.

- Import commit c89ea566d98c8e3fb29a5b8edd4576b135b4bc92
  a943e3ce2f machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
  71593f77db udev: fix review mixup
  73a89810b4 udev-builtin-net-id: print cescaped bad attributes
  0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
  40905232e2 udev: ensure tag parsing stays within bounds
  7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
  d018ac1ea3 udev: check for invalid chars in various fields received from the kernel (bsc#1259697)

- Import commit 626ffc7844795870235d15c6daab695f2d53a11e
  aef6e11921 core/cgroup: avoid one unnecessary strjoina()
  cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
  26a748f727 core: validate input cgroup path more prudently (CVE-2026-29111 bsc#1259418)
  99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

- Name libsystemd-{shared,core} based on the major version of systemd and the
  package release number (bsc#1228081 bsc#1256427)
  This way, both the old and new versions of the shared libraries will be
  present during the update. This should prevent issues during package updates
  when incompatible changes are introduced in the new versions of the shared
  libraries.

- Import commit 75eab961ea843dc161707d4af0789b018d499676
  - 8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)

- Import commit 5caaa71f4a7b00e6a6ceb396d08486af73687d45
  9ecd162284 timer: rebase last_trigger timestamp if needed
  cd4a9103ef timer: rebase the next elapse timestamp only if timer didn't already run
  c3f4407e97 timer: don't run service immediately after restart of a timer (bsc#1254563)
  05bcfe3295 test: check the next elapse timer timestamp after deserialization
  fe8f656975 test: restarting elapsed timer shouldn't trigger the corresponding service

- Reintroduce systemd-network as a transitional dummy package containing no
  files (bsc#1254202)
  The contents of this package were split into two independent packages:
  systemd-networkd and systemd-resolved. However, the initial replacement caused
  both network services to be disabled. Consequently, the original package has
  been restored as an empty transitional package to prevent the disabling of the
  services. It can be safely removed once the update is complete.

- Import commit 00ba3646e6cb3ce40bb3de3e92f93ebec0adce6d
  e4dd315b6c units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
  b58e72215a units: add dep on systemd-logind.service by user@.service
  97ceca445c detect-virt: add bare-metal support for GCE (bsc#1244449)

- add Requires to libtss2-fapi to pull in the tss user (bsc#1258720).
  Otherwise, when installing libtss2-fapi on its own, errors from
  systemd-tmpfiles can appear.

- CVE-2026-0990: call stack overflow leading to application crash
  due to infinite recursion in `xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811)
  * Add patch libxml2-CVE-2026-0990.patch
- CVE-2026-0992: excessive resource consumption when processing XML
  catalogs due to exponential behavior when handling `<nextCatalog>` elements (bsc#1256808, bsc#1256809, bsc#1256812)
  * Add patch libxml2-CVE-2026-0992.patch
- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files (bsc#1247858, bsc#1247850)
  * Add patch libxml2-CVE-2025-8732.patch

- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257593, bsc#1257594, bsc#1257595)
  * Add patch libxml2-CVE-2026-1757.patch

- CVE-2025-10911: use-after-free with key data stored cross-RVT (bsc#1250553)
  * Add patch libxml2-CVE-2025-10911.patch

- CVE-2026-0989: call stack exhaustion leading to application crash
  due to RelaxNG parser not limiting the recursion depth when
  resolving `<include>` directives (bsc#1256804, bsc#1256805, bsc#1256810)
  * Add patch libxml2-CVE-2026-0989.patch
  * https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374

- CVE-2025-10911 will be fixed on libxml2 side instead [bsc#1250553]
- deleted patches
  * libxslt-CVE-2025-10911.patch

- Fix CVE-2026-27171, infinite loop via the crc32_combine64 and
  crc32_combine_gen64 functions due to missing checks for negative
  lengths (bsc#1258392)
  * CVE-2026-27171.patch

- makedumpfile-Fix-data-race-in-multi-threading-mode.patch: Fix a
  data race in multi-threading mode (--num-threads=N)
  (bsc#1245569, bsc#1256455).

- update to NSS 3.112.4
  * bmo#2030135 - improve error handling in PK11_ImportPrivateKeyInfoAndReturnKey.
  * bmo#2029752 - Improving the allocation of S/MIME DecryptSymKey.
  * bmo#2029462 - store email on subject cache_entry in NSS trust domain.
  * bmo#2029425 - Heap use-after-free in cert_VerifyCertChainOld via dangling certsList[] entry on NameConstraints violation.
  * bmo#2029323 - Improve size calculations in CMS content buffering.
  * bmo#2028001 - avoid integer overflow while escaping RFC822 Names.
  * bmo#2027378 - Reject excessively large ASN.1 SEQUENCE OF in quickder.
  * bmo#2027365 - Deep copy profile data in CERT_FindSMimeProfile.
  * bmo#2027345 - Improve input validation in DSAU signature decoding.
  * bmo#2026311 - avoid integer overflow in RSA_EMSAEncodePSS.
  * bmo#2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
  * bmo#2026156 - Add a maximum cert uncompressed len and tests.
  * bmo#2026089 - Clarify extension negotiation mechanism for TLS Handshakes.
  * bmo#2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
  * bmo#2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
  * bmo#2019224 - Remove invalid PORT_Free().
  * bmo#1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
  * bmo#1935995 - make ss->ssl3.hs.cookie an owned-copy of the cookie.

- update to NSS 3.112.3
  * bmo#2009552 - avoid integer overflow in platform-independent ghash

- Add python36-certifi provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-idna provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-importlib-metadata provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-packaging provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- CVE-2026-30922: Denial of Service via Unbounded Recursion (bsc#1259803)
  Add patch CVE-2026-30922.patch

- Add python36-pycparser provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-pytz provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-py provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses target files that already exist without validation (bsc#1260589)
  Add patch CVE-2026-25645.patch

- Add python36- provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- Add python36-six provides/obsoletes to enable SLE-12 ->
  SLE-15 migration, bsc#1233012

- fix regression in CVE-2025-66471.patch when downloading large files
  (bsc#1259829)

- CVE-2026-4539: ReDoS processing in AdlLexer (bsc#1260796)
  Add patch CVE-2026-4539.patch

- Add patch CVE-2025-69223-auto_decompress-zip-bomb.patch:
  * Prevent zip bomb with parser auto_compress feature.
    (bsc#1256017, CVE-2025-69223, GHSA-6mq8-rvhq-8wgg)
- Add patch CVE-2025-69224-unicode-processing-header-values.patch:
  * Check for ASCII in header values
    (bsc#1256018, CVE-2025-69224, GHSA-69f9-5gxw-wvc2)
- Add patch CVE-2025-69225-forbid-non-ascii-in-range.patch:
  * Forbid non-ASCII decimals in the Range header
    (bsc#1256019, CVE-2025-69225, GHSA-mqqc-3gqh-h2x8)
- Add patch CVE-2025-69226-brute-force-leak-static-elements.patch:
  * Reject static URLs that traverse outside static root
    (bsc#1256020, CVE-2025-69226, GHSA-54jq-c3m8-4m76)
- Add patch CVE-2025-69227-raise-exceptions-not-asserts.patch:
  * Raise exceptions when processing a POST body
    (bsc#1256021, CVE-2025-69227, GHSA-jj3x-wxrx-4x23)
- Add patch CVE-2025-69228-enforce-client_max_size-for-entire-multipart.patch
  * Enforce client_max_size over entire multipart form
    (bsc#1256022, CVE-2025-69228, GHSA-6jhg-hg63-jvvf)
- Add patch CVE-2025-69229-small-chunk-exhaustion.patch:
  * Pause reading of chunks when it reaches a high water mark
    (bsc#1256023, CVE-2025-69229, GHSA-g84x-mcqj-x9qq)
- Add patch use-correct-warning-pytest-warns.patch:
  * Look for correct warning during the testsuite.

- Add CVE-2026-21226.patch to fix deserialization of untrusted data in
  Azure Core shared client library for Python allowing an authorized
  attacker to execute code over a network (bsc#1257703, CVE-2026-21226)

- Add CVE-2026-1703.patch to fix bsc#1257599
  (bsc#1257599, CVE-2026-1703, gh#pypa/pip#13777)

- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1259808)
  Add patch CVE-2026-27459.patch

- CVE-2026-27448: unhandled exception can result in connection not being cancelled (bsc#1259804)
  Add patch CVE-2026-27448.patch

- Add CVE-2026-24049.patch to fix CVE-2026-24049 (bsc#1257100)

- 15.6.20260227 (tracked in bsc#933411)
- Added libstoragemgmt update note (jsc#PED-7948)
- Added note about kdump maxcpus change (bsc#1218180)
- Added note about KubeVirt support (bsc#1219730)
- Added list of cgroup attributes that are deprecated (bsc#1220963)
- Added PostgreSQL 16 note (jsc#DOCTEAM-1502)
- Added note about firewalld (jsc#PED-13827)
- Added note about unsupported clang and llvm17 (jsc#DOCTEAM-1402)
- Updated kernel limits (bsc#1256789)

- Add Microsoft-signed 16.1 shim
- shim.spec: Temporarily disable nx-shim
  - We still need time to test nx (non-executable) shim and develop
    the script for delivery. We will not support nx-shim on all Leap
    and SLE distros because the function should also be supported by
    grub2 and kernel.
- shim.spec: Remove the reproducibility check for the shim binary
  - The binutils on Leap 15.6 and SLE-15-SP3 has been upgraded to 2.45
    when we are waiting shim-review and Microsoft signing. It causes
    that the shim binary is NOT reproducible on build services.
  - We just direct use the Microsoft signed-back shim binaries
    because we build this binary before and have the logs to prove it.
    Before we find a good approach to save/restore the build service
    environment, let’s directly use the Microsoft signed-back shim for
    delivery.
- Certificates: Add Microsoft UEFI CA files to the target certificates
  array in pretrans script.
- Certificates: Convert the SUSE certificates from PEM to DER format
- timestamp.pl: fix the size of checksum in PE Optional Header
- shim.spec: Workaround the string comparison issue in elif directive
- shim.spec: Specify the certificate format in openssl commands
- shim.spec: Use io.open instead of pcall rpm.open in pretrans lua script

- Add a pretrans script to verify that the UEFI db should have the
  necessary certificate to allow the shim binary to boot. The installation
  will be aborted if the db is missing the target certificate. To proceed,
  the user must enroll the target certificate in the db or disable UEFI
  Secure Boot.

- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]

- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in
    codebase.
  - Set the minimum version is gcc-13.
    if gcc_version < 13
    define gcc_version 13
    endif
  (bsc#1247432)

- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'

- Using gcc12 for building shim/shim-nx
  - The gcc12 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 12
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc12
  (bsc#1247432)

- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)

- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)

Factory: Fri Jul 25 05:44:51 UTC 2025 - Joey Lee <jlee@suse.com>
- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)

Factory: Wed May 28 03:37:04 UTC 2025 - Tseng <dennis.tseng@suse.com>
- add revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)

Factory: Tue May  6 06:19:02 UTC 2025 - Dennis <dennis.tseng@suse.com>
- Update to version 16.0
  - https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS->LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry->revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0

Factory: Tue Jun 25 04:12:39 UTC 2024 - Dennis Tseng <dennis.tseng@suse.com>
- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc
  - asc files of shim-15.8 for sles is already updated on Apr 18, 2024
    signature-sles.x86_64.asc,
    signature-sles.aarch64.asc.

Factory: Mon Feb 26 13:09:29 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.

Factory: Sat Feb 17 07:51:01 UTC 2024 - Joey Lee <jlee@suse.com>
- Modified shim.spec file to add suffix string of project to filename
  of included certificates. e.g.
    rpm -pql shim-15.8-lp155.6.1.x86_64.rpm
    /etc/uefi
    /etc/uefi/certs
    /etc/uefi/certs/2B697CB1-shim-devel.crt
    /etc/uefi/certs/4659838C-shim-opensuse.crt
    /etc/uefi/certs/BCA4E38E-shim-sles.crt
  The original name of crt files are:
    /etc/uefi/certs/2B697CB1-shim.crt
    /etc/uefi/certs/4659838C-shim.crt
    /etc/uefi/certs/BCA4E38E-shim.crt
  It can indicate the souce project of certificates.

- CVE-2026-35535: potential privilege escalation when running
  the mailer (bsc#1261420)
  * fix-CVE-2026-35535.patch

- Update to version 15.6.14:
  * 80-hotplug-cpu-mem.rules: remount tmpfs on "online" uevents
  (bsc#1254264)
  * udev: use systemd service to remount tmpfs (bsc#1253679)

- Drop last sysvinit Requirement/Provide (PED-13698)

- Fix bsc#1246399 / CVE-2025-45582.
- Add patch:
  * CVE-2025-45582.patch

- Fix bsc#1261191 / CVE-2026-34714.
- Fix bsc#1261271 / CVE-2026-34982.
- Fix bsc#1259985 / CVE-2026-33412.
- Update to 9.2.0280:
  * patch 9.2.0280: [security]: path traversal issue in zip.vim
  * patch 9.2.0279: terminal: out-of-bounds write with overlong CSI argument list
  * patch 9.2.0278: viminfo: heap buffer overflow when reading viminfo file
  * patch 9.2.0277: tests: test_modeline.vim fails
  * patch 9.2.0276: [security]: modeline security bypass
  * patch 9.2.0275: tests: test_options.vim fails
  * patch 9.2.0274: BSU/ESU are output directly to the terminal
  * patch 9.2.0273: tabpanel: undefined behaviour with large tabpanelop columns
  * patch 9.2.0272: [security]: 'tabpanel' can be set in a modeline
  * patch 9.2.0271: buffer underflow in vim_fgets()
  * patch 9.2.0270: test: trailing spaces used in tests
  * patch 9.2.0269: configure: Link error on Solaris
  * patch 9.2.0268: memory leak in call_oc_method()
  * patch 9.2.0267: 'autowrite' not triggered for :term
  * patch 9.2.0266: typeahead buffer overflow during mouse drag event
  * patch 9.2.0265: unnecessary restrictions for defining dictionary function names
  * patch 9.2.0264: Cannot disable kitty keyboard protocol in vim :terminal
  * patch 9.2.0263: hlset() cannot handle attributes with spaces
  * patch 9.2.0262: invalid lnum when pasting text copied blockwise
  * patch 9.2.0261: terminal: redraws are slow
  * patch 9.2.0260: statusline not redrawn after closing a popup window
  * patch 9.2.0259: tabpanel: corrupted display during scrolling causing flicker
  * patch 9.2.0258: memory leak in add_mark()
  * patch 9.2.0257: unnecessary memory allocation in set_callback()
  * patch 9.2.0256: visual selection size not shown in showcmd during test
  * patch 9.2.0255: tests: Test_popup_opacity_vsplit() fails in a wide terminal
  * patch 9.2.0254: w_locked can be bypassed when setting recursively
  * patch 9.2.0253: various issues with wrong b_nwindows after closing buffers
  * patch 9.2.0252: Crash when ending Visual mode after curbuf was unloaded
  * patch 9.2.0251: Link error when building without channel feature
  * patch 9.2.0250: system() does not support bypassing the shell
  * patch 9.2.0249: clipboard: provider reacts to autoselect feature
  * patch 9.2.0248: json_decode() is not strict enough
  * patch 9.2.0247: popup: popups may not wrap as expected
  * patch 9.2.0246: memory leak in globpath()
  * patch 9.2.0245: xxd: color output detection is broken
  * patch 9.2.0244: memory leak in eval8()
  * patch 9.2.0243: memory leak in change_indent()
  * patch 9.2.0242: memory leak in check_for_cryptkey()
  * patch 9.2.0241: tests: Test_visual_block_hl_with_autosel() is flaky
  * patch 9.2.0240: syn_name2id() is slow due to linear search
  * patch 9.2.0239: signcolumn may cause flicker
  * patch 9.2.0238: showmode message may not be displayed
  * patch 9.2.0237: filetype: ObjectScript routines are not recognized
  * patch 9.2.0236: stack-overflow with deeply nested data in json_encode/decode()
  * patch 9.2.0235: filetype: wks files are not recognized.
  * patch 9.2.0234: test: Test_close_handle() is flaky
  * patch 9.2.0233: Compiler warning in strings.c
  * patch 9.2.0232: fileinfo not shown after :bd of last listed buffer
  * patch 9.2.0231: Amiga: Link error for missing HAVE_LOCALE_H
  * patch 9.2.0230: popup: opacity not working accross vert splits
  * patch 9.2.0229: keypad keys may overwrite keycode for another key
  * patch 9.2.0228: still possible flicker
  * patch 9.2.0227: MS-Windows: CSI sequences may be written to screen
  * patch 9.2.0226: No 'incsearch' highlighting support for :uniq
  * patch 9.2.0225: runtime(compiler): No compiler plugin for just
  * patch 9.2.0224: channel: 2 issues with out/err callbacks
  * patch 9.2.0223: Option handling for key:value suboptions is limited
  * patch 9.2.0222: "zb" scrolls incorrectly with cursor on fold
  * patch 9.2.0221: Visual selection drawn incorrectly with "autoselect"
  * patch 9.2.0220: MS-Windows: some defined cannot be set on Cygwin/Mingw
  * patch 9.2.0219: call stack can be corrupted
  * patch 9.2.0218: visual selection highlighting in X11 GUI is wrong.
  * patch 9.2.0217: filetype: cto files are not recognized
  * patch 9.2.0216: MS-Windows: Rendering artifacts with DirectX
  * patch 9.2.0215: MS-Windows: several tests fail in the Windows CUI.
  * patch 9.2.0214: tests: Test_gui_system_term_scroll() is flaky
  * patch 9.2.0213: Crash when using a partial or lambda as a clipboard provider
  * patch 9.2.0212: MS-Windows: version packing may overflow
  * patch 9.2.0211: possible crash when setting 'winhighlight'
  * patch 9.2.0210: tests: Test_xxd tests are failing
  * patch 9.2.0209: freeze during wildmenu completion
  * patch 9.2.0208: MS-Windows: excessive scroll-behaviour with go+=!
  * patch 9.2.0207: MS-Windows: freeze on second :hardcopy
  * patch 9.2.0206: MS-Window: stripping all CSI sequences
  * patch 9.2.0205: xxd: Cannot NUL terminate the C include file style
  * patch 9.2.0204: filetype: cps files are not recognized
  * patch 9.2.0203: Patch v9.2.0185 was wrong
  * patch 9.2.0202: [security]: command injection via newline in glob()
  * patch 9.2.0201: filetype: Wireguard config files not recognized
  * patch 9.2.0200: term: DECRQM codes are sent too early
  * patch 9.2.0199: tests: test_startup.vim fails
  * patch 9.2.0198: cscope: can escape from restricted mode
  * patch 9.2.0197: tabpanel: frame width not updated for existing tab pages
  * patch 9.2.0196: textprop: negative IDs and can cause a crash
  * patch 9.2.0195: CI: test-suite gets killed for taking too long
  * patch 9.2.0194: tests: test_startup.vim leaves temp.txt around
  * patch 9.2.0193: using copy_option_part() can be improved
  * patch 9.2.0192: not correctly recognizing raw key codes
  * patch 9.2.0191: Not possible to know if Vim was compiled with Android support
  * patch 9.2.0190: Status line height mismatch in vertical splits
  * patch 9.2.0189: MS-Windows: opacity popups flicker during redraw in the console
  * patch 9.2.0188: Can set environment variables in restricted mode
  * patch 9.2.0187: MS-Windows: rendering artifacts with DirectX renderer
  * patch 9.2.0186: heap buffer overflow with long generic function name
  * patch 9.2.0185: buffer overflow when redrawing custom tabline
  * patch 9.2.0184: MS-Windows: screen flicker with termguicolors and visualbell
  * patch 9.2.0183: channel: using deprecated networking APIs
  * patch 9.2.0182: autocmds may leave windows with w_locked set
  * patch 9.2.0181: line('w0') moves cursor in terminal-normal mode
  * patch 9.2.0180: possible crash with winminheight=0
  * patch 9.2.0179: MS-Windows: Compiler warning for converting from size_t to int
  * patch 9.2.0178: DEC mode requests are sent even when not in raw mode
  * patch 9.2.0177: Vim9: Can set environment variables in restricted mode
  * patch 9.2.0176: external diff is allowed in restricted mode
  * patch 9.2.0175: No tests for what v9.2.0141 and v9.2.0156 fixes
  * patch 9.2.0174: diff: inline word-diffs can be fragmented
  * patch 9.2.0173: tests: Test_balloon_eval_term_visual is flaky
  * patch 9.2.0172: Missing semicolon in os_mac_conv.c
  * patch 9.2.0171: MS-Windows: version detection is deprecated
  * patch 9.2.0170: channel: some issues in ch_listen()
  * patch 9.2.0169: assertion failure in syn_id2attr()
  * patch 9.2.0168: invalid pointer casting in string_convert() arguments
  * patch 9.2.0167: terminal: setting buftype=terminal may cause a crash
  * patch 9.2.0166: Coverity warning for potential NULL dereference
  * patch 9.2.0165: tests: perleval fails in the sandbox
  * patch 9.2.0164: build error when XCLIPBOARD is not defined
  * patch 9.2.0163: MS-Windows: Compile warning for unused variable
  * patch 9.2.0162: tests: unnecessary CheckRunVimInTerminal in test_quickfix
  * patch 9.2.0161: intro message disappears on startup in some terminals
  * patch 9.2.0160: terminal DEC mode handling is overly complex
  * patch 9.2.0159: Crash when reading quickfix line
  * patch 9.2.0158: Visual highlighting might be incorrect
  * patch 9.2.0157: Vim9: concatenation can be improved
  * patch 9.2.0156: perleval() and rubyeval() ignore security settings
  * patch 9.2.0155: filetype: ObjectScript are not recognized
  * patch 9.2.0154: if_lua: runtime error with lua 5.5
  * patch 9.2.0153: No support to act as a channel server
  * patch 9.2.0152: concatenating strings is slow
  * patch 9.2.0151: blob_from_string() is slow for long strings
  * patch 9.2.0150: synchronized terminal update may cause display artifacts
  * patch 9.2.0149: Vim9: segfault when unletting an imported variable
  * patch 9.2.0148: Compile error when FEAT_DIFF is not defined
  * patch 9.2.0147: blob: concatenation can be improved
  * patch 9.2.0146: dictionary lookups can be improved
  * patch 9.2.0145: UTF-8 decoding and length calculation can be improved
  * patch 9.2.0144: 'statuslineopt' is a global only option
  * patch 9.2.0143: termdebug: no support for thread and condition in :Break
  * patch 9.2.0142: Coverity: Dead code warning
  * patch 9.2.0141: :perl ex commands allowed in restricted mode
  * patch 9.2.0140: file reading performance can be improved
  * patch 9.2.0139: Cannot configure terminal resize event
  * patch 9.2.0138: winhighlight option handling can be improved
  * patch 9.2.0137: [security]: crash with composing char in collection range
  * patch 9.2.0136: memory leak in add_interface_from_super_class()
  * patch 9.2.0135: memory leak in eval_tuple()
  * patch 9.2.0134: memory leak in socket_server_send_reply()
  * patch 9.2.0133: memory leak in netbeans_file_activated()
  * patch 9.2.0132: tests: Test_recover_corrupted_swap_file1 fails on be systems
  * patch 9.2.0131: potential buffer overflow in regdump()
  * patch 9.2.0130: missing range flags for the :tab command
  * patch 9.2.0129: popup: wrong handling of wide-chars and opacity:0
  * patch 9.2.0128: Wayland: using _Boolean instead of bool type
  * patch 9.2.0127: line('w0') and line('w$') return wrong values in a terminal
  * patch 9.2.0126: String handling can be improved
  * patch 9.2.0125: tests: test_textformat.vim leaves swapfiles behind
  * patch 9.2.0124: auto-format may swallow white space
  * patch 9.2.0123: GTK: using deprecated gdk_pixbuf_new_from_xpm_data()
  * patch 9.2.0122: Vim still supports compiling on NeXTSTEP
  * patch 9.2.0120: tests: test_normal fails
  * patch 9.2.0119: incorrect highlight initialization in win_init()
  * patch 9.2.0118: memory leak in w_hl when reusing a popup window
  * patch 9.2.0117: tests: test_wayland.vim fails
  * patch 9.2.0116: terminal: synchronized output sequences are buffered
  * patch 9.2.0115: popup: screen flickering possible during async callbacks
  * patch 9.2.0114: MS-Windows: terminal output may go to wrong terminal
  * patch 9.2.0113: winhighlight pointer may be used uninitialized
  * patch 9.2.0112: popup: windows flicker when updating text
  * patch 9.2.0111: 'winhighlight' option not always applied

* Update Vim to version 9.2.0110 (from 9.2.0045).
  * Specifically, this fixes bsc#1259051 / CVE-2026-28417.

* Update Vim to version 9.2.0045 (from 9.1.1629).
  * Fix bsc#1258229 CVE-2026-26269 as 9.2.0045 is not impacted (fixed
  upstream).
  * Fix bsc#1246602 CVE-2025-53906 as 9.2.0045 is not impacted (fixed
  upstream).
  * Drop obsolete or upstreamed patches:
  - vim-7.3-filetype_spec.patch
  - vim-7.4-filetype_apparmor.patch
  - vim-8.2.2411-globalvimrc.patch
  - vim-9.1.1683-avoid-null-dereference.patch
  * Refresh the following patches:
  - vim-7.3-filetype_changes.patch
  - vim-7.3-filetype_ftl.patch
  - vim-7.3-sh_is_bash.patch
  - vim-9.1.1134-revert-putty-terminal-colors.patch
  * Remove autoconf BuildRequires and drop the autoconf call in %build.
  * Add --with-wayland=no to COMMON_OPTIONS to explicitly disable wayland.
  * Package new Swedish (sv) man pages and clean up duplicate encodings
  (sv.ISO8859-1 and sv.UTF-8) during %install.

- bsc#1259247 - VUL-0: CVE-2026-23554: xen: Use after free of
  paging structures in EPT (XSA-480)
  xsa480.patch
- bsc#1259248 - VUL-0: CVE-2026-23555: xen: Xenstored DoS by
  unprivileged domain (XSA-481)
  xsa481.patch