Packages changed:
  MozillaFirefox (158.0 -> 158.0.1)
  apparmor
  bind (9.20.29 -> 9.20.30)
  brotli (1.2.0 -> 1.2.1)
  bubblewrap (0.12.0 -> 0.13.1)
  cdparanoia (3.10.2 -> 10.2)
  dracut (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef)
  ffado
  fwupd
  lame (3.100 -> 4.0)
  libapparmor
  libnotify (0.8.8 -> 0.8.9)
  libsndfile
  libtirpc (1.3.7 -> 1.3.8)
  linux-glibc-devel (7.2 -> 7.3)
  makedumpfile
  mariadb (12.3.2 -> 13.0.2)
  nano (9.2 -> 9.3)
  openSUSE-release (20261022 -> 20261023)
  python-argcomplete (3.6.3 -> 3.7.2)
  python-argparse-manpage (4.7 -> 4.8)
  python313
  python313-core
  rsyslog
  ruby4.0 (4.0.7 -> 4.0.9)
  simdutf (9.3.0 -> 9.3.2)
  strace (7.2 -> 7.3)
  taglib (2.3 -> 2.3.2)
  unbound (1.26.1 -> 1.26.2)
  util-linux
  util-linux-systemd
  virtualbox (7.2.20 -> 7.2.22)
  virtualbox-kmp (7.2.20_k7.3.0_1 -> 7.2.22_k7.3.0_1)
  vlc
  webkitgtk3
  webkitgtk4

=== Details ===

==== MozillaFirefox ====
Version update (158.0 -> 158.0.1)
Subpackages: MozillaFirefox-branding-upstream MozillaFirefox-translations-common

- Mozilla Firefox 158.0.1
  * https://www.firefox.com/en-US/firefox/158.0.1/releasenotes/
    MFSA 2026-111 (boo#)
  * CVE-2026-113399 (bmo#2079938)
    Incorrect boundary conditions in the SVG component
  * CVE-2026-113470 (bmo#2083382)
    Cryptographic issue in the Security Block-lists, Allow-lists,
    and other State component
  * CVE-2026-113400 (bmo#2061768)
    Uninitialized memory in the Audio/Video: cubeb component
  * CVE-2026-113401 (bmo#2073714)
    Denial-of-service in the PDF Viewer component
  * Mozilla blocked compromised eMudhra intermediate certificates
    via OneCRL on October 17th. The blocks were distributed to
    clients via Remote Settings the same day. This update contains
    the updated OneCRL block list, ensuring clients will block the
    compromised certificates even if RemoteSettings is disabled by
    policy or otherwise unavailable in the user's
    network environment
  * Fixed an issue where pages would unexpectedly scroll back to
    the top when selecting text (bmo#2081016)
  * Fixed an issue where Firefox was opening windows on the wrong
    monitor in multi-monitor setups on Linux (bmo#2076558)
  * Fixed an issue that could prevent the built-in VPN from turning
    on for some users (bmo#2055094)

==== apparmor ====
Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-parser-lang apparmor-profiles apparmor-utils apparmor-utils-lang python3-apparmor

- Pass the distribution build flags to the plain make builds of the
  parser and the binutils programs, so apparmor_parser, aa-exec,
  aa-load and aa-status are built with fortify and stack-protector
  hardening like the rest of the package
- Drop the obsolete BuildRoot tag from both specs and use the pkgconfig
  spelling of the pkg-config BuildRequires

==== bind ====
Version update (9.20.29 -> 9.20.30)
Subpackages: bind-doc bind-utils

- Upgrade to release 9.20.30
  Security Fixes:
  * Prevent exhaustion of CPU while parsing crafted DNS messages.
    (CVE-2026-19630)
    [bsc#1286575]
  * Prevent concurrent GSS-TSIG traffic from terminating named.
    (CVE-2026-94300)
    [bsc#1286578]
  * Fix a crash with redirect zones and strict QNAME minimization.
    (CVE-2026-96888)
    [bsc#1286579]
  * Fix a crash when resuming from a query initiated by RPZ.
    (CVE-2026-97313)
    [bsc#1286580]
  Bug Fixes:
  * Remove a spurious root trust anchor warning and recognize the
    new root key.
  * Do not accept HMAC keys and signatures for SIG(0) or DNSSEC.
  * Fix DNSSEC tool dates being read one hour late during Daylight
    Saving Time.
  * Reject URI records with an empty target.
  * Fix a crash when loading a zone in raw format.
  * Prevent dynamic update prerequisites from probing zones that
    refuse queries.
  * Fix a named-journalprint crash when using the -x option.
  * Honor server settings for keyed NOTIFY and DS queries.
  * Fix a catalog zone update bug.
  * Fix an out-of-bounds read in dig +dns64prefix.
  * Prevent excessive RRL table scans under load.
  * Make named-checkconf fail on invalid command-line arguments.
  * Remove the temporary file when saving a zone file fails.
  * Prevent the statistics channel from serving data on
    unregistered URL prefixes.
  * Fix a crash on OpenBSD when a signal reached an idle worker
    thread.
  * Resolve names in insecure zones whose apex answers with a
    CNAME.
  * Set GSS-TSIG keys to last as long as the negotiated context.

==== brotli ====
Version update (1.2.0 -> 1.2.1)
Subpackages: libbrotlicommon1 libbrotlicommon1-x86-64-v3 libbrotlidec1 libbrotlidec1-x86-64-v3 libbrotlienc1 libbrotlienc1-x86-64-v3

- Update to release 1.2.1
  * Fixed an out-of-bounds write write permitting remote code
    execution [CVE-2026-111497]

==== bubblewrap ====
Version update (0.12.0 -> 0.13.1)
Subpackages: bubblewrap-zsh-completion

- update to 0.13.1:
  * bwrap now accepts multiple --sync-fd arguments and will handle
    all of the fds.
  * O_PATH is used when opening parent directories in the new root,
    fixing an error when read permission is missing.
- update to 0.13.0:
  * Linux kernel headers with __NR_pivot_root (Linux 2.3.41+) are
    required at build-time on all architectures
  * If compiled with -Dassume_kernel=5.12.0 or newer, then a kernel with
    the mount_setattr syscall is required at runtime, and kernel headers
    with __NR_mount_setattr are required at build-time on most
    architectures. On the x86_64, i386 and aarch64 architectures, a
    fallback is provided to be able to compile with pre-5.12 kernel
    headers.
  * On kernels that support it (5.12+), use mount_setattr() to remount
    filesystems with ro, nodev and/or nosuid.
  * Arguments that expect a path argument (--bind, --overlay-src, etc.)
    now reject empty strings. Previously they would sometimes be treated
    as the root directory due to implementation details, but this was
    unintended.
  * A new build option -Ddebug_logging=true can be used to enable
    verbose debug logging (not recommended for distro builds). These
    debug messages don't appear unless environment variable
    DEBUG_INVOCATION is set at runtime.
  * Fix build failures with older gcc or older -std argument
  * Fix build failure with musl
  * Fix test failure on systems that lack hostname(1)
  * Fix test failure on systems with a mount point containing a
    backslash
  * Fix test failure on systems with older xdg-desktop-portal
  * Don't leave a temporary file behind after running the test suite
  * CI improvements

==== cdparanoia ====
Version update (3.10.2 -> 10.2)
Subpackages: libcdda_interface0 libcdda_paranoia0

- Align version with upstream release numbering (III 10.2):
  3.10.2 -> 10.2. No source changes (same upstream tarball).
- Spec cleanup: drop obsolete Group tags, https Source/URL.

==== dracut ====
Version update (112+suse.57.g23bbfee -> 112+suse.62.g1b64cef)

- Update to version 112+suse.62.g1b64cef:
  * fix(bluetooth): always install HID drivers that can be needed
  * fix(bluetooth): mark installed hostonly files
  * fix(nvmf): prevent nvmf's installkernel failure when no nbft present
  * test(DRACUT-CPIO): fix unbound CPIO_TESTDIR variable
  * test(STORAGE): fix condition to add disk2

==== ffado ====

- libffado-date_time.patch: avoid mismatched format string types
  and args

==== fwupd ====
Subpackages: fwupd-bash-completion fwupd-lang libfwupd3 typelib-1_0-Fwupd-2_0

- rename Polkit rules to give it a 10- prefix, allowing them to gain priority
  over the SUSE-specific rules generated in
  /etc/polkit-1/rules.d/90-default-privs.rules (bsc#1279948).

==== lame ====
Version update (3.100 -> 4.0)
Subpackages: libmp3lame0 libmp3lame0-x86-64-v3

- Update to version 4.0 (libmp3lame soname unchanged, still .so.0):
  * Major version bump: the 9-byte encoder version field in MP3s
    overflowed with 3.100 minor versions; 4.0 resets the scheme.
  * Security fixes: AIFF header parser integer-underflow DoS
    (CVSS 5.5, frontend); Blade DLL beInitStream stack overflow
    (Windows-only, CVSS 8.4).
  * Fix build with recent GCC/Clang (UTF-8 ID3 tag functions);
    export id3tag_set_textinfo/comment_utf8 from shared lib.
  * Add ID3v2.4 support and upstream pkg-config support.
  * mp3rtp gains IPv6 support (incompatible CLI change).
- Use upstream lame.pc; keep libmp3lame.pc alias.
- Use pkgconfig(ncurses); drop obsolete Group tags.
- Add pkgconfig(libmpg123) BuildRequires: 4.0's --enable-decoder
  mandates external mpg123 (configure errors out without it).
- Add lame-4.0-frontend-utf8.patch (backport of upstream post-4.0
  fix): split the mistyped ID3v2 tag handler into typed UTF-16/UTF-8
  variants and add id3tag_set_fieldvalue_utf8(); export hip_set_pinfo
  and hip_finish_pinfo for the frontend; unbreaks the build
  with GCC 14+ defaults.

==== libapparmor ====

- Pass the distribution build flags to the plain make builds of the
  parser and the binutils programs, so apparmor_parser, aa-exec,
  aa-load and aa-status are built with fortify and stack-protector
  hardening like the rest of the package
- Drop the obsolete BuildRoot tag from both specs and use the pkgconfig
  spelling of the pkg-config BuildRequires

==== libnotify ====
Version update (0.8.8 -> 0.8.9)
Subpackages: libnotify-tools libnotify4 typelib-1_0-Notify-0_7

- Update to version 0.8.9:
  * This is a maintenance release, mostly with bug fixes around notify-send
    behaviors and portal notifications, together with more tests coverage for
    hints edge cases, and some library cleanups:
    + Notify-send:
  - Start action ID from 1 as docs states
  - Fix the activation token FD validity check
  - Don't write the notification ID and action to stdin
  - Don't cache the hint conversion error
    + Notify: Free the application name and icon on uninit
    + Notification:
  - Do not send the default action as a button in portal notifications
  - Read the icon contents using g_file_load_contents()
  - Use g_clear_handle_id() for the portal timeout
    + Tests/notify-send:
  - Add tests for the default action button
  - Verify behavior on invalid hints
    + Launch-context: Don't omit parameter names in vfunc implementation
    + Bugs fixed:
  - portal: "default" action adds additional button
  - Omitted parameter names in a vfunc implementation

==== libsndfile ====

- Fix integer overflow vulnerability in mat4_read_header()
  (bsc#1282671, CVE-2026-88372):
  libsndfile-CVE-2026-88372.patch

==== libtirpc ====
Version update (1.3.7 -> 1.3.8)
Subpackages: libtirpc-netconfig libtirpc3

- Update to version 1.3.8 (bsc#1285882, CVE-2026-85977,
    bsc#1285881, CVE-2026-85231):
  * Security hardening against malicious-data memory exhaustion:
    cap decoded pmap/rpcb XDR list lengths to 1024 nodes
    (CVE-2026-85977) and RPCSEC_GSS wrapped payload decoding
    at 16 MB (CVE-2026-85231, authenticated remote DoS).
  * Fix off-by-one allocation when building the GSS caller name.
  * Export authdes_getucred and rpc_gss_getcred under a versioned
    symbol node (backward compatible, soname stays libtirpc.so.3).
- Spec cleanup: drop obsolete Group tags.

==== linux-glibc-devel ====
Version update (7.2 -> 7.3)

- Update to kernel headers 7.3

==== makedumpfile ====

- support kernel 7.1 -- add:
  * makedumpfile-Fix-wrong-exclusion-of-compound-tail-pages-on-.patch

==== mariadb ====
Version update (12.3.2 -> 13.0.2)
Subpackages: libmariadbd19 mariadb-client mariadb-errormessages

- Add remove-git-dependency.patch
  * Avoid git dependency by using patch instead of git apply
- Add fix-duckdb-sccache-launcher.patch
  * Forward CMAKE_[C|CXX]_COMPILER_ARG1/LAUNCHER into the bundled
    DuckDB ExternalProject_Add() configure step, fixing a build
    failure when sccache is wired in as the compiler
- Update to 13.0.2 (major release, evolution of 12.3):
    https://mariadb.com/docs/release-notes/community-server/13.0/13.0.2
    https://mariadb.com/docs/release-notes/community-server/changelogs/13.0/13.0.2
    https://mariadb.com/docs/release-notes/community-server/13.0/mariadb-13.0-changes-and-improvements
  * Single-table UPDATE ... RETURNING with OLD_VALUE() support,
    atomic CREATE OR REPLACE TABLE, reversed executable comments.
  * New innodb_log_archive for continuous WAL archiving and
    point-in-time recovery; mariadb-backup cannot read that format
    yet. binlog_row_event_max_size default raised to 64k.
  * New QB_NAME() optimizer hint with implicit block names, optimizer
    trace now includes used statistics, PERFORMANCE_SCHEMA digest
    moved to XXH3_128, init_rpl_role visible in SHOW VARIABLES.
  * INFORMATION_SCHEMA SYSTEM_VARIABLES gains deprecation columns;
    STATISTICS/COLUMNS show engine-specific create options. Configurable
    audit plugin log timestamp format, REF CURSOR and RECORD usable in
    package routines.
  * Crash and correctness fixes from 12.3.3 (included): SELECT INTO
    row-type and SYS_REFCURSOR crashes, GIS ST_* crashes, InnoDB
    recovery races, replication event application fixes.
  * Fixes the following security vulnerabilities:
    13.0.2: CVE-2026-107814 (bsc#1285002)
    CVE-2026-107815 (bsc#1285005)
    CVE-2026-107816 (bsc#1285006)
    CVE-2026-107817 (bsc#1285007)
    CVE-2026-107818 (bsc#1285033)
    CVE-2026-107821 (bsc#1284999)
    CVE-2026-107822 (bsc#1284998)
    CVE-2026-107823 (bsc#1284997)
    CVE-2026-102523
    CVE-2026-97380 (bsc#1286010)
    CVE-2026-92262 (bsc#1286011)
    CVE-2026-86047 (bsc#1285936)
    CVE-2026-85985 (bsc#1285935)
    CVE-2026-85748 (bsc#1285932)
    CVE-2026-85746 (bsc#1285931)
    CVE-2026-85745 (bsc#1285928)
    CVE-2026-61081
    CVE-2026-60585
    CVE-2026-60331
    CVE-2026-60747
    CVE-2026-47023
    CVE-2026-60184
- Drop mariadb-fix-testsuite-openssl3.2.3.patch (fixed upstream).
- Refresh fix-pamdir.patch and 0001-MDEV-38874-Make-tests-pass-
  after-2030.patch for the new sources; drop Group tags, use
  %ldconfig_scriptlets, add git-core BuildRequires for the DuckDB
  engine patch step.
- Skip main.mysql_client_test and main.mysql_client_test_comp: their
  new MDEV-25817 subtest expects host blocking after clean-EOF PROXY
  handshakes, which the server closes normally without counting
  connect errors, so the block never triggers.
- Use pkgconfig() BuildRequires for bzip2, krb5 (GSSAPI),
  libarchive, libedit, libevent, libxml2, lz4, lzo, ncurses, pam,
  pcre2, readline, unixODBC, xz and zlib, and pkgconfig() Requires
  for libmariadb in libmariadbd-devel; the systemd instance
  specifier in the socket sed stays unbraced on purpose.
- CVE-2026-107814 (boo#1285002): move the mysql service account
  home from the datadir to /nonexistent, matching upstream; migrate
  existing users via usermod in %pre.

==== nano ====
Version update (9.2 -> 9.3)
Subpackages: nano-lang

- Update to version 9.3:
  * On the mini bar, an overlong filename gets properly clipped.
  * The keypad operator keys produce their inscribed characters.
  * CVE-2026-6390 (boo#1272394): not affected, fixed upstream
    in 9.0 and the hardening is present in 9.3.

==== openSUSE-release ====
Version update (20261022 -> 20261023)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== python-argcomplete ====
Version update (3.6.3 -> 3.7.2)

- Update to 3.7.2:
  * Require Python 3.10+
  * Fix zsh global completion with zsh 5.9.0.1; expand ~ in
    _FilteredFilesCompleter
  * Escape glob and brace metacharacters in quote_completions;
    quote compgen prefix in FilesCompleter
  * Remove deprecated easy_install script detection
- Drop python-argcomplete-check-easy-install-script and its
  libalternatives registrations, removed upstream
- Remove the /usr/bin/env python3 shebang from the non-executable
  argcomplete/scripts modules

==== python-argparse-manpage ====
Version update (4.7 -> 4.8)

- Update to 4.8:
  * escape sequences are no longer propagated into the generated man pages
  * fixed a traceback when an action has no help text (action.help == None)
  * double-quoted values are newly supported in the manpages spec parsing
- Drop patch support-python-315.patch, merged upstream.

==== python313 ====
Subpackages: python313-curses python313-dbm python313-tk python313-x86-64-v3

- Require libexpat1 >= 2.8.5 for python313-base and raise
  the Expat build requirement accordingly. pyexpat uses
  XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the
  automatic SONAME dependency permits older libraries, breaking
  imports and venv/ensurepip (bsc#1285433).

==== python313-core ====
Subpackages: libpython3_13-1_0 libpython3_13-1_0-x86-64-v3 python313-base python313-base-x86-64-v3 python313-devel

- Require libexpat1 >= 2.8.5 for python313-base and raise
  the Expat build requirement accordingly. pyexpat uses
  XML_SetHashSalt16Bytes when built with Expat >= 2.8, but the
  automatic SONAME dependency permits older libraries, breaking
  imports and venv/ensurepip (bsc#1285433).

==== rsyslog ====

- fix postgresql dependency for devel package (bsc#1286162)

==== ruby4.0 ====
Version update (4.0.7 -> 4.0.9)
Subpackages: libruby4_0-4_0

- Update to 4.0.9 (boo#1287171 CVE-2026-89078, CVE-2026-93577,
  CVE-2026-97229, CVE-2026-110264)
  https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
  - Reject overflowed repeat/null-check IDs in huge regexps by
    makenowjust
- Update to 4.0.8
  - Bug #22311: Build crashes on macOS 26 with the macOS 27 SDK
    because pipe2() and dup3() are unavailable - Ruby - Ruby Issue
    Tracking System
  - Bug #22174: Set operations (&, ^, collect!, flatten, classify,
    divide) do not preserve compare_by_identity - Ruby - Ruby Issue
    Tracking System
  - Bug #22383: Fix inverted STR_SHARED check in
    rb_str_tmp_frozen_release - Ruby - Ruby Issue Tracking System
  - Bug #22387: str_shared_replace incorrectly recalculates termlen
  - Ruby - Ruby Issue Tracking System
  - Bug #22327: RubyVM::ZJIT.reset_stats! aborts the process (Rust
    panic) when ZJIT is not enabled - Ruby - Ruby Issue Tracking
    System
  - Bug #22381: MatchData assigned to $~ is incorrectly reused -
    Ruby - Ruby Issue Tracking System
  - Bug #22321: Assertion Failed:
    rb_vm_search_method_slowpath:RB_TYPE_2_P(klass, RUBY_T_CLASS,
    RUBY_T_ICLASS): klass: T_MODULE - Ruby - Ruby Issue Tracking
    System
  - Bug #22315: heap-use-after-free in String unpack with a block
    that mutates the receiver - Ruby - Ruby Issue Tracking System
  - Bug #22318: heap uaf triggered in array.flatten - Ruby - Ruby
    Issue Tracking System
  - Bug #22319: heap buffer overflow triggered by array's zip
    function - Ruby - Ruby Issue Tracking System
  - Bug #22322: AddressSanitizer: use-after-poison in
    econv_description /ruby-src/build/../transcode.c - Ruby - Ruby
    Issue Tracking System
  - Bug #22334: Assertion Failed: VM_ENV_FLAGS:FIXNUM_P(flags) -
    Ruby - Ruby Issue Tracking System
  - Bug #22336: IO:Buffer Heap uaf - Ruby - Ruby Issue Tracking
    System
  - Bug #22330: heap uaf from string.encode() - Ruby - Ruby Issue
    Tracking System
  - Bug #22340: Win32: File.stat succeeds on symbolic-link loops on
    Windows - Ruby - Ruby Issue Tracking System
  - Bug #22335: Stack corruption with >31 keyword args and refined
    Integer#== - Ruby - Ruby Issue Tracking System
  - Bug #22339: Ruby::Box: crash / hang at VM shutdown with
    RUBY_FREE_AT_EXIT=1 - Ruby - Ruby Issue Tracking System
  - Bug #22342: IO#gets can ignore the limit argument in some edge
    cases - Ruby - Ruby Issue Tracking System
  - Bug #22391: Fix propagation of errno in rb_io_maybe_wait. -
    Ruby - Ruby Issue Tracking System
  - Bug #22384: Regexp compile error in the 2nd+ branch of a
    top-level alternation leaks the parse tree (regression from
    [#13332], Ruby 4.0) - Ruby - Ruby Issue Tracking System
  - Bug #22388: Use-after-free when an Enumerable retains its each
    block - Ruby - Ruby Issue Tracking System
  - Bug #22284: Passing an object with to_int to curry as its arity
    causes problems with LLP64. - Ruby - Ruby Issue Tracking System
  - Bug #22416: Respect timezone abbreviation encodings in
    Time#strftime - Ruby - Ruby Issue Tracking System
  - Bug #22426: ZJIT: keyword arguments swapped when passed out of
    declared order to a method with a block (please backport
    d81a11d4e6 to 4.0) - Ruby - Ruby Issue Tracking System
  - Bug #22406: Process.fork can leave the child unable to resolve
    hostnames: getaddrinfo helper threads take glibc's resolver
    lock after releasing the fork lock - Ruby - Ruby Issue Tracking
    System
  - Bug #22445: On macOS, a child of Kernel#fork can abort with
    "[BUG] pthread_rwlock_destroy: Resource busy (EBUSY)" - Ruby -
    Ruby Issue Tracking System
  - Bug #22415: Thread.handle_interrupt needs to preserve errinfo -
    Ruby - Ruby Issue Tracking System
  - Bug #22434: "No live threads left. Deadlock?" when running
    system() or spawn in Ractors - Ruby - Ruby Issue Tracking
    System
  - Backport the regexp compiler program size overflow fixes to
    ruby_4_0 by hsbt · Pull Request #19025

==== simdutf ====
Version update (9.3.0 -> 9.3.2)

- Update to version 9.3.2:
  * icelake: unroll the base64 encoding loop
- Changes from version 9.3.1:
  + icelake: use plain loads in the base64 encoding loop

==== strace ====
Version update (7.2 -> 7.3)

- Update to strace 7.3
  * Implemented decoding of fchroot syscall.
  * Implemented decoding of SO_RIGHTS_NOTRUNC socket option.
  * Implemented decoding of IFA_MC_USERS and IFA_PROTO netlink attributes.
  * Implemented decoding of macvlan IFLA_INFO_DATA netlink attributes.
  * Implemented decoding of NHA_DST_PORT, NHA_GROUP_STATS,
    NHA_HW_STATS_ENABLE, NHA_HW_STATS_USED, and NHA_OP_FLAGS netlink
    nexthop attributes.
  * Implemented decoding of RTA_DEL_REASON route attribute.
  * Implemented decoding of TUN/TAP ioctls.
  * Implemented decoding of UFFDIO_MOVE, UFFDIO_RWPROTECT, and
    UFFDIO_SET_MODE userfaultfd ioctls.
  * Implemented decoding of bpf_link_info for BPF_OBJ_GET_INFO_BY_FD.
  * Implemented decoding of landlock_restrict_self flags.
  * Implemented decoding of ZCRX_CTRL_ADD_AREA io_uring zcrx ctrl operation.
  * Implemented decoding of VIDIOC_{UN,}SUBSCRIBE_EVENT ioctl commands.
  * Enhanced -e namespace=new option to decode setns(2) namespace transitions
    when nstype is 0.
  * Implemented decoding of auxiliary clock IDs.
  * Updated lists of ATA_*, KVM_*, NL80211_*, V4L2_*, and *_MAGIC constants.
  * Updated lists of ioctl commands from Linux 7.3.
  * Fixed the argument names printed by -N/--arg-names for getresgid,
    setfsgid, setgid, setregid, and setresgid syscalls.
  * Limited nested NLMSG_ERROR netlink decoding to prevent stack exhaustion.
  * Fixed out-of-bounds read in STHYI kernel response buffer tail decoding
    when the declared header length exceeds the available buffer size.
  * Fixed decoding of AF_BRIDGE RTM_GETNEIGH requests, including requests
    with multiple attributes.
  * Fixed several procfs lookups that used the wrong PID when strace's
    PID namespace differs from the mounted /proc, affecting -e namespace=new
    annotations for setns(2) and unshare(2), -Y/--decode-pids=comm process
    names, and "already traced" attach diagnostics.
  * Fixed -e namespace=new to report the correct namespace ID for setns(2)
    and unshare(2) transitions to PID and time namespaces, which affect
    future children rather than the caller.  An unavailable PID namespace
    ID after unshare(2) is omitted.
  * Fixed dynamic clock id decoding.

==== taglib ====
Version update (2.3 -> 2.3.2)
Subpackages: libtag2 libtag_c2

- Add fix-32bit-overflow.patch
  * Fix 32-bit overflows and i586 test suite
- Update to version 2.3.2 (soname unchanged, libtag.so.2):
  * 2.3.1: Matroska crash and element-length fixes, MP4 cnID
    64-bit/chapter fixes, QT stsc allocation guard, XM save fix.
  * 2.3.2: MP3 unsync/iTunes ID3 fixes, MP4 covr tolerance and
    new codecs, Ogg muxed Vorbis comments, ASF property
    improvements, RF64/BW64 support, Matroska scan/attachment
    fixes, crafted-input hardening (DoS/resource exhaustion).
  * Build: use Requires.private for zlib.
- Modernize spec (pkgconfig zlib, drop Group tags).

==== unbound ====
Version update (1.26.1 -> 1.26.2)
Subpackages: libunbound8 unbound-anchor

- Update to 1.26.2:
  * Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free
    on multi-threaded deployments.
    [bsc#1286139]
  * Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing
    records under a configured island trust anchor underneath an
    insecure parent.
    [bsc#1286140]
  * Fix CVE-2026-96405, Aggregate DNS name chained pointer
    decompression work leads to degradation of service.
    [bsc#1286141]
  * Fix CVE-2026-109125, Possible cache poisoning vulnerability via
    a cache side-channel exposed by 'unwanted-reply-threshold'.
    [bsc#1286142]
  * Fix CVE-2026-35501, Bypass of a configured island trust anchor
    underneath an insecure parent from an attacker-controlled NSEC
    record.
    [bsc#1286143]

==== util-linux ====
Subpackages: libblkid1 libfdisk1 libmount1 libsmartcols1 libuuid1 util-linux-lang

- Wrap the lastlog2 and liblastlog2-2 package descriptions within
  the line length limit
- Ship /var/lib/lastlog in the lastlog2 package; the directory is
  created by the tmpfiles entry but was missing from the file list
- Drop the no-op %tmpfiles_create calls from the lastlog2 and
  uuidd scriptlets; both packages ship their tmpfiles.d entries,
  which the systemd file trigger processes at install time
- Use the find -regextype name posix-extended instead of its
  posix-egrep alias in %install
- List the header directories excluded from the systemd package
  explicitly instead of globbing the shared include directory

==== util-linux-systemd ====
Subpackages: lastlog2 liblastlog2-2

- Wrap the lastlog2 and liblastlog2-2 package descriptions within
  the line length limit
- Ship /var/lib/lastlog in the lastlog2 package; the directory is
  created by the tmpfiles entry but was missing from the file list
- Drop the no-op %tmpfiles_create calls from the lastlog2 and
  uuidd scriptlets; both packages ship their tmpfiles.d entries,
  which the systemd file trigger processes at install time
- Use the find -regextype name posix-extended instead of its
  posix-egrep alias in %install
- List the header directories excluded from the systemd package
  explicitly instead of globbing the shared include directory

==== virtualbox ====
Version update (7.2.20 -> 7.2.22)

- Update to release 7.2.22
  * Maintenance release with security-related fixes.
- Delete cxx17.patch (merged)

==== virtualbox-kmp ====
Version update (7.2.20_k7.3.0_1 -> 7.2.22_k7.3.0_1)

- Update to release 7.2.22
  * Maintenance release with security-related fixes.
- Delete cxx17.patch (merged)

==== vlc ====
Subpackages: libvlc5 libvlccore9 vlc-codec-gstreamer vlc-lang vlc-noX vlc-plugins-desktop vlc-qt

- Update version dependencies according to configure.ac.
- Migrate to xz compression and manual service run
- Use legacy '#' instead of '%dnl' to comment: VLC is still being built for
  CODE15 branches outside of OBS, where %dnl is not supported.

==== webkitgtk3 ====
Subpackages: WebKitGTK-4.1-lang libjavascriptcoregtk-4_1-0 libwebkit2gtk-4_1-0 typelib-1_0-JavaScriptCore-4_1 typelib-1_0-WebKit2-4_1 webkit2gtk-4_1-injected-bundles

- Lower memory constraint down to 25G which is enough and allow
  build for armv9

==== webkitgtk4 ====
Subpackages: WebKitGTK-6.0-lang libjavascriptcoregtk-6_0-1 libwebkitgtk-6_0-4 typelib-1_0-JavaScriptCore-6_0 typelib-1_0-WebKit-6_0 webkitgtk-6_0-injected-bundles

- Lower memory constraint down to 25G which is enough and allow
  build for armv9