Packages changed:
  MicroOS-release (20261027 -> 20261028)
  cracklib-dict-full (2.8.12 -> 2.10.3)
  ethtool (7.1 -> 7.2)
  gettext-runtime
  ghostscript
  grub2
  libimobiledevice-glue (1.3.2+git0.20250604 -> 1.3.3+git0.20261005)
  libsolv (0.7.40 -> 0.7.41)
  libzypp (17.38.16 -> 17.38.17)
  live555 (2026.10.23 -> 2026.10.24)
  parted
  rsync
  rust-keylime (0.2.9+49 -> 0.2.10+12)
  samba (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb)
  speex
  xfsprogs (6.19.0 -> 7.2.0)
  zypper (1.14.101 -> 1.14.102)

=== Details ===

==== MicroOS-release ====
Version update (20261027 -> 20261028)
Subpackages: MicroOS-release-appliance MicroOS-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== cracklib-dict-full ====
Version update (2.8.12 -> 2.10.3)

- Switch wordlist Source URLs from ftp:// to http:// (ftp is not
  reachable from the build environment); three wordlists
  re-downloaded with identical content (gzip header only)
- Update to 2.10.3, following the cracklib 2.10.3 package
  (boo#1160062): rebuild the dictionaries with its current
  tools. No wordlist changes.
- Spec cleanup (spec-cleaner pass)

==== ethtool ====
Version update (7.1 -> 7.2)

- Update to release 7.2
  * Feature: support for KSZ87xx PHY tunables (--{get,set}-phy-tunable)
  * Fix: cmis: fix printing of Tx bias current (-m)
  * Fix: cmis: fix printing of channel-level flags (-m)
  * Fix: cmis: fix printing of CDB EPL pages (-m)
  * Fix: printing of transmitter technology for CMIS transceivers (-m)
  * Fix: avoid undefined behavior with CMIS transceivers (-m)
  * Fix: add missing CMIS transmitter technologies (-m)
  * Fix: printing of attenuation and wavelength (-m)
  * Fix: printing of link length (-m)
  * Fix: sfpid: print all implemented options (-m)
  * Fix: sfpid: print all compliance codes (-m)
  * Fix: qsfp: print all compliance codes (-m)
  * Fix: module-eeprom: clamp data length to attribute payload size (-m)
  * Fix: validate module EEPROM offset and length (-m)
  * Fix: rss: bound hash function masks in text and JSON output (-x)
  * Fix: fbnic: fix off-by-one shift in reg dump parser (-d)
  * Fix: fbnic: Fix various TX and RX CSR fields decoding (-d)
  * Fix: fbnic: Fix register dump names and bit labels (-d)

==== gettext-runtime ====
Subpackages: envsubst libtextstyle0

- Add ldconfig calls to the gettext-tools scriptlets: the package
  ships libgettextpo.so.0 but never ran ldconfig for it; the calls
  join the existing %post and a new %postun
- Add gettext-spit-shebang.patch: /usr/bin/spit used an
  /usr/bin/env python3 shebang, name the interpreter directly
- Extend the frozen gettext-linkdupes.sh hardlink list to cover
  the examples and data files added since it was generated
  (hello-go, hello-go-http, hello-c++20, hello-objc-gnome2, the
  GNOME m4 files, the shared po/LINGUAS files and the nls.m4
  pair under /usr/share); the list stays frozen and is extended
  by hand rather than replaced by live %fdupes runs, because a
  BuildRequires on fdupes would create a build loop (its
  dependency chain reaches back into gettext)
- Drop the stale removal of gettext.jar from %install: no jar is
  built since the Java support was dropped, and the line missed
  the buildroot prefix
- Fix the libtextstyle0 summary wording (text styling)
- Drop the deprecated Group: tags
- rpmlintrc: drop the filters for the fixed gettext-tools ldconfig
  findings and the gettext-csharp filters (that package is built
  from a different source package)
- The remaining rpmlint error, non-devel-file-in-devel-package
  for libgettextpo.so.0 in gettext-tools, is a checker problem,
  not a package defect: gettext-tools is the designated devel
  package for libgettextpo (it ships the headers, the unversioned
  symlink and Provides: gettext-devel). It is tracked on the
  rpmcrab side and is deliberately not restructured or filtered
  in this package

==== ghostscript ====

- Build --without-local-brotli to not use the brotli sources
  in Ghostscript but the system brotli library to avoid
  CVE-2026-111497: ghostscript: brotli: "Brotli decoder
  out-of-bounds write permits remote code execution"
  (bsc#1287815)

==== grub2 ====
Subpackages: grub2-common grub2-i386-efi grub2-i386-efi-bls grub2-i386-pc grub2-snapper-plugin grub2-x86_64-efi grub2-x86_64-efi-bls

- Fix out-of-bound memory write and uninitialized read in
  add_multiple_nvme_bootdevices() when adding boot device to PowerPC
  OpenFirmware's boot list (bsc#1284464)
  * 0001-osdep-unix-platform-Fix-NVMe-boot-device-buffer-boun.patch
  * 0002-osdep-unix-platform-Handle-missing-IEEE1275-NVMe-boo.patch
  * 0003-osdep-unix-platform-Fix-memory-leaks-in-add_multiple.patch
- Fix memory leak in error path, add missing error return check in
  grub_initrd_component(), ensure NULL check before memset() in
  grub_cryptokey_discard() (bsc#1284464)
  * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch
  * 0002-discard-cached-key-before-entering-grub-shell-and-ed.patch
  * Fix-the-size-calculation-for-the-synthesized-initrd.patch
- Fix out-of-bound memory write in add_multiple_dm_multipath_bootdevices() when
  adding boot device to PowerPC OpenFirmware's boot list
  * 0001-ieee1275-support-dm-multipath-bootlist.patch
- Rebase patches
  * 0002-Restrict-cryptsetup-key-file-permission-for-better-s.patch
  * 0001-Improve-TPM-key-protection-on-boot-interruptions.patch

==== libimobiledevice-glue ====
Version update (1.3.2+git0.20250604 -> 1.3.3+git0.20261005)

- Update to version 1.3.3+git0.20261005:
  * Update NEWS for release
  * Update soversion for release
  * utils: Correct ctype(3) usage
  * socket: Improve portability by replacing OS-specific macros
    with AC_CHECK_HEADERS
  * endianness.h: Default to little endian
  * Add atexit call to (empty) deinit function to prevent
    stripping off initializer code
  * Add FUNDING
  * [github-actions] Update build workflow to use windows-latest
  * socket: Use const void* instead of void* in signature of socket_send()

==== libsolv ====
Version update (0.7.40 -> 0.7.41)
Subpackages: libsolv-tools-base libsolv1

- improved speed of repo_add_solv, should now be more that 20%
  faster in many cases
- repo_add_solv hardening to catch corrupt solv files earlier
- hardened apkv3 code [bsc#1284786] [bsc#1284995]
  [CVE-2026-104622] [CVE-2026-104624]
- fixed repo_conda xml parsing [bsc#1284786] [CVE-2026-104621]
- support pre-sizing of id hashes (pool_presize_idhashes,
  pool_get_idcounts solv_read_idcounts)
- new POOL_FLAG_NOWHATPROVIDESSHRINK pool flag to disable
  shrinking if speed matters more then memory usage
- bump version to 0.7.41

==== libzypp ====
Version update (17.38.16 -> 17.38.17)

- Fix hanging eventloop in case setupHandle fails.
  This may happen e.g. due to a failing curlSetupOption call as
  result of a miss configured option value.
- zypp.conf: Add download.min_download_speed_time (60 sec) (fixes
  [#751])
- version 17.38.17 (35)

==== live555 ====
Version update (2026.10.23 -> 2026.10.24)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia122

- Update to version 2026.10.24:
  * In "RTPInterface::handleRead()", if we're reading from a TCP socket, call
    "getpeername()" to set our "fromAddress", because the "recvfrom()" call
    won't set it.
  * Added a check to "AC3AudioStreamParser" for a buffer overflow that probably
    won't happen, but to be safe...
  * Began replacing some calls to "sprintf()" (that were perfectly safe, but
    caused some compilers to emit warning messages) with calls to "snprintf()".

==== parted ====
Subpackages: libparted-fs-resize0 libparted2

- Drop Obsoletes: libparted0 from libparted2. The libparted.so.0
  and libparted.so.2 file sets are disjoint, so the generations
  are co-installable as the shared library packaging policy
  intends; the obsoletes only forced removal of the older
  generation, and also drew the obsolete-not-provided warning.
- baselibs.conf: run /sbin/ldconfig in %post and %postun of the
  generated libparted2 and libparted-fs-resize0 -32bit packages;
  they previously carried no ldconfig scriptlets at all.
- Drop the Group tags and the BuildRoot tag (ignored by rpm).
- Convert BuildRequires: pkg-config to pkgconfig, and drop the
  %doc marker from the info files (spec-cleaner conversions).

==== rsync ====

- Add rsync-direct-interpreters.patch: use direct interpreter
  paths, #!/bin/bash for rsync-ssl and #!/usr/bin/perl for
  rsyncstats, instead of /usr/bin/env lookups. The scripts
  then declare a proper interpreter dependency rather than
  relying on PATH resolution at runtime.
- Do not ship rsyncstats twice: the support documentation
  is copied without it, the script is installed once in
  /usr/bin.
- Drop the unused rsyncd.rc source and the empty init.d and
  xinetd.d directory creation; the daemon runs through the
  systemd units.
- Drop the grep and sed post requirements, no scriptlet of
  this package calls either tool.
- Spec cleanup per the packaging guidelines: drop the
  obsolete Group tag and write the library build
  requirements in pkgconfig form.

==== rust-keylime ====
Version update (0.2.9+49 -> 0.2.10+12)

- Add Cargo_toml.patch
- Update zip to 9.1.2
  bsc#1287921, CVE-2026-115905, CVE-2026-115906, CVE-2026-115907,
  CVE-2026-115908, CVE-2026-115909
- Update to version 0.2.10+12:
  * log Agent UUID at push agent startup
  * Limit actix-web workers
  * Fix clippy needless_late_init warnings
  * Unwrap OCTET STRING wrapped EK certificates
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * build(deps): bump glob from 0.3.3 to 0.3.4
  * build(deps): bump reqwest from 0.13.3 to 0.13.4
  * Check shutdown marker inside ml_extend loop
  * Fix clippy useless_borrows_in_formatting warnings
  * build(deps): bump tokio from 1.52.2 to 1.53.1
  * Fix payload key upgrade regression by falling back to mTLS key
  * Accept any RSA key size for payload encryption
  * Bump version to 0.2.10
  * keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols

==== samba ====
Version update (4.25.0+git.473.e78e78fbf4 -> 4.25.1+git.476.bfc358351cb)
Subpackages: libldb2 samba-ad-dc-libs samba-client samba-client-libs samba-libs

- Update to 4.25.1
  * CVE-2026-109411: Access control bypass via vfs_ceph_rgw
    case-insensitive open; (bso#16276); (bsc#1286540);
  * CTDB: Cannot find device "<iface>@<link>": need to extract real
    interface names; (bso#16274).
  * generate_unique_u64() may not protect against veto_value;
    (bso#16200).
  * Rename with ReplaceIfExists to a target differing only in case
    creates a duplicate instead of replacing; (bso#16261).
  * Samba 4.25.0 fails to build on macOS; (bso#16263).
  * Python smbconf transaction_start() lacks a talloc stack frame
    with CTDB; (bso#16258).
  * Linux i686 build fails on dynamic_lookup; (bso#16265).
  * vfs_acl_xattr crashes on zero-sized flistxattr queries;
    (bso#16287).
  * Dynamic interface support in smbd is racy; (bso#16235).
  * CTDB database operations can be run against incorrect nodes;
    (bso#16254).
  * A node can be banned because it tries to run recovery after
    losing the cluster lock; (bso#16273).
  * All backend log should honor global log level "log level = ";
    (bso#15857).
  * fruit:time machine max size can only be set to an integer and
    is ignored if user sets a float; (bso#15324).

==== speex ====

- Fix out-of-bounds write in speex_bits_read_whole_bytes()
  (CVE-2026-116741, bsc#1288101):
  speex-CVE-2026-116741.patch
- Refresh speex-no-build-date.patch to be applied with -p1

==== xfsprogs ====
Version update (6.19.0 -> 7.2.0)

- update to 7.2.0
  - xfs_quota, xfs_spaceman, libfrog: hoist xfsquotactl into libfrog
    with quotactl_fd and mount-fd support, so xfs_quota can open the
    filesystem mountpoint directly for quota operations and
    xfs_spaceman's makecfg can reuse the same code path
  - mkfs, xfs_admin, xfs_spaceman, xfs_db: allow specifying and
    printing mkfs default options via a configuration file; mkfs also
    upgrades autofsck earlier automatically
  - xfs: fix an off-by-one in rtrefcount btree root level validation, a
    reflink-flag clearing issue with INO1_WRITTEN during exchange-range,
    a memory leak in xfs_dqinode_metadir_create(), a 32-bit pointer
    arithmetic bug, an exchmaps reservation limit check, and growfs
    delta computation not returning the updated block count
  - xfs: report case sensitivity via fileattr_get
  - xfs_copy: always align I/O to at least the page size, and log the
    errno on write failures
  - man: document that XFS_IOC_FS[G|S]ETXATTR can't be used on special
    files
- update to 7.1.1
  - fiemap: add a nosync option
  - xfs_scrub: fix spacemap scan for the data volume
  - mdrestore: fix extent length overflow in the v2 restore path
  - xfs_healer: install targets one at a time (build fix)
- update to 7.1.0
  - xfs: zero directory data block padding and header regions on write
    verification and at init, avoiding exposure of stale data
  - xfs_scrub: dozens of correctness and crash fixes across rtgroups,
    zoned and realtime filesystem handling, spacemap scans, media
    verification and work estimation; notably an integer overflow, a
    crash when reporting clean health, and several memory/scan-item
    leaks
  - mkfs: fix PQUOTA/GQNOENFORCE conflict, hardlink detection, symlink
    length checks, a PATH_MAX check and protofile handling in directory
    import; fix filesystem/log size units
  - libfrog: fix a buffer overflow in getparents' path_to_string
  - xfs_healer, xfs_healer_start: fix a getmntent race in weakhandle,
    statmount buffer sizing, listmount checks on --check, and
    monitor-fd aliasing; allow AF_UNIX socket access for xfs_healer
    instances
  - xfs_db: dump zoned filesystem superblock fields
  - xfs_scrub_all, xfs_scrub_media_fail: reduce security lockdowns that
    broke postfix mail notifications, and fix broken command-line
    array construction
- update to 7.0.1
  - xfs_healer, libfrog: fix build/runtime on targets missing the
    HAVE_LISTMOUNT flag or statmount kernel support (missing flags and
    fallback stubs) -- a portability fix for the health-monitoring code
    introduced in 7.0.0
- update to 7.0.0
  - xfs_healer: new self-healing background daemon that monitors mounted
    filesystems for health events (metadata corruption, I/O errors,
    shutdowns) and automatically triggers spot or full repairs, picking
    repair mode from the autofsck fsproperty; adds a per-mount
    xfs_healer_start service to start it automatically
  - xfs_io: add listmount, statmount and a media verify command; monitor
    filesystem health events
  - xfs_scrub: use the new media-verify ioctl for phase 6 media scanning,
    extend it to cover the log region, raise media verification IO
    limits, and report truncated devices as media errors
  - mkfs: enable online repair by default when all backrefs are enabled
  - xfs_repair: don't fail on INCOMPLETE attrs in leaf blocks
  - xfs_scrub_all: fix a deadlock when lsblk produces a lot of output
  - xfs_scrub: drop the bogus warning about mixed bidirectional
    codepoints in names, warn about unicode variation selectors instead
  - xfs_quota: display default limits for users with zero usage

==== zypper ====
Version update (1.14.101 -> 1.14.102)
Subpackages: zypper-needs-restarting

- list-patches: Show issue numbers that were not found
  (bsc#1275036, fixes #655)
- Use RunCommand to execute the pager.
- security: replace shell-based pager execution with execvp.
- patch: Allow to select optional patches by category
  (bsc#1283249)
  Explicitly selecting optional patches by --category must imply
  - -with-optional. Otherwise the without-optional default would
  sort out the requested patches.
- version 1.14.102