Packages changed: MicroOS-release (20260805 -> 20260806) fuse-overlayfs (1.16 -> 1.17) grub2 gstreamer (1.28.5 -> 1.28.6) gstreamer-plugins-bad (1.28.5 -> 1.28.6) gstreamer-plugins-base (1.28.5 -> 1.28.6) libXfont2 python-charset-normalizer (3.4.7 -> 3.4.9) python-cryptography (49.0.0 -> 50.0.0) === Details === ==== MicroOS-release ==== Version update (20260805 -> 20260806) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== fuse-overlayfs ==== Version update (1.16 -> 1.17) - Update to v1.17 (bsc#1273100, CVE-2026-52791) * main: clear SUID/SGID bits on truncate (CVE-2026-52791). * main: make sure st_ino needs is unique for all inodes on a device. * man: uniformly apply bold attributes. ==== grub2 ==== Subpackages: grub2-common grub2-i386-efi grub2-i386-efi-bls grub2-i386-pc grub2-snapper-plugin grub2-x86_64-efi grub2-x86_64-efi-bls - Fix crash in booting kernel on some AMD systems (bsc#1271980) * 0001-linux-allocate-EFI-kernel-buffer-as-GRUB_EFI_LOADER_.patch ==== gstreamer ==== Version update (1.28.5 -> 1.28.6) Subpackages: libgstreamer-1_0-0 - Update to version 1.28.6: + Highlighted bugfixes in 1.28.6 - Various security fixes and playback fixes - playbin3, playbin: fix stalls after re-enabling previously disabled subtitles - Fix regression in core if a pad is re-linked while changed sticky events are being pushed - dtls/webrtc: fix some issues with OpenSSL 4.0.0 - RTP retransmission bitrate estimation fixes - Fix RTP depayloading of SMPTE ST291 frames with multiple ANC packets - Add H.266 muxing support to the Rust (f)mp4 muxers - Better handling of input buffers without timestamps in Rust (f)mp4 muxers - webrtcsink H.264 level/profile negotiation fixes and support for nvv4l2h265enc encoder - SMPTE ST2038 ancillary metadata and closed caption combiner improvements - Fix SEI insertion into H.265/HEVC streams with alpha - Windows D3D11 WinRT screen capture element fixes - Improved coded buffer size handling for VA encoders - Textaccumulate: various tweaks how the element outputs text, plus better handling of French punctuation - hlssink3: improved handling of input buffers without timestamps - Fix build against FFmpeg 9.0 - cerbero: fix Windows packages binary size increase regression; upgrade libsrt recipe to 1.5.6 - Various bug fixes, build fixes, memory leak fixes, and other stability and reliability improvements + gstreamer: - baseparse: Don't reset infer_ts/pts_interpolate subclass configuration in reset() and related fixes - cpuid: fix AArch64 NEON detection to check HWCAP_ASIMD, not HWCAP_NEON - pad: fix livelock when pushing changed sticky events when the pad is re-linked - valve: Don't send a reconfigure even when setting the drop property to the same value - meson: Make the g-ir-scanner init section consistent across modules - meson: use dependency('dl') instead of cc.find_library('dl') ==== gstreamer-plugins-bad ==== Version update (1.28.5 -> 1.28.6) Subpackages: libgstphotography-1_0-0 libgstplay-1_0-0 - Update to version 1.28.6: + adpcmdec: Fix IMA ADPCM input size check to match with the actual code + baseparse: Don't reset infer_ts/pts_interpolate subclass configuration in reset() and related fixes + d3d11winrtcapture: Fix incorrect capture height + dtls: make BIO read signal retry instead of EOF when no data + dtls: New DTLS test failure with OpenSSL 4.0.0 + dvdspu: Fix too strict off-by-one bounds check in a couple of places + h263parse: diracparse: Sync baseparse configuration with other compressed video parsers + h265parser: Fix out-of-bounds writes in RPS parsing + h265seiinserter: Fix HEVC with alpha stream handling + h266parser: fix SEI parsing error handler + meson: Make the g-ir-scanner init section consistent across modules + mpegpsdemux: Use byte readers for parsing data and make sure enough data is available + openjpegdec: Various issues related to striped mode and image origins, plus memory leaks + pnmdec: Don't assert if creating the output state fails and don't flush more data than is available + tfliteinference: fix leaks + tsdemux: Don't assert if stream pad was not yet created + vabaseenc: clamp driver-reported coded size to the coded buffer size + vtdec: Don't register the hw-only variant on simulators + vulkantrash: avoid reinitializing trash objects multiple times + waylandsink: Omit reporting drop frame on preroll + webrtcbin: fix possible floating leak for post-aux + wlvideobufferpool: Fix memory leak in gst_wl_video_buffer_pool_alloc_buffer + docs: Fix build when mse library is disabled + Remove incorrect G_GNUC_CONST annotation for _get_type() functions and some other functions ==== gstreamer-plugins-base ==== Version update (1.28.5 -> 1.28.6) Subpackages: libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 - Update to version 1.28.6: + gl/eagl: Fix GstGLUIView leak from duplicate __bridge_retained + playsink: don't wait for text pad block during reconfiguration + typefind: Actually register various forgotten typefinders + meson: Make the g-ir-scanner init section consistent across modules + Remove incorrect G_GNUC_CONST annotation for _get_type() functions and some other functions ==== libXfont2 ==== - bsc1272660_CVE-2026-59679_0001-fserve-validate-num_chars-against-encoding-array-siz.patch * libXfont2 fs_read_glyphs() heap OOB read/write via encoding array index mismatch (CVE-2026-59679, bsc#1272660) - bsc1272661_CVE-2026-44950-0002-fserve-bounds-check-cumulative-glyph-data-writes-in-.patch * libXfont2 fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (CVE-2026-44950, bsc#1272661) ==== python-charset-normalizer ==== Version update (3.4.7 -> 3.4.9) - update to 3.4.9: * Regression in our fallback path leading to a decode error. * We've yanked 3.4.8 as a result of that bug. * Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs * Unnecessary json import at runtime * Inverse capitalization not seen by noise detector * No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage. * Micro-optimizations in our noise / coherence measurements. * No longer using regex search by default for our preemptive charset mark algorithm. * Raised upperbound of setuptools to v83. * Raised upperbound of mypy(c) to v2.1. ==== python-cryptography ==== Version update (49.0.0 -> 50.0.0) - update to 50.0.0 (bsc#1273551, CVE-2026-69247): * SECURITY ISSUE: :func:`~cryptography.hazmat.primitives.serial ization.pkcs7.pkcs7_decrypt_der` and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in RFC 3218. Credit to @X1AOxiang for reporting the issue * Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. * Added xof() class methods to :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing algorithm instances configured for use with :class:`~cryptography.hazmat.primitives.hashes.XOFHash`. * The :mod:`X.509 verification ` APIs are now considered stable and are subject to our API stability policy. * Added the :doc:`/cobblestone` recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification for streaming authenticated encryption of large messages. * Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. * Added support for using :class:`~cryptography.x509.Name` as a field type in the :doc:`/hazmat/asn1/index` module. * Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it. * Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. * :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. * :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported when building against AWS-LC. * HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. * Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported when building against AWS-LC. * :func:`~cryptography.hazmat.primitives.serialization.load_der _public_key` and :func:`~cryptography.hazmat.primitives.seria lization.load_pem_public_key` now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits, matching the minimum already enforced when loading DH private keys and when constructing :class:`~cryptography.hazmat.primitives.asy mmetric.dh.DHParameterNumbers`. * Added :class:`~cryptography.hazmat.primitives.asymmetric.mlds a.MLDSAMuHasher` for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs. * The builtin :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm` classes and the classes in :mod:`~cryptography.hazmat.primitives.asymmetric.padding` can now be compared with ==. * :class:`~cryptography.x509.CertificateBuilder` now supports creating unsigned certificates (RFC 9925) with the create_unsigned method. * The :mod:`X.509 verification ` APIs now permit ML-DSA-44, ML-DSA-65, and ML-DSA-87 (RFC 9881) public keys and signatures by default.